Proxy Server Selection via Encoded Domain Name Resolution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network resource access control systems face challenges in analyzing encrypted requests due to the increasing use of cryptographic protocols like TLS and SSL, making it difficult to implement effective policy enforcement without compromising privacy or resources.
Innovation Solution
A system that encodes Uniform Resource Locators (URLs) into valid domain name syntax, allowing domain name resolution requests to be processed even when encrypted, using a proxy auto-configuration (PAC) file and URL encoder/decoder techniques, enabling policy application at proxy servers without decrypting the requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If cryptographic protocols (TLS/SSL) are used to encrypt requests, then privacy is improved, but the ability to analyze and enforce policies on request content deteriorates
Solution Approach 1:
The system performs preliminary encoding of URLs into domain name syntax before the request is encrypted. This allows the proxy server to analyze and enforce policies on the encoded form of the URL while the actual request content remains encrypted, thus preserving privacy while enabling policy enforcement.
Solution Approach 2:
The patent introduces an intermediary encoding mechanism that transforms URLs into a different syntax (domain name format) that can be analyzed by policy servers without requiring decryption of the original encrypted request. This intermediary form allows policy enforcement while maintaining the confidentiality of the original request content.
2Difficulty of detecting and measuring
If SSL Man In The Middle (MITM) technique is used to decrypt and analyze requests, then policy enforcement capability is improved, but resource intensity and implementation complexity increase
Solution Approach 1:
The system extracts only the necessary URL information and encodes it into domain name syntax before encryption, rather than requiring full decryption of the encrypted request. This extraction approach allows policy servers to analyze the essential routing information without the computational overhead and complexity of SSL MITM implementation.
3Reliability
If URL encoding into domain name syntax is implemented, then policy enforcement on encrypted requests is improved, but system complexity increases
Solution Approach 1:
The patent leverages the existing domain name resolution infrastructure and makes it multi-functional by using domain name syntax not only for its traditional purpose but also as an encoded form for URL analysis. This universal approach allows the existing DNS system to serve dual purposes, reducing the need for entirely new infrastructure and thereby limiting the increase in system complexity.
Data Source
Figure 1A
Figure 1B
Figure 2A
AI summary
Processing computer network requests by receiving from a requesting computer an encoded value in a domain name resolution request, where the encoded value has a valid domain name syntax, decoding the encoded value into a Uniform Resource Locator having a host portion and a non-host portion, determining that the host portion of the Uniform Resource Locator in combination with the non-host portion of the Uniform Resource Locator meets a predefined routing criterion associated with a computer network address that is associated with a proxy server, and sending the computer network address to the requesting computer in response to the domain name resolution request.