On-Device DNS Traffic Encryption via Trusted Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Connected mobile devices are vulnerable to DNS-based attacks due to the unencrypted and unprotected nature of the Domain Name System (DNS) protocol, which can lead to intercepted queries being used for privacy compromise and malicious redirection.
Innovation Solution
Implementing on-device protection by intercepting and routing all DNS traffic to a trusted DNS server using secure protocols like HTTPS (DoH) or TLS (DoT), ensuring that DNS queries are encrypted and protected from interception or spoofing, regardless of the network or app used.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS traffic is transmitted using the standard clear text protocol, then device connectivity and compatibility are maintained, but DNS queries are vulnerable to interception and spoofing attacks
Solution Approach 1:
The patent introduces a trusted DNS server as an intermediary between the device and the original DNS server. The local DNS client redirects DNS queries to this trusted intermediary, which then forwards them to the original DNS server. This mediator verifies the authenticity of DNS responses and protects against spoofing attacks, resolving the security vulnerability without requiring changes to the fundamental DNS protocol infrastructure.
Solution Approach 2:
The patent establishes a predetermined trusted relationship between the device and a specific DNS server before DNS queries are transmitted. The device is pre-configured with the identity and public key of the trusted DNS server, allowing it to verify responses in advance. This preliminary authentication setup enables secure DNS communication without adding complex real-time verification mechanisms for each query.
2Reliability
If DNS traffic is intercepted and redirected to a trusted DNS server, then DNS security is improved, but network traffic flow and processing time are affected
Solution Approach 1:
The patent segments the DNS resolution process into distinct phases: local verification of the trusted DNS server's identity, redirection of queries to the trusted server, and verification of responses. By separating these functions, the system minimizes the time overhead at each stage. The initial verification happens once during connection establishment, not for every query, reducing per-query time loss.
Solution Approach 2:
The trusted DNS server acts as an efficient intermediary that maintains persistent connections and cached responses. Once the initial redirection and verification are complete, subsequent queries benefit from the established trusted channel and potential caching, reducing the time penalty of the interception and redirection mechanism.
3Reliability
If all DNS traffic is routed through a trusted DNS server, then protection against malicious DNS servers is achieved, but the ability to use arbitrary DNS servers on different networks is lost
Solution Approach 1:
The patent uses the trusted DNS server as a mediator that forwards queries to the original DNS server while maintaining security. The local DNS client can be configured to work with different trusted DNS servers depending on the network context, allowing adaptability to different networks while maintaining the security guarantee of using a verified intermediary.
Solution Approach 2:
The system dynamically selects which trusted DNS server to use based on network conditions and device configuration. The trusted DNS server relationship can be changed or updated, allowing the system to adapt to different networks and scenarios while maintaining the security model of using a verified intermediary for DNS communication.
Data Source
AI summary
Methods and systems are provided for protecting DNS traffic locally on an electronic device (e.g., a smart phone) by capturing DNS traffic from network traffic transmitted from the device and ensuring the DNS traffic is routed to a trusted DNS server via a prescribed transmission protocol.