Partial Domain Name Hashing for Secure DNS Resolution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The domain name system (DNS) is insecure and prone to man-in-the-middle attacks and data breaches due to unauthenticated DNS servers and the sharing of sensitive data, with current solutions failing to adequately address these issues.
Innovation Solution
A system that uses probabilistic data structures like Cuckoo filters and Bloom filters to identify IP addresses from partial hashes of domain names, incorporating encryption and digital signatures to enhance security and privacy, and employs a 'gossip' tactic to verify DNS results across multiple servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional DNS resolution is used, then DNS query processing is simple and fast, but the system is vulnerable to MITM attacks and cache poisoning
Solution Approach 1:
The patent segments the domain name into multiple parts and processes them through different cryptographic hash functions. Instead of resolving the entire domain name at once, the system divides it into segments, hashes each segment separately, and uses the resulting hash values to query multiple DNS servers independently. This segmentation approach enhances security by preventing single-point failures and MITM attacks while maintaining system functionality.
Solution Approach 2:
The patent introduces cryptographic hash functions as intermediaries between the domain name and the DNS resolution process. The hash functions transform the original domain name into hash values that serve as intermediaries for querying DNS servers. This intermediary layer protects the original domain name from exposure while enabling DNS resolution, thereby enhancing security without completely redesigning the DNS system.
2Productivity
If DNS servers freely share server names and IP addresses, then DNS resolution is efficient, but sensitive data can be exfiltrated and browsing habits tracked
Solution Approach 1:
The patent extracts only the necessary information for DNS resolution while leaving out sensitive data. Instead of sharing complete domain names and full IP address information across the network, the system extracts and transmits only the cryptographic hash values of domain name segments. This extraction approach enables DNS resolution efficiency while preventing the exfiltration of sensitive browsing data and habits.
Solution Approach 2:
The patent changes the parameter representation from plain text domain names to cryptographic hash values. By transforming the domain name parameter into its hash equivalent, the system maintains the functional capability for DNS resolution while altering the form of data transmitted across the network. This parameter change prevents unauthorized tracking and data exfiltration while preserving resolution efficiency.
3Reliability
If partial hash of domain name is used, then browser tracking uncertainty is introduced, but additional cryptographic operations increase processing time
Solution Approach 1:
The patent applies partial action by using only a portion of the domain name (segments rather than the complete name) for cryptographic hashing and DNS querying. Instead of hashing and querying with the entire domain name, the system selectively processes segments, which reduces the computational overhead and processing time while still introducing sufficient uncertainty to prevent effective browser tracking.
4Reliability
If multiple DNS servers are queried for verification, then result authenticity is ensured, but network latency increases
Solution Approach 1:
The patent performs preliminary actions by pre-segmenting the domain name and pre-computing hash values before the actual DNS resolution process. By preparing the segmented hash values in advance, the system reduces the computational work required during the actual multi-server verification process. This preliminary preparation enables querying multiple DNS servers for authenticity verification while minimizing the additional network latency experienced during resolution.
Data Source
AI summary
In one aspect, a first device may include at least one processor and storage accessible to the at least one processor. The storage may include instructions executable by the at least one processor to receive, from a second device, a partial hash of a domain name. The instructions may also be executable to use the partial hash and a probabilistic data structure to identify an Internet protocol (IP) address associated with the domain name. Responsive to identifying the IP address, the instructions may be executable to transmit the IP address to the second device.