Secure domain name system to support a private communication service

Patent metadata

Field	Value
Publication number	US-10965651-B2
Application number	US-201715848983-A
Country	US
Kind code	B2
Filing date	Dec 20, 2017
Priority date	Dec 20, 2017
Publication date	Mar 30, 2021
Grant date	Mar 30, 2021

Abstract

Described herein are systems, methods, and software to enhance secure communications between computing systems. In one implementation, a private domain name system (DNS) receives a DNS lookup request from a computing system of a plurality of computing systems associated with a private communication group, and forwards the DNS lookup request to a public DNS. The private DNS further receives a public address associated with the DNS lookup request from the public DNS, translates the public address to a private address, and transfers the private address to the requesting computing system.

First claim

What is claimed is:

1. A computer-implemented system for enhancing security of domain name system (DNS) interactions occurring in a communication network comprising at least a first computing system and a second computing system, said system comprising:
a processor;
a memory module communicably coupled to said processor, said memory module storing computer program code, wherein said memory module and said computer program code stored therein are configured, with the processor, to:
establish an overlay network communicably coupling said first computing system and said second computing system;
establish a private domain name system (DNS) accessible only to said first computing system and said second computing system, only through said overlay network;
in response to receiving, from said first computing system, a request for communicating with said second computing system, generate a first secured data packet comprising an encrypted portion and a non-encrypted portion, and wherein said encrypted portion of said first secured data packet incorporates at least a uniform resource locator (URL) corresponding to said second computing system, a private source address corresponding to said first computing system, and a private destination address corresponding to said private DNS;
transmit said first secured data packet to said private DNS over said overlay network, instead of a TCP/IP network protocol stack embedded within said first computing system;
trigger said private DNS to process said first secured data packet and consult a predetermined public DNS to retrieve therefrom at least a public destination address corresponding to said second computing system;
trigger said private DNS to selectively translate said public destination address corresponding to said second computing system, into a private destination address corresponding to said second computing system;
in an event said public destination address corresponding to said second computing system is not translated into said private destination address corresponding to said second computing system, trigger said private DNS to selectively enable said first computing system to communicate with said second computing system using said public destination address, based on a pre-configured policy applicable to said private DNS;
in an event said public destination address corresponding to said second computing system is translated into said private destination address corresponding to said second computing system, trigger said private DNS to encapsulate said private destination address corresponding to said second computing system within an encrypted portion of a second secured data packet; and
trigger said private DNS to transmit said second secured data packet to said first computing system via said overlay network, and trigger said first computing system to establish communication with said second computing device, based on said private addressing information corresponding to said second computing system, embedded within said encrypted portion of said second secured data packet.

2. The system as claimed in claim 1 , wherein said non-encrypted portion of said first secured data packet incorporates a public source address corresponding to said first computing system, a public destination address corresponding to said private DNS, and supplementary information necessary for decrypting said encrypted portion of said first secured data packet.

3. The system as claimed in claim 1 , wherein said supplementary information necessary for decrypting said encrypted portion of said first secured data packet is selected from the group of information consisting of a group identifier, length of said encrypted portion, sequence number of said first secured data packet, a predetermined keyed-hash message authentication code (HMAC), a peer identifier, and a predetermined initialization vector.

4. The system as claimed in claim 1 , wherein said encrypted portion of said second secured data packet further incorporates a private source address corresponding to said private DNS, and a private destination address corresponding to said second computing system.

5. The system as claimed in claim 1 , wherein a non-encrypted portion of said second secured data packet incorporates a public source address corresponding to said second computing system, a public destination address corresponding to said private DNS, and supplementary information necessary for decrypting said encrypted portion of said second secured data packet.

6. The system as claimed in claim 1 , wherein said first computing system is configured to decrypt said encrypted portion of said second secured data packet and retrieve said private destination address corresponding to said second computing system therefrom.

7. The system as claimed in claim 1 , wherein said private DNS is further configured to transmit to said first computing system, said second secured data packet embodying said private destination address, as a DNS lookup response, said private DNS further configured to selectively transmit to said first computing system, said public destination address corresponding to said second computing system as said DNS lookup response, in an event said private destination address corresponding to said public destination address is deemed unavailable.

8. The system as claimed in claim 1 , wherein said private DNS is further configured to selectively block said request for communicating with said second computing system, based on said pre-configured policy applicable to said private DNS, in an event said public destination address corresponding to said second computing system is not translated into said private destination address corresponding to said second computing system.

9. A computer-implemented method for enhancing security of domain name system (DNS) interactions in a communication network comprising at least a first computing system and a second computing system, said method comprising the following computer-implemented steps:
establishing, by a processor, an overlay network communicably coupling said first computing system and said second computing system;
establishing, by said processor, a private domain name system (DNS) accessible only to said first computing system and said second computing system, only through said overlay network;
generating, by said processor, a first secured data packet comprising an encrypted portion and a non-encrypted portion, in response to receiving, from said first computing system, a request for communicating with said second computing system;
embedding, by said processor, at least a uniform resource locator (URL) corresponding to said second computing system, a private source address corresponding to said first computing system, and a private destination address corresponding to said private DNS, into said encrypted portion of said first secured data packet;
transmitting, by said processor, said first secured data packet to said private DNS over said overlay network, instead of a TCP/IP network protocol stack embedded within said first computing system;
processing, by said private DNS, said first secured data packet and consulting, by said private DNS, a predetermined public DNS to retrieve therefrom at least a public destination address corresponding to said second computing system;
selectively translating, by said private DNS, said public destination address corresponding to said second computing system, into a private destination address corresponding to said second computing system;
in an event said public destination address corresponding to said second computing system is not translated into said private destination address corresponding to said second computing system, selectively enabling said first co

Assignees

• Colortokens Inc

Inventors

• Kapoor Anoop
• Farjadi Ryan
• Parekh Pankaj
• Trivedi Ashish
• Tyagi Satyam
• Magganmane Harish
• Mohanty Deepak
• Voleti Ravi

Classifications

• H04L2101/38

  Telephone uniform resource identifier [URI] · CPC title

• H04L61/5007

  Internet protocol [IP] addresses · CPC title

• H04L61/4511

  using domain name system [DNS] · CPC title

• H04L61/2514

  between local and global IP addresses · CPC title

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title