Proxy DNS Intermediary for EDNS0 Attack Mitigation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Businesses are increasingly vulnerable to denial of service (DOS) attacks that utilize resource-intensive queries, such as Extended DNS (EDNS0) queries, which existing technologies have not effectively protected against.

Innovation Solution

A proxy system is placed between servers and querying devices to analyze and block malicious communications by sending probe queries and identifying characteristics consistent with DOS attacks, allowing for the identification and blocking of malevolent devices.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a proxy system is deployed to analyze and block malicious queries, then network security is improved, but device complexity increases

Engineering Contradiction:

Improvenetwork securityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

A proxy server is introduced as an intermediary component between DNS clients and authoritative DNS servers. The proxy intercepts DNS queries, analyzes them for malicious characteristics (such as EDNS0 extension usage patterns), and blocks suspicious traffic before it reaches the target servers. This intermediary approach enhances security without requiring modification of existing DNS infrastructure components.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The DNS system is segmented into multiple functional components: the proxy server that handles query analysis and filtering, the firewall that provides additional protection layers, and the authoritative DNS servers that process only validated queries. This segmentation allows each component to specialize in specific security functions, improving overall system security while distributing complexity across multiple manageable elements.

Inventive Principle:

Principle #1Segmentation

2Measurement precision

If resource-intensive query analysis is performed to identify DOS attacks, then detection precision is improved, but use of energy increases

Engineering Contradiction:

Improveattack detection precisionVSAvoidcomputational energy consumption

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The proxy server performs partial analysis of DNS queries by focusing specifically on identifying characteristic patterns of resource-intensive queries (such as EDNS0 extensions with particular parameters) rather than conducting exhaustive analysis of all query components. This selective approach maintains high detection precision for DOS attacks while reducing overall computational energy consumption compared to complete query validation.

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The system performs preliminary filtering of DNS queries at the proxy level before they reach authoritative servers. By pre-identifying and blocking malicious query patterns in advance, the system reduces the need for more intensive analysis later in the DNS resolution process, thereby lowering total energy consumption while maintaining detection precision.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS9407659B2Protecting computing assets from resource intensive querying attacks

Publication Date: 2016.08.02 ARBOR NETWORKS INC

AI summary

A method and system for managing data traffic and protecting computing assets. The method and system includes intercepting queries and messages, such as EDNS0 queries, and sending probe queries and reply queries to the originating computing device to determine whether the originating computing device may be sufficiently validated so as to justify forwarding resource-intensive queries and messages to the targeted computing device.