Systems and methods for secure communication
An encrypted message comprising a DNS request may be received from a client device. The DNS request may be decrypted to determine an IP address and a port associated with the client device. A security token may be determined based on the IP address and the port. A message comprising an indication of the DNS request and the security token may be sent to a DNS server. A reply comprising a payload and the security token may be received from the DNS server. Based on the security token, an indication of the payload of the reply may be sent to the client device.
1. A method comprising:
receiving, by an encryption module of a domain name system (DNS) server, and from a client device, a message;
establishing, by the encryption module of the DNS server and based on the receiving the message, a secure communication session with the client device;
determining a DNS request associated with the message, wherein the DNS request identifies an IP address associated with the client device and a domain name query;
determining, by applying a one-way hash function to at least the identified IP address associated with the client device, a security token;
sending, by the encryption module of the DNS server and to a DNS resolver module of the DNS server, the security token and the domain name query;
receiving, from the DNS resolver module of the DNS server, a reply comprising a payload and the security token; and
sending, by the encryption module of the DNS server and based on the security token, an indication of the payload of the reply to the client device via the secure communication session.
2. The method of claim 1 , wherein the encryption module comprises a smart network interface card (SmartNIC).
3. The method of claim 1 , further comprising:
storing, to a lookup table, an indication of the security token mapped to an indication of an identification of the secure communication session; and
wherein sending, based on the security token, the reply comprises determining, by performing a lookup in the lookup table, the communication session.
4. The method of claim 1 , wherein the secure communication session comprises at least one of a transport layer security (TLS) session or a hypertext transfer protocol secure (HTTPS) session.
5. The method of claim 1 , wherein the DNS request comprises a fully qualified domain name.
6. The method of claim 1 , wherein the DNS request comprises at least one of a DNS over HTTP (DoH) or a DNS over TLS (DOT) request.
7. The method of claim 1 , wherein the DNS request further identifies a port associated with the client device.
8. A device comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the device to:
receive, by an encryption module of a domain name system (DNS) server, and from a client device, a message;
establish, by the encryption module of the DNS server and based on the receiving the message, a secure communication session with the client device;
determine a DNS request associated with the message, wherein the DNS request identifies an IP address associated with the client device domain name query;
determine, by applying a one-way hash function to at least the identified IP address associated with the client device, a security token;
send, by the encryption module of the DNS server and to a DNS resolver module of the DNS server, the security token and the domain name query;
receive, from the DNS resolver module of the DNS server, a reply comprising a payload and the security token; and
send, by the encryption module of the DNS server and based on the security token, an indication of the payload of the reply to the client device via the secure communication session.
9. The device of claim 8 , wherein the encryption module comprises a smart network interface card (SmartNIC).
10. The device of claim 8 , wherein the instructions further cause the device to:
store, to a lookup table, an indication of the security token mapped to an indication of an identification of the secure communication session; and
determine, by performing a lookup in the lookup table using the security token in the reply, to send the payload of the reply to the client device via the secure communication session.
11. The device of claim 8 , wherein the secure communication session comprises at least one of a transport layer security (TLS) session or a hypertext transfer protocol secure (HTTPS) session.
12. The device of claim 8 , wherein the DNS request comprises a fully qualified domain name.
13. The device of claim 8 , wherein the DNS request comprises at least one of a DNS over HTTP (DoH) or a DNS over TLS (DOT) request.
14. A non-transitory computer-readable medium storing instructions that, when executed, cause:
receiving, by an encryption module of a domain name system (DNS) server, and from a client device, a message;
establishing, by the encryption module of the DNS server and based on the receiving the message, a secure communication session with the client device;
determining-a DNS request associated with the message, wherein the DNS request identifies an IP address associated with the client device and a domain name query;
determining, by applying a one-way hash function to at least the identified IP address associated with the client device, a security token;
sending, by the encryption module of the DNS server and to a DNS resolver module of the DNS server, the security token and the domain name query;
receiving, from the DNS resolver module of the DNS server, a reply comprising a payload and the security token; and
sending, by the encryption module of the DNS server and based on the security token, an indication of the payload of the reply to the client device via the secure communication session.
15. The non-transitory computer-readable medium of claim 14 , wherein the secure communication session comprises at least one of a transport layer security (TLS) session or a hypertext transfer protocol secure (HTTPS) session.
16. The non-transitory computer-readable medium of claim 14 , wherein the DNS request comprises a fully qualified domain name.
17. The non-transitory computer-readable medium of claim 14 , wherein the DNS request comprises at least one of a DNS over HTTP (DoH) or a DNS over TLS (DOT) request.