Managing client-oriented domain name service over Hypertext Transfer Protocol Secure

Patent metadata

Field	Value
Publication number	US-11943258-B2
Application number	US-202117322268-A
Country	US
Kind code	B2
Filing date	May 17, 2021
Priority date	May 17, 2021
Publication date	Mar 26, 2024
Grant date	Mar 26, 2024

Abstract

Various embodiments include network computing devices and methods for managing Domain Name Service (DNS) over Hypertext Transfer Protocol Secure (DoH). A processor of a network computing device may receive from a client computing device a DoH request comprising a public certificate associated with a client identifier. The processor may generate a fingerprint of the public certificate. The processor may obtain a client-specific DoH policy based on an association between the fingerprint of the public certificate and the client-specific DoH policy. The processor may apply the DoH policy to the DoH request to formulate a response to the DoH request.

First claim

What is claimed is:

1. A method performed by a network computing device for managing Domain Name Service (DNS) over Hypertext Transfer Protocol Secure (DoH), comprising:
receiving from a client computing device a DoH request comprising a public certificate associated with a client identifier and DoH request content;
generating a fingerprint of the public certificate;
obtaining a client-specific DoH policy based on an association between the fingerprint of the public certificate and the client-specific DoH policy;
routing the DoH request content to a DNS resolver, wherein the DoH request does not contain any identifying information regarding the client computing device;
receiving a DNS response from the DNS resolver; and
applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request based upon the DNS response.

2. The method of claim 1 , further comprising:
receiving from the client computing device policy parameters; and
configuring the client-specific DoH policy based on the received policy parameters;
wherein obtaining the client-specific DoH policy based on the association between the fingerprint of the public certificate and the client-specific DoH policy comprises obtaining the client-specific DoH policy that is configured based on the received policy parameters.

3. The method of claim 2 , wherein configuring the client-specific DoH policy based on the received policy parameters comprises:
generating the association between the fingerprint of the public certificate and the client-specific DoH policy; and
storing in a data structure the association between the fingerprint of the public certificate and the client-specific DoH policy.

4. The method of claim 1 , wherein applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request comprises:
applying the client-specific DoH policy to the DoH request to perform a DNS-based advertisement management operation; and
formulating the response to the DoH request using an output of the DNS-based advertisement management operation.

5. The method of claim 1 , wherein applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request comprises:
applying the client-specific DoH policy to the DoH request to perform a DNS-based parental control operation; and
formulating the response to the DoH request using an output of the DNS-based parental control operation.

6. The method of claim 1 , wherein applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request comprises:
applying the client-specific DoH policy to the DoH request to perform a DNS-based content filtering operation; and
formulating the response to the DoH request using an output of the DNS-based content filtering operation.

7. A network computing device, comprising:
a processor coupled to the memory and configured with processor-executable instructions to perform operations comprising:
receiving from a client computing device a Domain Name Service (DNS) over Hypertext Transfer Protocol Secure (DoH) request comprising a public certificate associated with a client identifier and DoH request content;
generating a fingerprint of the public certificate;
obtaining a client-specific DoH policy based on an association between the fingerprint of the public certificate and the client-specific DoH policy;
routing the DoH request content to a DNS resolver, wherein the DoH request does not contain any identifying information regarding the client computing device;
receiving a DNS response from the DNS resolver; and
applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request based upon the DNS response.

8. The network computing device of claim 7 , wherein the processor is configured with processor-executable instructions to perform operations further comprising:
receiving from the client computing device policy parameters; and
configuring the client-specific DoH policy based on the received policy parameters;
wherein obtaining the client-specific DoH policy based on the association between the fingerprint of the public certificate and the client-specific DoH policy comprises obtaining the client-specific DoH policy that is configured based on the received policy parameters.

9. The network computing device of claim 8 , wherein the processor is configured with processor-executable instructions to perform operations such that configuring the client-specific DoH policy based on the received policy parameters comprises:
generating the association between the fingerprint of the public certificate and the client-specific DoH policy; and
storing in a data structure the association between the fingerprint of the public certificate and the client-specific DoH policy.

10. The network computing device of claim 7 , wherein the processor is configured with processor-executable instructions to perform operations such that applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request comprises:
applying the client-specific DoH policy to the DoH request to perform a DNS-based advertisement management operation; and
formulating the response to the DoH request using an output of the DNS-based advertisement management operation.

11. The network computing device of claim 7 , wherein the processor is configured with processor-executable instructions to perform operations such that applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request comprises:
applying the client-specific DoH policy to the DoH request to perform a DNS-based parental control operation; and
formulating the response to the DoH request using an output of the DNS-based parental control operation.

12. The network computing device of claim 7 , wherein the processor is configured with processor-executable instructions to perform operations such that applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request comprises:
applying the client-specific DoH policy to the DoH request to perform a DNS-based content filtering operation; and
formulating the response to the DoH request using an output of the DNS-based content filtering operation.

13. A non-transitory processor-readable medium having stored thereon processor-executable instruction configured to cause a processor of a network computing device to perform operations comprising:
receiving from a client computing device a Domain Name Service (DNS) over Hypertext Transfer Protocol Secure (DoH) request comprising a public certificate associated with a client identifier and DoH request content;
generating a fingerprint of the public certificate;
obtaining a client-specific DoH policy based on an association between the fingerprint of the public certificate and the client-specific DoH policy;
routing the DoH request content to a DNS resolver, wherein the DoH request does not contain any identifying information regarding the client computing device;
receiving a DNS response from the DNS resolver; and
applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request based upon the DNS response.

14. The non-transitory processor-readable medium of claim 13 , wherein the stored processor-executable instructions are configured to cause a processor of a network computing device to perform operations further comprising:
receiving from the client computing device policy parameters; and
configuring the client-specific DoH policy based on the received policy pa

Assignees

• Charter Communications Operating Llc

Inventors

• Wright Ethan J
• Wright Matthew James
• Schmidt Wystan

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L9/3263

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L63/166

  at the transport layer · CPC title

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L61/4511

  using domain name system [DNS] · CPC title