Concurrent DNS Record Versioning and Signing Bypass

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The Domain Name System (DNS) is vulnerable to inefficiencies and resolution failures due to inefficiencies in DNSSEC signing techniques, particularly in large zones, leading to delays and resolution failures, and lacks optimal resource utilization and testing of registry data before publication.

Innovation Solution

A system and method for concurrently publishing current and next versions of DNS records, using a record selection module, a DNSSEC signing system, and a distribution system to bypass storage in the registry database, allowing for simultaneous generation and testing of DNS data without interrupting current operations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If DNSSEC signing is implemented for large zones, then security and data integrity are improved, but processing time and resolution delays increase

Engineering Contradiction:

ImproveDNS data integrityVSAvoidDNS resolution time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The DNS zone is divided into multiple sub-zones or chunks that can be signed and processed independently. This segmentation allows parallel processing of signing operations across different parts of the zone, reducing overall processing time while maintaining security for the entire zone.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

DNS records are pre-signed and validated before being published to the DNS system. This preliminary action ensures that signing is completed in advance, so that when DNS resolution occurs, the signed data is already ready and can be verified quickly without adding resolution delays.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If DNSSEC signing is performed for all DNS records, then security coverage is improved, but computational resources and processing overhead increase

Engineering Contradiction:

ImproveDNS security coverageVSAvoidComputational resources

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

DNSSEC signing is applied selectively to specific DNS record types or critical sub-zones rather than uniformly to all records. This local quality approach focuses computational resources on the most security-sensitive parts of the DNS system while reducing overall processing overhead.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

Instead of signing every single DNS record, the system signs a representative subset or uses selective signing based on record importance. This partial action provides adequate security coverage for critical functions while significantly reducing computational resource consumption.

Inventive Principle:

Principle #16Partial or excessive action

3Reliability

If registry data is tested and validated before publication, then DNS resolution reliability is improved, but processing time and operational complexity increase

Engineering Contradiction:

ImproveDNS resolution success rateVSAvoidPublication process complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

Validation and testing of DNS records are performed in advance during the publication process, before the records become active in the DNS system. This preliminary validation ensures that only correct and secure records are published, improving resolution reliability without adding complexity to the resolution process itself.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

An intermediary validation system or layer is introduced between data entry and DNS publication. This intermediary automatically checks and validates records using standardized criteria, improving reliability while keeping the complexity contained within the validation layer rather than propagating it throughout the entire system.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Productivity

If concurrent generation of current and next DNS versions is implemented, then productivity is improved, but system complexity and coordination requirements increase

Engineering Contradiction:

ImproveDNS data generation speedVSAvoidVersion coordination complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The DNS data generation process is segmented into independent parallel streams for current and next versions. Each stream can be generated and validated independently, allowing concurrent processing that improves productivity while the segmentation itself manages the complexity by creating clear boundaries between version streams.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS11405353B2System and method for generating concurrently live and test versions of DNS data

Publication Date: 2022.08.02 IDENTITY DIGITAL LTD

AI summary

A system for concurrently facilitating publishing a current version of a plurality of Domain Name System (DNS) records for a domain name and storing a next version of the plurality of DNS records for the domain name, the system comprising a record selection module for obtaining selected data of registry data associated with the domain name stored in a registry database; a DNS Security (DNSSEC) signing system having at least one signing module for digitally signing the selected data of the registry data; a distribution system for coordinating concurrent generation of the current version and the next version; and the distribution system and signing system cooperating to, in part, generate the current version according to a first set of generation instructions and transmit the current version to one or more authoritative servers of the DNS in a first transmission path that bypasses storing the current version in the registry database.