DNS-Based Network Location Detection for Secure Configuration

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for determining a device's location within a network, such as pinging a known address or checking DNS resolvability, are inefficient as they require waiting for request timeouts, leading to delays and potential inaccuracies in network configuration application.

Innovation Solution

Using DNS queries to differentiate between internal and external network locations by examining the addresses returned in response to a location-determination domain name query, allowing for immediate and accurate determination of network configuration without waiting for timeouts.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If ping or DNS timeout-based methods are used to determine device location, then the device can detect network location, but the process experiences delays and potential inaccuracies due to waiting for timeouts

Engineering Contradiction:

Improveaccuracy of network location determinationVSAvoiddelay in determining network location

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary configuration by setting up multiple DNS servers with different response behaviors before the actual location determination is needed. Internal DNS servers are pre-configured to respond to specific domain names with internal IP addresses, while external DNS servers would respond with external addresses. This preliminary setup eliminates the need for timeout-based detection during actual operation.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces DNS servers as intermediaries between the device and the network location determination process. Instead of directly pinging addresses or waiting for timeouts, the device queries DNS servers which mediate the location determination by returning different IP addresses based on whether they are internal or external servers. This intermediary approach provides immediate, accurate location determination without timeouts.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If timeout-based detection methods are used, then the device can determine network location, but performance is reduced due to waiting for request timeouts

Engineering Contradiction:

Improvenetwork location detection capabilityVSAvoidspeed of network configuration application

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system pre-configures DNS servers with specific domain name mappings before location determination is needed. Internal DNS servers are预先 configured to return internal IP addresses for specific domains, enabling immediate location determination when queries are made, thus improving productivity without sacrificing detection capability.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The DNS servers automatically provide location determination information through their normal DNS resolution function. Instead of requiring separate timeout-based detection mechanisms, the DNS servers themselves serve the dual purpose of domain resolution and location determination by returning different addresses based on their internal/external status, eliminating performance delays.

Inventive Principle:

Principle #25Self-service

3Reliability

If traditional location determination methods are used, then the device can identify network position, but misclassifications occur due to request timeouts

Engineering Contradiction:

Improvenetwork position identificationVSAvoidaccuracy of network configuration classification

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

DNS servers act as intermediaries that provide definitive location information through their response content rather than through timeout absence. The internal DNS servers explicitly return internal IP addresses in their DNS responses, providing precise classification without the ambiguity of timeout-based detection, thereby eliminating misclassifications.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces the mechanical timeout-based detection mechanism with a DNS response-based mechanism. Instead of determining location by the absence of a response (timeout), the system uses the presence and content of DNS responses to determine location, substituting a positive confirmation mechanism for a negative inference mechanism, thereby eliminating misclassifications.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS8990425B1Determining device location based on domain name response

Publication Date: 2015.03.24 IBOSS INC

AI summary

Methods and systems for managing encrypted network traffic using spoofed addresses. One example method includes sending a domain name resolution query including a domain name; receiving a domain name resolution response including a network address; determining a current network location of the computing device based on the received domain name resolution response; and applying to the computing device either an internal network configuration or an external network configuration depending on the determined current network location of the computing device.