Method for policy-driven, classifying, and routing traffic using the domain name system

Patent metadata

Field	Value
Publication number	US-11115387-B2
Application number	US-201916373055-A
Country	US
Kind code	B2
Filing date	Apr 2, 2019
Priority date	Feb 4, 2019
Publication date	Sep 7, 2021
Grant date	Sep 7, 2021

Abstract

Systems, methods, and computer-readable storage media are provided for managing application traffic. A routing policy defines the data flow path between the client device (which uses a virtual private network (VPN) client) and the appropriate network-based service. Based on various factors associated with the user, the client device, and the destination (e.g. network-based service), the routing policy will direct the VPN client to communicate with either a public DNS (via the public Internet) or to a private DNS (via the private Intranet). The resulting IP addresses will be used to establish a particular route (either over a public Internet or private Intranet) between the client device and the network-based service in accordance to the routing policy.

First claim

We claim:

1. A method for routing traffic, the method comprising:
instructing a virtual private network (VPN) client to clear any previously resolved domain-name based requests stored in memory;
receiving, at the VPN client, a domain name-based request to access a network-based service at a client device, wherein the VPN client is forced to operate as a DNS proxy in response to clearing of the any of the previously resolved domain-name based requests stored in the memory;
forwarding the domain name-based request from the VPN client acting as the DNS proxy to a policy service;
identifying, by the policy service, a policy for the VPN client of the client device based on receipt of the domain name-based request at the policy service, wherein the policy provides instructions to the VPN client for routing a flow path between the client device and the network-based service;
generating, by the policy service, routing instructions for the VPN client of the client device based on the instructions provided by the identified policy, wherein the routing instructions include identifying whether to route the flow path from the VPN client over a private network or a public network;
routing, from the VPN client, the domain name-based request to a domain name system (DNS) to obtain IP addresses associated with the network-based service, wherein the DNS used to resolve the domain name-based request is based on the routing instructions provided by the identified policy, and wherein the IP addresses are stored in a routing table associated with the VPN client; and
establishing the flow path between the client device and the network-based service, wherein the VPN client routes the flow path to the network-based service using IP addresses stored in the routing table of the VPN client and in accordance with the generated routing instructions.

2. The method of claim 1 , wherein the identified policy is one of a plurality of different policies associated with the policy service, and wherein the identified policy is selected from the plurality of different policies based on one or more factors associated with a user, the client device, and the network-based service.

3. The method of claim 2 , wherein the one or more factors associated with the user includes an identity of the user, and wherein the identity of the user including whether the user is an employee of an enterprise of which the network-based service is associated with.

4. The method of claim 2 , wherein the one or more factors associated with the user includes a geo-location of the user.

5. The method of claim 2 , wherein the one or more factors associated with the client device includes a posture of the client device, and wherein the posture includes whether the client device is a secure computing device.

6. The method of claim 1 , wherein the routing instructions include identifying whether to resolve the domain name-based request at a private DNS or a public DNS.

7. The method of claim 1 further comprising updating routing instructions for the VPN client based on a change in the identified policy for the VPN client.

8. The method of claim 7 , wherein the updates to the routing instructions for the VPN client are performed when the flow path between the client device and the IP address affected by the updated routing instructions is not currently in use.

9. The method of claim 1 , wherein the routing instructions include a pre-determined time period with each of the IP addresses, and wherein after the pre-determined time period expires the VPN client is instructed to discard IP address stored in the routing table.

10. A system for routing traffic, the system comprising:
a processor; and
a computer-readable device storing instructions which, when executed by the processor, cause the processor to perform operations comprising:
instructing a virtual private network (VPN) client to clear any previously resolved domain-name based requests stored in memory;
receiving, at the VPN client, a domain name-based request to access a network-based service at a client device, wherein the VPN client is forced to operate as a DNS proxy in response to clearing of the any of the previously resolved domain-name based requests stored in the memory;
forwarding the domain name-based request from the VPN client acting as the DNS proxy to a policy service;
identifying, by the policy service, a policy for the VPN client of the client device based on receipt of the domain name-based request at the policy service, wherein the policy provides instructions to the VPN client for routing a flow path between the client device and the network-based service;
generating, by the policy service, routing instructions for the VPN client of the client device based on the instructions provided by the identified policy, wherein the routing instructions include identifying whether to route the flow path from the VPN client over a private network or a public network;
routing, from the VPN client, the domain name-based request to a domain name system (DNS) to obtain IP addresses associated with the network-based service, wherein the DNS used to resolve the domain name-based request is based on the routing instructions provided by the identified policy, and wherein the IP addresses are stored in a routing table associated with the VPN client; and
establishing the flow path between the client device and the network-based service, wherein the VPN client routes the flow path to the network-based service using the IP addresses stored in the routing table of the VPN client and in accordance with the generated routing instructions.

11. The system of claim 10 , wherein the identified policy is one of a plurality of different policies associated with the policy service, and wherein the identified policy is selected from the plurality of different policies based on one or more factors associated with a user, the client device, and the network-based service.

12. The system of claim 10 , wherein the instructions further include updating routing instructions for the VPN client based on a change in the identified policy for the VPN client, and wherein the updates to the routing instructions for the VPN client are performed when the flow path between the client device and the IP address affected by the updated routing instructions is not currently in use.

13. The system of claim 10 , wherein the routing instructions include identifying whether to resolve the domain name-based request at a private DNS or a public DNS.

14. A computer-readable device storing instructions which, when executed by a computer device, cause the computer device to perform operations comprising:
instructing a virtual private network (VPN) client to clear any previously resolved domain-name based requests stored in memory;
receiving, at the VPN client, a domain name-based request to access a network-based service at a client device, wherein the VPN client is forced to operate as a DNS proxy in response to clearing of the any of the previously resolved domain-name based requests stored in the memory;
forwarding the domain name-based request from the VPN client acting as the DNS proxy to a policy service;
identifying, by the policy service, a policy for the VPN client of the client device based on receipt of the domain name-based request at the policy serve, wherein the policy provides instructions to the VPN client for routing a flow path between the client device and the network-based service;
generating, by the policy service, routing instructions for the VPN client of the client device based on the instructions provided by the identified policy, wherein the routing instruc

Assignees

• Cisco Tech Inc

Inventors

• Bosch Peter
• Duminuco Alessandro
• Napper Jeffrey
• Mullender Sape Jurrien
• Ward David Delano

Classifications

• H04L63/0272 Primary

  Virtual private networks · CPC title

• H04L61/59

  using proxies for addressing · CPC title

• H04L61/5007

  Internet protocol [IP] addresses · CPC title

• H04L61/4511

  using domain name system [DNS] · CPC title

• H04L63/0281

  Proxies · CPC title