Proxy Device Server Name Verification via DNS Caching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Proxy devices face challenges in applying accurate security policies to connection request messages due to the manipulability of Server Name Identification (SNI) extensions in TLS client hello messages, which can lead to malicious traffic bypassing security measures by altering server names without changing the IP address, thus compromising network security.
Innovation Solution
A proxy device verifies the server name in connection request messages by comparing the SNI extension with cached DNS results, ensuring that the server name matches the domain name associated with the IP address, and applies policies accordingly to prevent malicious traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the proxy device uses the SNI extension to apply security policies, then the ease of operation is improved, but the reliability deteriorates because the SNI extension can be manipulated by clients
Solution Approach 1:
The proxy device performs preliminary DNS resolution to obtain the authoritative server name before the TLS connection is established. This pre-obtained server name is then used to verify the SNI extension presented by the client, preventing manipulation attacks while maintaining ease of policy application.
Solution Approach 2:
The patent introduces an intermediary verification mechanism where the proxy device acts as a mediator between the client's SNI extension and the actual server identity. By comparing the SNI against the pre-resolved DNS record, the proxy device ensures that the server name identification is authentic and has not been manipulated by the client.
2Reliability
If the proxy device performs DNS resolution for each connection request, then the reliability of server name verification is improved, but the productivity deteriorates due to increased processing time
Solution Approach 1:
DNS resolution is performed in advance before the TLS connection establishment process begins. The proxy device obtains and caches the authoritative server name ahead of time, so that when connection requests arrive, verification can proceed immediately without blocking the connection process, thus maintaining both reliability and productivity.
Solution Approach 2:
The system dynamically adjusts its verification approach based on timing and caching. Frequently accessed server names are cached after initial DNS resolution, reducing repeated lookups. The proxy device performs DNS resolution proactively when appropriate and uses cached results when available, optimizing the balance between verification reliability and connection speed.
Data Source
AI summary
Techniques are presented herein for a proxy device to verify that the server name listed in a connection request message is the name of the server at the IP address listed in the connection request message. The proxy device obtains a domain name server query sent by a client to a domain name server and then obtains a domain name server result that is sent by the domain name server. The proxy device may cache the data of the domain name server result. The proxy device may obtain a connection request message sent by the client seeking a connection with a server, and then compare the connection request message to the cached domain name server result. Finally, the proxy device may apply one or more policies to the connection request message based on the comparison between the connection request message and the domain name server result.