DNS Resolver-Assisted Domain Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewalls struggle to create effective access policies based on domain names due to the dynamic nature of IP address mappings and the lack of direct correlation between domain names and IP addresses, leading to either overly restrictive or lenient access controls, especially when dealing with DNS caches and TTL values.
Innovation Solution
A DNS resolver-assisted approach that links a firewall device with a DNS resolver to accurately and efficiently use domain names in access policies, enabling the firewall to determine IP addresses associated with domain names and manage access policies based on this information, including subdomains and wildcard policies, without requiring additional decryption or deep packet inspection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a firewall uses IP address-based access policies, then access control can be implemented, but it becomes difficult to manage and update when IP addresses change dynamically
Solution Approach 1:
The patent introduces a DNS resolver as an intermediary between the firewall and the dynamic IP address space. The DNS resolver receives domain name queries, resolves them to current IP addresses, and provides this mapping information to the firewall. This allows the firewall to use static domain name-based policies while the DNS resolver handles the complexity of dynamic IP address translations, resolving the contradiction between adaptability and management complexity.
2Ease of operation
If a firewall implements domain name-based access control without DNS resolver assistance, then domain names can be used in policies, but the firewall cannot accurately determine current IP addresses without deep packet inspection or decryption
Solution Approach 1:
The DNS resolver acts as a mediator that performs the difficult task of IP address resolution on behalf of the firewall. Instead of the firewall attempting to extract IP addresses from encrypted traffic or perform complex DNS queries itself, the DNS resolver receives the domain name from the client, resolves it to the current IP address, and provides this information to the firewall through a trusted channel, making IP address correlation easy and accurate.
Solution Approach 2:
The system performs DNS resolution in advance before the firewall needs to make access control decisions. The DNS resolver resolves domain names to IP addresses proactively and caches this information, so when the firewall needs to evaluate a domain name-based policy, the IP address mapping is already available without requiring real-time packet inspection or decryption.
3Measurement precision
If the firewall performs deep packet inspection to correlate domain names with IP addresses, then accurate access control can be achieved, but computational complexity and processing overhead increase significantly
Solution Approach 1:
The patent extracts the computationally intensive DNS resolution function from the firewall system and places it in a dedicated DNS resolver. This separates the accuracy-critical function of IP address correlation from the performance-critical function of packet filtering. The DNS resolver handles the complex resolution process using optimized algorithms and caching, while the firewall focuses on simple policy evaluation, resolving the contradiction between measurement precision and device complexity.
Data Source
AI summary
A domain name system (DNS) resolver includes a processor and a non-transitory computer-readable media storing instructions that, when executed by the processor, causes the processor to perform operations including receiving, from a client device, a request for an internet protocol (IP) address associated with a domain name, determining the IP address associated with the domain name, sending first data defining the IP address associated with the domain name to the client device, and sending second data defining the IP address associated with the domain name to a firewall device, the second data including an identification of the client device.