Secure DNS Traffic Redirection Through Verified Name Resolution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DNS discovery mechanisms in LAN networks are insecure, allowing malicious equipment to intercept communications and redirect users to malicious servers, compromising data security and service continuity.
Innovation Solution
A method for securely redirecting DNS traffic from a first name resolution server to a second server by verifying the legitimacy of the second server through a secure communication channel, using protocols like HTTPS or QUIC, and managing actions such as verifying legitimacy, indicating connection failures, or deactivating redirection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS server discovery mechanisms are implemented in LAN networks, then name resolution service is provided, but security vulnerabilities arise allowing malicious equipment to intercept user data and redirect communications
Solution Approach 1:
The patent introduces an intermediary verification mechanism where the first DNS server acts as a mediator to verify the legitimacy of the second DNS server before allowing traffic redirection. This intermediary role prevents malicious servers from directly intercepting traffic by requiring authentication through a trusted third party (the first DNS server), thus resolving the contradiction between service availability and security against malicious equipment.
Solution Approach 2:
The patent implements preliminary verification of the second DNS server's legitimacy through authentication procedures before DNS traffic redirection is activated. The terminal device verifies the second server's credentials in advance through the first DNS server, ensuring that only authenticated servers can receive redirected traffic. This preliminary action prevents malicious servers from compromising DNS resolution before they can intercept traffic.
2Object-affected harmful factors
If authentication certificates and secure connections are used, then DNS communication security is improved, but malicious servers cannot be effectively detected and prevented
Solution Approach 1:
The patent implements a feedback mechanism where the terminal device receives verification results from the first DNS server about the second server's legitimacy. The terminal uses this feedback to decide whether to redirect DNS traffic to the second server. This feedback loop enables the system to detect and prevent malicious servers by continuously verifying server credentials and adjusting traffic routing based on verification outcomes, thus maintaining both security and detection capability.
Solution Approach 2:
The patent applies preliminary anti-action by implementing verification procedures that actively prevent malicious server connections before they can compromise security. The terminal device proactively verifies the second DNS server's legitimacy through the first server before establishing any communication channel, thereby preventing malicious servers from intercepting traffic even if they attempt to use secure connections or authentication certificates.
3Duration of action of stationary object
If DNS traffic redirection is implemented from first server to second server, then service continuity is maintained, but security risks increase due to potential malicious interference
Solution Approach 1:
The patent implements preliminary verification of the second DNS server's legitimacy before activating traffic redirection. The terminal device authenticates the second server through the first DNS server in advance, ensuring that only verified servers can receive redirected traffic. This preliminary action maintains service continuity by ensuring legitimate servers are always available while preventing security risks from malicious servers attempting to intercept redirected traffic.
Solution Approach 2:
The first DNS server acts as an intermediary that mediates the relationship between the terminal device and the second DNS server. It verifies the second server's credentials and provides authentication information to the terminal, enabling secure redirection. This intermediary mechanism maintains service continuity by ensuring always-on verification while mitigating security risks through trusted mediation, preventing malicious servers from compromising redirected traffic.
Data Source
AI summary
Methods for traffic redirection, corresponding terminal, controller, authorization server, name resolution servers and computer program. A name resolution method implemented in a terminal connected to a communication network includes: transmitting, to a first name resolution server, a name resolution message via a secure communication channel between the terminal and the first name resolution server; if a redirection of the DNS traffic of the terminal is authorized, obtaining at least one identifier of a second name resolution server for the redirection; and executing at least one action for managing the redirection of the DNS traffic of the terminal to the second name resolution server, at least from among: verifying legitimacy of the second name resolution server, sending an indication of a failure of a connection of the terminal with the second name resolution server; and requesting deactivation of the redirection of the DNS traffic to the second name resolution server.