Methods and nodes for deactivating server name indication, SNI, encryption in a telecommunication network

Patent metadata

Field	Value
Publication number	US-12302091-B2
Application number	US-202118023765-A
Country	US
Kind code	B2
Filing date	Jun 2, 2021
Priority date	Sep 1, 2020
Publication date	May 13, 2025
Grant date	May 13, 2025

Abstract

A method for deactivating Server Name Indication, SNI, encryption in a telecommunication network, wherein said telecommunication network comprises a Domain Name System, DNS, server, said method comprising the steps of receiving, by said DNS server, from a User Equipment, UE, a DNS query comprising a Domain Name to be converted to an Internet Protocol, IP, address, determining, by said DNS server, that SNI encryption is to be deactivated for subsequent traffic associated with said Domain Name, forwarding, by said DNS server, said DNS query to an external DNS server, wherein said DNS query comprises said Domain Name and a request for deactivating SNI encryption, receiving, by said DNS server, from said external DNS server, a DNS answer, wherein said DNS answer comprises said converted IP address and wherein said DNS answer is free from encryption keys for encrypting SNI and forwarding, by said DNS server, said DNS answer comprising said converted IP address to said UE, wherein said DNS answer is free from encryption keys such that said UE is not able to encrypt said SNI in said subsequent traffic.

First claim

The invention claimed is:

1. A method for deactivating Server Name Indication, SNI, (SNI) encryption in a telecommunication network, wherein the telecommunication network comprises a Domain Name System (DNS) server, the method comprising the steps of:
receiving, by the DNS server, from a user equipment (UE) a DNS query comprising a Domain Name to be converted to an Internet Protocol (IP) address;
determining, by the DNS server, that SNI encryption is to be deactivated for subsequent traffic associated with the Domain Name;
forwarding, by the DNS server, the DNS query to an external DNS server, wherein the DNS query comprises the Domain Name and a request for deactivating SNI encryption;
receiving, by the DNS server, from the external DNS server, a DNS answer, wherein the DNS answer comprises the converted IP address and wherein the DNS answer is free from encryption keys for encrypting SNI; and
forwarding, by the DNS server, the DNS answer comprising the converted IP address to the UE, wherein the DNS answer is free from encryption keys such that the UE is not able to encrypt the SNI in the subsequent traffic.

2. The method of claim 1 , wherein the step of determining further comprises:
transmitting, by the DNS server, to a Policy and Charging function entity, a user consent request for querying whether the UE has provided a consent for deactivating the SNI encryption; and
receiving, by the DNS server, from the Policy and Charging function entity, a user consent response comprising an indication that the UE has provided the consent for deactivating the SNI encryption.

3. The method of claim 2 ,
wherein the received DNS query and the transmitted user consent request comprise an IP address of the UE for enabling the Policy and Charging function entity to determine whether the UE has provided the user consent.

4. The method of claim 1 , wherein the step of forwarding the DNS query comprises:
forwarding, by the DNS server, the DNS query to an external DNS server, wherein the DNS query comprises an operator identification for identifying an operator of the telecommunication network thereby enabling the external DNS server to determine whether Server Name Indication, SNI, (SNI) encryption may be deactivated for the operator.

5. The method of claim 1 , wherein the DNS answer is free from encryption keys being any of a public key corresponding to the Domain Name and an Encrypted server name indication, ESNI, key corresponding to the Domain Name.

6. A method for supporting of deactivating Server Name Indication (SNI) encryption in a telecommunication network, wherein the telecommunication network comprises a Domain Name System (DNS) server, and a Policy and Charging function entity, the method comprising the steps of:
receiving, by the Policy and Charging function entity, from the DNS server, a user consent request for querying whether the UE has provided a consent for deactivating the SNI encryption;
determining, by the Policy and Charging function entity that the UE has provided the consent for deactivating the SNI encryption; and
transmitting, by the Policy and Charging function entity, to the DNS server, a user consent response comprising an indication that the UE has provided the consent for deactivating the SNI encryption.

7. The method of claim 6 , wherein the received user consent request comprise an IP address of the UE, wherein the step of determining comprises:
determining that the UE has provided the consent based on the received IP address of the UE.

8. The method of claim 7 , wherein the method comprises the initial steps of:
transmitting, by the Policy and Charging function entity, to a Unified Data Repository, UDR, a Query Request message for retrieving policy data of the UE;
receiving, by the Policy and Charging function entity, from the Unified Data Repository, UDR, a Query Response message, wherein the Query Response message comprises the indication that the UE has provided the consent for deactivating the SNI encryption;
storing, by the Policy and Charging function entity, the received indication that the UE has provided the consent for deactivating the SNI encryption.

9. A method for supporting of deactivating Server Name Indication (SNI) encryption in a telecommunication network, by an external Domain Name System (DNS) server in an Internet Protocol (IP) communication system, wherein the external DNS server is arranged to communicate with a DNS server in a telecommunication network, wherein the method comprises the steps of:
receiving, by the external DNS server, from the DNS server in the telecommunication network, a DNS query comprising a Domain Name to be converted to an Internet Protocol (IP) address, and comprising a request for deactivating SNI encryption;
converting, by the external DNS server, the Domain Name to the IP address;
determining, by the external DNS server, that the SNI encryption may be deactivated for the Domain Name; and
transmitting, by the external DNS server, to the DNS server in the telecommunication network a DNS answer, wherein the DNS answer comprises the converted IP address and wherein the DNS answer is free from encryption keys for encrypting the SNI.

10. The method of claim 9 , wherein the received DNS query comprises an operator identification for identifying an operator of the telecommunication network, and wherein the step of determining comprises:
determining that the SNI encryption may be deactivated for the Domain Name based on the operator identification.

11. A Domain Name System (DNS) server arranged for operating in a telecommunication network and for deactivating Server Name Indication (SNI) encryption in the telecommunication network,
receive equipment arranged for receiving, from a user equipment (UE) a DNS query comprising a Domain Name to be converted to an Internet Protocol (IP) address;
process equipment arranged for determining that SNI encryption is to be deactivated for subsequent traffic associated with the Domain Name;
transmit equipment arranged for forwarding the DNS query to an external DNS server, wherein the DNS query comprises the Domain Name and a request for deactivating SNI encryption;
wherein the receive equipment is further arranged for receiving from the external DNS server, a DNS answer, wherein the DNS answer comprises the converted IP address and wherein the DNS answer is free from encryption keys for encrypting SNI;
wherein the transmit equipment is further arranged for forwarding the DNS answer comprising the converted IP address to the UE, wherein the DNS answer is free from encryption keys such that the UE is not able to encrypt the SNI in the subsequent traffic.

12. The DNS server of claim 11 , wherein:
said transmit equipment is arranged for transmitting to a Policy and Charging function entity, a user consent request for querying whether the UE has provided a consent for deactivating the SNI encryption;
said receive equipment is arranged for receiving from the Policy and Charging function entity, a user consent response comprising an indication that the UE has provided the consent for deactivating the SNI encryption.

Assignees

• Ericsson Telefon Ab L M

Inventors

• Muñoz De La Torre Alonso Miguel Angel
• Mas Rosique Maria Luisa
• Ihlar Marcus

Classifications

• H04L61/4511

  using domain name system [DNS] · CPC title

• H04W12/0431

  Key distribution or pre-distribution; Key agreement · CPC title

• H04W12/033 Primary

  of the user plane, e.g. user's traffic · CPC title

• H04L63/0407 Primary

  wherein the identity of one or more communicating identities is hidden (cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00) · CPC title