DNS-Based VPN Liveness Check for Non-DPD Tunnels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
VPN tunnel state checking is inadequate in scenarios where Dead Peer Detection (DPD) is not supported or disabled, leading to potential delays in communication due to inactive VPN tunnels.
Innovation Solution
A DNS-based VPN liveness check method is introduced, where a mobile device sends DNS PTR requests over a VPN tunnel and retransmits if no response is received within a set interval, providing an inactive tunnel indication to the VPN client manager after a maximum number of requests, allowing for alternative tunnel state verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DPD-based liveness check is used, then VPN tunnel state can be monitored efficiently, but compatibility issues arise when DPD is not supported or disabled
Solution Approach 1:
The patent changes the monitoring parameter from DPD-based IPsec traffic patterns to DNS-based domain name resolution. By using DNS queries as the liveness check mechanism, the system adapts to environments where DPD is unavailable, maintaining tunnel state monitoring capability through a different technical parameter (DNS response time instead of IPsec traffic patterns).
Solution Approach 2:
The patent introduces DNS as an intermediary mechanism between the VPN client and the network. Instead of directly using DPD for liveness checking, the system uses DNS queries as a mediator to indirectly determine tunnel status, enabling compatibility with systems that do not support DPD while maintaining reliable tunnel state monitoring.
2Device complexity
If DPD is disabled or not supported, then simpler VPN implementation is achieved, but tunnel liveness cannot be detected causing communication delays
Solution Approach 1:
The patent introduces DNS as an intermediary liveness check mechanism that works independently of DPD complexity. This allows simpler VPN implementations without DPD support to still benefit from timely tunnel status detection, preventing communication delays by using DNS queries as a lightweight alternative to complex DPD mechanisms.
Solution Approach 2:
The system uses DNS queries that are naturally part of network communication to perform liveness checking. By leveraging the existing DNS infrastructure and domain name resolution process, the system achieves tunnel state monitoring without adding complex DPD-specific logic, maintaining simplicity while preventing communication delays.
3Reliability
If DNS-based liveness check is implemented, then tunnel state monitoring is reliable without DPD, but additional network requests are required
Solution Approach 1:
The patent makes DNS serve multiple functions: both normal domain name resolution for network communication and VPN tunnel liveness checking. By using DNS queries for both purposes, the system avoids dedicated liveness check requests, improving network request efficiency while maintaining reliable tunnel state monitoring through the universal DNS infrastructure.
Data Source
AI summary
A method and apparatus for virtual private network (‘VPN’) liveness checking, the method, upon expiration of a timer, sending, over a VPN tunnel, a request to a server located behind a terminator of the VPN; checking whether a response to the request is received within a time interval; if a response to the request is received, resetting the timer; and if a response to the request is not received within the time interval, resending the request if a request count is less than a set number of requests; or providing an inactive tunnel indication to a VPN client manager if the request count equals the set number of requests.