Authoritative DNS IP Rotation for Distributed DoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Denial-of-Service (DoS) attacks on the Internet are difficult to detect and mitigate, particularly in distributed forms, as they overwhelm targeted websites with large amounts of traffic, compromising client devices and disrupting legitimate communication.
Innovation Solution
A cloud-based proxy service that provides DoS detection and mitigation without requiring additional hardware or software installation, utilizing proxy servers to analyze network traffic, scatter domains under attack, and employ mitigation strategies like rate limiting and anycast protocols to distribute attack surfaces.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single IP address is used for a domain, then DNS configuration is simple, but the domain becomes vulnerable to DoS attacks
Solution Approach 1:
The patent segments the domain's IP address representation by introducing multiple canonical names (CNAMEs) that point to different alias records, each resolving to the same actual IP address. This creates a hierarchical segmentation: domain → multiple canonical names → multiple alias records → single IP address, thereby distributing the attack surface while maintaining configuration manageability through centralized DNS control.
Solution Approach 2:
The patent introduces intermediary DNS record types (canonical names and alias records) between the domain and the actual IP address. These intermediaries act as mediators that can be manipulated independently of the actual IP address, allowing the domain to present different IP addresses to different clients or to rotate through multiple IP addresses, thus mitigating DoS attacks without requiring changes to the actual server configuration.
2Reliability
If multiple IP addresses are used for a domain, then DoS attack resistance improves, but DNS management complexity increases
Solution Approach 1:
The patent creates universal DNS record structures (canonical names and alias records) that can serve multiple functions: they can all resolve to the same IP address for normal operation, can be selectively modified for load balancing, can be rotated for DoS mitigation, and can be used for geographic routing. This multi-functionality allows a single DNS configuration framework to handle various scenarios without requiring separate management systems.
Solution Approach 2:
The patent introduces dynamicity into DNS management by allowing alias records to be easily created, modified, or deleted without affecting the canonical name structure. This enables dynamic response to DoS attacks where IP addresses can be rapidly rotated or redistributed among multiple alias records, while the overall DNS management structure remains consistent and manageable through standardized record types.
Data Source
AI summary
An authoritative domain name system (DNS) server receives DNS requests for domains. The authoritative DNS server transmits DNS responses to the DNS requests with address records that include IP addresses that are selected from a larger pool of IP addresses, where a first DNS response can include IP addresses different from IP addresses included in a second DNS response for the same domain. Also, the same IP addresses may be returned for a first domain and a different, second domain. The authoritative DNS server may select the IP addresses to include in DNS responses to the DNS requests using a round-robin process.