Transparent DNS Proxy Authentication for Reliable DDoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for protecting DNS resolvers against DDOS attacks are unreliable, easily bypassed, and limited to authoritative DNS servers, failing to authenticate clients effectively.
Innovation Solution
A transparent proxy mechanism that challenges clients with a DNS response setting the Truncated (TC) bit to 1, establishes a TCP connection if successful, and forwards UDP queries to the DNS resolver, converting responses to TCP for secure authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If passive UDP mode is used to drop the first DNS query and wait for retransmission, then the system can filter some malicious traffic, but the method is unreliable and easily bypassed by attackers who can simply forge and resend DNS queries multiple times
Solution Approach 1:
The patent introduces a transparent proxy as an intermediary component between the client and DNS resolver. The proxy intercepts UDP DNS queries, challenges clients by responding with TC bit set, and mediates the authentication process by establishing TCP connections with legitimate clients before forwarding their queries to the DNS resolver. This intermediary mechanism resolves the unreliability of passive UDP mode while maintaining system simplicity.
2Reliability
If active UDP mode is used with ns referral or cname to redirect resolver queries, then authoritative DNS servers can be protected, but the method fails when multiple NS candidates exist at client side as the anti-DDOS product cannot receive challenge responses back
Solution Approach 1:
The patent creates a universal authentication mechanism that works with both authoritative DNS servers and recursive resolvers. The transparent proxy implements a standardized challenge-response protocol using TC bit and TCP connection establishment that is applicable regardless of the DNS server type or client configuration. This resolves the limitation of active UDP mode being restricted to authoritative servers only.
3Reliability
If active TCP mode is used with Truncate bit to force client resending over TCP, then source address authentication can be achieved, but the process requires client-side configuration and notification which complicates deployment
Solution Approach 1:
The patent extracts the authentication logic from the DNS protocol itself and implements it in a separate transparent proxy component. The proxy handles the TCP challenge-response mechanism independently, allowing the DNS resolver and client to operate with standard protocols without any configuration changes. This extraction resolves the deployment complexity while maintaining reliable source address authentication.
4Reliability
If a transparent proxy is introduced to establish TCP connections for authentication, then robust protection against DDOS attacks can be achieved, but the system complexity increases
Solution Approach 1:
The transparent proxy implements self-service by automatically challenging incoming UDP DNS queries with TC bit set and autonomously establishing TCP connections with clients that respond appropriately. The proxy independently manages the authentication process without requiring external intervention or complex configuration, achieving robust DDOS protection while keeping the system relatively simple through automated self-service operations.
Data Source
AI summary
A UDP DNS query from a client, and validated by a transparent proxy prior to prevent DDOS attacks. In more detail, the client is challenged by sending back a DNS response with a Truncated (TC) bit set to 1. Responsive to the client sending back a TCP SYN frame, an attempt is made to establish a TCP connection with the client from the transparent DNS proxy. Responsive to a successful TCP connection, the UDP DNS query is forwarded from the transparent DNS proxy to the DNS resolver on behalf of the client. Responsive to receiving a DNS response from the DNS resolver, the UDP DNS response is converted to a TCP response forwarded to the client. The TCP connection can then be closed.