Secure domain name system
A method and system for authenticating answers to Domain Name System (DNS) queries originating from recursive DNS servers are provided. A verification component provides a verification that a DNS query originated from the recursive DNS server. An authoritative DNS server receives the query via a network, such as the Internet, and provides an answer to the query to an authentication component. The authentication component then provides an authentication, such as a digital signature, which confirms that the received answer was provided by the authoritative DNS server, and then communicates the answer and the authentication to the verification component via the network. The verification component then verifies that the authentication corresponds to the received answer and sends the answer to the recursive DNS server. When the verification component receives an answer in the absence of a corresponding authentication, the verification component drops the answer.
1. A system for authenticating answers to Domain Name System (DNS) queries originating from recursive DNS servers, the system comprising:
a verification component in serial communication with a recursive DNS server, the verification component being configured to receive a DNS query from the recursive DNS server and to provide a first verification that the DNS query originated from the recursive DNS server;
a first authentication component in communication with the verification component via a network, the first authentication component being configured to receive the DNS query and the first verification from the verification component, and to provide a confirmation that the first verification corresponds to the received DNS query; and
a first authoritative DNS server in serial communication with the first authentication component, the first authoritative DNS server being configured to provide an answer to the DNS query and to transmit the answer to the first authentication component,
wherein the first authentication component is further configured to receive the answer to the DNS query from the first authoritative DNS server and to provide an authentication that the received answer was provided by the first authoritative DNS server, and to communicate the received answer and the authentication to the verification component via the network
wherein the verification component is further configured to receive the answer to the DNS query and to receive the authentication, and to verify that the authentication corresponds to the received answer, and
wherein the verification component, the first authentication component, and the first authoritative DNS server each comprise one or more processors.
2. The system of claim 1 , wherein the network comprises the Internet.
3. The system of claim 1 , wherein the network comprises the World Wide Web.
4. The system of claim 1 , wherein the first authentication component further provides the DNS query in addition to the confirmation to the first authoritative DNS server.
5. The system of claim 1 , wherein the first verification comprises a digital signature generated by the verification component.
6. The system of claim 5 , wherein the first authentication component provides the DNS query to the first authoritative DNS server after validating the digital signature.
7. The system of claim 1 , wherein the first authentication component further provides an outgoing communication to the recursive DNS server, the outgoing communication including the answer to the DNS query.
8. The system of claim 7 , wherein the outgoing communication to the recursive DNS server is sent after determining that the answer corresponds to the DNS query.
9. The system of claim 7 , wherein the outgoing communication is encrypted.
10. The system of claim 1 , wherein the DNS query is encrypted.
11. A method for authenticating answers to Domain Name System (DNS) queries originating from recursive DNS servers, the method comprising:
receive, by a verification component, a DNS query from a recursive DNS server, the verification component being in serial communication with the recursive DNS server;
providing, by the verification component, a first verification that the DNS query originated from the recursive DNS server;
receiving, by a first authentication component, the DNS query and the first verification from the verification component, the first authentication component being in communication with the verification component via a network;
providing, by the first authentication component, a confirmation that the first verification corresponds to the received DNS query; and
providing, by a first authoritative DNS server, an answer to the DNS query, the first authoritative DNS server being in serial communication with the first authentication component, the first authoritative DNS server being configured to provide an answer to the DNS query;
transmitting, by the first authoritative DNS server, the answer to the first authentication component;
receiving, by the first authentication component, the answer to the DNS query from the first authoritative DNS server;
providing, by the first authentication component, an authentication that the received answer was provided by the first authoritative DNS server;
communicating, by the first authentication component, the received answer and the authentication to the verification component via the network;
receive, by the verification component, the answer to the DNS query and the authentication; and
verifying, by the verification component, that the authentication corresponds to the received answer.
12. The method of claim 11 , wherein the network comprises the Internet.
13. The method of claim 11 , wherein the network comprises the World Wide Web.
14. The method of claim 11 , wherein the first authentication component further provides the DNS query in addition to the confirmation to the first authoritative DNS server.
15. The method of claim 11 , wherein the first verification comprises a digital signature generated by the verification component.
16. The method of claim 15 , wherein the first authentication component provides the DNS query to the first authoritative DNS server after validating the digital signature.
17. The method of claim 11 , wherein the first authentication component further provides an outgoing communication to the recursive DNS server, the outgoing communication including the answer to the DNS query.
18. The method of claim 17 , wherein the outgoing communication to the recursive DNS server is sent after determining that the answer corresponds to the DNS query.
19. The method of claim 17 , wherein the outgoing communication is encrypted.
20. The method of claim 11 , wherein the DNS query is encrypted.