DNS denial of service attack protection

Patent metadata

Field	Value
Publication number	US-9756071-B1
Application number	US-201414487834-A
Country	US
Kind code	B1
Filing date	Sep 16, 2014
Priority date	Sep 16, 2014
Publication date	Sep 5, 2017
Grant date	Sep 5, 2017

Abstract

Exemplary embodiments for protecting a data network from a DNS denial of service attack are disclosed. The systems and methods provide for the use of a shared DNS cache between DNS UDP and DNS TCP proxy servers, to enable detection and mitigation of DNS denial of service attacks.

First claim

What is claimed:

1. A method for a Domain Name System proxy server to protect a data network from a Domain Name Service (DNS) denial of service attack, the method comprising:
receiving a first DNS request from a client for a domain name, the first DNS request being a DNS User Datagram Protocol (UDP) request;
determining the domain name included in the DNS UDP request does not match with a plurality of domain names in a DNS entry table at a shared cache in the DNS proxy server, wherein the determining further comprises one or more of:
detecting a pre-determined plurality of unanswerable DNS requests from the client, a burst of unanswerable DNS requests within a short period of time from the client, or a plurality of unanswerable DNS requests from suspected clients or network address sources;

responding to the client to retry the DNS UDP request as a second DNS request via a DNS Transmission Control Protocol (TCP) request;
querying a DNS server for the domain name in the DNS TCP request;
receiving a DNS response from the DNS server; and
determining, based at least on the DNS response, that the first DNS UDP request from the client is characteristic of a DNS denial of service attack.

2. The method of claim 1 , wherein the responding to the client to retry the DNS UDP request as a DNS TCP request comprises responding to the client with a truncated (TC) bit set.

3. A method for a Domain Name System proxy server to protect a data network from a Domain Name Service (DNS) denial of service attack, the method comprising:
receiving a first DNS request from a client for a domain name, the first DNS request being a DNS User Datagram Protocol (UDP) request;
determining the domain name included in the DNS UDP request does not match with a plurality of domain names in a DNS entry table of a shared cache at the DNS proxy server, wherein the determining further comprises one or more of:
detecting a pre-determined plurality of unanswerable DNS requests from the client, a burst of unanswerable DNS requests within a short period of time from the client, or a plurality of unanswerable DNS requests from suspected clients or network address sources;

responding to the client to retry the DNS UDP request as a second DNS request via a DNS Transmission Control Protocol (TCP) request;
querying a DNS server for the domain name in the DNS TCP request;
receiving a DNS response from the DNS server in response to the DNS TCP request;
determining from the DNS response to the second DNS TCP request that the first DNS UDP request from the client is not characteristic of a DNS denial of service attack; and
forwarding the received DNS response to the client.

4. The method of claim 3 , wherein the DNS proxy server creates a DNS entry in the DNS entry table of the shared cache of the DNS proxy server for the DNS response to the DNS TCP request.

5. The method of claim 3 , wherein the shared cache at the DNS proxy server is used to respond to future DNS TCP requests and future DNS UDP requests.

6. The method of claim 3 , further comprising:
receiving a DNS UDP request from a second client;
determining a domain name included in the DNS UDP request does match with a plurality of domain names in a DNS entry table at the shared cache of the DNS proxy server; and
responding to the client with a DNS response.

7. A system for protecting a data network from a Domain Name Service (DNS) denial of service attack, the system comprising:
a DNS proxy server configured to:
receive a first DNS request from a client for a domain name, the first DNS request being a DNS User Datagram Protocol (UDP) request;
determine the domain name included in the DNS UDP request does not match a plurality of domain names in a DNS entry table at a shared cache of the DNS proxy server, the determination comprising one or more of:
detecting a pre-determined plurality of unanswerable DNS requests from the client, a burst of unanswerable DNS requests within a short period of time from the client, or a plurality of unanswerable DNS requests from suspected clients or network address sources; and

respond to the client to retry the DNS UDP request as a second DNS request via a DNS Transmission Control Protocol (TCP) request;
query a DNS server for the domain name in the DNS TCP request;
receive a DNS response from the DNS server; and
determine based at least on the DNS response, that the first DNS UDP request from the client is characteristic of a DNS denial of service attack.

8. The system of claim 7 , wherein the DNS proxy server responding to the client to retry the first DNS UDP request as a second DNS TCP request comprises responding to the client with a truncated (TC) bit set.

9. The system of claim 7 , wherein the DNS proxy server is further configured to:
query a DNS server for the domain name in the DNS TCP request;
receive a DNS response from the DNS server; and
forward the DNS response to the client.

10. The system of claim 9 , wherein the DNS proxy server creates a DNS entry in the DNS entry table of the DNS proxy server for the DNS response.

11. The system of claim 9 , wherein the DNS proxy server stores the DNS entry from the DNS response in the DNS entry table in order to respond to future DNS requests.

12. The system of claim 7 , wherein if there is a match between the domain name in the DNS request and a domain name of a DNS entry of DNS entry table, the DNS proxy server sends a DNS response using the DNS entry to the client.

13. The system of claim 7 , wherein the DNS proxy server is further configured to:
query a network controller for the domain name in the DNS TCP request;
receive DNS information from the network controller; and
forward the DNS information to the client.

14. A system for protecting a data network from a Domain Name Service (DNS) denial of service attack, the system comprising:
a DNS proxy server with a plurality of ports, the DNS proxy server configured to:
receive a DNS request from a client at a first port of the DNS proxy server;
determine a domain name included in the DNS request does not match a plurality of domain names in a DNS entry table at a shared cache of the DNS proxy server, wherein the determining further comprises one or more of:
detecting a pre-determined plurality of unanswerable DNS requests from the client, a burst of unanswerable DNS requests within a short period of time from the client, or a plurality of unanswerable DNS requests from suspected clients or network address sources; and

respond to the client to retry the DNS request at a second port of the DNS proxy server;
receive a DNS request at the second port of the DNS proxy server;
query a DNS server for the domain name in the DNS request received at the second port of the DNS proxy server;
receive a DNS response from the DNS server; and
determine, based at least on the DNS response, that the DNS request received at the first port of the DNS server is characteristic of a DNS denial of service attack.

15. The system of claim 14 , wherein the received DNS request is a UDP request.

16. The system of claim 14 , wherein the received DNS request is a TCP request.

17. The system of claim 14 , wherein the domain name in the DNS request is a name of a network device.

18. The system of claim 14 , wherein the DNS proxy server creates a DNS entry in the DNS entry table of the DNS proxy server for the DNS response.

19. The system of claim 14 , wherein the DNS proxy server stores the DNS entry from the DNS response in the DNS entry table in order to respond

Assignees

• A10 Networks Inc

Inventors

• Golshan Ali

Classifications

• H04L63/1458 Primary

  Denial of Service · CPC title

• G06F17/30864

  Physics · mapped topic

• H04L61/58

  Caching of addresses or names · CPC title

• H04L61/4511

  using domain name system [DNS] · CPC title

• G06F16/951

  Indexing; Web crawling techniques · CPC title