Sinkhole DNS Server for Cloud Data Exfiltration Prevention

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In cloud computing environments, there is a vulnerability where sensitive data can be compromised through malicious DNS tunnelling via the native/default DNS server, requiring a balance between granting full access and restricting DNS functionality to prevent unauthorized data transfer.

Innovation Solution

Implementing a sinkhole DNS server within the cloud environment to intercept and redirect unauthorized DNS queries, preventing data exfiltration while minimizing network strain and maintaining functionality by responding with successful or non-existent messages, and generating alerts for detection and action.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If the second party is granted full access to the third party cloud environment's computing resources including the native DNS server, then the second party can effectively communicate with internal and external domains, but a vulnerability arises where sensitive data can be compromised through malicious DNS tunnelling to unauthorised domains

Engineering Contradiction:

Improveaccess to cloud environment resourcesVSAvoidDNS tunnelling vulnerability

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a sinkhole DNS server as an intermediary between the second party's DNS queries and the native DNS server. This intermediary captures DNS queries for unauthorised domains and redirects them to a controlled sinkhole server, which returns fake responses. This allows the system to maintain full DNS functionality for authorised domains while blocking malicious queries, thus resolving the contradiction between providing full access and preventing DNS tunnelling vulnerabilities.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If the native DNS server is used to prevent DNS tunnelling by restricting functionality, then data security is improved, but the second party's access to cloud environment resources is unduly restricted

Engineering Contradiction:

Improvedata securityVSAvoidaccess to cloud environment resources

Core Design Contradiction:

Object-affected harmful factorsVSEase of operation

Solution Approach 1:

The patent segments DNS query handling into two distinct paths: authorised domain queries are forwarded to the native DNS server for normal resolution, while unauthorised domain queries are redirected to the sinkhole server. This segmentation allows the system to maintain security by blocking unauthorised access while preserving full functionality for authorised domains, thus resolving the contradiction between data security and ease of operation.

Inventive Principle:

Principle #1Segmentation

3Object-affected harmful factors

If DNS queries to unauthorised domains are blocked entirely, then DNS tunnelling is prevented, but network and DNS server strain increases due to repeated query attempts

Engineering Contradiction:

ImproveDNS tunnelling preventionVSAvoidnetwork and DNS server strain

Core Design Contradiction:

Object-affected harmful factorsVSLoss of energy

Solution Approach 1:

The patent converts the harmful effect of repeated DNS queries to unauthorised domains into a beneficial security detection mechanism. The sinkhole server captures these repeated queries and uses them to identify and alert on potential DNS tunnelling attacks. By transforming the waste of repeated queries into a security benefit, the system prevents DNS tunnelling while actually reducing network strain through efficient detection and alerting mechanisms.

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

Data Source

PatentUS11743260B2Domain name security in cloud computing environment

Publication Date: 2023.08.29 BARCLAYS EXECUTION SERVICES LTD

AI summary

A computer implemented method for resolving a Domain Name System, DNS, query received at a third party cloud computing environment comprises: receiving a DNS query at the third party cloud computing environment. The DNS query is forwarded to a sinkhole DNS server if the DNS query comprises an unauthorised domain name. The DNS query is forwarded to a default DNS server of the third party cloud computing environment if the DNS query does not comprise an unauthorised domain name.