Lock-free DNS Blacklist Updates via Page Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DNS blacklist update mechanisms require locking the response policy zone database during updates, leading to concurrent read request blocking and slowed DNS resolver response times.
Innovation Solution
Implement a lock-free updating system by designating outdated entries as 'garbage' in the response policy zone database, allowing concurrent reading and writing, and deleting them only after all reads are complete.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the RPZ database is locked during updates to maintain data integrity, then data consistency is improved, but concurrent read requests are blocked and DNS resolver response time increases
Solution Approach 1:
The RPZ database is segmented into multiple pages, allowing updates to be applied at the page level rather than locking the entire database. This enables partial access to different pages concurrently, maintaining data integrity for updated pages while allowing reads from non-updated pages to proceed without blocking.
Solution Approach 2:
The system creates a copy of the RPZ database page before applying updates. This preliminary copying action allows the update process to proceed on the copy while the original page remains accessible for reads, eliminating the need to block read requests during updates and thus reducing DNS resolver response time while maintaining data consistency.
2Reliability
If the RPZ database is locked during updates, then data integrity is maintained, but update frequency must be reduced to minimize blocking
Solution Approach 1:
By segmenting the database into pages and applying updates at the page level, the system can perform multiple smaller updates concurrently without requiring long lock periods. This increases update frequency while maintaining data integrity, as each page update is quick and other pages remain accessible.
Solution Approach 2:
The system creates copies of database pages for updates, allowing frequent updates to be applied to copies without blocking reads from the original pages. This enables high update frequency while maintaining data integrity, as the copy mechanism ensures that reads always access consistent data versions.
3Productivity
If multiple DNS resolvers access the RPZ database concurrently, then system throughput is improved, but resource contention increases and performance degrades
Solution Approach 1:
The database is divided into multiple pages that can be accessed independently by different DNS resolvers concurrently. This segmentation reduces resource contention, as resolvers can access different pages simultaneously without interfering with each other, thereby maintaining high system throughput while simplifying contention management.
Solution Approach 2:
The system introduces an intermediary page copy mechanism that mediates between writers and readers. Writers work on page copies while readers access original pages, and the intermediary versioning system coordinates access without requiring complex locking protocols. This enables concurrent access by multiple resolvers while reducing resource contention and managing complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer-implemented method updates a domain name system blacklist in a lock-free manner is disclosed. In the method, an entry of the domain name blacklist is read at a DNS resolver in a plurality of DNS resolvers. The entry specifies a policy for the DNS resolver to execute when the DNS resolver receives a request to resolve a domain name. Before the reading is complete, an updated entry of the domain name blacklist is received, a new record to the domain name blacklist is added, and the entry being read is placed into a garbage pool having a current version number. Independently from the reading of the entry, the current version number is incremented and a new garbage pool is created for the incremented version number. When the reading is complete, the current version number is assigned to the DNS resolver.