Domain name system cache integrity check

Patent metadata

Field	Value
Publication number	US-9300623-B1
Application number	US-201414183518-A
Country	US
Kind code	B1
Filing date	Feb 18, 2014
Priority date	Feb 18, 2014
Publication date	Mar 29, 2016
Grant date	Mar 29, 2016

Abstract

A domain name system (DNS) cache integrity check system is provided. The system comprises a checking server which comprises an application stored in a memory that, when executed by a processor, checks domain name to internet protocol (IP) address mappings amongst a plurality of DNS cache servers. The checking application consults a valid list data store and identifies a discrepant domain name to IP address mapping. The application requests for a mapping list from an authoritative DNS server. The checking application compares the discrepant mapping to the authoritative DNS server list, if the discrepant mapping is located on the authoritative DNS server list, the discrepant mapping is authorized and written to the valid list, if the discrepant mapping is not located on the authoritative DNS server list, the DNS cache server with the discrepant mapping is flushed and replaced with an authorized mapping from the authoritative DNS server list.

First claim

What is claimed is:

1. A method of facilitating a domain name system (DNS) cache integrity check system, comprising:
checking each of a plurality of domain name to internet protocol (IP) address mappings of a plurality of DNS cache servers via a checking application of a checking server;
consulting a valid list data store, wherein the valid list data store comprises a plurality of authorized domain name to IP address mappings;
in response to consulting the valid list, identifying a discrepant domain name to IP address mapping by the checking server, wherein the discrepant domain name to IP address mapping is a domain name to IP address mapping stored in a DNS cache server that is not located on the valid list;
in response to identifying a discrepant domain name to IP address mapping, requesting a domain name to IP address mapping for at least one of the DNS cache servers from an authoritative DNS server by the checking application; and
writing the authorized domain name to IP address mapping received from the authoritative DNS server to the valid list.

2. The method of claim 1 , wherein the checking application requests the domain name to IP address mapping from the authoritative DNS server over a transmission control protocol (TCP) session connection.

3. The method of claim 2 , wherein the authorized domain name to IP address mapping is received from the authoritative DNS server in response to the request for the domain name to IP address mapping sent to the authoritative DNS server over the TCP session connection.

4. The method of claim 1 , further comprising: determining that the discrepant domain name to IP address mapping is not authorized by the authoritative DNS server; and deleting an unauthorized domain name to IP address mapping from the DNS cache server that stores the unauthorized domain name to IP address mapping.

5. The method of claim 4 , further comprising writing an authorized domain name to IP address mapping for the domain name identified in the unauthorized domain name to IP address mapping into the DNS cache server from which the unauthorized domain name to IP address mapping is deleted.

6. The method of claim 1 , wherein a snapshot of all of the domain name to IP address mappings of the plurality of DNS cache servers is taken by the checking application, and wherein the snapshot is a file that stores all of the domain name to IP address mappings.

7. The method of claim 6 , wherein the checking application checks the snapshot file to see if there are any discrepancies, wherein if there are, the checking application uses the file from the snapshot to compare the discrepant domain name to IP address mapping to the valid list, and wherein if there are no discrepancies, the snapshot file is cleared.

8. A method of enacting a domain name system (DNS) cache integrity check system, comprising:
checking each of a plurality of domain name system (DNS) records of a plurality of DNS cache servers via a checking application of a checking server;
consulting a valid list data store, wherein the valid list data store comprises a plurality of authorized DNS records;
in response to consulting the valid list, identifying at least one DNS record that is not located on the valid list via the checking server;
in response to identifying a discrepant DNS record, requesting a DNS record from an authoritative DNS server via the checking server, wherein a discrepant DNS record is a DNS record that is not located on the valid list; and
in response to receiving a response from the authoritative DNS server, comparing the discrepant DNS record with the response received from the authoritative DNS server via the checking server, wherein if the discrepant DNS record is located in the response received from the authoritative DNS server, the DNS record is written on to the valid list, and wherein if the discrepant DNS record is not located in the response received from the authoritative DNS server, the DNS cache server with the discrepant DNS record flushes the discrepant DNS record and replaces the discrepant DNS record with a DNS record received in the response from the authoritative DNS server.

9. The method of claim 8 , wherein the checking server requests the DNS record from the authoritative domain name system server using a transmission control protocol (TCP) session connection.

10. The method of claim 9 , wherein the internet protocol address of the checking server is not a well-known internet protocol address.

11. The method of claim 10 , wherein the response received from the authoritative DNS server via the checking application of the checking server comprises all valid values of the identified DNS record.

12. The method of claim 8 , wherein if the discrepant DNS record is not identified in the response received from the authoritative DNS server, a notification is transmitted.

13. The method of claim 12 , wherein the notification is transmitted to an employee of a telecommunications service provider, and wherein the employee is one of a system administrator, an information security technologist, or a manager.

14. The method of claim 13 , wherein the notification comprises the discrepant DNS record.

15. A domain name system checking server, comprising;
a processor;
a memory; and
an application stored in the memory that, when executed by the processor,
accesses a plurality of domain name to internet protocol (IP) address mappings stored by a plurality of DNS cache servers,
compares the plurality of domain name to IP address mappings stored by the plurality of DNS cache servers,
requests at least one domain name to IP address mapping for at least one domain name accessed from at least one of the DNS cache servers from an authoritative DNS server, and
stores the at least one domain name to IP address mapping received from the authoritative DNS server in at least one DNS cache server.

16. The system of claim 15 , wherein the application further
accesses a plurality of domain name system (DNS) records stored by the plurality of DNS cache servers,
compares the plurality of DNS records stored by the plurality of DNS cache servers,
requests at least one DNS record accessed from at least one of the DNS cache servers from an authoritative DNS server, and
stores the at least one DNS record received from the authoritative DNS server in at least one DNS cache server.

17. The system of claim 15 , wherein the application accesses and compares the DNS cache servers at intervals of about every four minutes.

18. The system of claim 15 , wherein the application accesses and compares the DNS cache servers in intervals of about every minute, about every two minutes, about every five minutes, about every ten minutes, about every thirty minutes, or about every hour.

19. The method of claim 15 , wherein the domain name to IP address mappings used in each of the DNS cache servers are given a time to live period of less than one day, at least one day, or another predefined period of time from the authoritative DNS server.

20. The system of claim 15 , wherein the domain name system checking server is communicatively coupled to a network, and wherein the network comprises a public communication network, a private communication network, or a combination thereof.

Assignees

• Sprint Communications Co

Inventors

• Earl Bryson
• Szymanski Todd M

Classifications

• H04L61/1511 Primary

  Electricity · mapped topic

• H04L61/1552

  Electricity · mapped topic

• H04L61/6009

  Electricity · mapped topic

• H04L61/4552

  Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories · CPC title

• H04L61/4511 Primary

  using domain name system [DNS] · CPC title