Domain Name Network Policy Enforcement via DNS Resolution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network devices lack flexibility in enforcing network policies using domain names, requiring manual IP address resolution and increased complexity and resource usage when trying to implement domain name-based policies, especially when managing multiple routers and policies.
Innovation Solution
A method and system that allow the use of domain name-based network policies stored in a separate device, where network devices receive DNS look-up replies to identify IP addresses and create IP address-based policies, enabling flexible policy enforcement without the need for manual IP address resolution and reducing computational overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a router uses an overriding routing table to enforce network policies based on IP addresses, then the simplicity of enforcing network policies is improved, but the flexibility to use domain names to enforce network policies deteriorates
Solution Approach 1:
The patent introduces a domain name resolution mechanism as an intermediary between the router and the network policies. When a packet arrives, the router first resolves the destination IP address to a domain name using DNS or local resolution, then uses this domain name to match against policy rules. This intermediary step enables domain name-based policy enforcement while keeping the router's core routing function simple.
Solution Approach 2:
The patent performs domain name resolution in advance before policy enforcement. By resolving IP addresses to domain names beforehand and storing these mappings, the router can directly match domain names against policy rules without performing resolution during packet forwarding. This preliminary action improves both flexibility and efficiency.
2Ease of manufacture
If a network administrator manually looks up IP addresses and creates routing policies using IP addresses, then the ability to create routing policies is improved, but the labor intensity and susceptibility to human error deteriorates
Solution Approach 1:
The patent enables the routing policy system to automatically resolve domain names to IP addresses and generate policy rules without human intervention. The administrator simply specifies domain names in the policy configuration, and the system automatically performs DNS resolution, creates the corresponding routing entries, and updates the forwarding table. This self-service approach eliminates manual IP lookup and reduces errors.
Solution Approach 2:
The system performs domain name resolution in advance during policy configuration time, storing the resolved IP addresses for future use. This preliminary resolution action eliminates the need for administrators to manually look up IP addresses when creating or updating policies, significantly reducing labor intensity and errors.
3Adaptability or versatility
If a proxy server examines contents to enforce routing policies using domain names, then the flexibility to use domain name is improved, but the network traffic throughput and processing power requirements deteriorates
Solution Approach 1:
The patent separates the domain name resolution function from the content examination function. Instead of having the proxy server perform both DNS resolution and content inspection, the system divides these tasks: DNS resolution is handled by a dedicated resolution mechanism, while the proxy server focuses on content examination. This segmentation reduces the processing burden on the proxy server and improves throughput.
Solution Approach 2:
The system performs domain name resolution in advance before packets reach the proxy server for content examination. By resolving domain names beforehand and caching the results, the proxy server receives packets with already-resolved domain information, eliminating the need for real-time DNS queries during content inspection. This preliminary action significantly reduces processing power requirements and improves throughput.
4Productivity
If domain name based network policies are stored in a separate device, then the management scalability is improved, but the device complexity and policy enforcement mechanism deteriorates
Solution Approach 1:
The patent introduces a policy management server as an intermediary between the centralized policy storage and the distributed routers. This server stores domain name-based policies, resolves domain names to IP addresses, and distributes the resolved policies to routers. The intermediary handles the complexity of policy translation and distribution, keeping the router implementation simple while enabling centralized scalable policy management.
Solution Approach 2:
The patent extracts the complex domain name resolution and policy translation functionality from the routers and places it in a separate policy management server. This extraction allows policies to be stored and managed centrally in a scalable manner, while routers receive simplified IP address-based policy rules that are easier to enforce. The complex processing is taken out from the network path devices and handled by a dedicated management system.
Data Source
AI summary
A method and a system for creating Internet Protocol address based network policies (IPPs) by using domain name based network policies (DNNTPs) is disclosed. The DNNTPs are stored in a second device, and are used for enforcing IPPs at a first device. The first device retrieves one or more DNNTPs from the second device and monitors network traffic for Domain Name System (DNS) look-up reply. When a network device receives a record Domain Name System look-up reply, the network device identifies one or more Internet Protocol addresses of one or more host names specified in the address record Domain Name System look-up reply, then determine whether the one or more host names contain a domain name used in one or more DNNTPs and create one or more IPPs.