Applianced domain name server

• US 8,898,773 B2
• Filed: 03/20/2007
• Issued: 11/25/2014
• Est. Priority Date: 03/20/2006
• Status: Active Grant

• Current Assignee: Nixu Software Oy (Nixu Oy)
• Original Assignee: Nixu Software Oy (Nixu Oy)
• Inventors: Holkkola, Juha, Kummu, Ville, Aukia, Petri
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US11/688,594
• Publication Number:
  US 20080276313A1
• Time in Patent Office: 2,807 Days
• Field of Search: 726/10, 726/11, 726/22, 726/23, 726/25
• US Class Current: 726/22
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A software installation package for a domain name server (DNS) comprises a hardened operating system, a domain name server software, a management interface. To detect and block attack attempts (2-1), the software installation package also comprises an attack detection logic (ADS) for analyzing (2-2, 2-3) IP packets based on a set of attack detection rules. A response logic reacts (2-4) to detected attack attempts.

Claims

1. A method for making an applianced domain name server, the method comprising:

forming a software installation package for the domain name server; and

making the appplianced domain name server by installing the software installation package in a server, wherein the software installation package comprises;

a hardened operating system;

a securely pre-configured domain name server software;

a management interface;

a local response logic for responding to attack attempts from one or more blacklisted client computers;

a local attack detection logic, wherein the attack detection logic performs one or more analyses, each of which being based on a plurality of IP packets from an individual client computer, based on a predetermined set of attack detection rules,

wherein, if at least some of the analyses, which are based on the plurality of IP packets from the individual client computer, identify the individual client computer as an attacking client computer, the local attack detection logic blacklists the individual client computer as an attacking client computer thereby indicating that IP traffic from the individual client computer should be blocked.

2. The method of claim 1, wherein Domain Name Service is the only service provided to client computers by the applianced domain name server.

3. A software installation package for a domain name server, the software installation package comprising:

a hardened operating system;

a securely pre-configured domain name server software;

a management interface;

a local attack detection logic, wherein the attack detection logic performs one or more analyses, each of which being based on a plurality of IP packets from an individual client computer, based on a predetermined set of attack detection rules,

wherein, if at least some of the analyses, which are based on the plurality of IP packets from the individual client computer, identify the individual client computer as an attacking client computer, the local attack detection logic blacklists the individual client computer as an attacking client computer thereby indicating that IP traffic from the individual client computer should be blocked, and

wherein the software installation package is stored in a tangible software carrier that constitutes a non-transitory storage medium.

4. The software installation package of claim 3, wherein the attack detection logic comprises means for monitoring a frequency of inquiries from each of a plurality of client computers.

5. The software installation package of claim 4, wherein the set of attack detection rules comprises a rule for detecting an attack attempt from a client computer if the monitored frequency of inquiries from that client computer exceeds a predetermined limit.

6. The software installation package of claim 3, wherein the set of attack detection rules comprises a rule for detecting an attack attempt from a client computer if a monitored size of inquiries from that client computer exceeds a predetermined limit.

7. The software installation package of claim 3, wherein the response logic comprises means for temporarily suspending the functionality of the domain name server.

8. The software installation package of claim 3, further comprising an automated process for updating software used in the software installation package after installation and hardening.

9. The software installation package of claim 3, wherein Domain Name Service is the only service provided to client computers by the applianced domain name server.