METHOD AND SYSTEM FOR PREVENTING DNS CACHE POISONING

• US 20120297478A1
• Filed: 01/18/2011
• Published: 11/22/2012
• Est. Priority Date: 01/19/2010
• Status: Abandoned Application

• Current Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Original Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Inventors: Martin, Antony, Papillon, Serge
• Application Number:
  US13/519,606
• Publication Number:
  US 20120297478A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 2463/145 Detection or countermeasures against cache poisoning
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/58 Caching of addresses or names
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A method for preventing the poisoning of at least one DNS cache (5_—i) within a computer network (B) including several DNS caches (5_—1, 5_—i, 5_—n), this method comprising a step of comparing at least two DNS responses to a DNS query, returned by two different DNS caches.

Claims

1. A method for preventing a poisoning of at least one DNS cache within a computer network including several DNS caches, the method comprising the steps of:

comparing at least two DNS responses to a DNS query returned by two different DNS caches, and

analyzing the DNS query to identify a service with which said DNS query is associated before querying the DNS caches.

2. The method according to claim 1, wherein a number of DNS caches queried depends upon the service with which the DNS query is associated.

3. The method according to claim 1, wherein the step of comparing the at least two DNS responses further comprises a step of reversing a resolution of the DNS query by at least one DNS cache.

4. The method according to claim 1, wherein the step of comparing the at least two DNS responses further comprises a step of calculating ratios of the at least two DNS responses.

5. The method according to claim 4, wherein the DNS response with the highest ratio among a set of DNS responses returned by the DNS caches is the DNS response to the DNS query.

6. The method according to claim 1, wherein an inconsistency among the at least two DNS responses returned by the DNS caches triggers at least one of the following actions:

notifying a source of the DNS query of a security problem;

notifying a administrator of a computer network of a potential poisoning attack on at least one DNS cache;

storing at least one of the at least two DNS responses in a database.

7. The method according to claim 4, wherein a Time To Live of a DNS cache returning a DNS response with a low ratio among the responses returned by the set of DNS caches is reduced to zero.

8. The method according to claim 1, wherein the at least two DNS responses comprise a DNS response returned by a DNS root server.

9. A system for preventing a poisoning of at least one DNS cache in a computer network including several DNS caches, the system comprising:

an analyzer of at least two DNS responses to a DNS query returned by two different DNS caches, and

a DNS query analyzer, equipped with a database of information on DNS queries, configured to identify a service associated with the DNS query.

10. The system according to claim 9, wherein the at least two DNS responses comprise a DNS response returned by a DNS root server.