DNS Routing Voucher for IP Network Packet Admission
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Public IP networks lack mechanisms to prevent unwanted data packets from illicit or corrupt end-users from being routed to receivers, leading to issues like flooding, spamming, and Denial-of-service threats, as existing security solutions are insufficient and primarily focused on last-line defenses.
Innovation Solution
Implementing a packet admission policy in the DNS system that generates a routing voucher, which must be included in data packets to ensure only authorized end-hosts can route data to specific end-hosts, with the voucher being distributed and verified across IP routers to control packet routing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If public IP networks allow free routing of data packets to any end-host, then network accessibility and ease of operation are improved, but security against unwanted traffic and Denial-of-service threats deteriorates
Solution Approach 1:
The patent implements preliminary action by requiring end-hosts to register with DNS servers and obtain routing vouchers before being able to receive data packets. The DNS server pre-approves end-hosts by storing their identifiers and generating routing vouchers that routers will verify. This preliminary registration and approval process prevents unwanted traffic before it reaches the network, as routers can discard packets from unregistered sources without needing complex inspection rules.
Solution Approach 2:
The patent introduces DNS servers as intermediaries between end-hosts and routers. The DNS server acts as a trusted mediator that verifies end-host identities, stores approved identifiers, and generates routing vouchers. Routers trust the DNS server's approvals and simply verify the presence of valid routing vouchers in packets, delegating the complex security decision-making to the intermediary DNS system rather than requiring each router to independently evaluate packet sources.
2Reliability
If routing vouchers are required in all data packets for verification, then network security is improved, but device complexity and processing overhead increases
Solution Approach 1:
The patent extracts the complex security verification function from routers and places it in the DNS server. Routers only need to perform the simple task of checking whether a routing voucher is present in the packet header, rather than verifying end-host identities or evaluating security policies. The DNS server handles the complex tasks of identity verification, voucher generation, and maintaining approval records, thereby simplifying router operations while maintaining security.
Solution Approach 2:
The patent uses copying by having the DNS server store copies of approved end-host identifiers and generate routing vouchers that contain or reference these identifiers. Routers verify packets by checking for the presence of these copied identifiers in the routing vouchers, rather than maintaining their own copies of end-host authorization lists. This copying approach allows routers to perform simple presence checks without needing access to the DNS server or complex verification logic.
3Reliability
If DNS servers store and manage routing vouchers for multiple end-hosts, then packet admission control is improved, but information storage and system complexity increases
Solution Approach 1:
The patent implements local quality by having the DNS server store only the specific information needed for routing verification - namely, approved end-host identifiers and their associated routing vouchers - rather than maintaining complete end-host profiles or communication histories. Each DNS server manages only the local information relevant to its authorized end-hosts, keeping storage requirements proportional to the number of registered end-hosts rather than requiring global network state information.
Data Source
AI summary
Method and apparatus for controlling the routing of data packets in an IP network (200). A DNS system (202) stores a packet admission policy configured for a first end-host (B) that dictates conditions for allowing other end-hosts to get across data packets to the first end-host or not. A routing voucher is defined which is required for routing data packets to the first end-host. The routing voucher is distributed to routers (R) in the IP network. When an address query is received at the DNS system (202) from a second end-host, the voucher is supplied to the second end-host if the configured policy allows the second end-host to convey data packets. Otherwise, the voucher is not supplied. If allowed, the second end-host will add the routing voucher to any data packets directed to the first end-host. When a valid routing voucher is present in a packet at a router (204) in the network, the packet will be forwarded to the next router in the IP network. The router will otherwise discard the packet.