DNS Record Publishing Bypassing Registry Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The implementation of DNSSEC in large zones leads to inefficiencies in signing techniques, causing delays and resolution failures, which can significantly impact e-commerce and high-traffic sites, and suboptimal utilization of storage, connection, and computing resources in the DNS environment.
Innovation Solution
A system and method for publishing DNS records that bypasses storing signed records in the registry database by using a record selection module to obtain registry data, a DNSSEC signing system to digitally sign the data using signing keys, and a distribution system to coordinate the publishing of DNS records directly to authoritative servers, allowing for both signed and unsigned records to be generated based on signing identifiers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNSSEC signing is implemented for all DNS records in large zones, then security and data integrity are improved, but processing time increases and resolution failures occur
Solution Approach 1:
The patent segments DNS records into two categories: authenticated records (signed with DNSSEC) and unauthenticated records (unsigned). This segmentation allows the system to apply security measures only where necessary while maintaining fast resolution for records that don't require authentication, thus resolving the contradiction between security and processing speed.
Solution Approach 2:
The patent applies different quality attributes to different parts of the DNS data structure. Specifically, certain record types (e.g., A, AAAA, CNAME) are marked as requiring authentication and are signed, while other record types are left unsigned. This local differentiation allows the system to maintain high security for critical records while avoiding the performance penalty of signing all records.
2Reliability
If DNSSEC signing is applied to all records, then security is improved, but device complexity and resource utilization deteriorate
Solution Approach 1:
The patent divides the DNS record set into authenticated and unauthenticated segments, applying DNSSEC signing only to the authenticated segment. This reduces the complexity of the signing system by eliminating the need to process and sign all records, thereby maintaining security where needed while reducing overall system complexity.
Solution Approach 2:
The patent applies DNSSEC signing to only the necessary portion of DNS records rather than all records. By signing only authenticated records and leaving unauthenticated records unsigned, the system achieves adequate security coverage without the excessive complexity and resource consumption that would result from signing every record type.
3Duration of action of stationary object
If signed DNS records are stored in the registry database, then data persistence is improved, but storage efficiency and processing speed deteriorate
Solution Approach 1:
The patent extracts signed DNS records from the registry database storage path. Instead of storing signed records in the registry database, the system generates signed records on-demand and delivers them directly to DNS resolvers. This extraction eliminates the storage overhead and processing delays associated with database operations, thereby improving publishing efficiency while maintaining data persistence through direct delivery.
Solution Approach 2:
The patent introduces an intermediary mechanism (the authenticated records generator) that sits between the registry database and DNS resolvers. This intermediary generates signed records on-demand without requiring storage in the registry database, acting as a mediator that provides both persistence (through direct delivery) and efficiency (by avoiding database write operations for signed records).
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This approach enhances the efficiency of DNS record publishing, reduces delays, and optimizes resource utilization by bypassing unnecessary signing and storage processes, thereby improving the performance and reliability of DNS operations.
Implementation Method 1
a DNSSEC signing system having at least one signing module for digitally signing the selected data of the registry data, the digitally signing using one or more signing keys (SK) to generate a signed DNS record
Data Source
AI summary
A system for publishing a plurality of Domain Name System (DNS) records for a domain name, the system comprising: a record selection module for obtaining selected data of registry data associated with the domain name in a registry database; a DNS Security (DNSSEC) signing system having at least one signing module for digitally signing the selected data of the registry data, the digitally signing using one or more signing keys (SK) to generate a signed DNS record, the one or more signing keys associated with the registry data of the domain name; a distribution system for coordinating the publishing of a set of DNS records in the DNS by facilitating transmitting of the set of DNS records to one or more authoritative servers of the DNS in a transmission path that bypasses storing of the signed DNS record in the registry database, the set of DNS records generated based on a signing identifier on how to generate the set of DNS records by either: a) sending the selected data to the DNSSEC signing system for subsequent direct inclusion as the signed DNS record in the set of DNS records by the DNSSEC signing system using a set of generation instructions; or b) including the selected data as an unsigned DNS record in the set of DNS records by the distribution system using the set of generation instructions, wherein the transmission path also bypasses the at least one signing module of the DNSSEC signing system.