Global DNS Policy Engine Using Client Subnets Through NAT
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DNS policies struggle to differentiate between internal devices due to network address translation (NAT), which obfuscates internal IP addresses, making it difficult for external DNS servers to apply granular policies.
Innovation Solution
Implement a policy engine in the global recursive resolver that utilizes the EDNS0 client subnet to identify client subnets, allowing external DNS servers to apply internal network policies based on both source IP addresses and client subnets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network address translation (NAT) is implemented to map multiple internal IP addresses to a single external IP address, then network security and address management are improved, but the ability to differentiate between internal devices for DNS policy application deteriorates
Solution Approach 1:
The patent embeds the client subnet identifier within the EDNS0 OPT pseudo-resource record, which is nested within the DNS query structure. This allows the external DNS server to access internal network identification information without breaking the NAT architecture. The nested structure enables policy differentiation while maintaining the external IP address masking provided by NAT.
Solution Approach 2:
The EDNS0 OPT pseudo-resource record acts as an intermediary that carries the client subnet identifier from the internal network through the NAT boundary to the external DNS server. This intermediary mechanism enables policy application without requiring changes to the NAT infrastructure or installation of specialized software on internal devices.
2Adaptability or versatility
If specialized software or hardware is installed on each internal device or between internal devices and internal servers to enable granular DNS policy application, then policy granularity is improved, but network complexity and implementation cost deteriorate
Solution Approach 1:
The external DNS server is enhanced to perform multiple functions: it acts as a standard DNS resolver while simultaneously functioning as a policy evaluation engine that applies internal network policies. This universal approach eliminates the need for specialized hardware or software on internal devices, as the policy application capability resides in the external DNS server that already handles DNS queries.
Solution Approach 2:
The patent uses the existing EDNS0 protocol framework and creates a policy application mechanism that operates over standard DNS queries. Rather than creating entirely new specialized infrastructure, the solution copies and extends existing DNS infrastructure capabilities to achieve policy application, reducing complexity and leveraging existing network components.
3Adaptability or versatility
If internal networks are reconfigured to enable external DNS servers to apply internal network policies, then policy enforcement capability is improved, but network stability and operational simplicity deteriorate
Solution Approach 1:
The client subnet identifier is extracted from the source IP address and embedded in the EDNS0 OPT record in advance, before the DNS query reaches the external DNS server. This preliminary preparation of identification information enables the external server to apply policies without requiring any reconfiguration of the internal network infrastructure, maintaining network stability while enabling policy enforcement.
Solution Approach 2:
The internal recursive resolver automatically extracts the client subnet from the source IP address and embeds it in the EDNS0 OPT record without requiring manual configuration or intervention. This self-service mechanism enables policy application while keeping the internal network configuration simple and stable, as the process occurs automatically based on existing IP address information.
Data Source
AI summary
In one embodiment, a global domain name system (DNS) server processes a DNS query based on an internal network policy. Upon receiving a DNS query that is associated with a source IP address, the global DNS server identifies a client subnet based on the DNS query. The client subnet is associated with an internal device on an internal network. The global DNS server selects an internal network policy from multiple predetermined policies based on the source IP address and the client subnet. The global DNS server then tailors one or more DNS resolution operations that generate a response to the DNS query based on the selected internal network policy. Advantageously, the client subnet provides the global DNS server with visibility into the internal network. Such visibility enables the global DNS server to apply policies selectively at the granularity of individual devices on the internal network.