Secure domain name system
View Patent ↗A method and system for authenticating answers to Domain Name System (DNS) queries originating from recursive DNS servers are provided. A verification component provides a verification that a DNS query originated from the recursive DNS server. An authoritative DNS server receives the query via a network, such as the Internet, and provides an answer to the query to an authentication component. The authentication component then provides an authentication, such as a digital signature, which confirms that the received answer was provided by the authoritative DNS server, and then communicates the answer and the authentication to the verification component via the network. The verification component then verifies that the authentication corresponds to the received answer and sends the answer to the recursive DNS server. When the verification component receives an answer in the absence of a corresponding authentication, the verification component drops the answer.
1. Apparatus for authenticating answers to Domain Name System (DNS) queries originating from recursive DNS servers, the apparatus comprising:
a verification appliance, wherein the verification appliance comprises a CPU and a memory, disposed in front of and in serial communication with a separate recursive DNS server, the verification appliance being configured to (i) receive a DNS query from the recursive DNS server and to (ii) provide a first verification that the query originated from the recursive DNS server;
a first authentication component in communication with the verification appliance via a network, the first authentication component being configured to (i) receive the DNS query and the first verification from the verification appliance, and to (ii) provide a first confirmation that the first verification corresponds to the received DNS query; and
a first authoritative DNS server in serial communication with the first authentication component, the first authoritative DNS server being configured to (i) provide an answer to the DNS query and to (ii) transmit the answer to the first authentication component,
wherein the first authentication component is further configured to (i) receive the answer to the DNS query from the first authoritative DNS server and to (ii) provide an authentication that the received answer was provided by the first authoritative DNS server, and to (iii) communicate the received answer and the authentication to the verification appliance via the network; and
wherein the verification appliance is further configured to (i) receive the answer to the DNS query and to receive the authentication, and to (ii) verify that the authentication corresponds to the received answer, wherein when the verification appliance receives the answer in the absence of a corresponding authentication, and wherein the verification appliance is configured to prevent the answer from being communicated to the recursive DNS server;
a second authentication component, the second authentication component being in communication with the verification appliance via the network, the second authentication component being configured to receive the DNS query and the first verification from the verification appliance when the first authentication component is not functioning properly, and to provide a second confirmation that the first verification corresponds to the received DNS query;
and a second authoritative DNS server,
wherein the second authoritative DNS server being in serial communication with the second authentication component, the second authoritative DNS server component being configured to provide the answer to the DNS query and to transmit the answer to the second authentication component,
wherein the second authentication component is further configured to receive the answer to the DNS query from the second authoritative DNS server and to provide an authentication that the received answer was provided by the second authoritative DNS server component, and to communicate the received answer and the authentication to the verification appliance via the network; and
wherein the verification component is further configured to receive the answer to the DNS query and to receive the authentication, and to verify that the authentication corresponds to the received answer.
2. The apparatus of claim 1 , wherein the network comprises the Internet.
3. The apparatus of claim 1 , wherein the network comprises the World Wide Web.
4. The apparatus of claim 1 , wherein the authentication comprises a digital signature.
5. The apparatus of claim 1 , further comprising a second authentication component, the second authentication component being in serial communication with both of the first authentication component and the first authoritative
DNS server, and the second authentication component being configured identically as the first authentication component to provide redundancy,
wherein the second authentication component is configured to receive the DNS query and the first verification from the verification appliance via the network and the first authentication component, and to provide a third confirmation that the first verification corresponds to the received DNS query, and to transmit the DNS query and the third confirmation to the authoritative DNS server, and
wherein the second authentication component is further configured to receive the answer from the authoritative DNS server component and to provide an authentication that the received answer was provided by the authoritative DNS server component, and to communicate the received answer and the authentication to the verification appliance via the first authentication component and the network.
6. A method of verifying an authenticity of an answer to a Domain Name System (DNS) query originating from a recursive DNS server, the method comprising the steps of:
receiving, with a verification appliance in front of and in serial communication with the recursive DNS server, the DNS query from the recursive DNS server;
the verification appliance providing a verification that the DNS query originated from the recursive DNS server;
communicating the DNS query and the verification to an authoritative DNS server via a network; and
receiving an answer to the DNS query and an authentication corresponding to the received answer,
wherein the authoritative DNS server is configured to transmit the answer to an authentication component that is configured to provide an authentication corresponding to the answer and to communicate the authentication in conjunction with the answer, said authentication component being in serial communication with the authoritative DNS server,
wherein when the answer to the DNS query is received in the absence of a corresponding authentication dropping the received answer;
wherein when the first authentication component is not functioning properly, communicating the DNS query and the verification to a second authoritative DNS server via the network; and receiving the answer to the DNS query and an authentication corresponding to the received answer, wherein the second authoritative DNS server is configured to transmit the answer to a second authentication component that is configured to provide an authentication corresponding to the answer and to communicate the authentication in conjunction with the answer.
7. The method of claim 6 , wherein the network comprises the Internet.
8. The method of claim 6 , wherein the network comprises the World Wide Web.
9. The method of claim 6 , wherein the authentication comprises a digital signature.
10. The method of claim 6 , wherein when the answer to the DNS query is received in the absence of a corresponding authentication, the method further comprises the steps of:
re-communicating the DNS query and the verification to the authoritative DNS server via the network; and
receiving a second answer to the DNS query and an authentication corresponding to the received second answer.
11. A method of authenticating an answer to a Domain Name System (DNS) query originating from a recursive DNS server, the method comprising the steps of:
receiving, with a verification appliance in front of and in serial communication with the recursive DNS server, the DNS query from the recursive DNS server;
receiving, at a first authentication component, the DNS query from the verification appliance via a network;
communicating the received DNS query to an authorized DNS server;
receiving an answer to the DNS query from the authorized DNS server;
providing an authentication corresponding to the received answer, the authentication provided by the first authentication component in serial communication with the DNS server,
wherein when an answer to the DNS query is received in the absence of a corresponding authentication dropping the received answer,
wherein when the first authentication component is not functioning properly, communicating the DNS query and the verification to a second authoritative DNS server via the network; and receiving the answer to the DNS query and an authentication corresponding to the received answer, wherein the second authoritative DNS server is configured to transmit the answer to a second authentication component that is configured to provide an authentication corresponding to the answer and to communicate the authentication in conjunction with the answer; and
communicating the received answer and the authentication to the recursive DNS server via the network.
12. The method of claim 11 , wherein the network comprises the Internet.
13. The method of claim 11 , wherein the network comprises the World Wide Web.
14. The method of claim 11 , wherein the authentication comprises a digital signature.
15. The method of claim 11 , further comprising the step of receiving, from the verification appliance, a verification that the received DNS query was actually originated by the recursive DNS server, wherein the step of receiving a verification occurs prior to the step of communicating the received DNS query to the authorized DNS server.