Recursive domain name service (DNS) prefetching

Patent metadata

Field	Value
Publication number	US-10587649-B2
Application number	US-201715823307-A
Country	US
Kind code	B2
Filing date	Nov 27, 2017
Priority date	Apr 13, 2017
Publication date	Mar 10, 2020
Grant date	Mar 10, 2020

Abstract

A method, apparatus and program product utilize Domain Name Service (DNS) prefetching in a recursive DNS server, e.g., to mitigate Distributed Denial of Service (DDoS) attacks on a DNS service.

First claim

What is claimed is:

1. A method of handling Domain Name Service (DNS) requests, the method comprising:
prefetching from an authoritative DNS server DNS entries for one or more domains to build a whitelist of DNS entries in a recursive DNS server, wherein the prefetched DNS entries map domain names to addresses; and
in response to a DNS request received by the recursive DNS server:
determining if the whitelist is active;
if the whitelist is active, accessing the whitelist to attempt to locate a matching DNS entry for the received DNS request; and
in response to locating a matching DNS entry for the received DNS request, returning the matching DNS entry as a response to the DNS request rather than forwarding the DNS request to a different DNS server;

wherein the method further comprises monitoring system load and selectively activating the whitelist based upon the monitored system load such that accessing the whitelist is selectively performed in response to the monitored system load, wherein the recursive DNS server processes the DNS request without accessing the whitelist when the whitelist is inactive, and wherein the method further comprises:
activating a mode in response to determining a high system load from the monitored system load, wherein accessing the whitelist is only performed when the mode is activated when the DNS request is received by the recursive DNS server; and
after activating the mode, selectively deactivating the mode in response to determining a discontinuation of the high system load from the monitored system load.

2. The method of claim 1 , wherein the whitelist is a semi-authoritative whitelist.

3. The method of claim 1 , wherein monitoring system load includes monitoring system load in the recursive DNS server.

4. The method of claim 1 , wherein monitoring system load includes monitoring response time for the authoritative DNS server.

5. The method of claim 1 , further comprising
caching failed DNS requests in a negative feedback cache; and
in response to the DNS request received by the recursive DNS server, accessing the negative feedback cache and returning an invalid DNS response in response to the DNS request received by the recursive DNS server matching a failed DNS request cached in the negative feedback cache.

6. The method of claim 5 , wherein accessing the whitelist is performed in response to the DNS request received by the recursive DNS server not matching any failed DNS request cached in the negative feedback cache.

7. The method of claim 5 , further comprising removing stale failed DNS requests from the negative feedback cache.

8. The method of claim 7 , wherein caching the failed DNS requests includes associating each failed DNS request with a timeout, and wherein removing stale failed DNS requests includes removing failed DNS requests for which the associated timeout has been triggered.

9. The method of claim 5 , further comprising:
in response to not locating the matching DNS entry for the received DNS request, forwarding the DNS request received by the recursive DNS server to a different DNS server; and
in response to receiving an invalid response to the forwarded DNS request from the different DNS server, caching the DNS request received by the recursive DNS server in the negative feedback cache as a failed DNS request.

10. The method of claim 5 , further comprising:
activating a mode in response to determining a high system load, wherein accessing the negative feedback cache is only performed when the mode is activated when the DNS request is received by the recursive DNS server; and
after activating the mode, selectively deactivating the mode in response to determining a discontinuation of the high system load from the monitored system load.

11. The method of claim 5 , further comprising applying a malicious query matching filter to the DNS request received by the recursive DNS server, and returning an invalid DNS response to the DNS request received by the recursive DNS server in response to a match with the malicious query matching filter.

12. The method of claim 11 , wherein the malicious query matching filter includes a bloom filter.

13. The method of claim 1 , wherein prefetching from the authoritative DNS server the DNS entries for the one or more domains includes prefetching from the authoritative DNS server each sub-domain for the one or more domains.

14. The method of claim 13 , further comprising updating the whitelist over time by repeating prefetching from the authoritative DNS server.

15. The method of claim 1 , wherein the recursive DNS server is resident in a root DNS data processing system, an Internet Service Provider (ISP) data processing system, a network router data processing system or a client data processing system.

Assignees

• IBM

Inventors

• Koster David M
• Nikolai Jason A
• Reznechek Adam D
• Thorstensen Andrew T

Classifications

• H04L63/1458 Primary

  Denial of Service · CPC title

• H04L43/0876

  Network utilisation, e.g. volume of load or congestion level · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L61/6009

  Electricity · mapped topic

• H04L61/1511

  Electricity · mapped topic