VPN Virtual Addressing for Faster, More Secure Name Resolution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Name resolution in virtual private networks (VPNs) is a significant bottleneck that slows down connection speed and compromises security due to the need for DNS lookups over the VPN tunnel, which exposes data to security risks.
Innovation Solution
Implementing a system where the VPN client assigns a virtual IP address to the hostname using a consistent hashing or compression algorithm, allowing the connection to proceed without completing DNS resolution, and the VPN server performs the actual DNS lookup when necessary, thus minimizing the data traverse over the VPN tunnel.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS resolution is performed over the VPN tunnel, then hostname resolution can be completed, but connection speed decreases and security is compromised
Solution Approach 1:
The patent extracts the DNS resolution process from the VPN tunnel by implementing split DNS resolution. The client performs initial DNS queries locally without routing them through the encrypted VPN tunnel, while still maintaining VPN connectivity for actual data traffic. This separates the DNS resolution function from the VPN tunnel traversal, eliminating the security risk and speed penalty of exposing DNS queries over the tunnel.
Solution Approach 2:
The DNS resolution process is segmented into two parts: initial resolution performed by the client using local DNS servers, and subsequent resolution performed by the VPN server for names that need to be resolved within the VPN network. This segmentation allows most DNS traffic to bypass the VPN tunnel while maintaining security for VPN-specific name resolution.
2Ease of operation
If DNS lookups are performed over the VPN tunnel, then hostname resolution is possible, but data exposure to public internet increases security risks
Solution Approach 1:
The patent extracts DNS resolution requests from the VPN tunnel by implementing split DNS resolution where the client performs initial DNS queries locally without routing them through the encrypted VPN tunnel. This separates the DNS resolution function from the VPN tunnel traversal, eliminating the security risk of exposing DNS queries over the tunnel while maintaining hostname resolution capability.
3Reliability
If traditional hostname resolution is used in VPN, then connectivity is established, but time required for connection establishment increases
Solution Approach 1:
The patent implements preliminary DNS resolution by the client before establishing the VPN connection or simultaneously with it. The client resolves hostnames to IP addresses using local DNS servers in advance, so when the VPN connection is established, the actual data traffic can immediately use the pre-resolved IP addresses without waiting for additional DNS lookups through the VPN tunnel.
Solution Approach 2:
The connection establishment process is segmented into DNS resolution phase (performed locally by client) and VPN tunnel establishment phase. This allows DNS resolution to occur in parallel or before VPN setup, eliminating the sequential dependency that would otherwise require DNS queries to traverse the entire VPN tunnel establishment process.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems for performing methods which include receiving by a VPN server, from a VPN client operating on a computing device, over a VPN connection a first message including a first IP address. The VPN server determines a hostname based on the first IP address, resolves the hostname to a second IP address, and transmits the first message to a network device at the second IP address.