Active DNS Proxy for IPv6-to-IPv4 Security Inspection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Legacy servers and services often do not fully support IPv6, leading to network connection delays and security vulnerabilities when dual-stack clients attempt to access IPv6 traffic in environments primarily configured for IPv4.

Innovation Solution

Implementing an active DNS proxy that detects IPv6 requests and translates them to IPv4 requests, ensuring seamless connectivity and security inspection by leveraging cache or DNS servers for IPv4 addresses, thereby avoiding sinkhole failures and reducing delay.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If dual-stack clients attempt to access IPv6 traffic in an IPv4 environment, then network connectivity is established, but network connection delays and security vulnerabilities occur

Engineering Contradiction:

ImproveIPv6 connectivityVSAvoidnetwork connection delay

Core Design Contradiction:

Adaptability or versatilityVSLoss of time

Solution Approach 1:

The DNS proxy performs preliminary translation of IPv6 DNS requests to IPv4 DNS requests before the actual data transmission occurs. By detecting the IPv6 protocol type in the DNS request and preemptively converting it to IPv4, the system eliminates the need for later protocol conversion during data transfer, thus reducing connection delays and ensuring seamless connectivity to legacy IPv4 servers.

Inventive Principle:

Principle #10Preliminary action

2Adaptability or versatility

If IPv6 traffic is directed to legacy servers, then connectivity is established, but security inspection capabilities are compromised

Engineering Contradiction:

ImproveIPv6 protocol supportVSAvoidsecurity inspection

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The DNS proxy acts as an intermediary between IPv6 clients and legacy IPv4 servers. It detects IPv6 DNS requests, translates them to IPv4 requests, and returns IPv4 addresses to the clients. This intermediary translation layer ensures that security inspection can be performed on IPv4 traffic while maintaining IPv6 client connectivity, thus preserving both adaptability and security inspection capabilities.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Ease of operation

If IPv6 DNS requests are forwarded to DNS servers, then address resolution is achieved, but sinkhole failures occur when IPv6 is not supported

Engineering Contradiction:

ImproveDNS request processingVSAvoidconnection stability

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The DNS proxy performs preliminary detection of IPv6 protocol type in DNS requests and preemptively translates them to IPv4 requests before forwarding to DNS servers. This preliminary action prevents sinkhole failures by ensuring that only IPv4 addresses are resolved and returned, which are then used for reliable connections to legacy servers that do not support IPv6.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS20260067254A1Active DNS proxy

Publication Date: 2026.03.05 PALO ALTO NETWORKS INC

AI summary

At an active Domain Name System (DNS) proxy, an Internet Protocol version 6 (IPv6) DNS request from a client is received. It is determined that security inspection of Internet Protocol version 6 (IPv6) is not supported by a security service node. An Internet Protocol version 4 (IPv4) address is obtained and provided in response to the IPv6 DNS request.