Firewall DNS Policy Enforcement for Dynamic ACL IP Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security policy features fail to provide granular-level access control, leading to denied access requests due to outdated IP address caches and vulnerabilities from server migrations or malicious actors, causing downtime in machine controller systems.
Innovation Solution
Implementing a firewall that dynamically updates access control lists based on DNS requests and responses, allowing seamless access to resources even during server migrations and preventing man-in-the-middle attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security policy features use static IP address caches, then access control is simplified, but access requests are denied during server migrations causing downtime
Solution Approach 1:
The patent transforms the static IP address cache into a dynamic system that automatically updates IP addresses by intercepting and monitoring DNS queries. The firewall now dynamically resolves domain names to current IP addresses, allowing seamless adaptation to server migrations while maintaining access control policies based on domain names rather than static IP addresses.
Solution Approach 2:
The system implements feedback by intercepting DNS responses and using the returned IP addresses to update the access control list in real-time. This creates a closed-loop system where the firewall continuously monitors DNS activity and automatically adjusts its IP address cache based on actual server locations, ensuring uninterrupted access during migrations.
2Reliability
If access control lists are updated frequently to maintain current IP addresses, then access continuity is improved, but system performance decreases due to processing overhead
Solution Approach 1:
The patent applies partial action by selectively updating only those IP addresses that are actually needed for current operations. Instead of continuously refreshing all cached IP addresses, the system intercepts DNS queries only when applications attempt to access resources, updating the access control list with minimal overhead and only when necessary.
3Measurement precision
If granular access control is implemented at the domain name level, then security precision is improved, but device complexity increases
Solution Approach 1:
The patent introduces domain names as an intermediary layer between the application layer and the network layer. Instead of directly managing IP addresses, the firewall policies are configured to allow or deny access based on domain names. The DNS interception mechanism automatically translates these domain-based policies into current IP addresses, simplifying policy management while maintaining granular control.
Data Source
AI summary
Systems and methods described herein provide for novel security policy features network devices. In embodiments, a first domain name system (DNS) request for a resource may be obtained by a first computer system associated with a firewall. The first DNS request may be between a second computer system and a DNS server and include a domain name for the resource. A determination may be made that the domain name included in the first DNS request is included in an access control list maintained by the first computer system. A first DNS response from the DNS server may be received by the first computer system and include an internet protocol (IP) address for the resource. The access control list may be updated to include the IP address for the domain name for the resource. The IP address may be transmitted to the second computer system by the first computer system.