DNS Server Quarantine Mode Using Cached Responses
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DNS server quarantine methods lead to service disruptions and resource inefficiencies due to prolonged blocking of requests from computing devices that exceed traffic thresholds, causing data loss and impacting service continuity.
Innovation Solution
Implementing a method where the DNS server analyzes requests based on predefined rules to trigger a quarantine mode, providing restricted services by using cached responses and avoiding recursive searches, thereby minimizing data loss and ensuring service continuity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the DNS server blocks requests from computing devices that exceed traffic thresholds, then the DNS server protects itself from traffic overload, but the service continuity is disrupted and data loss occurs
Solution Approach 1:
The patent segments the quarantine mechanism into two distinct modes: complete blocking mode and restricted service mode. This segmentation allows the system to differentiate between fully malicious traffic and potentially legitimate traffic that exceeds thresholds, enabling partial service continuity while still protecting the DNS server from overload.
Solution Approach 2:
The patent implements dynamic quarantine modes that can transition between complete blocking and restricted service based on traffic analysis. The system dynamically adjusts the level of service provided to quarantined IP addresses, allowing flexible response to varying traffic conditions and enabling service continuity when appropriate.
2Measurement precision
If the DNS server performs recursive searches for quarantined IP addresses, then accurate IP resolution is achieved, but processing time and resource consumption increase
Solution Approach 1:
The patent performs preliminary actions by checking the quarantine status of IP addresses before initiating recursive searches. The DNS server analyzes traffic patterns and determines quarantine status in advance, preventing unnecessary recursive searches for IPs that should be blocked, thus reducing processing time while maintaining resolution accuracy for non-quarantined addresses.
Solution Approach 2:
The patent applies partial action by performing restricted service mode for some quarantined IP addresses, where the DNS server provides limited resolution services without performing full recursive searches. This partial action reduces processing time and resource consumption while still providing some level of service continuity for potentially legitimate traffic.
3Productivity
If the DNS server provides restricted services to quarantined IP addresses using cached responses, then service continuity is maintained, but data loss may occur due to using potentially outdated information
Solution Approach 1:
The patent implements beforehand cushioning by maintaining cached DNS responses that can be provided to quarantined IP addresses during restricted service mode. These pre-cached responses serve as a buffer that allows service continuity even when real-time resolution is blocked, cushioning against the potential data loss from not performing fresh lookups.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Method(s) and System(s) for quarantining an IP address of a computing device are described. The described system(s) may implement method(s) that include receiving a DNS request from the computing device and analyzing the request based on a pre-defined set of rules. Thereafter, the IP address of the computing device may be quarantined and a quarantine mode may be triggered for the IP address based on the analysis. In the quarantine mode, restricted DNS services may be provided to the computing device. Further the method includes providing a DNS response corresponding to the request to the computing device if the response is available in a DNS cache. The response available in the cache can either be an expired response or an unexpired response based on a Time to Live (TTL) of the response. If the response is not available in the cache, then the method includes abstaining from providing the response corresponding to the request. The abstaining may include not performing a recursive DNS search for accessing the response corresponding to the request.