Systems and methods for reducing denial of service attacks against dynamically generated next secure records

Patent metadata

Field	Value
Publication number	US-9396330-B2
Application number	US-201313895279-A
Country	US
Kind code	B2
Filing date	May 15, 2013
Priority date	May 15, 2013
Publication date	Jul 19, 2016
Grant date	Jul 19, 2016

Abstract

The present solution reduces denial of service (DoS) attacks against dynamically generated next secure (NSEC) records. A domain name system (DNS) proxy may prevent spoofed IP addresses by forcing clients to transmit DNS queries via transmission control protocol (TCP), by replying to a user datagram protocol (UDP) DNS request with a blank or predetermined resource record with a truncation bit set to indicate that the record is too large to fit within a single UDP packet payload. Under the DNS specification, the client must re-transmit the DNS request via TCP. Upon receipt of the retransmitted request via TCP, the DNS proxy may generate fictitious neighbor addresses and a signed NSEC record and transmit the record to the client. Accordingly, the DNS Proxy need not waste time and processor cycles generating and signing records for requests from spoofed IP addresses via UDP.

First claim

What is claimed:

1. A method for reducing denial of service (DoS) attacks against dynamically generated next secure (NSEC) records, comprising:
receiving, by a domain name system (DNS) proxy executed by a first computing device, a first user datagram protocol (UDP) request from a client for a DNS resource record maintained by a server executed by a second computing device;
transmitting, by the DNS proxy to the server, a second request for the DNS resource record;
receiving, by the DNS proxy from the server, a response to the second request indicating a name error or that no corresponding resource record exists;
generating, by the DNS proxy, a default response comprising a predetermined truncated response with a truncation bit set and with a fictitious resource record;
transmitting, by the DNS proxy to the client, responsive to receiving the response to the second request indicating the name error or that no corresponding resource record exists, a second response, generated by the DNS proxy, to the first request different from the response received from the server, the second response comprising the default response generated by the DNS proxy;
storing, by the DNS proxy, to a cache, the default response;
receiving, by the DNS proxy, a second UDP request for the same DNS resource record from one of the client or a second client; and
responding, by the DNS proxy, to the second UDP request with the default response stored in the cache.

2. The method of claim 1 , further comprising:
receiving, by the DNS proxy, a retransmission of the first request from the client for the DNS resource record, the retransmitted first request transmitted via a transport control protocol (TCP);
generating, by the DNS proxy responsive to receiving the retransmitted first request via TCP, an authenticated NSEC record identifying the resource record as nonexistent; and
transmitting, by the DNS proxy to the client, the authenticated NSEC record via TCP.

3. The method of claim 2 , further comprising establishing a transport layer connection via TCP between the client and the DNS proxy.

4. The method of claim 2 , wherein generating the authenticated NSEC record comprises generating the NSEC response identifying fictitious close neighbors of the requested resource request.

5. The method of claim 2 , further comprising caching, by the DNS proxy, the generated authenticated NSEC record identifying the resource record as nonexistent.

6. The method of claim 5 , further comprising:
receiving, by the DNS proxy, a third request via TCP from a second client for the DNS record;
identifying, by the DNS proxy, the authenticated NSEC record in the cache; and
transmitting, by the DNS proxy to the second client, the authenticated NSEC record via TCP.

7. The method of claim 1 , further comprising:
determining, by the DNS proxy, that the resource record does not exist in a DNS cache of the proxy; and
wherein transmitting the second request to the server is performed responsive to the determination.

8. The method of claim 1 , wherein the server does not support domain name system security extensions (DNSSEC).

9. The method of claim 1 , wherein the predetermined truncated response is a blank DNS resource record with the truncation bit set.

10. The method of claim 1 , wherein the predetermined truncated response comprises a DNS resource record having random data with the truncation bit set.

11. A system for reducing denial of service (DoS) attacks against dynamically generated next secure (NSEC) records, comprising:
a first computing device executing a DNS proxy for a server executed by a second computing device; and
wherein the DNS proxy is configured for:
receiving a first user datagram protocol (UDP) request from a client for a DNS resource record maintained by the server,
transmitting, to the server, a second request for the DNS resource record,
receiving, from the server, a response to the second request indicating a name error or that no corresponding resource record exists,
generating, by the DNS proxy, a default response comprising a predetermined truncated response with a truncation bit set and with a fictitious resource record;
transmitting, to the client, responsive to receiving the response to the second request indicating the name error or that no corresponding resource record exists, a second response, generated by the DNS proxy, to the first request different from the response received from the server, the second response comprising the the default response generated by the DNS proxy;
storing, by the DNS proxy, to a cache, the default response;
receiving, by the DNS proxy, a second UDP request for the same DNS resource record from one of the client or a second client; and
responding, by the DNS proxy, to the second UDP request with the default response stored in the cache.

12. The system of claim 11 , wherein the DNS proxy is further configured for:
receiving a retransmission of the first request from the client for the resource record, the retransmitted first request transmitted via a transport control protocol (TCP),
generating, responsive to receiving the retransmitted first request via TCP, an authenticated NSEC record identifying the resource record as nonexistent, and
transmitting, to the client, the authenticated NSEC record via TCP.

13. The system of claim 12 , wherein the DNS proxy is further configured for establishing a transport layer connection via TCP between the client and the DNS proxy.

14. The system of claim 12 , wherein the DNS proxy is further configured for generating the authenticated NSEC record identifying fictitious close neighbors of the requested resource record.

15. The system of claim 12 , wherein the DNS proxy is further configured for:
caching the generated authenticated NSEC record identifying the resource record as nonexistent.

16. The system of claim 12 , wherein the DNS proxy is further configured for:
receiving a third request via TCP from a second client for the DNS record;
identifying the generated authenticated NSEC record in the cache; and
transmitting, to the second client, the authenticated NSEC record via TCP.

17. The system of claim 11 , wherein the DNS proxy is further configured for:
determining that the resource record does not exist in a DNS cache of the proxy; and
wherein transmitting the second request to the server is performed responsive to the determination.

18. The system of claim 11 , wherein the server does not support domain name system security extensions (DNSSEC).

19. The system of claim 11 , wherein the predetermined truncated response is a blank DNS resource record with the truncation bit set.

20. The system of claim 11 , wherein the predetermined truncated response comprises a DNS resource record having random data with the truncation bit set.

Assignees

• Citrix Systems Inc

Inventors

• Muthiah Manikam

Classifications

• H04L67/2804

  Electricity · mapped topic

• H04L61/6009

  Electricity · mapped topic

• H04L63/1458 Primary

  Denial of Service · CPC title

• G06F21/55 Primary

  Detecting local intrusion or implementing counter-measures · CPC title

• H04L61/1511

  Electricity · mapped topic