Dynamic DNS Redirection to Safe API Endpoint Hosts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing API security systems either trigger alerts or block connections to risky API endpoints, which negatively impacts application availability, without effectively redirecting API calls to safer endpoints.
Innovation Solution
Implement an intelligent domain name system (DNS) engine within a service mesh to intercept and redirect API calls from risky to safe endpoints by manipulating DNS queries and replies, using security services to identify and cache safe API endpoints, and dynamically adjust TTL values based on risk assessments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If API security systems block connections to risky API endpoints, then security risk is reduced, but application availability deteriorates
Solution Approach 1:
The patent introduces an intelligent DNS engine as an intermediary between applications and API endpoints. This mediator intercepts DNS queries, evaluates the security risk of target endpoints using multiple data sources (threat intelligence feeds, vulnerability databases, security ratings), and redirects traffic to safe endpoints without requiring applications to change their behavior. This resolves the contradiction by maintaining security through active monitoring and redirection while preserving availability through transparent operation.
Solution Approach 2:
The system dynamically changes the DNS resolution parameter (IP address mapping) based on real-time security assessments. When a risky endpoint is detected, the DNS engine modifies the resolution to point to an alternative safe endpoint instead of the originally intended endpoint. This parameter change enables security risk reduction while maintaining application functionality and availability.
2Reliability
If API security systems trigger alerts for risky endpoints, then security monitoring is improved, but application availability deteriorates
Solution Approach 1:
The intelligent DNS engine acts as an unobtrusive intermediary that provides security monitoring through DNS query interception and evaluation. Instead of triggering alerts that disrupt applications, the system silently monitors endpoint security risks and automatically redirects traffic to safe endpoints, thereby improving security monitoring capability while maintaining application availability through transparent operation.
Solution Approach 2:
The system enables self-service security by automatically evaluating endpoint risks and performing redirections without requiring application-level security checks or alert responses. This automated self-service approach improves security monitoring while preserving application availability by eliminating the need for manual intervention or application downtime.
3Reliability
If DNS queries are intercepted and redirected, then security risk reduction is improved, but system complexity increases
Solution Approach 1:
The intelligent DNS engine consolidates multiple security functions into a single universal component: DNS query interception, endpoint risk evaluation using multiple data sources, safe endpoint identification, and traffic redirection. By providing multi-functionality in one system, the patent achieves comprehensive security risk reduction while minimizing the complexity increase that would result from multiple separate security components.
Data Source
AI summary
A method of application program interface (API) endpoint host redirection may include with an intelligent domain name system (DNS) engine (IDE) associated with a containerized service within a pod of a mesh network, snooping a DNS query from the containerized service, identifying within the DNS query, an API endpoint name, snooping a DNS response associated with the DNS query, identifying an Internet protocol (IP) address associated with the API endpoint name, transmitting the API endpoint name and the IP address to a controller, receiving, from the controller, a list of safe API endpoint hosts with no known security vulnerabilities based on security data obtained from at least one security service, caching, at the IDE, the list of safe API endpoint hosts including safe IP addresses, and transmitting to the containerized service, via the IDE, IP addresses of safe API endpoint hosts within the list of safe API endpoint hosts.