mDNS Service Advertisement Verification Using Device Fingerprints
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Multicast DNS (mDNS) networks face security risks due to unauthorized devices spoofing legitimate devices, making it difficult to identify and protect against potential attacks or data breaches, especially in large networks.
Innovation Solution
A method and network device that obtain device fingerprint data with a confidence score, compare it with a threshold score, and determine if the advertised characteristics are consistent, allowing legitimate devices to advertise while rejecting fraudulent messages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If mDNS protocol is used to enable automatic device discovery without centralized DNS server, then ease of operation and adaptability are improved, but security reliability deteriorates due to unauthorized devices and spoofing attacks
Solution Approach 1:
The patent introduces a network device as an intermediary that mediates between mDNS traffic and the network. This intermediary captures service advertisement messages, verifies device characteristics against fingerprint data, and selectively forwards or rejects messages. This resolves the contradiction by maintaining the ease of mDNS operation while adding a security layer that prevents unauthorized devices from compromising network reliability
Solution Approach 2:
The system performs preliminary actions by obtaining and storing fingerprint data representing device characteristics before security verification is needed. When service advertisement messages are received, the system compares them against pre-stored fingerprint data to verify authenticity. This preliminary preparation enables rapid security verification without disrupting the automatic device discovery functionality
2Reliability
If service advertisement messages are rejected based on characteristic inconsistency to protect against spoofing, then security reliability is improved, but ease of operation deteriorates due to potential rejection of legitimate devices
Solution Approach 1:
The patent changes the parameter of confidence scoring to resolve the contradiction. Instead of binary accept/reject decisions, the system assigns confidence scores to device characteristics and compares them against threshold values. This allows flexible adjustment of security strictness - high confidence scores permit legitimate devices while low confidence scores block potential spoofing attempts, maintaining both security reliability and operational ease
3Reliability
If device fingerprint data is obtained and verified for each service advertisement message, then security reliability is improved, but device complexity and processing overhead increase
Solution Approach 1:
The system uses copying by creating and storing fingerprint data copies that represent device characteristics. Instead of performing complex real-time analysis of each service advertisement message, the system compares messages against pre-created fingerprint copies. This reduces verification complexity while maintaining high security reliability through efficient data matching
Data Source
AI summary
A method for a network device is provided, the method comprising obtaining device fingerprint data representing a first set of characteristics of a device connected to the network and an associated confidence score representative of a confidence in the first set of characteristics, obtaining a threshold confidence score, receiving a service advertisement message from the device, the service advertisement message including an indication of a second set of characteristics of the device. The method then involves determining whether the first set of characteristics are inconsistent with the second set of characteristics and performing a predetermined action in dependence on an outcome of this determining and on a comparison of the confidence score with the threshold confidence score. A network device configured to perform the method, and a non-transitory computer-readable storage medium comprising instructions for executing the method are also provided.