DNS Query Rewriting for Alternative Network Path Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network technologies face limitations in efficiently routing network traffic, particularly in software-defined networks, leading to suboptimal performance and resource utilization when accessing third-party resources outside the internal network domain.
Innovation Solution
Implementing a software-defined network with a control device that manages the control plane to optimize routing decisions, allowing for rerouting of traffic flows through alternative paths with superior performance and using DNS server rewriting to maintain expected DNS responses, while addressing issues with Network Address Translation (NAT) exit points.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If traffic is routed through the default path via core location (data center), then network security and control are maintained, but network performance and response times deteriorate due to increased distance and internal traffic volume
Solution Approach 1:
The patent segments the network routing into two distinct paths: a default path through the core location for security-critical traffic, and an alternative direct path for performance-critical traffic. This segmentation allows different traffic types to be handled differently, improving overall network performance while maintaining security controls where needed.
Solution Approach 2:
The patent introduces a network address translation (NAT) exit point as an intermediary that enables direct routing to third-party resources without passing through the core data center. This intermediary allows performance optimization while maintaining security by acting as a controlled gateway point.
2Productivity
If alternative paths are used to access third-party resources directly, then network performance improves, but DNS response consistency and security control worsen
Solution Approach 1:
The patent implements DNS server rewriting that creates a copy of the internal DNS server's functionality at the NAT exit point. This allows DNS queries to be resolved consistently whether they travel through the default path or alternative paths, maintaining response consistency while enabling performance optimization.
Solution Approach 2:
The patent changes the destination IP address parameter of DNS queries from the internal DNS server address to the NAT exit point's DNS server address. This parameter change enables queries to be routed through alternative paths while maintaining consistent DNS responses through the rewritten server address.
3Reliability
If all traffic is routed through the core data center, then security control is simplified, but network resource utilization and performance efficiency deteriorate
Solution Approach 1:
The patent applies local quality by providing different routing treatments to different traffic flows based on their destination and requirements. Critical security traffic maintains the secure path through the data center, while routine third-party resource access uses efficient direct paths, optimizing both security and resource utilization locally for each traffic type.
Solution Approach 2:
The patent implements dynamic routing where the system can adaptively select between default and alternative paths based on traffic characteristics, destination, and network conditions. This dynamic approach allows the network to optimize resource utilization while maintaining security controls, rather than using a static all-through-core approach.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method may include receiving a domain name system (DNS) query at a network device, where the DNS query may be associated with a traffic flow identified for rerouting through an alternative path utilizing an alternative network device instead of a default path. The method may also include rewriting the DNS query such that the DNS query is routed through the alternative network device along the alternative path and to a DNS server associated with the alternative path. The method may additionally include receiving a DNS response from the DNS server, where a resource identified in the DNS response may be based on the DNS query coming through the alternative network device.