Configuring hostname based firewall policies

Patent metadata

Field	Value
Publication number	US-2020366648-A1
Application number	US-201916412219-A
Country	US
Kind code	A1
Filing date	May 14, 2019
Priority date	May 14, 2019
Publication date	Nov 19, 2020
Grant date	—

Abstract

A hostname based access configuration system (HNACS) is provided for configuring a host-based firewall to implement firewall policies referencing hostnames. The HNACS defines a hostname based firewall policy (HNFP) referencing a host server using a corresponding hostname instead of an internet protocol (IP) address. The HNACS incorporates the HNFP onto the host-based firewall but renders the HNFP non-implementable on the computing device until a domain name system (DNS) query is generated. If the DNS query includes the hostname in the HNFP, the HNACS determines a mapping between the hostname specified in the DNS query and an IP address corresponding to the hostname (obtained via a DNS response corresponding to the DNS query). Based on the mapping, the HNFP is transformed via an implicit replacement of the hostname in the HNFP with the IP address of the host server, thereby rendering the HNFP executable on the host-based firewall.

First claim

What is claimed is:

1 . A computer-implemented method for configuring a host-based firewall installed on a computing device to implement firewall policies referencing hostnames, said method comprising the following computer-implemented steps:
defining at least one hostname based firewall policy referencing a host server using a corresponding hostname, instead of an internet protocol (IP) address assigned to said host server; updating said host-based firewall installed on said computing device, by incorporating said hostname based firewall policy onto said host-based firewall, and rendering said hostname based firewall policy non-implementable on said computing device until said computing device generates a domain name system (DNS) query requesting access to said host server referenced by said hostname based firewall policy; on initiation of said DNS query from said computing device, intercepting said DNS query and determining whether said intercepted DNS query comprises said hostname incorporated within said hostname based firewall policy and referencing said host server; on determining that said intercepted DNS query comprises said hostname incorporated within said hostname based firewall policy for referencing said host server, passing said intercepted DNS query to a DNS server and intercepting a DNS response received from said DNS server in response to said intercepted DNS query; resolving said intercepted DNS response, and determining, based on said intercepted DNS response, a mapping between said hostname specified in said intercepted DNS query and an IP address corresponding to said hostname, said IP address being a destination IP address assumed to said host server; and based on said mapping between said hostname and said IP address corresponding to said hostname, transforming said hostname based firewall policy by implicitly replacing said hostname incorporated within said hostname based firewall policy with said IP address assigned to said host server, thereby rendering said hostname based firewall policy executable on said host-based firewall installed on said computing device, and thereby allowing said host-based firewall to implement said hostname based firewall policy in a manner equivalent to implementation of a host-based firewall policy.

2 . The computer-implemented method as claimed in claim 1 , wherein the method further comprises the step of storing said mapping between said hostname specified in said intercepted DNS query and said IP address corresponding to said hostname, and a time-to-live value assigned to said mapping, in a local cache of said computing device.

3 . The computer-implemented method as claimed in claim 2 , wherein the method further comprises the step of determining whether said hostname incorporated within said hostname based firewall policy is mapped to a plurality of destination IP addresses corresponding to respective host servers, and subsequently storing each mapping between said hostname and each of said destination IP addresses, in said local cache, along with a time-to-live value assigned to said each mapping.

4 . The computer-implemented method as claimed in claim 2 , wherein the method further comprises the step of removing said IP address assigned to said host server from said hostname based firewall policy on expiration of time defined by said time-to-live value assigned to said mapping between said hostname specified in said intercepted DNS query and said IP address corresponding to said hostname.

5 . The computer-implemented method as claimed in claim 1 , wherein the step of transforming said hostname based firewall policy, further includes the step of including a source IP address assigned to said computing device in said hostname based firewall policy.

6 . The computer-implemented method as claimed in claim 1 , wherein the step of defining at least one hostname based firewall policy further includes the step of referencing said host server using a combination of said hostname and a predetermined regular expression, wherein said predetermined regular expression is usable in determining a range of hostnames referenced by said at least one hostname based firewall policy.

7 . The computer-implemented method as claimed in claim 1 , wherein the method further includes the step of periodically verifying said mapping between said hostname specified in said intercepted DNS query and said IP address corresponding to said hostname to identify and provide access to a correct host server by implicitly replacing said hostname incorporated within said hostname based firewall policy with an IP address assigned to said correct host server.

8 . A hostname based access configuration system for configuring a host-based firewall installed on a computing device to implement firewall policies referencing hostnames, said system comprising:
a non-transitory computer-readable storage medium for storing computer program instructions defined by modules of said hostname based access configuration system; and at least one processor communicatively coupled to said non-transitory computer-readable storage medium for executing said computer program instructions defined by said modules of said hostname based access configuration system, said modules comprising:
a policy definition module for defining at least one hostname based firewall policy referencing a host server using a corresponding hostname instead of an internet protocol (IP) address assigned to said host server;
a firewall update module for updating said host-based firewall installed on said computing device by incorporating said hostname based firewall policy onto said host-based firewall, and rendering said hostname based firewall policy non-implementable on said computing device until said computing device generates a domain name system (DNS) query requesting access to said host server referenced by said hostname based firewall policy;
a query-response processing module for intercepting said DNS query initiated from said computing device and determining whether said intercepted DNS query comprises said hostname incorporated within said hostname based firewall policy and referencing said host server;
said query-response processing module for passing said intercepted DNS query to a DNS server and intercepting a DNS response received from said DNS server in response to said intercepted DNS query, on determining that said intercepted DNS query comprises said hostname incorporated within said hosmame based firewall policy for referencing said host server;
a mapping module for resolving said intercepted DNS response, and determining, based on said intercepted DNS response, a mapping between said hostname specified in said intercepted DNS query and an IP address corresponding to said hostname, said IP address being a destination IP address assigned to said host server; and
a policy transformation module for transforming said hostname based firewall policy based on said mapping between said hostname and said IP address corresponding to said hostname by implicitly replacing said hostname incorporated within said hostname based firewall policy with said IP address assigned to said host server, thereby rendering said hostname based firewall policy executable on said host based firewall installed on said computing device, and thereby allowing said host based firewall to implement said hostname based firewall policy in a manner equivalent to implementing a host-based firewall policy.

9 . The system as claimed in claim 8 , wherein said mapping module stores said mapping between said hostname specified in said intercepted DNS query and said IP address corresponding to said hostname, and a time-to-live value assigned to said mapping, in a local cache of

Assignees

• Colortokens Inc

Inventors

• Kuppannan Jayaraghavendran
• Kushwaha Deepak
• Venkataraman Natarajan
• Tutliani Puneet

Classifications

• H04L61/4511

  using domain name system [DNS] · CPC title

• H04L63/0263 Primary

  Rule management · CPC title

• H04L63/0236 Primary

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title