Wildcard DNS Resolution Using Bloom Filter Subdomain Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DNS implementations face limitations in scaling due to the maximum number of supported DNS records, leading to inefficiencies and potential denial of service from malicious or malformed subdomain requests when wildcard DNS records are used without validation.
Innovation Solution
Implementing a probabilistic wildcard-based DNS resolution process using a bloom filter to validate subdomain validity before resolving, routing valid requests to a primary handler and invalid requests to a secondary handler, thereby reducing resource competition.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If wildcard DNS records are used to handle multiple subdomains, then the number of supported subdomains increases beyond the maximum DNS record limit, but the system becomes vulnerable to denial of service attacks from malicious or malformed subdomain requests
Solution Approach 1:
The patent applies preliminary action by validating subdomain requests against a whitelist of authorized subdomains before processing them through the wildcard DNS record. This pre-validation step prevents malicious or malformed requests from consuming server resources, thereby resolving the contradiction between supporting unlimited subdomains and protecting against denial of service attacks.
2Ease of operation
If all subdomain requests are routed to the same handler, then DNS resolution simplicity is maintained, but resource competition increases when valid and invalid requests are mixed
Solution Approach 1:
The patent applies segmentation by dividing subdomain requests into two separate categories: valid requests matching the whitelist pattern and invalid requests not matching the pattern. Each category is routed to different handlers, with valid requests going to the primary application server and invalid requests being rejected or handled separately. This segmentation eliminates resource competition while maintaining clear operational rules for each path.
Data Source
AI summary
Implementations for probabilistic wildcard-based DNS resolution are described. A request to validate a first subdomain is received from a domain name system (DNS) service attempting to resolve a DNS request that identifies the first subdomain. A validation outcome that indicates a guess regarding validity of the first subdomain may be determined based on a probabilistic data structure representing a set of valid subdomains. The validation outcome may be sent to the DNS service to cause the DNS service to resolve the first subdomain based on the validation outcome. In the case of the validation outcome indicating a guess of the first subdomain being valid, the first subdomain is caused to be resolved to a first common subdomain. In the case of the validation outcome indicating a guess of the first subdomain being invalid, the first subdomain is caused to be resolved to a second common subdomain.