DNS Filtering in Oblivious Deployments via Policy Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In oblivious domain name systems, applying per-user policies, such as parental control and threat prevention, is challenging due to the divided protocol between client identity and requests, making it difficult for network providers to implement customized services without compromising client privacy.
Innovation Solution
A network traffic management system that receives a DNS request from a client, sends the request to a policy server to retrieve a filter ID, and then sends the request with the filter ID to an oblivious server to generate a subscriber content filtering policy configuration, allowing for filtered content to be returned to the client without compromising privacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an oblivious proxy is used to prevent a single element from knowing both client identity and requests, then client privacy is improved, but the ability to apply per-user policies is worsened
Solution Approach 1:
The system segments the protocol into two distinct parts: an oblivious proxy component that handles privacy by not revealing client identity, and a policy enforcement component that retrieves and applies per-user policies. This segmentation allows both privacy protection and personalized service to coexist by distributing functionality across different system elements.
Solution Approach 2:
The patent introduces an intermediary mechanism (policy retrieval system) that bridges the gap between the oblivious proxy and per-user policy requirements. This intermediary can retrieve policies based on anonymized identifiers without compromising client privacy, enabling personalized services while maintaining the privacy guarantees of the oblivious proxy architecture.
2Adaptability or versatility
If customized services like parental control and threat prevention are implemented, then service quality is improved, but the complexity of the system is worsened
Solution Approach 1:
The patent implements a universal policy retrieval mechanism that can handle multiple types of customized services (parental control, threat prevention, content filtering) through a single unified system. This multi-functional approach allows diverse services to be delivered without proportionally increasing system complexity, as the same infrastructure supports multiple service types.
Solution Approach 2:
The system performs preliminary actions by retrieving and caching user policies in advance before actual content filtering is needed. This allows personalized services to be applied efficiently without real-time complexity, as policies are prepared beforehand and can be quickly applied when traffic needs filtering.
Data Source
AI summary
Methods, non-transitory computer readable media, network traffic manager apparatuses, and systems that assist with filtering content includes receiving a domain name system request from a client. Then, sending an address from the domain name system request to a policy server. The policy server can retrieve a filter id associated with the client. The method then includes sending the domain name system request with the filter id to an oblivious server. After, the method includes receiving a response with filtered content based on the domain name system request with the filter id from the oblivious server. The oblivious server can then generate a subscriber content filtering policy configuration based on the filter id and generate the response with the filtered content based on the subscriber content filtering policy configuration. Lastly, the methods includes sending the response to the domain name system request with filtered content to the client.