Router DNS Validation for IP Connectivity Security

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing network systems face vulnerabilities and inconsistencies due to the selection of upstream DNS resolvers at the end-user device level, leading to privacy concerns, unnecessary packet requests, and susceptibility to cyber threats, as they do not effectively manage IP connectivity based on DNS queries.

Innovation Solution

Implementing Internet Protocol Enforcement (IPE) in routers to funnel TCP and UDP traffic through a compatible gateway only when the destination IP is identified as a result of a prior DNS query within its TTL period, using a source-destination filter lookup table to block all IP connectivity that does not originate from a validated DNS query by default.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If DNS queries are allowed to resolve to any IP address, then network connectivity and accessibility are improved, but network security and vulnerability to cyber threats worsen

Engineering Contradiction:

Improvenetwork connectivityVSAvoidcyber threats

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The router performs preliminary validation of DNS queries before allowing IP connectivity. By checking domain names against blocklists and validating DNS responses in advance, the system prevents potentially harmful connections before they are established, thus maintaining security while allowing legitimate connectivity

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The router acts as an intermediary between DNS resolvers and the local network. It intercepts and validates DNS queries, mediates the resolution process by checking against blocklists and validating responses, and only permits traffic to IPs that pass validation, thus securing the network while maintaining connectivity

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If upstream DNS resolver selection is made at end-user device level, then device autonomy and flexibility are improved, but network consistency and security management worsen

Engineering Contradiction:

Improvedevice autonomyVSAvoidnetwork consistency

Core Design Contradiction:

Adaptability or versatilityVSStability of the object's composition

Solution Approach 1:

The patent merges DNS resolver selection functionality into the router, combining device-level autonomy with network-level consistency. The router centralizes DNS query validation and blocklist checking, ensuring all devices on the network benefit from consistent security policies while maintaining the ability to select different resolvers for different domains

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The router implements a universal DNS validation mechanism that serves all devices on the network. The same blocklists, validation rules, and security policies are applied consistently across all DNS queries from any device, providing network-wide consistency while maintaining flexibility in resolver selection

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Object-affected harmful factors

If all IP connectivity is blocked by default, then network security is improved, but network productivity and accessibility worsen

Engineering Contradiction:

Improvecyber threatsVSAvoidnetwork productivity

Core Design Contradiction:

Object-affected harmful factorsVSProductivity

Solution Approach 1:

The system inverts the traditional approach by blocking all IP connectivity by default and only permitting connections that have been validated through DNS queries. This reverse approach ensures that only explicitly authorized traffic passes through, maintaining security while allowing legitimate productivity-critical connections

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The system uses feedback from validated DNS queries to dynamically control IP connectivity. When a DNS query is validated and resolves to an approved IP address, the router receives feedback to permit traffic to that address. This feedback mechanism ensures that productivity-critical connections are automatically allowed while maintaining security

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS10686753B2Method and router to permit or block internet protocol (IP) connectivity based on originating domain name server (DNS) requests

Publication Date: 2020.06.16 DNSTHINGY INC

AI summary

A router and method for validating Domain Name Service (DNS) queries which can include sending them upstream. Internet Protocol Enforcement (IPE) is included into the router to allow passage of Transmission Communication Protocol (TCP) and User Datagram Protocol (UDP) traffic through a compatible gateway only when the destination IP address was the result of a prior validated DNS query still in its TTL (time to live) period. IP packets that did not originate with a DNS query can be blocked by default, for example.