Visibility control for domain name system service discovery

Patent metadata

Field	Value
Publication number	US-10057208-B2
Application number	US-201414529725-A
Country	US
Kind code	B2
Filing date	Oct 31, 2014
Priority date	Oct 31, 2014
Publication date	Aug 21, 2018
Grant date	Aug 21, 2018

Abstract

Techniques are provided for performing domain name system (DNS) service discovery based on policy evaluations. In an embodiment, policy data is represented as DNS-SD records and is used to control visibility of services for service requesting devices. The policy data may describe policies for a particular type of a service or a particular service delivery unit. The visibility of service delivery units is determined through evaluations of the policies in policy data. In some embodiments, additional metadata may be retrieved to be used in the policy evaluations. In certain embodiments, based on the policy evaluations service data about only a subset of service delivery units available is returned to a service requesting device in response to a DNS-SD query.

First claim

What is claimed is:

1. A data processing apparatus, comprising:
one or more database units each storing thereon:
domain name system (DNS) service data that associates service namespace data with service identifying data that identifies accessible services, and
DNS policy data that associates the service namespace data with policy data specifying one or more policies and that is configured to control visibility of services for computing devices that are specified in the service identifying data;

one or more transceivers coupled to the database units, wherein each of the transceivers is configured to receive, from a particular computing device, a DNS query to discover one or more services, wherein the DNS query is configured to access resource records in canonical form comprising the service namespace data indicating a service namespace that includes a service domain name;
one or more processors coupled to each of the one or more database units and the one or more transceivers;
one or more memory units storing one or more instructions, which when executed by the one or more processors cause:
in response to receiving, from the particular computing device, the DNS query to discover one or more services, executing the DNS query to discover one or more services by:
using a service selection unit that is coupled to the one or more processors, selecting a plurality of accessible services, from among the service identifying data in the DNS service data, based on the service namespace in the DNS query,
using a policy selection unit coupled to the one or more processors, selecting a policy, from the DNS policy data, based on the service namespace indicated in the DNS query, and
using a policy applying unit coupled to the one or more processors and to the one or more transceivers, applying the policy to generate particular service identifying data that identifies a subset of accessible services selected from the plurality of accessible services;

using the one or more transceivers, transmitting to the particular computing device, a response, to the received DNS query to discover one or more services, that includes the particular service identifying data that identifies the subset of accessible services selected from the plurality of accessible services.

2. The apparatus of claim 1 , wherein the DNS query includes metadata about the particular computing device and wherein the one or more processors executing instruction that cause, using the policy applying unit, applying the policy using the metadata.

3. The apparatus of claim 2 , wherein the metadata comprises at least one of an identity value that identifies the particular computing device, a user identity value, a geographic location value specifying a geo-location of the computing device, an organizational affiliation value specifying an entity associated with the computing device, a user organizational affiliation value, a timestamp value indicating a date or time of day of receiving the DNS query, load values indicating current loads of the plurality of accessible services, availability values specifying current availabilities of the plurality of accessible services, a connection value specifying a connection characteristic of the computing device, or a connection type value specifying a connection type of the computing device.

4. The apparatus of claim 1 , wherein the one or more database units are configured to store the DNS policy data in DNS resource records (RRs) comprising the policy associated with an entry that contains the service domain name.

5. The apparatus of claim 1 , wherein the one or more database units are configured to store the DNS policy data in DNS pointer resource records comprising the policy as a domain name associated with an entry that contains the service domain name.

6. The apparatus of claim 5 , further comprising a FQDN processing unit coupled to the one or more processors, the one or more processors executing one or more instructions to cause:
determining fully qualified domain name of the particular computing device;
applying the policy by comparing the fully qualified domain name with the service domain to select the subset of the plurality of accessible services.

7. The apparatus of claim 6 , wherein the one or more processors executing one or more instructions to cause, using the FQDN processing unit, determining the fully qualified domain name of the particular computing device by performing a reverse DNS lookup.

8. The apparatus of claim 1 , wherein the DNS query is a Domain Name System-based Service Discovery (DNS-SD) query that is received on a multicast connection.

9. The apparatus of claim 8 , further comprising a service delivery unit that is to provide one or more services from the subset of the plurality of accessible services to the computing device.

10. The apparatus of claim 9 , wherein the DNS query is a DNS unicast query, and the apparatus further comprising a DNS server computer comprising the one or more processors executing one or more instructions that cause storing the DNS policy data and selecting the policy based on the DNS unicast query.

11. The apparatus of claim 1 , wherein the apparatus is a unicast DNS server computer.

12. A method comprising:
storing domain name system (DNS) service data that associates service namespace data with service identifying data that identifies accessible services, and DNS policy data that associates the service namespace data with policy data specifying one or more policies that is configured to control visibility of services for computing devices that are specified in the service identifying data;
receiving, from a particular computing device, a DNS query to discover one or more services, wherein the DNS query is configured to access resource records in canonical form comprising the service namespace data indicating a service namespace that includes a service domain name;
in response to receiving, from the particular computing device, the DNS query to discover one or more services, executing the DNS query to discover one or more services by:
selecting a plurality of accessible services, from among the service identifying data in the DNS service data, based on the service namespace in the DNS query,
selecting a policy, from the DNS policy data, based on the service namespace indicated in the DNS query, and
applying the policy to generate particular service identifying data that identifies a subset of accessible services selected from the plurality of accessible services;

transmitting, to the particular computing device, a response, to the received DNS query to discover one or more services, that includes the particular service identifying data that identifies the subset of accessible services selected from the plurality of accessible services;
wherein the method is executed on one or more computing devices.

13. The method of claim 12 , wherein the DNS query includes metadata about the particular computing device and the method further comprising applying the policy using the metadata.

14. The method of claim 13 , wherein the metadata comprises at least one of an identity value that identifies the particular computing device, a user identity value, a geographic location value specifying a geo-location of the computing device, an organizational affiliation value specifying an entity associated with the computing device, a user organizational affiliation value, a timestamp value indicating a date or time of day of receiving the DNS query, load values indicating current loads of the plurality of accessible services, availability values specifying current availabilities of the plurality of acc

Assignees

• Cisco Tech Inc

Inventors

• Droms Ralph
• Donahue Timothy P

Classifications

• G06F17/30554

  Physics · mapped topic

• H04L61/1511 Primary

  Electricity · mapped topic

• G06F17/30477

  Physics · mapped topic

• H04L61/1541

  Electricity · mapped topic

• H04L61/4541 Primary

  Directories for service discovery · CPC title