DNS Name Resolution via Hash-Based Routing Policy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Domain Name System (DNS) faces challenges in managing large numbers of domain names, leading to scaling and security risks, where a single collection of name records can become a failure point and expose the network to malicious actors due to its large size and centralized nature.
Innovation Solution
Implementing a routing policy that uses hashing to distribute name records across multiple collections in a tree-like structure, where a hash value generated from the domain name identifies the appropriate collection for name resolution, thereby reducing the impact of failures and securing the network by obscuring information about the network architecture.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If name records are centralized in a single collection for DNS resolution, then name resolution functionality is simplified, but the system becomes vulnerable to failures and security risks due to its large size and centralized nature
Solution Approach 1:
The patent divides the single large collection of name records into multiple smaller collections organized in a tree-like structure. Each collection contains a subset of name records, and the system uses hashing functions to determine which collection to query for a given domain name. This segmentation reduces the impact of failures in any single collection and distributes the security risk across multiple isolated collections.
2Reliability
If name records are distributed across multiple collections using hashing, then system reliability and security are improved, but the complexity of the DNS system increases
Solution Approach 1:
The patent introduces a routing policy as an intermediary layer between the DNS resolver and the name record collections. The routing policy contains hashing functions that take domain names as input and output the appropriate collection identifier. This intermediary simplifies the complexity by providing a systematic, automated method for routing queries to the correct collection, eliminating the need for complex manual routing logic.
3Object-affected harmful factors
If a single large collection of name records is used, then information about network architecture is more exposed, but distributing collections obscures this information improving security
Solution Approach 1:
The patent segments the name record collection into multiple isolated collections arranged in a tree-like structure, where each collection contains only a subset of name records relevant to specific domain name patterns. This segmentation obscures the overall network architecture by preventing attackers from analyzing a single large collection to infer the complete network structure, as they would need to query multiple collections to gather comprehensive information.
Data Source
AI summary
Hashing name resolution requests may be performed according to an identified routing policy. A query from a Domain Name System (DNS) resolver to lookup a name in a first collection of name records may be received. A hash function may be applied to the name to generate a hash value according to a routing policy for the first collection of name records that determines which name record in the first collection of name records is used to answer the query. A name record in the collection of name records may be identified according to a mapping request for the name record using the hash value and a value for the name record may be returned to the DNS resolver. The value for the name record may identify a second collection of name records to query as part of determining the network address at the DNS resolver.