Virtual Root Node DNS Security System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing DNS architecture is vulnerable to single-point failures, particularly at the root node, which can lead to domain name resolution failures and increased risk of DNS attacks, given the limited number of root servers and their geographical distribution.
Innovation Solution
A DNS security system is introduced, featuring a virtual root node that invokes authorization information from a database to provide resolution services when a root node failure occurs, reducing single-point failures and enhancing attack defense capabilities by storing all DNS requests and corresponding authorization information in an authorization information database.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a traditional DNS hierarchical architecture is used, then DNS resolution can be achieved through standard procedures, but the system is vulnerable to single-point failures at the root node and has limited defense capability against DNS attacks
Solution Approach 1:
The patent pre-collects and stores authorization information for domain names in an authorization information database before attacks or failures occur. This preliminary preparation enables the virtual root node to quickly provide resolution services when the real root node fails or is attacked, without needing to query in real-time during critical moments.
Solution Approach 2:
The patent introduces a virtual root node as an intermediary between clients and the real root node. This virtual root node acts as a mediator that can intercept DNS queries, check authorization information, and either forward legitimate queries to the real root node or block malicious ones, thereby protecting the system from attacks while maintaining resolution functionality.
2Device complexity
If the number of root servers is kept limited, then the DNS architecture remains simple and manageable, but the system becomes more susceptible to single-point failures
Solution Approach 1:
The patent creates a virtual copy of the root node (virtual root node) that replicates the authorization information database. This copy can independently handle DNS resolution requests without needing to constantly communicate with the real root node, thereby providing redundancy and improving availability while maintaining architectural simplicity.
Solution Approach 2:
The patent segments the DNS resolution function into two parts: the real root node that maintains the authoritative authorization information database, and the virtual root node that provides backup resolution services. This segmentation allows the system to maintain simplicity at the authoritative level while adding redundancy at the service level.
Data Source
AI summary
The present invention provides a DNS security system and failure processing method. The DNS security system comprises: at least one client, configured to initiate a DNS request; a root node, configured to provide authorization information to the DNS request; an authorization information database, configured to store all DNS requests and corresponding authorization information in a designated area; a virtual root node, configured to invoke corresponding authorization information from the authorization information database when a DNS resolution failure occurs on the root node, and to provide a resolution service to a corresponding client. Using the present invention enhances the security and stability of DNS resolution.