Lock-Free DNS Blacklist Updates via Versioned Garbage Pools
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DNS blacklist update mechanisms often require locking the response policy zone database, leading to concurrent read request blocking and slowed DNS resolver response times, which hampers efficient network security measures against malicious domains.
Innovation Solution
Implementing a lock-free update method for DNS blacklists by designating outdated entries as 'garbage' and deleting them only after all reads are complete, allowing concurrent reading and writing to the response policy zone database without immediate overwriting or deletion.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the RPZ database is locked during updates to ensure data consistency, then update reliability is improved, but concurrent read requests are blocked and DNS resolver response time increases
Solution Approach 1:
The database update process is segmented into multiple independent operations: writing new entries to the database, incrementing version numbers, and deleting old entries. These operations are performed in a specific sequence that allows read requests to continue accessing valid data while updates proceed, eliminating the need for exclusive locks during the entire update process.
Solution Approach 2:
New database entries are added and version numbers are incremented before deleting old entries. This preliminary action ensures that read requests can always find valid data to access, while the deletion of old entries occurs as a separate, non-blocking operation that maintains data consistency without preventing concurrent reads.
2Stability of the object's composition
If the database is locked during updates, then data consistency is maintained, but system productivity decreases due to blocked concurrent operations
Solution Approach 1:
The system dynamically adjusts the timing and sequencing of update operations based on the state of concurrent read requests. By performing writes and version increments before deletions, the system maintains data consistency dynamically without requiring static locking mechanisms that would block productivity.
Solution Approach 2:
Old database entries are discarded only after new entries are successfully added and version numbers are incremented. This ensures data consistency is maintained throughout the update process, while the discarding operation itself does not block concurrent reads since it occurs after the critical data structures are already in place.
3Speed
If immediate overwriting or deletion of database entries is performed, then update speed is improved, but concurrent read requests may access corrupted or inconsistent data
Solution Approach 1:
The system performs preliminary actions of adding new entries and incrementing version numbers before deleting old entries. This sequence ensures that at no point during the update process are read requests able to access corrupted or inconsistent data, while still allowing rapid update execution through non-blocking operations.
Solution Approach 2:
Version numbers serve as an intermediary mechanism that coordinates between read and write operations. By incrementing version numbers as part of the update process, the system provides a clear indication of data state changes without requiring locks, allowing read operations to proceed concurrently while maintaining consistency guarantees.
Data Source
AI summary
A computer-implemented method updates a domain name system blacklist in a lock-free manner is disclosed. In the method, an entry of the domain name blacklist is read at a DNS resolver in a plurality of DNS resolvers. The entry specifies a policy for the DNS resolver to execute when the DNS resolver receives a request to resolve a domain name. Before the reading is complete, an updated entry of the domain name blacklist is received, a new record to the domain name blacklist is added, and the entry being read is placed into a garbage pool having a current version number. Independently from the reading of the entry, the current version number is incremented and a new garbage pool is created for the incremented version number. When the reading is complete, the current version number is assigned to the DNS resolver.