Dynamic Split Tunneling via Domain Name Resolution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The management of split tunneling in VPNs becomes complex due to the migration of services across infrastructure, especially with IPv6 and network translation schemes, making it difficult to include or exclude specific services from the VPN tunnel effectively.
Innovation Solution
A dynamic split tunneling system that allows traffic to be dynamically excluded or included from a VPN tunnel based on the domain name of the destination, using a split tunneling policy that can include or exclude specific host names or wildcard domain names, and dynamically provisions routes and filters to match the resolved IP addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If services are hosted from a shared IP pool with mutable IP addresses, then resource utilization and flexibility are improved, but split tunneling policy management becomes more difficult
Solution Approach 1:
The patent introduces a domain name as an intermediary layer between the service and the VPN tunnel. Instead of directly managing IP addresses, the system uses domain name resolution to identify services and applies split tunneling policies based on domain names. This mediator approach allows policies to remain stable even when IP addresses change, resolving the contradiction between service flexibility and policy management complexity.
Solution Approach 2:
The patent changes the parameter basis for split tunneling from IP addresses to domain names. By resolving domain names to IP addresses dynamically and applying policies based on domain name matches, the system adapts to mutable IP addresses while maintaining consistent policy enforcement. This parameter transformation resolves the contradiction by making policy management independent of IP address changes.
2Productivity
If multiple services are hosted from a single IP pool, then infrastructure efficiency is improved, but the ability to selectively include/exclude specific services from VPN tunnel is reduced
Solution Approach 1:
The patent uses domain names as intermediaries to enable service-level granularity in split tunneling policies. Each service within the shared IP pool can be identified by its domain name, allowing administrators to create specific policies for each service even though they share the same IP infrastructure. This resolves the contradiction by providing service-level control without requiring separate IP addresses for each service.
3Adaptability or versatility
If IPv6 and network translation schemes are implemented, then network capacity and flexibility are improved, but VPN policy tuning effectiveness is reduced
Solution Approach 1:
The patent introduces domain name resolution as an intermediary step between the VPN client and the actual IP address. The system resolves domain names to IP addresses (whether IPv4 or IPv6) and applies split tunneling policies based on domain name matches rather than IP address patterns. This approach maintains policy enforcement precision across different network protocols and translation schemes, as the policy matching occurs at the domain name level before IP address translation or protocol conversion.
Data Source
AI summary
A computing device dynamically excludes/includes traffic from/in a secure tunnel based on the domain name of the destination of the traffic. The computing device establishes a secure tunnel from the computing device, and receives a request to access a remote resource at a domain name. The computing device resolves the domain name at a domain name server and receives a resolved network address associated with the domain name. The computing device determines whether to send the request inside the secure tunnel or outside the secure tunnel by comparing the domain name to a split tunneling policy. Based on the comparison with the split tunneling policy, the computing device sends the request to the resolved network address either outside the secure tunnel or inside the secure tunnel.