User-Segmented DNS Caching for Enterprise Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
DNS caching systems face challenges in serving the same responses for different user groups, leading to increased DNS round trip delays and poor user experience, as cached responses are not applicable across user groups, necessitating constant remote server queries.
Innovation Solution
Implementing a local DNS cache that associates DNS responses with user identifiers and groups, allowing the network element to cache and deliver appropriate responses based on remotely determined access policies, while maintaining security services by signaling authorized user groups in DNS responses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If DNS caching is implemented without user group differentiation, then DNS query response time is reduced, but DNS response accuracy deteriorates because cached responses are not applicable across different user groups
Solution Approach 1:
The patent segments the DNS cache by creating separate cache entries for different user groups. Each cache entry is associated with specific user group identifiers, allowing the system to retrieve the appropriate cached response based on the querying user's group membership. This segmentation enables parallel caching of multiple valid responses without conflict.
Solution Approach 2:
The patent adds a new dimension to DNS caching by incorporating user group identifiers as an additional indexing parameter. Instead of caching DNS responses solely by domain name, the system caches responses by (domain name, user group identifier) pairs. This dimensional extension allows the same domain to have multiple cached responses tailored to different user groups.
2Reliability
If DNS responses are customized for different user groups, then DNS response accuracy is improved, but system complexity increases due to multiple cache management requirements
Solution Approach 1:
The patent creates a universal DNS cache structure that can handle both user-specific and user-group-specific DNS responses. The cache system is designed to accept and store multiple response types using a unified data structure that includes domain name, user group identifiers, and response data. This multi-functional cache reduces the need for separate caching mechanisms.
Solution Approach 2:
The patent uses copying to replicate DNS response data across multiple cache entries with different user group identifiers. When a DNS response is received, the system creates copies of the response data and stores them in association with relevant user group identifiers. This copying approach simplifies cache management by using a single storage mechanism rather than requiring complex selective storage logic.
3Productivity
If local DNS caching is implemented, then network efficiency is improved, but security policy enforcement deteriorates without proper user identification mechanisms
Solution Approach 1:
The patent performs preliminary action by pre-fetching and caching DNS responses for multiple user groups before they are actually needed. When user group identifiers are available in advance, the system proactively retrieves and caches the corresponding DNS responses, so that when queries arrive, the appropriate cached response is immediately available. This eliminates the need for real-time security policy checks during query processing.
Solution Approach 2:
The patent implements feedback by using user group identifiers from DNS queries to retrieve the appropriate cached responses. The system continuously monitors query patterns and updates the cache based on actual usage, ensuring that the most relevant DNS responses are kept in cache. This feedback mechanism maintains security policy compliance while optimizing cache hit rates.
Data Source
AI summary
A local network element on an enterprise network caches Domain Name System (DNS) responses in association with user identifiers in accordance with a DNS-based access control policy. The network element receives a DNS request from a first endpoint device. The DNS request includes a domain name to resolve. The network element forwards the DNS request to a domain name server along with a first user identifier associated with the first endpoint device. The network element receives a DNS response from the domain name server. The DNS response includes a network address associated with the domain name, as well as the first user identifier and at least one other user identifier. The network element stores the network address in a DNS cache as a cached DNS response for the domain name. The cached DNS response is stored in association with the first user identifier and the other user identifier(s).