Secure DNS Query Channel for Smart Card Power Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Smart cards, such as SIM and UICC, face challenges in securing DNS queries due to limited energy and memory resources, making it difficult to adapt secure DNS solutions from the Internet to these devices without increasing power consumption and memory footprint.
Innovation Solution
A method is implemented to establish a secure connection between a terminal's secure element and a DNS server using cryptographic protocols like TLS-PSK, allowing for secure DNS queries and responses while reducing power consumption by reusing the same secure channel for multiple queries and optimizing memory usage by storing and resuming the DNS security context between volatile and non-volatile memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secure DNS solutions (DNS over TLS) are implemented on smart cards, then DNS query security is improved, but power consumption and memory footprint increase
Solution Approach 1:
The patent merges multiple DNS queries into a single secure TLS connection by maintaining a persistent secure channel between the smart card and DNS server. Instead of establishing a new TLS connection for each DNS query (which would consume significant power), the system reuses the same secure connection for multiple queries, thereby reducing the frequency of cryptographic operations and lowering overall power consumption while maintaining security.
Solution Approach 2:
The patent establishes the secure TLS connection in advance before DNS queries are needed, and maintains it open for a period to handle multiple queries. This preliminary establishment of the secure channel avoids the need to repeatedly perform computationally expensive TLS handshakes, thereby reducing power consumption while ensuring security is already in place when queries are made.
2Reliability
If secure DNS solutions (DNS over TLS) are implemented on smart cards, then DNS query security is improved, but memory footprint increases
Solution Approach 1:
The patent combines multiple DNS queries handled within the same secure TLS connection, allowing the smart card to maintain security context (TLS session state, cryptographic keys, certificates) for an extended period. This approach avoids the need to store and manage separate security contexts for each query, thereby reducing overall memory footprint while maintaining security.
Solution Approach 2:
The patent makes the secure TLS connection multi-functional by using it to handle multiple different DNS queries over time. The same secure channel serves various resolution requests, allowing the smart card to reuse cryptographic materials and security context rather than allocating new memory resources for each query, thus reducing memory footprint.
3Reliability
If a new secure connection is established for each DNS query, then security is maintained, but power consumption increases
Solution Approach 1:
The patent maintains continuous secure communication by keeping the TLS connection open across multiple DNS queries rather than repeatedly establishing and tearing down connections. This continuity allows the smart card to avoid the periodic power spikes associated with repeated cryptographic handshakes, reducing average power consumption while maintaining unbroken security through the persistent encrypted channel.
Data Source
Figure 1a
Figure 1b
Figure 2
AI summary
The present invention relates to a method performed at a terminal for communicating with a remote DNS server. A secure connection is established between a secure element of the terminal and the remote DNS server, and associated with a counter representative of a number of DNS requests already sent. The method may comprise: as long as the value of the counter is less than or equal to a threshold, iteratively performing: receiving a DNS resolution triggering request; upon receiving the resolution triggering request, sending a ciphered DNS request to the remote DNS server via the secure connection; receiving, from the remote DNS server, a ciphered DNS response in response to the sent DNS request via the secure connection; processing the ciphered DNS response received; increasing the value of the counter; and when the value of the counter is greater than the threshold, closing the secure connection.