Dynamic Name Resolution for Zero-Trust Service Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies fail to provide secure access to internet-facing services without exposing them to the risks of the open internet, as they rely on shared networks that can be vulnerable to attacks.
Innovation Solution
Implementing a cloud-based system that acts as an authoritative name server, enforcing zero trust policies and controls based on user and service characteristics, isolating services from direct internet exposure, and providing access through a control layer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If applications are made available in a shared network over the open internet, then accessibility to the application is improved, but security vulnerability to attacks increases
Solution Approach 1:
The patent introduces a cloud-based system as an intermediary between users and destination services. This system resolves DNS queries, enforces security policies, and controls access without exposing the destination service directly to the internet. The intermediary layer maintains accessibility while filtering out malicious traffic and enforcing zero trust principles.
Solution Approach 2:
The patent segments the network architecture into distinct layers: the public internet layer, the cloud-based control layer, and the private destination service layer. This segmentation isolates the destination service from direct internet exposure while maintaining controlled accessibility through the intermediate cloud layer.
2Reliability
If zero trust protection is enforced through a cloud-based system, then security is improved, but network complexity increases
Solution Approach 1:
The cloud-based system performs multiple functions within a single unified platform: DNS resolution, security policy enforcement, access control, and traffic routing. This multi-functionality consolidates what would otherwise require multiple separate systems, reducing overall network complexity while maintaining comprehensive zero trust protection.
Solution Approach 2:
The system automatically resolves DNS queries, enforces policies, and manages access control without requiring manual network configuration or intervention. The cloud-based infrastructure self-manages the complexity of zero trust implementation, allowing organizations to benefit from enhanced security without proportionally increasing operational complexity.
3Ease of operation
If DNS resolution is performed by a cloud-based system, then access control is improved, but loss of information about network topology increases
Solution Approach 1:
The patent implements local quality by allowing different levels of DNS resolution and information disclosure. The cloud-based system can provide detailed topology information to authorized components (such as the control layer) while presenting only necessary information to external users. This selective information disclosure maintains access control while preserving necessary topology knowledge where needed.
Data Source
AI summary
Systems and methods for dynamic distributed name resolution. In various embodiments, steps include receiving a request from a user to access a destination service; resolving an Internet Protocol (IP) address for the destination service based on one or more characteristics of the request; enforcing one or more controls on the request based on a configuration provided by an owner of the destination service; and providing access to the destination service to the user based on the one or more controls.