# US 10,375,117 B2 · Apparatus and method for securely connecting to a remote server > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,117 B2 - Document ID: US10375117B2 - Status: Granted - Kind: B2 - Application number: 16/150,122 - Filed: 2018-10-02 - Published: 2019-01-31 - Granted: 2019-08-06 - Earliest claimed: 2016-02-24 - Assignees: QUALCOMM Incorporated - Applicants: QUALCOMM Incorporated - Inventors: Jeffree Froelicher; Lalitha B. S. Suryanarayana; Giridhar Dhati Mandyam - Web page: https://patentgrep.com/patent/US10375117B2 ## CPC - H04L 63/164: {at the network layer} - H04L 61/4511: using domain name system [DNS] - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for securely connecting to a remote server that provides improved Internet security. In the method, a client receives a request to connect to a remote server associated with a domain name. The client, when resolving the domain name, determines whether the remote server supports at least one predetermined IP layer security protocol. The client performs a key exchange protocol with the remote server to generate at least one shared secret in response to determining that the remote server supports the at least one predetermined IP layer security protocol. The client connects to the remote server using the at least one shared secret in the IP layer security protocol. ## Claims ### Claim 1 A method for securely connecting to a remote server, comprising: receiving, by a client, a request to connect to a remote server associated with a domain name; in response to receiving the request to connect to the remote server associated with the domain name, obtaining a Domain Name System (DNS) resolution from a Domain Name System (DNS) server, the DNS resolution obtained from the DNS server including an Internal Protocol (IP) address for the remote server, the DNS resolution obtained from the DNS server further including a service (SRV) record, the SRV record included in the DNS resolution obtained from the DNS server including at least one parameter indicating that the remote server supports at least one defined IP layer security protocol; determining, by the client, that the remote server supports the at least one defined IP layer security protocol based on the at least one parameter indicating that the remote server supports the at least one defined IP layer security protocol included in the SRV record included in the DNS resolution obtained from the DNS server; performing, by the client, a key generation protocol with the remote server to generate at least one shared secret in response to determining that the remote server supports the at least one defined IP layer security protocol; and connecting, by the client, to the remote server using a key that is based on the at least one shared secret in the at least one defined IP layer security protocol. ### Claim 2 (depends on 1) The method of claim 1, wherein the DNS resolution is obtained from the DNS server using a secure DNS protocol. ### Claim 3 (depends on 1) The method of claim 1, wherein the request to connect to the remote server associated with the domain name is a request from a browser using a Uniform Resource Locator (URL) that includes the domain name associated with the remote server. ### Claim 4 An apparatus for securely connecting to a remote server, comprising: means for receiving a request to connect to a remote server associated with a domain name; means for, in response to receiving the request to connect to the remote server associated with the domain name, obtaining a Domain Name System (DNS) resolution from a Domain Name System (DNS) server, the DNS resolution obtained from the DNS server including an Internal Protocol (IP) address for the remote server, the DNS resolution obtained from the DNS server further including a service (SRV) record, the SRV record included in the DNS resolution obtained from the DNS server including at least one parameter indicating that the remote server supports at least one defined IP layer security protocol; means for determining that the remote server supports the at least one defined IP layer security protocol when resolving the domain name based on the at least one parameter indicating that the remote server supports the at least one defined IP layer security protocol included in the SRV record included in the DNS resolution obtained from the DNS server; means for performing a key generation protocol with the remote server to generate at least one shared secret in response to determining that the remote server supports the at least one defined IP layer security protocol; and means for connecting to the remote server using a key that is based on the at least one shared secret in the at least one defined IP layer security protocol. ### Claim 5 (depends on 4) The apparatus of claim 4, wherein the DNS resolution is obtained from the DNS server using a secure DNS protocol. ### Claim 6 (depends on 4) The apparatus of claim 4, wherein the request to connect to the remote server associated with the domain name is a request from a browser using a Uniform Resource Locator (URL) that includes the domain name associated with the remote server. ### Claim 7 An apparatus, comprising: a processor configured to: receive a request to connect to a remote server associated with a domain name; in response to receiving the request to connect to the remote server associated with the domain name, obtain a Domain Name System (DNS) resolution from a Domain Name System (DNS) server, the DNS resolution obtained from the DNS server including an Internal Protocol (IP) address for the remote server, the DNS resolution obtained from the DNS server further including a service (SRV) record, the SRV record included in the DNS resolution obtained from the DNS server including at least one parameter indicating that the remote server supports at least one defined IP layer security protocol; determine that the remote server supports the at least one defined IP layer security protocol when resolving the domain name based on the at least one parameter indicating that the remote server supports the at least one defined IP layer security protocol included in the SRV record included in the DNS resolution obtained from the DNS server; perform a key generation protocol with the remote server to generate at least one shared secret in response to determining that the remote server supports the at least one defined IP layer security protocol; and connect to the remote server using a key that is based on the at least one shared secret in the at least one defined IP layer security protocol. ### Claim 8 (depends on 7) The apparatus of claim 7, wherein the DNS resolution is obtained from the DNS server using a secure DNS protocol. ### Claim 9 (depends on 7) The apparatus of claim 7, wherein the request to connect to the remote server associated with the domain name is a request from a browser using a Uniform Resource Locator (URL) that includes the domain name associated with the remote server. ### Claim 10 A non-transitory computer-readable medium, comprising: code for causing a computer to receive a request to connect to a remote server associated with a domain name; code for causing the computer to, in response to receiving the request to connect to the remote server associated with the domain name, obtain a Domain Name System (DNS) resolution from a Domain Name System (DNS) server, the DNS resolution obtained from the DNS server including an Internal Protocol (IP) address for the remote server, the DNS resolution obtained from the DNS server further including a service (SRV) record, the SRV record included in the DNS resolution obtained from the DNS server including at least one parameter indicating that the remote server supports at least one defined IP layer security protocol; code for causing the computer to determine that the remote server supports the at least one defined IP layer security protocol when resolving the domain name based on the at least one parameter indicating that the remote server supports the at least one defined IP layer security protocol included in the SRV record included in the DNS resolution obtained from the DNS server; code for causing the computer to perform a key generation protocol with the remote server to generate at least one shared secret in response to determining that the remote server supports the at least one defined IP layer security protocol; and code for causing the computer to connect to the remote server using a key that is based on the at least one shared secret in the at least one defined IP layer security protocol. ### Claim 11 (depends on 10) The non-transitory computer-readable medium of claim 10, wherein the DNS resolution is obtained from the DNS server using a secure DNS protocol. ### Claim 12 (depends on 10) The non-transitory computer-readable medium of claim 10, wherein the request to connect to the remote server associated with the domain name is a request from a browser using a Uniform Resource Locator (URL) that includes the domain name associated with the remote server.