Secure domain name system
A method and system for authenticating answers to Domain Name System (DNS) queries originating from recursive DNS servers provided. A verification component provides a versification that a DNS query originated from the recursive DNS server. An authoritative DNS server receives the query via a network, such as the Internet, provides an answer to the query to an authentication component. The authentication component then provides an authentication such as a digital signature, which confirms that the received answer was provided by the authoritative DNS server, and then communicates the answer and the authentication to the verification component via the network. The verification component then verifies that the authentication corresponds to the receive answer and sends the answer to the recursive DNS server. When the verification component receives an answer in the absence of a corresponding authentication the verification component drops the answer.
1. A system comprising:
a component in serial communication with an authoritative Domain Name System (DNS) server, wherein the component comprises one or more processors that access a corresponding memory, and are configured to:
receive an incoming communication sent by a verification component associated with a recursive DNS server, wherein the incoming communication includes:
(i) a DNS query generated by the recursive DNS server, and
(ii) a first digital signature generated by the verification component;
after validating the first digital signature, send the DNS query included in the incoming communication to the authoritative DNS server;
receive a DNS answer generated by the authoritative DNS server and destined for the recursive DNS server;
determine whether the DNS answer corresponds to the sent DNS query; and
send an outgoing communication to the recursive DNS server via the verification component, wherein the outgoing communication includes the DNS answer and a second digital signature.
2. The system of claim 1 , wherein the verification component is in serial communication with the recursive DNS server.
3. The system of claim 1 , wherein the outgoing communication to the recursive DNS server is sent after determining that the DNS answer corresponds to the sent DNS query.
4. The system of claim 1 , wherein the processors are further configured to:
after the first digital signature is validated, record that the recursive DNS server associated with the DNS query is expecting an answer from the authoritative DNS server, and wherein the determination of whether the DNS answer corresponds to the sent DNS query includes verifying whether the recursive DNS server is recorded as expecting an answer from the authoritative DNS answer.
5. The system of claim 1 , wherein the processors are further configured to generate the second digital signature.
6. The system of claim 1 , wherein the component is arranged with respect to the authoritative DNS server such that (i) all communications destined for the authoritative DNS server, and (ii) all communications originating from the authoritative DNS server are received at the component.
7. The system of claim 1 , wherein the authoritative DNS server and the component are implemented on two separate devices.
8. The system of claim 1 , further comprising a second component in serial communication with the component.
9. The system of claim 1 , wherein a second verification component is in serial communication with the verification component and the recursive DNS server.
10. The system of claim 1 , wherein at least one of the incoming communication and the outgoing communication is encrypted.
11. A method performed by a component in serial communication with an authoritative Domain Name System (DNS) server, the method comprising:
receiving an incoming communication sent by a verification component associated with a recursive DNS server, wherein the incoming communication includes:
(i) a DNS query generated by the recursive DNS server, and
(ii) a first digital signature generated by the verification component;
after validating the first digital signature, sending the DNS query included in the incoming communication to the authoritative DNS server;
receiving a DNS answer generated by the authoritative DNS server and destined for the recursive DNS server;
determining whether the DNS answer corresponds to the sent DNS query; and
sending an outgoing communication to the recursive DNS server via the verification component, wherein the outgoing communication includes the DNS answer and a second digital signature.
12. The method of claim 11 , wherein the verification component is in serial communication with the recursive DNS server.
13. The method of claim 11 , wherein the outgoing communication to the recursive DNS server is sent after determining that the DNS answer corresponds to the sent DNS query.
14. The method of claim 11 , further comprising:
after the first digital signature is validated, recording that the recursive DNS server associated with the DNS query is expecting an answer from the authoritative DNS server, and wherein the determination of whether the DNS answer corresponds to the sent DNS query includes verifying whether the recursive DNS server is recorded as expecting an answer from the authoritative DNS answer.
15. The method of claim 11 , further comprising generating the second digital signature.
16. The method of claim 11 , wherein the component is arranged with respect to the authoritative DNS server such that (i) all communications destined for the authoritative DNS server, and (ii) all communications originating from the authoritative DNS server are received at the component.
17. The method of claim 11 , wherein the authoritative DNS server and the component are implemented on two separate devices.
18. The method of claim 11 , further comprising a second component in serial communication with the component.
19. The method of claim 11 , wherein a second verification component is in serial communication with the verification component and the recursive DNS server.
20. A component in serial communication with an authoritative Domain Name System (DNS) server, comprising one or more processors that access a corresponding memory, and are configured to:
receive an incoming communication sent by a verification component associated with a recursive DNS server, wherein the incoming communication includes:
(i) a DNS query generated by the recursive DNS server, and
(ii) a first digital signature generated by the verification component;
after validating the first digital signature, send the DNS query included in the incoming communication to the authoritative DNS server;
receive a DNS answer generated by the authoritative DNS server and destined for the recursive DNS server;
determine whether the DNS answer corresponds to the sent DNS query; and
send an outgoing communication to the recursive DNS server via the verification component, wherein the outgoing communication includes the DNS answer and a second digital signature.