Secure Name Resolution via Overlay Network Parameter Rules
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional name resolution technologies, such as DNS, face security vulnerabilities and are not designed to operate in modern networks with overlay networks, leading to difficulties in ensuring secure and efficient name resolution across multiple networks via a single interface.
Innovation Solution
Implementing a set of resolution parameters that can be used to govern name resolution processes, including security measures like DNSSEC, to secure the process and enable operation in overlay networks, by maintaining a collection of sets of parameters that specify how to communicate with different networks and ensure the legitimacy of responses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional DNS name resolution is used, then name resolution is simple and fast, but security vulnerabilities exist allowing attackers to misdirect computing devices
Solution Approach 1:
The patent applies preliminary action by performing security validation of DNS responses before using them for name resolution. The computing device validates the authenticity of DNS responses against a trusted authority or previously validated cache entries before accepting them, preventing attackers from injecting fraudulent responses. This preliminary validation step ensures security while maintaining the simplicity of DNS operation for legitimate use cases.
2Reliability
If DNSSEC is implemented to secure name resolution, then security is improved, but processing burden on client devices increases
Solution Approach 1:
The patent applies partial action by implementing selective DNSSEC validation only when needed. The computing device determines whether to perform full DNSSEC validation based on factors such as the domain being queried, network conditions, or security policies. For low-risk queries or trusted domains, the device may use simplified validation or cache results, reducing processing burden while maintaining security for high-risk scenarios.
Solution Approach 2:
The patent applies preliminary action by pre-validating DNS responses and caching them before they are needed. The computing device or a trusted intermediary validates DNS responses in advance and stores them in a secure cache with validity metadata. When the same domain is queried again, the pre-validated cached result is used without repeating the full validation process, significantly reducing processing burden while maintaining security.
3Adaptability or versatility
If conventional name resolution is used, then operation is simple, but it cannot operate in overlay networks via single interface
Solution Approach 1:
The patent applies universality by designing a name resolution system that can operate across multiple network types through a single interface. The computing device implements a unified name resolution mechanism that automatically adapts to different network environments (traditional networks, overlay networks, hybrid networks) without requiring separate resolution systems. This is achieved through network-agnostic query formulation and response validation that works regardless of the underlying network architecture.
Solution Approach 2:
The patent applies the intermediary principle by introducing a trusted intermediary component that mediates between the computing device and various network types. This intermediary validates and translates name resolution requests and responses, allowing the computing device to interact with overlay networks and traditional networks through a standardized interface. The intermediary handles the complexity of different network protocols and security requirements, presenting a unified simple interface to the end device.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Techniques for securing name resolution technologies and for ensuring that name resolution technologies can function in modern networks that have a plurality of overlay networks accessible via a single network interface. In accordance with some of the principles described herein, a set of resolution parameters may be implemented by a user, such as an end user or an administrator, to be used during a name resolution process for securing the process and/or for conducting the process in an overlay network. In some implementations, the set of resolution parameters may be maintained as a table of rules, and used to govern name resolution processes. For example, resolution parameters may be created that govern a DNSSEC session, or that govern how to communicate with networks implemented with Microsoft's Direct Access overlay technologies, or that govern communications using any other networking technology.