VPN Virtual IP Mapping to Reduce DNS Tunnel Delay

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Name resolution in virtual private networks (VPNs) is a significant bottleneck that slows down connection speed and compromises security due to the need for DNS lookups over the VPN tunnel, which exposes data to security risks.

Innovation Solution

Implementing a system where VPN clients and servers use consistent hashing or compression algorithms to assign virtual IP addresses based on hostnames, allowing connections to proceed without complete DNS resolution, and only resolving hostnames when necessary, thus minimizing data traversal over the VPN tunnel.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If DNS resolution is performed over the VPN tunnel, then hostname resolution can be achieved, but connection speed deteriorates and security is compromised

Engineering Contradiction:

ImprovesecurityVSAvoidconnection speed

Core Design Contradiction:

ReliabilityVSSpeed

Solution Approach 1:

The patent extracts the DNS resolution process from the VPN tunnel by introducing a split-DNS architecture where local resolvers handle resolution requests without forwarding them through the encrypted tunnel. This separates the hostname resolution function from the VPN data path, eliminating the security risk and speed penalty of tunneling DNS queries.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces local resolver intermediaries (such as DNS-over-HTTPS clients or local DNS servers) that mediate between applications and the remote DNS infrastructure. These intermediaries perform resolution locally using alternative mechanisms (DoH, DoT, or local cache) without requiring tunnel traversal, thus protecting against DNS leakage while maintaining resolution functionality.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Loss of time

If complete DNS resolution is performed before connection, then accurate routing is achieved, but connection establishment time increases

Engineering Contradiction:

Improveconnection establishment timeVSAvoidrouting accuracy

Core Design Contradiction:

Loss of timeVSMeasurement precision

Solution Approach 1:

The patent performs preliminary hostname-to-IP mapping using consistent hashing algorithms that operate on hostname prefixes or portions of hostnames. This preliminary action creates virtual IP addresses that enable immediate connection establishment, with full DNS resolution deferred to a later stage when the connection is already established.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent segments the DNS resolution process into multiple stages: first using hostname portions or prefixes with consistent hashing to obtain virtual IPs for immediate connection, then performing full resolution in the background. This segmentation allows connection establishment to proceed without waiting for complete DNS resolution.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS12457193B2Systems and methods implementing name resolution and virtual addresses to enable network connections

Publication Date: 2025.10.28 GEN DIGITAL INC

AI summary

Systems for performing methods which include receiving by a VPN server, from a VPN client operating on a computing device, over a VPN connection a first message including a first IP address. The VPN server determines a hostname based on the first IP address, resolves the hostname to a second IP address, and transmits the first message to a network device at the second IP address.