Method and system for allowing the use of domain names in enforcing network policy

Patent metadata

Field	Value
Publication number	US-9369345-B2
Application number	US-201113881726-A
Country	US
Kind code	B2
Filing date	Nov 11, 2011
Priority date	Nov 11, 2011
Publication date	Jun 14, 2016
Grant date	Jun 14, 2016

Abstract

A method and a system for creating Internet Protocol address based network policy by using domain name based network policies is disclosed. The domain name based network policies are stored. When a network device receives an record Domain Name System look-up reply, the network device identifies one or more Interact Protocol addresses of one or more host names specified in the address record Domain Name System look-up reply, then determine whether the one or more host names contain a domain name used in one or more domain name based network policies and create one or more Internet Protocol address based network policies.

First claim

The invention claimed is:

1. A method for creating Internet Protocol address based network policy (IPP) at a network device comprising the steps of:
(a) storing one or more domain name based network policies (DNNTP), wherein the DNNTPs contains parameters selected from a group consisting of address of source traffic, one or more domain names of traffic destination, protocol, and algorithm;
(b) examining contents of network traffic passing through the network device;
(c) receiving an address record Domain Name System look-up reply;
(d) identifying one or more Internet Protocol addresses of one or more host names specified in the address record Domain Name System look-up reply;
(e) determining whether the one or more host names contain a domain name used in the one or more DNNTPs;
(f) if the one or more host names contain a domain name used in the one or more DNNTPs, creating one or more IPP with one or more IP addresses of the one or more host names; wherein the IPP contains parameters selected from a group consisting of the address of source traffic, one or more IP addresses of traffic destination, protocol, and algorithm;
(g) if the one or more host names do not contain a domain name used in the one or more DNNTPs, not creating an IPP in relation to the one or more host names;
(h) enforcing the one or more IPP on network traffic based on the IP address of the network traffic;
(i) when more than one IPP is created for a first IP address, enforcing an IPP with higher priority on network traffic with the first IP address;
(j) removing the one or more IPPs from storage after a pre-determined period of time;
wherein the predetermined period of time is based on a time to live (TTL) associated with the address record Domain Name System look-up reply;
wherein the address of source traffic is an TP address, IP address range, or Ethernet address; and
wherein the protocol is transmission control protocol, or user datagram protocol;
wherein the algorithm is selected from a group consisting of a-weight balance, least used, lowest latency or priority.

2. The method of claim 1 , further comprising the steps of:
(k) receiving an address record Domain Name System look-up request;
(l) delivering the address record Domain Name System look-up request;
(m) receiving an address record Domain Name System look-up reply,
(n) delivering the address record Domain Name System look-up reply;
wherein step (n) is performed after step (f).

3. The method of claim 1 , wherein the one or more IPPs are stored at a first server.

4. The method of claim 1 wherein the Internet Protocol address is an internet Protocol version 4 or Internet Protocol version 6 address.

5. The method of claim 1 further comprising the step of:
(o) determining whether the one or more IPP is identical to another existing stored IPP;
and storing the one or more IPP if the one or more IPP is not identical to another existing stored IPP.

6. The method of claim 5 further comprising the step of:
(p) not storing the one or more IPP if the one or more IPP is identical to another existing stored IPP;
(q) updating the time of removing the another existing stored IPP based on the TTL associated with the address record Domain Name System look-up reply.

7. The method of claim 1 wherein the domain name used in a DNNTP contains no, one or more wildcards.

8. The method of claim 2 further comprising the steps of:
(r) receiving a non-address record Domain Name System look-up request;
(s) delivering the non-address record type Domain Name System look-up request;
(t) receiving a non-address record type Domain Name System look-up reply;
(u) delivering the non-address record type Domain Name System look-up reply;
(v) determining whether the non-address record contains a domain name used in one or more DNNTPs; and
wherein steps (r)-(v) are performed before step (k); wherein the non-address record is one of the canonical name record, mail exchange record, name server record, service locator and text record.

9. The method of claim 8 further comprising the steps of:
(w) delivering an address record type Domain Name System look-up request for the non-address record type Domain Name System look-up reply received; and
(x) receiving an address record type Domain Name System look-up reply for the non-address record type Domain Name System look-up reply received.

10. The method of claim 1 further comprising the step of:
(y) changing one or more when the domain name of a DNNTP is changed.

11. A system for creating Internet Protocol address based network policy (IPP) by using domain name comprising:
one or more storage units for storing program instructions executable by one or more processing units, for storing one or more domain name based network policies (DNNTP) and for storing one or more IPP;
one or more network interfaces; and
one or more processing units for executing program instructions stored in the one or more storage units, for methods comprising the steps of:

(a) storing one or more DNNTP, wherein the DNNTPs contains parameters selected from a group consisting of address of source traffic, one or more domain names of traffic destination, protocol, and algorithm;
(b) examining contents of network traffic passing through the network device;
(c) receiving an address record Domain Name System look-up reply through the one or more network interfaces;
(d) identifying one or more Internet Protocol addresses of one or more host names specified in the address record Domain Name System look-up reply;
(e) determining whether the one or more host names contain a domain name used in the one or more DNNTPs; and
(f) if the one or more host names contain a domain name used in the one or more DNNTPs, creating one or more IPP with one or more IP addresses of the one or more host names; wherein the IPP contains parameters selected from a group consisting of the address of source traffic, one or more TP addresses of traffic destination, protocol, and algorithm;
(g) if the one or more host names do not contain a domain name used in the one or more DNNTPs, not creating an IPP in relation to the one or more host names;
(h) enforcing the one or more IPP on network traffic based on the IP address of the network traffic;
(i) when more than one IPP is created for a first IP address, enforcing an IPP with higher priority on network traffic with the first IP address;
(j) removing the one or more IPPs from storage after a pre-determined period of time;
wherein the pre-determined period of time is based on a time to live (TTL) associated with the address record Domain Name System look-up reply;
wherein the address of source traffic is an IP address, IP address range, or Ethernet address;

wherein the protocol is transmission control protocol, user datagram protocol;
wherein the algorithm is selected from a group consisting of weight balance, least used, lowest latency or priority.

12. The system of claim 11 , wherein the one or more processing units are further operable for:
(k) receiving an address record Domain Name System look-up request;
(l) delivering the address record Domain Name System look-up request;
(m) receiving an address record Domain Name System look-up reply;
(n) delivering the address record Domain Name System look-up reply;
wherein step (n) is performed after step (f).

13. The system of claim 12 , wherein the one or more IPPs are stored at a first server.

14. The system of claim 11 wherein the Internet Protocol address is an Internet Protocol version 4 or Inter

Assignees

• Chan Ho Ming
• Yip Chi Pan
• Chan Sze Hon
• Chan Alex Wing Hong
• Chau Kit Wai
• Pismo Labs Technology Ltd

Inventors

• Chan Ho Ming
• Yip Chi Pan
• Chan Sze Hon
• Chan Alex Wing Hong
• Chau Kit Wai

Classifications

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L61/1511

  Electricity · mapped topic

• H04L41/0893 Primary

  Assignment of logical groups to network elements · CPC title

• H04L61/2557

  Translation policies or rules · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title