Secure Dynamic Address Resolution Without Third-Party DNS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Domain Name System (DNS) is vulnerable to security threats such as hijacking, which can redirect users to malicious websites or intercept messages, highlighting the need for a secure dynamic address resolution and communication protocol that enhances security while remaining backwards compatible with modern communication protocols.
Innovation Solution
A method involving node pairing with authentication using unique keys or certificates, dynamic DNS record updates, and encryption to ensure secure communication between devices, allowing direct address resolution without relying on third-party DNS systems, with a 'kill-switch' for termination conditions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a third-party DNS system is used for address resolution, then ease of operation is improved, but security is worsened due to vulnerabilities like hijacking and redirection to malicious hosts
Solution Approach 1:
The patent extracts the DNS resolution functionality from third-party systems and implements it locally within the communication device. Each device maintains its own DNS resolution capability, eliminating dependence on external DNS servers and thereby removing the security vulnerability of third-party DNS hijacking while preserving ease of address resolution.
Solution Approach 2:
The patent introduces a local DNS cache and resolution mechanism as an intermediary between the application layer and network layer. This local intermediary resolves addresses before transmission, preventing direct exposure to third-party DNS systems and blocking malicious redirection attacks while maintaining operational convenience.
2Object-affected harmful factors
If direct address resolution between devices is implemented, then security is improved, but device complexity increases due to local DNS implementation
Solution Approach 1:
The patent implements a local DNS cache that stores address resolutions temporarily and discards them when expired or updated. This disposable approach to DNS caching provides security through local resolution while keeping the implementation simple and manageable, avoiding permanent complex DNS infrastructure.
Solution Approach 2:
The communication device performs DNS resolution autonomously using its own local DNS cache and resolution logic. This self-service capability eliminates the need for complex external DNS infrastructure while maintaining security, as each device independently resolves addresses without relying on third-party systems.
3Adaptability or versatility
If dynamic address updates are implemented, then adaptability is improved, but reliability is worsened due to potential address changes disrupting communication
Solution Approach 1:
The patent pre-establishes a secure pairing relationship between devices before address changes occur. This preliminary authentication creates a trusted bond that allows the system to adapt to address changes dynamically while maintaining reliability, as the pre-established trust relationship validates future communication even with new addresses.
Solution Approach 2:
The patent implements a feedback mechanism where devices continuously verify and update their address information through authenticated communication. This feedback loop ensures that address changes are detected and validated, allowing the system to adapt to network changes while maintaining communication reliability through continuous verification.
Data Source
AI summary
The present invention is directed to a method for providing secure dynamic address resolution and communication directly between two nodes, without communication to third party DNS and/or MX server(s). A first a second node are initially paired, which may include the identification of an authentication scheme and creating a DNS record with the current address of the other node, the address of the other node may be dynamically updated. Further secure transmission of messages may be implemented, which include first resolving based on the DNS record a current address of the other node, authentication the destination node, and transmitting a message upon successful authentication. Dynamic message encryption and the provision of a DNS cache may further be implemented.