Private DNS Address Translation for Secure Network Deployment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security technologies for managing network communications between computing systems are cumbersome and difficult to deploy, especially when applications require domain name system (DNS) interactions, often necessitating modifications to applications or network configurations.
Innovation Solution
A method is introduced that operates a private DNS within a computing network, receiving DNS lookup requests, forwarding them to a public DNS, translating public addresses to private addresses, and transferring these private addresses back to the computing systems, enhancing security by using private addressing information for overlay networks and public addressing information for underlay networks within secure packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current security technologies (VLANs, encryption) are deployed to secure network communications, then security is improved, but deployment complexity and management difficulty increase
Solution Approach 1:
The patent introduces a private DNS server as an intermediary component between computing systems and public DNS infrastructure. This mediator handles address translation and security policy enforcement, simplifying deployment by centralizing security management rather than requiring complex configuration of multiple security devices across the network
Solution Approach 2:
The private DNS server performs multiple functions simultaneously: it acts as a DNS resolver, an address translator between public and private addressing schemes, and a security policy enforcement point. This multi-functionality reduces the number of separate security components needed, thereby reducing overall deployment complexity
2Ease of manufacture
If security configurations are implemented without modifying applications or network configurations, then ease of deployment is improved, but security policy coherence may be compromised
Solution Approach 1:
The private DNS server automatically retrieves security policies from external sources (such as cloud-based policy servers) and configures itself without requiring manual intervention or modification of applications. This self-service capability enables easy deployment while maintaining security policy coherence through automated policy retrieval and enforcement
Solution Approach 2:
The system implements feedback mechanisms where the private DNS server continuously monitors and retrieves updated security policies, ensuring that security policy coherence is maintained dynamically. The server adjusts its behavior based on retrieved policies, creating a closed-loop system that maintains security integrity without requiring application modifications
3Reliability
If private addressing information is used for overlay networks and public addressing for underlay networks, then security is improved, but DNS interaction complexity increases
Solution Approach 1:
The private DNS server acts as a mediator that automatically handles the complexity of address translation between public and private addressing schemes. Computing systems simply interact with the private DNS using private addresses, while the DNS server manages the translation to public addresses for underlay network communication, shielding applications from DNS interaction complexity
Solution Approach 2:
The system creates and maintains mappings between public addresses and private addresses, essentially creating a copy or alias system. The private DNS server stores and manages these address mappings, allowing computing systems to use private addresses locally while the server handles the corresponding public addresses for external communication, simplifying the DNS interaction for end systems
Data Source
AI summary
Described herein are systems, methods, and software to enhance secure communications between computing systems. In one implementation, a private domain name system (DNS) receives a DNS lookup request from a computing system of a plurality of computing systems associated with a private communication group, and forwards the DNS lookup request to a public DNS. The private DNS further receives a public address associated with the DNS lookup request from the public DNS, translates the public address to a private address, and transfers the private address to the requesting computing system.