Authenticated name resolution

Patent metadata

Field	Value
Publication number	US-11882109-B2
Application number	US-202017062147-A
Country	US
Kind code	B2
Filing date	Oct 2, 2020
Priority date	Oct 3, 2011
Publication date	Jan 23, 2024
Grant date	Jan 23, 2024

Abstract

A method, system, and computer-readable memory containing instructions include receiving a DNS request containing authentication information, validating the authentication information, determining an appropriate action to take based on the validating status, and taking the appropriate action. Actions may include responding with an individualized network layer address or service location address, delaying sending a response message, sending a network layer address or service location address corresponding to a site containing authentication information, and sending a response with a network layer address or service location address with a web address configured to mimic the website related to the requested resource.

First claim

What is claimed is:

1. A method of authenticated Domain Name System (DNS) name resolution performed by an authenticating DNS server, the method comprising:
receiving a DNS request from a user;
determining that the DNS request requires authentication upon examination of the DNS request;
determining whether the DNS request contains authentication information;
determining whether the authentication information is in an expected format and type;
determining whether the authentication information is valid;
upon determining that the DNS request contains the authentication information, the authentication information is in the expected format and type, and the authentication information is valid, returning a DNS response;
upon determining at least one of that the DNS request does not contain the authentication information, the authentication information is not in the expected format and type, or the authentication information is not valid, further determining a security action.

2. The method of claim 1 , further comprising:
upon determining that the DNS request contains the authentication information, the authentication information is in the expected format and type, and the authentication information is valid, further determining a classification for the user based on the authentication information.

3. The method of claim 1 , wherein determining whether the authentication information is valid comprises:
examining the authentication information;
determining whether the user is authenticated in accordance with implemented caching guidelines upon examining an authentication cache;
upon determining that the user is authenticated, validating the user as authenticated; and
upon determining that the user is not authenticated, executing a query to a resource authentication interface.

4. The method of claim 3 , wherein determining whether the authentication information is valid further comprises:
upon executing the query to the resource authentication interface, determining whether the resource authentication interface returns a valid response,
upon determining that the resource authentication interface returns the valid response, validating the user as authenticated;
upon determining that the resource authentication interface does not return the valid response, further determining that the user is not authenticated.

5. The method of claim 2 , wherein determining the classification for the user comprises:
determining one or more available classifications for the user;
determining the classification for the user, wherein the determined classification is at least one of the one or more available classifications, and
tracking the determined classification for the user.

6. The method of claim 5 , wherein the one or more available classification comprises at least one of a high priority user, a middle priority user, a low priority user, a governmental user, an emergency professional user, a high-traffic user, a free user, a paid user, a premium user, or a guest user.

7. The method of claim 1 , wherein the DNS response comprises one or more IPv6 addresses.

8. A system for authenticated Domain Name System (DNS) name resolution, the system comprising an authenticating DNS server having at least one electronic processor that executes instructions to perform actions comprising:
receiving a DNS request from a user;
determining that the DNS request requires authentication upon examination of the DNS request;
determining whether the DNS request contains authentication information;
determining whether the authentication information is in an expected format and type;
determining whether the authentication information is valid;
upon determining that the DNS request contains the authentication information, the authentication information is in the expected format and type, and the authentication information is valid, returning a DNS response;
upon determining at least one of that the DNS request does not contain the authentication information, the authentication information is not in the expected format and type, or the authentication information is not valid, further determining a security action.

9. The system of claim 8 , further performing actions comprising:
upon determining that the DNS request contains the authentication information, the authentication information is in the expected format and type, and the authentication information is valid, further determining a classification for the user based on the authentication information.

10. The system of claim 8 , wherein determining whether the authentication information is valid comprises:
examining the authentication information;
determining whether the user is authenticated in accordance with implemented caching guidelines upon examining an authentication cache;
upon determining that the user is authenticated, validating the user as authenticated; and
upon determining that the user is not authenticated, executing a query to a resource authentication interface.

11. The system of claim 10 , wherein determining whether the authentication information is valid further comprises:
upon executing the query to the resource authentication interface, determining whether the resource authentication interface returns a valid response,
upon determining that the resource authentication interface returns the valid response, validating the user as authenticated;
upon determining that the resource authentication interface does not return the valid response, further determining that the user is not authenticated.

12. The system of claim 9 wherein determining the classification for the user comprises:
determining one or more available classifications for the user;
determining the classification for the user, wherein the determined classification is at least one of the one or more available classifications, and
tracking the determined classification for the user.

13. The system of claim 12 , wherein the one or more available classification comprises at least one of a high priority user, a middle priority user, a low priority user, a governmental user, an emergency professional user, a high-traffic user, a free user, a paid user, a premium user, or a guest user.

14. The system of claim 8 , wherein the DNS response comprises one or more IPv6 addresses.

15. A non-transitory computer-readable medium containing instructions which, when executed by at least one electronic processor, perform a method for authenticated Domain Name System (DNS) name resolution comprising:
receiving a DNS request from a user;
determining that the DNS request requires authentication upon examination of the DNS request;
determining whether the DNS request contains authentication information;
determining whether the authentication information is in an expected format and type;
determining whether the authentication information is valid;
upon determining that the DNS request contains the authentication information, the authentication information is in the expected format and type, and the authentication information is valid, returning a DNS response;
upon determining at least one of that the DNS request does not contain the authentication information, the authentication information is not in the expected format and type, or the authentication information is not valid, further determining a security action.

16. The non-transitory computer-readable medium of claim 15 , performing the method further comprising:
upon determining that the DNS request contains the authentication information, the authentication information is in the expected format and type, and th

Assignees

• Verisign Inc

Inventors

• Mcpherson Danny
• Waldron Joseph
• Osterweil Eric

Classifications

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L61/4511

  using domain name system [DNS] · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title