Caching Resolver DNS Query ACL Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer network systems process access control lists (ACLs) without querying DNS, leading to potential denial or grant of access to resources due to outdated IP address bindings in cloud environments, where host-to-IP address mappings change frequently, causing inconsistencies in access control.
Innovation Solution
Implementing DNS queries to dynamically update ACLs by having a caching resolver receive name server queries for hostnames and adding the received IP addresses to the ACL, ensuring real-time access control for cloud-based resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If hostnames are translated to IP addresses at configuration or boot time, then access control lists can be processed at line rate without queries, but the IP address bindings become outdated when cloud services migrate or change load balancing schemes
Solution Approach 1:
The patent transforms the static hostname-to-IP translation performed at configuration time into a dynamic process by integrating DNS query functionality directly into the ACL processing path. When a packet with a hostname in the ACL arrives, the system dynamically queries the DNS server to obtain the current IP address binding, ensuring the ACL always uses up-to-date information while maintaining line-rate processing through optimized query handling and caching mechanisms.
Solution Approach 2:
The system establishes a feedback loop where DNS query results are continuously fed back into the ACL processing mechanism. The DNS server responds to queries about current hostname bindings, and this feedback information is used to update the ACL entries in real-time, ensuring that access control decisions are based on current IP address assignments rather than stale configuration data.
2Adaptability or versatility
If different IP addresses are returned for the same hostname from DNS queries, then load balancing and service migration are supported, but inconsistencies arise where some devices learn correct addresses while others are denied access inappropriately
Solution Approach 1:
The patent introduces an intermediary mechanism in the form of a DNS query processing system that mediates between the ACL policy enforcement and the DNS server. This intermediary captures DNS queries for hostnames in the ACL, receives the current IP address bindings from the DNS server, and ensures consistent distribution of this information to all relevant network devices. This intermediary layer resolves inconsistencies by providing a single source of truth for hostname-to-IP mappings across the network.
3Reliability
If DNS queries are integrated into ACL processing, then real-time access control is achieved, but packet processing delay increases
Solution Approach 1:
The patent implements preliminary action by performing DNS queries in advance for hostnames that appear in ACLs, rather than waiting for packets to trigger the queries. The system proactively queries the DNS server for current IP address bindings and caches these results, so when packets arrive, the ACL processing can use the pre-fetched information without introducing delay. This preliminary action eliminates the need for real-time queries during packet processing.
Solution Approach 2:
The system creates and maintains copies of DNS query results and ACL data in local caches on network devices. Instead of every device performing DNS queries or accessing the DNS server directly, each device maintains local copies of the hostname-to-IP mappings, allowing fast local ACL processing without network delays. These copies are periodically updated through efficient DNS query mechanisms, balancing freshness of data with processing speed.
Data Source
AI summary
In one embodiment, a caching resolver receives a name server query from an end device for an Internet Protocol (IP) address for a hostname, and determines whether the hostname requested is in an access control list (ACL). In response to the hostname being in the ACL, the caching resolver examines a received response to the name server query for the hostname, wherein the received response contains a particular IP address for the hostname, and adds the particular IP address for the hostname to the ACL. In one embodiment, the ACL is local to the caching resolver, while in another embodiment, adding the particular IP address for the hostname to the ACL comprises sending a message to a remote ACL-maintaining device that maintains the ACL.