DNS Request Validation to Prevent Inadvertent Subzone Creation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Large enterprises face challenges in managing complex DNS records due to cumbersome authentication processes, user errors leading to inadvertent zone creation, and vulnerability to Denial of Service (DoS) attacks on authoritative DNS servers.

Innovation Solution

Implementing a DNS Ownership Intermediary API that uses shared authentication credentials and load balancing to manage DNS requests, validating user identities, and preventing typographical errors, thereby offloading authentication complexity and protecting DNS servers from attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional authentication processes are used for DNS record management, then security is maintained, but the authentication process becomes cumbersome and difficult for large numbers of users

Engineering Contradiction:

Improveauthentication securityVSAvoidauthentication process

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent introduces an intermediary authentication service that mediates between users and the authoritative DNS server. This service handles authentication requests from multiple users using a shared authentication credential, verifying user identities without requiring the authoritative DNS server to implement complex multi-user authentication mechanisms. The intermediary service acts as a buffer that simplifies the authentication process while maintaining security through centralized credential verification.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If users are allowed to directly modify DNS records, then management flexibility is improved, but user errors can inadvertently create new DNS zones causing fragmentation

Engineering Contradiction:

ImproveDNS record management flexibilityVSAvoidDNS zone integrity

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent implements preliminary validation of DNS record modification requests before they are executed. The system checks whether a requested CNAME record would inadvertently create a new DNS zone by validating the record hierarchy and parent zone existence. This preliminary check prevents erroneous modifications that could fragment the DNS structure, while still allowing legitimate management operations to proceed.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If authoritative DNS servers handle all authentication requests directly, then authentication control is maintained, but the servers become vulnerable to DoS attacks from excessive API calls

Engineering Contradiction:

Improveauthentication controlVSAvoidDoS attack vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent extracts the authentication handling function from the authoritative DNS server and relocates it to a separate intermediary authentication service. This extraction removes the vulnerability of the DNS server to DoS attacks caused by excessive authentication API calls, as the intermediary service is designed to handle high volumes of authentication requests. The DNS server retains authentication control through validated requests while being protected from direct exposure to attack vectors.

Inventive Principle:

Principle #2Taking out (Extraction)

4Adaptability or versatility

If multiple authentication frameworks are implemented for different users, then user-specific authentication is supported, but the authentication system complexity increases

Engineering Contradiction:

Improvemulti-user authentication supportVSAvoidauthentication system complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent implements a universal authentication approach where a single intermediary authentication service handles authentication for multiple users across different contexts. Instead of implementing separate authentication frameworks for each user or application, the intermediary service provides a unified authentication interface that validates all users against a shared credential system. This universal approach supports multi-user authentication while minimizing system complexity through centralized credential verification and shared authentication logic.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS12579229B2DNS validation to avoid inadvertent subzone creation

Publication Date: 2026.03.17 CAPITAL ONE SERVICES LLC

AI summary

Methods, systems, and apparatuses are described herein for management of a Domain Name System (DNS) system. The system comprises numerous improvements, many related to CNAME records of the DNS. A computing device may manage authentication for a DNS using shared authentication credentials of a first authentication framework. In this manner, a wide variety of users might authenticate themselves using a first framework and use authentication credentials for a second framework to access a DNS. The computing device may further protect DNS servers from Denial of Service (DoS) attacks by bifurcating read and write requests to a DNS to different servers, such that attacks on read requests do not affect all of the DNS. The computing device may further validate DNS requests using, for example, natural language processing to avoid typographical errors inadvertently creating DNS zones.