US 10,757,070 B2Granted

Trustworthiness-verifying DNS server for name resolution

AssigneeInternational Business Machines Corporation

InventorsAaron K. Baughman, Mauro Marzorati, Gregory A. Porpora

Life of this patent

Estimating the term…

Loading patent…

Abstract

A request is received at a local domain name system server (LDNS) from a client application to resolve a domain name. Responsive to the request a WHOIS information corresponding to the domain name is obtained, using which an age of registration of the domain name and a first weighted value based on the age are computed at the LDNS. A host associated with the domain name is accessed to determine whether a type of a service is configured at the host. A second weighted value is computed based on the configuration of the type of the service. A weighted score is computed using the first weighted value and the second weighted value. An action is selected according to the weighted score. The action is applied to a network component in a network where the client application is executing, to control a manner in which the client application communicates with the host.

Claims20

Dependent claims

A method comprising:

obtaining, responsive to receiving at a local domain name system server (LDNS) a request from a client application to resolve a domain name, a WHOIS information corresponding to the domain name;
computing, based on the WHOIS information, using a processor at the LDNS, an age of registration of the domain name;
computing a first weighted value based on the age;
accessing, a host associated with the domain name to determine whether a type of a service is configured at the host;
computing a second weighted value based on the configuration of the type of the service;
computing a weighted score using the first weighted value and the second weighted value;
selecting an action according to the weighted score;
applying the action to a network component in a network where the client application is executing, the applying configuring the network component to control a manner in which the client application communicates with the host;
determining that the weighted score is indicative of an uncertainty in the host being malicious;
configuring, responsive to the uncertainty, the network component, the configuring preventing the host from learning an address associated with the client application;
communicating a correct address of the host to the client application;
and
configuring a Time to Live (TTL) of the correct address below a threshold amount of time.

10 more elements

A computer program product comprising one or more computer-readable storage devices, and program instructions stored on at least one of the one or more storage devices, the stored program instructions comprising:

program instructions to obtain, responsive to receiving at a local domain name system server (LDNS) a request from a client application to resolve a domain name, a WHOIS information corresponding to the domain name;
program instructions to compute, based on the WHOIS information, using a processor at the LDNS, an age of registration of the domain name;
program instructions to compute a first weighted value based on the age;
program instructions to access, a host associated with the domain name to determine whether a type of a service is configured at the host;
program instructions to compute a second weighted value based on the configuration of the type of the service;
program instructions to compute a weighted score using the first weighted value and the second weighted value;
program instructions to select an action according to the weighted score;
program instructions to apply the action to a network component in a network where the client application is executing, the applying configuring the network component to control a manner in which the client application communicates with the host;
program instructions to determine that the weighted score is indicative of an uncertainty in the host being malicious;
program instructions to configure, responsive to the uncertainty, the network component, the configuring preventing the host from learning an address associated with the client application;
program instructions to communicate a correct address of the host to the client application;
and
program instructions to configure a Time to Live (TTL) of the correct address below a threshold amount of time.

10 more elements

A computer system comprising one or more processors, one or more computer-readable memories, and one or more computer-readable storage devices, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, the stored program instructions comprising:

program instructions to obtain, responsive to receiving at a local domain name system server (LDNS) a request from a client application to resolve a domain name, a WHOIS information corresponding to the domain name;
program instructions to compute, based on the WHOIS information, using a processor at the LDNS, an age of registration of the domain name;
program instructions to compute a first weighted value based on the age;
program instructions to access, a host associated with the domain name to determine whether a type of a service is configured at the host;
program instructions to compute a second weighted value based on the configuration of the type of the service;
program instructions to compute a weighted score using the first weighted value and the second weighted value;
program instructions to select an action according to the weighted score;
program instructions to apply the action to a network component in a network where the client application is executing, the applying configuring the network component to control a manner in which the client application communicates with the host;
program instructions to determine that the weighted score is indicative of an uncertainty in the host being malicious;
program instructions to configure, responsive to the uncertainty, the network component, the configuring preventing the host from learning an address associated with the client application;
program instructions to communicate a correct address of the host to the client application;
and
program instructions to configure a Time to Live (TTL) of the correct address below a threshold amount of time.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/191,223Filed 14 Nov 2018 · continuation
Priority: 24 Nov 2015
Published: US 2020/0153790 A114 May 2020
Granted: 25 Aug 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

H04L 61/5053
Address allocation: lease time; Renewal aspects
H04L 61/4511
Using standardised directories; using standardised directory access protocols: using domain name system [DNS]
H04L 63/0227
For separating internal from external traffic, e.g. firewalls: filtering policies
H04L 63/1433
For detecting or protecting against malicious traffic: vulnerability analysis

Family

Application14/950,312Parent of this continuation · filed 24 Nov 2015
US 2020/0153790 A1Pre-grant publication · published 14 May 2020
US 10,212,123 B2Parent of this continuation
US 2017/0149730 A1Published application
US 10,757,070 B2This patent

From the US filing history. Foreign family members aren’t listed.