DNS Rebinding for Secure Cross-Domain HTTP Requests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies face limitations in enabling secure and efficient cross-domain requests in computer networks, particularly due to the same origin policy enforced by internet browsers, which restricts code execution and data access across different domains.
Innovation Solution
A method and system that allow a user agent device to initiate a safe cross-domain request by binding a first domain name to an IP address of a second domain name through a DNS address cache, enabling routing of HTTP requests to a computer at the second domain name without requiring specific CORS headers, and managing IP addresses to ensure reliability and scalability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If CORS headers and same origin policy are enforced to ensure security, then security is improved, but cross-domain request capability deteriorates
Solution Approach 1:
The patent introduces a domain name server as an intermediary that performs DNS rebinding. The server resolves a first domain name to an IP address belonging to a second domain name, allowing the user agent to issue requests to the first domain name while they are routed to the second domain name's computer. This intermediary mechanism bypasses the same origin policy restrictions while maintaining security through controlled DNS resolution rather than direct cross-domain access.
2Adaptability or versatility
If DNS rebinding is used to enable cross-domain requests, then cross-domain request capability is improved, but system complexity deteriorates
Solution Approach 1:
The patent implements a self-service mechanism where the domain name server automatically performs the DNS rebinding operation in response to an initialization request. The server designates a class of domain names to be resolved to an IP address belonging to the second domain name and establishes the binding in the DNS address cache without requiring complex client-side configuration or manual intervention. This automation reduces system complexity while enabling cross-domain requests.
3Reliability
If multiple IP addresses are managed in DNS cache for reliability, then reliability is improved, but management complexity deteriorates
Solution Approach 1:
The patent creates a universal binding mechanism where a single domain name can resolve to multiple IP addresses from a designated class of domain names. The domain name server evaluates multiple candidate IP addresses and binds them to the first domain_name in the DNS cache, allowing the system to universally handle requests through any of the bound addresses. This multi-functionality improves reliability through redundancy while the centralized server management keeps the binding process simple and uniform.
Data Source
AI summary
Cross-domain requests by DNS name rebinding. A domain name server at a first domain name receives an initialization request from a user agent device. The request designates a class of domain names to be resolved to an IP address belonging to a second domain name to which the user agent device seeks to issue a safe cross-domain request. That request will be directed to the first domain name, but serviced by a server belonging to the second. In a DNS cache of the user agent, the first domain name is bound to an IP address belonging to the first domain, and to an IP address belonging to the second domain name. This binding is established by providing two or more IP address resource records resolving the designation of the class of domain names, having the relevant IP addresses, and ensuring that the first domain name is pinned to the first IP address in a DNS cache of the user agent device, and that others of the IP addresses are stored in the user agent's DNS cache as alternative binding(s) to the first domain name, and then invalidating the first IP address, so that the binding falls through to an alternative one of the IP addresses.