DNS URI Blocking With Path-Level Access Control

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing DNS-based blocking mechanisms only check domain names, leading to the blocking of all content on a device if a domain name is blocked, even when valid content is accessible.

Innovation Solution

Implement a domain name resolution system with an extended blocking mechanism that processes domain names and paths of objects, allowing selective blocking of access to specific content while keeping other valid content accessible.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Object-affected harmful factors

If a DNS-based blocking mechanism checks only domain names, then it can block malicious content effectively, but it also blocks all valid content on the same device

Engineering Contradiction:

Improveblocking malicious contentVSAvoidselective blocking capability

Core Design Contradiction:

Object-affected harmful factorsVSAdaptability or versatility

Solution Approach 1:

The patent segments the domain name into two parts: the domain name itself and the path component. By checking both elements against blocking lists, the system can selectively block only specific paths (e.g., /malicious/file.exe) while allowing other paths on the same domain to remain accessible. This resolves the contradiction by enabling fine-grained control over what content is blocked.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent applies different blocking rules to different parts of the URI. Instead of treating the entire domain name as a single blocking unit, it allows the path component to have independent blocking status. This enables local quality control where only specific resources on a domain are blocked while others remain accessible, balancing security with content availability.

Inventive Principle:

Principle #3Local quality

2Reliability

If a domain name is blocked to prevent malware access, then security is improved, but all content on that domain becomes inaccessible including valid content

Engineering Contradiction:

Improvesecurity against malwareVSAvoidaccess to valid content

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

By separating domain name checking from path checking, the system can apply security blocks at the path level rather than the entire domain level. This allows valid content on the same domain to remain accessible while blocking only the malicious paths, thus maintaining both security and content accessibility.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Instead of applying a complete domain block (excessive action), the patent applies blocking only to specific paths within the domain (partial action). This ensures that security measures are applied precisely where needed without over-blocking valid content, maintaining ease of operation for legitimate resources.

Inventive Principle:

Principle #16Partial or excessive action

3Measurement precision

If the blocking mechanism checks both domain name and path, then selective blocking precision is improved, but the complexity of the blocking mechanism increases

Engineering Contradiction:

Improveblocking precisionVSAvoidblocking mechanism complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent extends the existing DNS blocking mechanism to handle both domain names and paths using the same resolution process. The DNS server continues to resolve domain names to IP addresses, while path blocking is implemented by checking the path component against blocking lists before or during the resolution process. This multi-functional approach achieves high precision without proportionally increasing complexity.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The patent introduces a path checking mechanism that acts as an intermediary between the DNS query and the actual content access. The path is checked against blocking lists, and if blocked, an NXDOMAIN response is returned. This intermediary layer adds precision to blocking while keeping the overall system architecture familiar and manageable.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentEP4672671A1A method and a communication system for blocking access to a uniform resource identifier using a domain name resolution system

Publication Date: 2025.12.31 DEUTSCHE TELEKOM AG

Figure 1

AI summary

The present invention relates to a method and a communication system that implement a domain name resolution system using an extended blocking mechanism to block access to a URI queried by a user's computing device (20). The user's computing device (20) is configured to generate by executing an application program a domain name resolution query message including a domain name of a destination device and a path of an object stored on the destination device and to transmit it to a respective domain name resolution server device (40) on which the extended blocking mechanism is implemented. The domain name resolution server device (40) is configured to processes the domain name resolution query message by checking whether the domain name of a destination device or the path of an object stored on the destination device is blocked.