DNS Container Image with External Cryptographic Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current DNS infrastructure is vulnerable to DDoS attacks due to limited server capacity and lack of control over private keys for integrity protection, which can lead to unauthorized changes in DNS information.
Innovation Solution
Creating a domain name system container image with signed DNS information using cryptographic signatures outside the DNS server infrastructure, allowing for dynamic scaling of DNS container instances and integrity protection through asymmetrical encryption, ensuring that private keys remain under the domain owner's control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS servers are equipped with large computing capacities and clustered using load balancers, then availability is improved, but device complexity and infrastructure cost increase
Solution Approach 1:
The patent uses container images to create multiple identical or near-identical DNS server instances. These containers can be rapidly deployed and scaled without the complexity of traditional server clustering, as they share the underlying host infrastructure while maintaining isolated DNS services. This allows availability improvement through replication without proportionally increasing infrastructure complexity.
Solution Approach 2:
The patent dynamically adjusts the number of DNS container instances based on load conditions. During normal operation, fewer instances are maintained, but during attacks or high demand, additional instances can be rapidly spawned by pulling from container images. This dynamic parameter adjustment improves availability when needed while minimizing infrastructure complexity during normal conditions.
2Ease of operation
If traditional DNS server infrastructure is used, then ease of operation is maintained, but vulnerability to DDoS attacks increases due to limited scaling capacity
Solution Approach 1:
The patent implements dynamic scaling of DNS server capacity using containers. The system can automatically spin up additional DNS instances from container images when detecting attacks or increased load, and scale down when conditions normalize. This dynamic capability maintains ease of operation through automated responses while providing the scalability needed to resist DDoS attacks that would overwhelm traditional fixed-capacity DNS servers.
3Reliability
If cryptographic signatures are created outside the DNS server infrastructure, then integrity protection is improved, but device complexity increases
Solution Approach 1:
The patent extracts the cryptographic signature creation process from the DNS server infrastructure itself and places it in an external, secure environment. The DNS servers focus solely on serving DNS requests, while a separate system handles signature generation and validation. This separation improves integrity protection by isolating key management from the attack-prone DNS infrastructure, while the modular design keeps complexity manageable through clear separation of concerns.
Data Source
AI summary
A method is provided for storing at least one domain name system container image, wherein the domain name system container image is configured to create at least one domain name system container instance in a domain name system infrastructure. The method includes: creating at least one item of signed domain name system information, wherein the at least one item of signed domain name system information is created by a cryptographic signature of an item of domain name system information, wherein the cryptographic signature is created outside the domain name system server infrastructure; creating at least one domain name system container image, wherein the at least one domain name system container image has the signed domain name system information and at least one item of domain name system server software; and storing the at least one domain name system container image in a container registry.