Privacy-Preserving DNS via Homomorphic Encryption

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing DNS systems do not adequately protect user privacy, as they allow DNS providers to harvest browsing data despite encryption during transport between clients and nameservers.

Innovation Solution

Implementing a privacy-preserving DNS method using homomorphic encryption, where a private query with an encrypted hash index is transmitted to a nameserver for an encrypted lookup, and the response is decrypted by the client to maintain privacy.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Loss of information

If DNS requests are encrypted during transport between client and nameserver, then privacy protection against network snooping is improved, but the DNS provider still has unobstructed access to browsing data

Engineering Contradiction:

Improvebrowsing data privacyVSAvoidencryption system complexity

Core Design Contradiction:

Loss of informationVSDevice complexity

Solution Approach 1:

The patent introduces an intermediary encryption layer using homomorphic encryption that allows the DNS provider to process encrypted queries without being able to decrypt or read the actual browsing data. The encrypted DNS requests pass through the provider's infrastructure in an unreadable format, preventing data harvesting while maintaining functional DNS resolution services.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent transforms the encryption parameter from standard TLS/HTTPS encryption to homomorphic encryption, which fundamentally changes how the data is protected. This parameter change enables the DNS provider to perform operations on encrypted data without being able to access the plaintext, thus preventing browsing data access while maintaining service functionality.

Inventive Principle:

Principle #35Parameter changes

2Speed

If traditional DNS is used for speed and convenience, then DNS query response time is improved, but user browsing privacy is compromised

Engineering Contradiction:

ImproveDNS query response timeVSAvoidbrowsing history privacy

Core Design Contradiction:

SpeedVSLoss of information

Solution Approach 1:

The homomorphic encryption layer acts as an intermediary that preserves the speed of traditional DNS by allowing rapid processing of encrypted queries, while simultaneously protecting browsing privacy by ensuring the provider cannot read the actual domain names being queried.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If DNS providers have unobstructed access to DNS requests, then DNS service functionality is improved, but browsing data can be harvested and analyzed

Engineering Contradiction:

ImproveDNS service functionalityVSAvoiddata harvesting and profiling

Core Design Contradiction:

ReliabilityVSObject-generated harmful factors

Solution Approach 1:

Homomorphic encryption serves as an intermediary mechanism that allows DNS providers to maintain full service functionality by processing encrypted queries, while the encryption itself prevents data harvesting and profiling by making the queries unreadable to the provider.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent converts the potential harm of encrypted data (which could prevent proper DNS resolution) into a benefit by using homomorphic encryption properties that allow the provider to work with encrypted data as if it were plaintext, thus maintaining functionality while preventing data access.

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

Data Source

PatentUS12328381B2Privacy-preserving domain name services (DNS)

Publication Date: 2025.06.10 BITDEFENDER IPR MANAGEMENT

AI summary

Described systems and methods allow carrying out privacy-preserving DNS exchanges. In some embodiments, a client machine engages in a private information retrieval (PIR) exchange with a nameserver. In response to receiving an encrypted query from the client, the query formulated according to a domain name, the nameserver may extract a record (e.g., an IP address) from a domain name database without decrypting the respective query. Some embodiments achieve such information retrieval by the use of homomorphic encryption.