Firewall FQDN Rule Revalidation via IP-Domain Table Versioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewalls face challenges in maintaining accurate mappings between FQDN expressions and IDs due to dynamic rule updates and restrictive DNS refreshes, leading to inefficiencies in applying firewall rules.
Innovation Solution
Implementing an IP-Domain table to store mappings between IP addresses, domain names, and expression IDs, with versioning schemes to validate and revalidate expression tables only when necessary, reducing the churn caused by frequent updates and improving rule application accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If FQDN rules are continuously modified and updated, then the firewall can adapt to changing security requirements, but the mapping between FQDN expressions and IDs becomes indefinite and validation becomes complex
Solution Approach 1:
The patent performs preliminary validation of FQDN expressions against the IP-Domain table before the expressions are deployed to the expression matching engine. This advance validation ensures that expression IDs correctly correspond to current domain names and IP addresses, preventing invalid rules from being applied. The validation is triggered by events such as DNS cache expiration or IP-Domain table updates, rather than continuously, thus adapting to changes while maintaining validation efficiency.
Solution Approach 2:
The patent implements a feedback mechanism where the system monitors events such as DNS cache expiration, IP-Domain table updates, and expression table modifications. When such events occur, the system triggers revalidation of affected FQDN expressions. This event-driven feedback approach ensures that validation occurs only when necessary, maintaining accuracy while avoiding unnecessary validation overhead during normal operations.
2Reliability
If validation is performed for every newly established connection, then rule application accuracy is maintained, but system performance deteriorates due to excessive validation churn
Solution Approach 1:
Instead of validating every connection, the patent implements periodic validation triggered by specific events such as DNS cache expiration (based on TTL parameters) or IP-Domain table updates. This periodic approach ensures that validation occurs at appropriate intervals when actual changes occur, maintaining rule accuracy while avoiding the performance degradation associated with continuous validation on every connection establishment.
Solution Approach 2:
The patent validates only the subset of FQDN expressions that are affected by specific events rather than validating all expressions. For example, when a DNS cache entry expires or an IP-Domain table entry is updated, only the related FQDN expressions are revalidated. This partial validation approach maintains reliability for affected rules while significantly reducing the validation churn compared to validating all expressions on every connection.
3Measurement precision
If DNS refreshes are performed frequently, then mapping accuracy is improved, but the system is constrained by rigid DNS TTL limitations
Solution Approach 1:
The patent introduces the IP-Domain table as an intermediary layer between DNS resolution and FQDN expression validation. The IP-Domain table stores the mapping between domain names and IP addresses separately from the FQDN expressions. This intermediary allows the system to validate expressions against the IP-Domain table independently of DNS cache timing, enabling validation to be triggered by IP-Domain table updates rather than being constrained by DNS TTL parameters. This decoupling provides flexibility in validation timing while maintaining mapping accuracy.
Data Source
AI summary
A method comprises: in response to detecting a new expression in a policy rule, updating a global version number to a new value; identifying a particular IP address that corresponds to an FQDN matching on the new expression; storing an entry comprising the particular IP address, the new expression, and an entry version number in a first data structure, the entry version number being assigned the new value; in response to detecting a new connection to a destination IP address: finding a matching entry in the first data structure corresponding to the destination IP address; determining whether the global version number matches the entry version number for the matching entry; and in response to determining that the global version number does not match the entry version number for the matching entry, sending update information to a slowpath process that associates an updated configuration information for the matching entry.