Nonce-Based DNS Security Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security policy enforcement methods, particularly in dynamic policy-based routing, are brittle and inefficient due to reliance on client agents that cannot verify client identities securely and struggle with end-to-end encryption, leading to potential bypassing of security infrastructure and delayed policy updates across distributed client devices.
Innovation Solution
Implementing a nonce-based approach where the DNS service provides a short-lived, unique nonce address that directs traffic through enterprise security infrastructure, allowing secure routing and policy enforcement without the need for client agents, leveraging end-to-end encryption and centralized policy management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS requests are sent over UDP port 53 in the clear for client agent examination, then security policy enforcement is enabled, but DNS traffic encryption is lost and traffic can be intercepted
Solution Approach 1:
The patent introduces an intermediary encrypted DNS channel (DoH/DoT) between the client and DNS server. This intermediary mechanism allows DNS queries to be encrypted while still enabling security policy enforcement through alternative means (client agent examining encrypted traffic or DNS server providing bespoke responses based on client identity).
Solution Approach 2:
The patent changes the transmission parameter of DNS traffic from unencrypted UDP to encrypted HTTPS/TLS protocols. This parameter change encrypts the traffic while maintaining the ability to enforce security policies through modified examination mechanisms or server-side client identification.
2Adaptability or versatility
If client agents are used to enforce security policies on distributed client devices, then per-client policy enforcement is enabled, but policy update lag occurs and the system becomes brittle
Solution Approach 1:
The patent extracts the security policy enforcement function from the client agent and relocates it to the DNS server. By taking out the enforcement mechanism from distributed client agents and centralizing it in the DNS server, the system eliminates policy update lag while maintaining per-client adaptability through the DNS server's ability to provide bespoke responses.
Solution Approach 2:
The patent establishes a feedback mechanism where the DNS server receives client identification information, determines appropriate security policies, and provides bespoke DNS responses accordingly. This feedback loop enables real-time policy enforcement without requiring continuous client agent updates.
3Speed
If DNS responses are cached by clients, then DNS query performance is improved, but clients can bypass security infrastructure by using cached addresses
Solution Approach 1:
The patent applies preliminary anti-action by having the DNS server embed security directives (firewall rules, routing instructions) directly in the DNS response before the client can use the address. This preliminary embedding of security controls prevents later bypass attempts by ensuring security enforcement is baked into the resolution process itself.
Data Source
AI summary
This disclosure describes techniques including, by a domain name service (DNS), receiving a name resolution request from a client computing device and, by the DNS, providing a nonce to the client computing device, wherein a service is configured to authorize a connection request from the client computing device based at least in part on processing the nonce. This disclosure further describes techniques include a method of validating a connection request from a client computing device, including receiving the connection request, the connection request including a nonce. The techniques further include determining that the nonce is a valid nonce. The techniques further include, based at least in part on determining that the nonce is a valid nonce, authorizing the connection request and disabling the nonce.