Applianced Domain Name Server

• US 20080276313A1
• Filed: 03/20/2007
• Published: 11/06/2008
• Est. Priority Date: 03/20/2006
• Status: Active Grant

• Current Assignee: Nixu Software Oy (Nixu Oy)
• Original Assignee: Nixu Software Oy (Nixu Oy)
• Inventors: Holkkola, Juha, Kummu, Ville, Aukia, Petri
• Granted Patent: US 8,898,773 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A software installation package for a domain name server (DNS) comprises a hardened operating system, a domain name server software, a management interface. To detect and block attack attempts (2-1), the software installation package also comprises an attack detection logic (ADS) for analyzing (2-2, 2-3) IP packets based on a set of attack detection rules. A response logic reacts (2-4) to detected attack attempts.

Claims

1. A method for installing an applianced domain name server, the method comprising:

forming a software installation package for the domain name server, the software installation package comprising;

a hardened operating system;

a securely pre-configured domain name server software;

a management interface;

a local attack detection logic for detecting an attack attempt, wherein the attack detection logic comprises means for analyzing a plurality of IP packets based on a predetermined set of attack detection rules;

a local response logic for responding to a detected attack attempt; and

installing the software installation package in a domain name server.

2. A software installation package for a domain name server, the software installation package comprising:

a hardened operating system;

a securely pre-configured domain name server software;

a management interface;

a local attack detection logic for detecting an attack attempt, wherein the attack detection logic comprises means for analyzing a plurality of IP packets based on a predetermined set of attack detection rules;

a local response logic for responding to a detected attack attempt.

3. A software installation package according to claim 2, wherein the attack detection logic comprises means for monitoring a frequency of inquiries from each of a plurality of client computers.

4. A software installation package according to claim 2, wherein the set of attack detection rules comprises a rule for detecting an attack attempt from a client computer if the monitored frequency of inquiries from that client computer exceeds a predetermined limit.

5. A software installation package according to claim 2, wherein the set of attack detection rules comprises a rule for detecting an attack attempt from a client computer if the monitored size of inquiries from that client computer exceeds a predetermined limit.

6. A software installation package according to claim 2, wherein the response logic comprises means for temporarily suspending the functionality of the domain name server.

7. A software installation package according to claim 2, further comprising an automated process for updating software used in the software installation package after installation and hardening.