DNS Preload Caching for Secure Query Latency Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DNS protocols, including secure DNS protocols like DNSSEC, hinder caching techniques due to the need for authentic record verification, leading to increased latency and reduced efficiency in resolving DNS queries.
Innovation Solution
Implementing a DNS preload client at the customer premise equipment (CPE) that analyzes DNS queries and generates a preload list based on IP address parameters and network activity, allowing for pre-submission of DNS queries at scheduled times to populate the CPE's DNS cache, thereby optimizing DNS resolution without continuous server communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS responses are digitally signed using DNSSEC to ensure authenticity, then security is improved, but caching efficiency deteriorates because records cannot be modified for optimization
Solution Approach 1:
The system performs DNS queries in advance of when they are needed, populating a cache with DNS records before actual user requests occur. This preliminary action allows the cache to be pre-filled with authentic records from DNSSEC-signed responses, so that when users make requests, the answers are already available locally without requiring real-time verification or server communication.
Solution Approach 2:
The system separates the DNS resolution process into two distinct phases: an offline phase where DNSSEC-signed records are obtained and cached in advance, and an online phase where pre-cached records are served immediately to users. This segmentation allows the computationally intensive verification and caching operations to occur separately from the user-facing query resolution, improving overall efficiency.
2Reliability
If DNS queries are resolved in real-time from servers, then authenticity is ensured, but latency increases due to transmission delays
Solution Approach 1:
The system performs DNS queries in advance of when they are needed, populating a cache with DNS records before actual user requests occur. This preliminary action eliminates the need for real-time server communication during user queries, thereby removing transmission delays while preserving authenticity through pre-verification of DNSSEC records.
Solution Approach 2:
The system creates local copies of authentic DNS records obtained from remote servers and stores them in a local cache. These copies are made after verification of authenticity, allowing subsequent queries to be resolved using the local copies without requiring ongoing communication with remote servers, thus eliminating latency while maintaining reliability.
3Loss of time
If caching clients store copies of IP addresses locally, then latency is reduced, but security vulnerabilities increase due to potential interception and false address supply
Solution Approach 1:
The system introduces DNSSEC cryptographic signatures as an intermediary verification mechanism between the DNS server and the caching client. These signatures act as a trusted mediator that proves the authenticity of DNS records without requiring continuous server communication. The caching client verifies these cryptographic proofs locally, ensuring that cached records are genuine and have not been intercepted or spoofed.
Solution Approach 2:
The system performs verification of DNS record authenticity in advance before storing records in the cache. By verifying DNSSEC signatures beforehand, the system ensures that only authenticated records are cached, eliminating the security vulnerability of caching potentially spoofed records while still maintaining the latency benefits of local caching.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and method for improving network performance of DNS queries. The system includes a terminal which receives DNS queries from a customer premise equipment (CPE), and supplies matching DNS records in response to the queries. The terminal monitors all traffic from the CPE and generates a preload list containing domains and a time schedule at which name resolution should be requested for the domains. A DNS preload client in the CPE receives the preload list from the terminal, and submits preload DNS queries for name resolution of domains contained in the preload list at times specified in the time schedule. Preload records supplied in response to the preload DNS queries are stored by the CPE and used to resolve DNS queries from applications installed on the CPE.