Delegation Chain Construction for Secure Domain Name Resolution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication architectures face challenges in securely delegating content delivery from a second domain to a first domain without sharing private keys, leading to security and reliability issues, especially in CDN architectures where multiple domains may not have agreements with the origin server, and lack a priori control over data access service reliability.
Innovation Solution
A method involving a redirection process where a resolution server constructs a delegation chain through recursive redirections between multiple domains, adding redirection information at each step, and includes a validation or invalidation mechanism to ensure the chain's authenticity and compliance with security policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a CDN server delivers content from a different domain than the originally requested domain, then data access speed and reliability are improved, but security and trust issues arise because the terminal cannot verify the legitimacy of the content source
Solution Approach 1:
The patent introduces a delegation chain as an intermediary mechanism between the terminal and the CDN server. This chain includes delegation information that mediates the trust relationship, allowing the terminal to verify the legitimacy of content delivery without requiring direct trust between the terminal and the CDN server. The delegation chain acts as a mediator that establishes secure communication across different domains.
Solution Approach 2:
The patent implements preliminary verification by requiring the terminal to check the delegation chain before establishing communication with the CDN server. The terminal verifies the delegation information in advance to ensure the CDN server is authorized to deliver content for the requested domain. This preliminary action prevents security issues by validating trust relationships before content delivery begins.
2Ease of operation
If private keys are shared between domains to enable content delivery, then authentication is simplified, but confidentiality and security problems occur
Solution Approach 1:
The patent segments the authentication mechanism by introducing domain-specific private keys for each domain in the delegation chain. Instead of sharing a single private key across domains, each domain maintains its own key pair. This segmentation allows authentication to work across multiple domains while maintaining security, as each domain's private key remains confidential and is not shared with other domains.
Solution Approach 2:
The delegation chain serves as an intermediary that enables authentication without direct key sharing. Each domain in the chain uses its own private key to sign delegation information, creating a chain of trust. This intermediary mechanism allows the terminal to verify authenticity through the delegation chain without requiring private keys to be shared between domains, thus maintaining both ease of operation and security.
3Loss of energy
If multiple domains are involved in content delivery without agreements with the origin server, then network bandwidth consumption is reduced, but control over data access service reliability is lost
Solution Approach 1:
The patent implements feedback mechanisms where each domain in the delegation chain provides delegation information that can be verified by the terminal. This feedback loop allows the terminal to verify the legitimacy of each domain's involvement in content delivery. The delegation chain includes verification information that feeds back to the terminal, enabling it to control and monitor the reliability of data access across multiple domains.
Solution Approach 2:
The patent performs preliminary verification of domain legitimacy through the delegation chain before content delivery begins. The terminal checks the delegation information in advance to ensure each domain in the chain is authorized to participate in content delivery. This preliminary action maintains control over reliability while allowing multiple domains to be involved in reducing bandwidth consumption.
4Adaptability or versatility
If a delegation chain with multiple redirections is constructed, then dynamic and flexible content delivery is achieved, but the complexity of the resolution process increases
Solution Approach 1:
The patent segments the resolution process into manageable steps by breaking down the delegation chain into individual redirection segments. Each segment represents a domain-level delegation that can be processed independently. This segmentation allows the resolution server to handle complex multi-domain delegations by processing them as a sequence of simpler, manageable units, reducing the overall complexity while maintaining flexibility.
Solution Approach 2:
The patent implements dynamic delegation chains that can adapt to different content delivery scenarios. The resolution process dynamically constructs the delegation chain based on the specific content and domain relationships involved. This dynamic approach allows the system to handle various delivery configurations flexibly while managing complexity through automated chain construction and verification processes.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a redirection device and method, relating to the identification of a data server (22) capable of delivering content to a terminal (100), initiated by the transfer to a second name server (41) of a second domain (40) of a message for obtaining an identifier of the data server in the second domain (40) received from the terminal (100). Following this transfer, the second name server (41) sends a redirection message to a first domain (40), including a delegation chain comprising first data for redirection from the second domain (40) to the first domain (30). The chain is updated recursively with the redirections between domains (40, 30, 20) added by respective name servers (41, 31, 21) until a name server (21) is able to provide an identifier of the data server (22).