Local DNS Resolver for Encrypted Query Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security methods struggle to efficiently categorize and manage fully qualified domain names (FQDNs) in local networks, especially when DNS queries and server name indications are encrypted, which hinders service providers' ability to track and manage network traffic effectively.
Innovation Solution
Implementing a system that decrypts DNS queries, maps FQDNs to IP addresses, and uses reputation information to block access to malicious FQDNs, allowing for both local caching and cloud-based analysis to manage network traffic efficiently, even with encrypted connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS queries are encrypted (DNS over HTTPS or TLS), then network security and privacy are improved, but the ability to inspect and manage DNS traffic is worsened
Solution Approach 1:
The patent introduces a local DNS resolver as an intermediary component that sits between the client device and the external DNS servers. This local resolver receives encrypted DNS queries from clients, decrypts them locally, checks against the blocked FQDN list, and only forwards legitimate queries to external resolvers. This intermediary approach allows the system to maintain encrypted DNS communication while still enabling local inspection and control of DNS traffic.
2Reliability
If cloud-based DNS resolution is used, then security updates and FQDN blocking capabilities are improved, but the time required for DNS queries is worsened
Solution Approach 1:
The patent implements preliminary action by maintaining a local cache of blocked FQDNs and their corresponding IP addresses on the network apparatus. When a DNS query arrives, the system first checks this pre-populated local database before contacting external DNS servers. This preliminary local check eliminates the need to query external sources for every DNS request, significantly reducing query time while maintaining up-to-date blocking capabilities through periodic updates from the security service provider.
Solution Approach 2:
The patent applies local quality by implementing a hierarchical DNS resolution approach where different types of DNS queries are handled differently based on their urgency and security requirements. Routine queries are resolved locally using the cached blocked FQDN list, while updates to the blocking database are received periodically from the cloud. This localizes the quality of service for time-sensitive operations while maintaining cloud connectivity for security updates.
3Reliability
If deep packet inspection is implemented, then network security monitoring is improved, but device complexity and processing overhead are worsened
Solution Approach 1:
The patent extracts and isolates the complex deep packet inspection functionality into a dedicated local DNS resolver component with specific responsibility for DNS traffic analysis. Rather than implementing comprehensive packet inspection across the entire network stack, the system extracts only the necessary DNS query inspection functionality and places it in the local resolver. This extraction reduces overall device complexity by concentrating inspection capabilities in a specialized component that handles only DNS protocols.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
There is provided a method comprising receiving (200) a domain name system (DNS) query from a client computing device, decrypting (201) the DNS query by a DNS resolver device, and requesting (202) reputation information related to the FQDN from an agent device of the router apparatus. If a matching FQDN is not found in a local database, the DNS query is allowed (204) to proceed from the DNS resolver device to a cloud DNS resolver, the IP and MAC address of the client computing device are logged and mapped to the local database, the reputation information related to the FQDN is requested from a cloud FQDN server, and if the reputation information indicates that the FQDN should be blocked, the local database is updated (205) with the reputation information and further queries to the FQDN are blocked.