# US 10,375,020 B2 · Security policy for HTTPS using DNS > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,020 B2 - Document ID: US10375020B2 - Status: Granted - Kind: B2 - Application number: 15/408,616 - Filed: 2017-01-18 - Published: 2018-07-19 - Granted: 2019-08-06 - Earliest claimed: 2017-01-18 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Daniel G. Wing; K. Tirumaleswar Reddy; Prashanth Patil - Web page: https://patentgrep.com/patent/US10375020B2 ## CPC - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 61/4511: using domain name system [DNS] - H04L 63/101: {Access control lists [ACL]} - H04L 63/168: {above the transport layer} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 2463/121: Timestamp - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one embodiment, a browser operating on a host device receives, from a user, a request to access a web server that includes a Uniform Resource Locator (URL) associated with the web server. In response, the browser sends, to a Domain Name System (DNS) server, a request for an Internet Protocol (IP) address correlated with the domain hosting the URL, and receives, from the DNS server, a response that comprises a block policy IP address and an appropriate error code. Based on this IP address and the error code indicated in the response, the browser renders an access denied page indicating that access to the web server associated with the URL is not permitted, wherein at least a portion of the access denied page is stored in memory accessible to the browser prior to sending the request for the IP address correlated with the domain that is hosting the URL. ## Claims ### Claim 1 A method comprising: receiving, at a browser operating on a host device, a request to access a web server, wherein the request comprises a Uniform Resource Locator (URL) associated with the web server; sending, to a Domain Name System (DNS) server, a request for an Internet Protocol (IP) address correlated with a domain hosting the URL; receiving, from the DNS server, a response to the request for the IP address correlated with the domain hosting the URL, wherein the response comprises a block policy IP address and an error code; and based on the block policy IP address and the error code indicated in the response, rendering, by the browser, an access denied page indicating that access to the web server associated with the URL is not permitted, wherein at least a portion of the access denied page is stored in memory accessible to the browser prior to the sending of the request for the IP address correlated with the domain hosting the URL, wherein the block policy IP address comprises a subnet mask indicating a category of content hosted by the web server associated with the URL, wherein the category of content is prohibited by a rule or policy associated with an administrative domain to which the host device is connected. ### Claim 2 (depends on 1) The method of claim 1, wherein the block policy IP address does not correspond to a reachable IP address. ### Claim 3 (depends on 1) The method of claim 1, wherein an indication of the category is rendered in the access denied page. ### Claim 4 (depends on 1) The method of claim 1, wherein the error code is indicated in a last octet of the block policy IP address. ### Claim 5 (depends on 1) The method of claim 1, further comprising receiving, at the browser, a first configuration file, wherein the first configuration file includes a first set of error codes. ### Claim 6 (depends on 5) The method of claim 5, wherein the host device receives the first configuration file in response to logging onto an administrative domain. ### Claim 7 (depends on 5) The method of claim 5, wherein the first configuration file further includes a Time to Live (TTL) parameter associated with the first set of error codes, wherein the TTL parameter indicates a duration that the first set of error codes is valid. ### Claim 8 (depends on 1) The method of claim 1, wherein the access denied page includes a selectable link, which when selected, causes the browser to render rules or policies associated with an administrative domain to which the host device is connected. ### Claim 9 (depends on 1) The method of claim 1, further comprising determining, by the browser, that the response to the request for the IP address correlated with the domain hosting the URL is not a valid response, wherein the determining is made without using a root certificate associated with a security server. ### Claim 10 (depends on 1) The method of claim 1, further comprising sending a message to a URL provided in the response, wherein the message comprises an indication notifying a server associated with the URL provided in the response of the request for the IP address correlated with the domain hosting the URL. ### Claim 11 (depends on 1) The method of claim 1, wherein the rendering of the access denied page is triggered by a plug-in extension to the browser operating on the host device. ### Claim 12 An apparatus comprising: a network interface unit configured to enable network communications; a memory; and a processor, coupled to the network interface unit and the memory, and configured to: receive a request to access a web server, wherein the request comprises a Uniform Resource Locator (URL) associated with the web server; send, to a Domain Name System (DNS) server, a request for an Internet Protocol (IP) address correlated with a domain hosting the URL; receive, from the DNS server, a response to the request for the IP address correlated with the domain hosting the URL, wherein the response comprises a block policy IP address and an error code; and based on the block policy IP address and the error code indicated in the response, render an access denied page indicating that access to the web server associated with the URL is not permitted, wherein at least a portion of the access denied page is stored in the memory prior to the sending of the request for the IP address correlated with the domain hosting the URL, wherein the block policy IP address comprises a subnet mask indicating a category of content hosted by the web server associated with the URL, wherein the category of content is prohibited by a rule or policy associated with an administrative domain to which the host device is connected. ### Claim 13 (depends on 12) The apparatus of claim 12, wherein the processor is further configured to receive a first configuration file, wherein the first configuration file includes a first set of error codes. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the processor is further configured to receive the first configuration file in response to the apparatus logging onto an administrative domain. ### Claim 15 A non-transitory computer readable storage media storing executable instructions that are operable in a computing device, to perform operations to: receive a request to access a web server, wherein the request comprises a Uniform Resource Locator (URL) associated with the web server; send, to a Domain Name System (DNS) server, a request for an Internet Protocol (IP) address correlated with a domain hosting the URL; receive, from the DNS server, a response to the request for the IP address correlated with the domain hosting the URL, wherein the response comprises a block policy IP address and an error code; and based on the block policy IP address and the error code indicated in the response, render an access denied page indicating that access to the web server associated with the URL is not permitted, wherein at least a portion of the access denied page is stored in memory accessible to the browser prior to the sending of the request for the IP address correlated with the domain hosting the URL, wherein the block policy IP address comprises a subnet mask and an octet indicating a category of content hosted by the web server associated with the URL. ### Claim 16 (depends on 15) The non-transitory computer readable storage media of claim 15, further comprising instructions that are operable to receive a first configuration file, wherein the first configuration file includes a first set of error codes. ### Claim 17 (depends on 16) The non-transitory computer readable storage media of claim 16, further comprising instructions that are operable to receive the first configuration file in response to logging onto an administrative domain.