DNS Alias Encryption for Secure Domain Assignment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The management of domain names across multiple regions in computing resource services is complicated by conflicts and burdens due to multiple entities desiring the same domain name, leading to issues in resource access and security.
Innovation Solution
A system utilizing a managed directory service and Domain Name System (DNS) to securely assign and reserve aliases, employing cryptographic keys and salt or initialization vectors to decrypt alias records, ensuring that high-volume customers can obtain recognizable domain names while preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If domain names are assigned to multiple entities without verification, then domain name availability increases, but security and unauthorized access risks increase
Solution Approach 1:
The patent introduces a DNS service as an intermediary between domain name requests and the actual domain name database. This intermediary verifies requests against customer identifiers and maintains authorization records, preventing unauthorized domain name assignments while ensuring legitimate entities can obtain domain names. The DNS service acts as a security gatekeeper that mediates between domain name availability and access control.
2Ease of operation
If domain name management is decentralized across regions, then service accessibility improves, but conflicts over same domain names increase
Solution Approach 1:
The patent merges decentralized regional DNS services into a unified authorization system. Each regional DNS service maintains local domain name databases, but all authorization decisions are coordinated through a central DNS service that verifies customer identifiers across regions. This combination allows regional autonomy for accessibility while central coordination prevents domain name conflicts.
Solution Approach 2:
The patent implements feedback mechanisms where DNS services across regions continuously communicate domain name assignment status and customer authorization information. When a domain name is assigned in one region, the DNS service notifies other regional DNS services to prevent duplicate assignments. This feedback loop resolves conflicts while maintaining decentralized service accessibility.
3Reliability
If cryptographic verification is implemented for all domain name requests, then security improves, but processing time increases
Solution Approach 1:
The patent performs cryptographic verification of customer identifiers in advance during domain name registration and authorization setup. Once verified, the authorization records are cached in the DNS service, eliminating the need for repeated cryptographic verification during subsequent domain name requests. This preliminary action ensures security while reducing processing time for routine operations.
Data Source
AI summary
A computing resource service receives a request from a customer to assign a domain name to a computing resource. The computing resource service may submit a query to a domain name system service to determine whether the domain name has been reserved for the customer. The domain name system service may provide an encrypted alias record corresponding to the requested domain name and specifying one or more identifiers of customers for whom the domain name has been reserved. The computing resource service may decrypt the alias record and determine whether the customer corresponds to one of the one or more identifiers within the alias record. If the customer does correspond to one of the one or more identifiers within the alias record, the computing resource service may assign the domain name to the computing resource.