Security-Aware GSLB DNS Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Global Server Load Balancing (GSLB) systems do not account for security issues at datacenters, which can lead to poor performance and prolonged denial of service (DOS) attacks when clients are assigned to insecure datacenters, exacerbating security threats and performance issues.
Innovation Solution
A security-aware GSLB system that collects security data from datacenters using hardware or software agents, monitors smart network interface cards, and generates a source-IP deny-list to prevent clients from accessing compromised datacenters, thereby assigning clients to more secure datacenters based on security patches and attack status.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If GSLB systems use traditional load balancing methods without security awareness, then load distribution is simple and fast, but security risks increase as clients may be assigned to compromised datacenters
Solution Approach 1:
The system performs preliminary security assessments of datacenters before assigning clients. Security agents continuously monitor datacenter security status, patch levels, and threat conditions in advance, so that when a client needs assignment, the DNS service already has security-aware information to make safe routing decisions without delay.
Solution Approach 2:
Security agents act as intermediaries between the DNS service and datacenters. These agents collect security data from datacenters and provide it to the DNS service, which then uses this information to make informed load balancing decisions. This intermediary layer adds security awareness without requiring the DNS service itself to directly monitor each datacenter.
2Productivity
If clients are assigned to datacenters without security awareness, then load balancing is faster, but DOS attack impact is exacerbated
Solution Approach 1:
The system implements feedback loops where security agents continuously monitor datacenter security status and report back to the DNS service. When a datacenter is found to be under attack or compromised, the DNS service receives immediate feedback and adjusts client assignments in real-time, preventing further traffic from being directed to compromised datacenters while maintaining overall system responsiveness.
3Reliability
If security data collection is implemented across all datacenters, then security awareness is improved, but system complexity and overhead increase
Solution Approach 1:
Each datacenter runs its own security agents that autonomously collect and report security data about their local environment. The agents self-manage the collection of patch information, threat detection, and security status reporting without requiring centralized control or additional infrastructure at the DNS service level, reducing overall system overhead while maintaining comprehensive security awareness.
Data Source
AI summary
The method of some embodiments assigns a client to a particular datacenter from among multiple datacenters. The method is performed at a first datacenter, starting when it receives security data associated with a second datacenter. Then the method receives a DNS request from the client. Based on the received security data, the method sends a DNS reply assigning the client to the particular datacenter instead of the second datacenter. The receiving and sending is performed by a DNS cluster of the datacenter in some embodiments. The particular datacenter includes a set of servers implementing an application for the client in some embodiments. The datacenter to which the client gets assigned can be the first datacenter or a third datacenter.