Secure DNS Server Malicious Connection Handling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing devices are vulnerable to malicious connections when joining a new network, as they may be directed to DNS servers that do not provide protection against malicious destinations.
Innovation Solution
A method to manage DNS requests by transmitting them to a local DNS server when a secure DNS server is unavailable, caching the information, and sending it to the secure DNS server once available, allowing the secure DNS server to perform security checks and terminate potentially malicious connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a computing device uses a local DNS server when a secure DNS server is unavailable, then the device can maintain network connectivity and DNS resolution functionality, but the device becomes vulnerable to malicious connections and lacks security protection
Solution Approach 1:
The system performs preliminary security checks by caching DNS request information locally before the secure DNS server becomes available. When the secure DNS server is unavailable, the system has already prepared and cached the necessary DNS data, allowing for rapid transition to secure processing once the server becomes available, thus maintaining both connectivity and security.
Solution Approach 2:
The local DNS server acts as an intermediary between the computing device and the secure DNS server. It temporarily handles DNS requests when the secure server is unavailable, and then transfers cached information to the secure DNS server for processing, bridging the gap between unsecured and secured states.
2Reliability
If a computing device switches to a secure DNS server, then security against malicious connections is improved, but network connectivity may be disrupted during the transition
Solution Approach 1:
The system caches DNS request information locally in advance before switching to the secure DNS server. This preliminary caching of connection data and DNS responses ensures that when the transition occurs, the necessary connection information is already prepared, minimizing disruption and transition time while maintaining security.
3Object-affected harmful factors
If DNS requests are processed through a secure DNS server, then malicious connections are blocked, but the system complexity increases due to the need to manage multiple DNS servers and caching mechanisms
Solution Approach 1:
The system segments the DNS processing function into two distinct parts: a local DNS server that handles immediate requests and a secure DNS server that performs security validation. The caching mechanism separates the data storage function from the processing function, allowing each component to have specialized responsibilities while working together to block malicious connections.
Solution Approach 2:
The caching mechanism serves as an intermediary layer between the local DNS server and the secure DNS server. It stores and manages DNS request information, simplifying the communication protocol between the two servers and reducing the complexity of coordinating their operations while maintaining effective malicious connection blocking.
Data Source
AI summary
Provided herein are systems, methods, and software to manage DNS requests to DNS servers. An exemplary method includes, in response to determining a secure DNS server is unavailable, transmitting DNS requests to a local DNS server and generating one or more connections to addresses returned by the local DNS server in response to the DNS requests. The method also includes caching information about the DNS requests in a cache and, in response to determining the secure DNS server is available, sending the information from the cache to the secure DNS server. The secure DNS server processes the information to determine whether a portion of one or more connections is potentially malicious. In response to the secure DNS server indicating the portion of the one or more connections is malicious, the method includes terminating the portion of the one or more connections.