DNS metadata-based signaling for network policy control
AssigneeCisco Technology, Inc.
InventorsJoseph Michael Clarke, Charles Calvin Byers, Gonzalo Salgueiro
Life of this patent
Estimating the term…
Abstract
In one embodiment, a device in a network intercepts a Domain Name System (DNS) query sent by a node in the network to a DNS service. The device inserts metadata information about the node into the DNS query before sending the DNS query on to the DNS service. The device extracts policy information regarding the node from a DNS response sent from the DNS service back to the node in response to the DNS query. The device implements a network policy for the node within the network based on the policy information extracted from the DNS response.
Claims20
A method comprising:
- intercepting, by a device in a network, a Domain Name System (DNS) query sent by a node in the network to a DNS service;
- inserting, by the device, metadata information about the node into the DNS query before sending the DNS query on to the DNS service;
- intercepting, by the device, a DNS response sent from the DNS service back to the node in response to the DNS query;
- extracting, by the device, policy information indicative of a network policy for the node from the DNS response, wherein the DNS service generates the policy information based on the metadata information in the DNS query and includes the policy information in the DNS response;
- determining, by the device, the network policy for the node based on the extracted policy information after intercepting the DNS response;
- and
- implementing, by the device, the network policy for the node within the network.
A method comprising:
- receiving, at a domain name system (DNS) service, a DNS query sent by a node in a network, wherein the DNS query includes metadata information about the node inserted into the DNS query by a device in the network;
- extracting, by the DNS service, the metadata information about the node from the DNS query;
- generating, by the DNS service, policy information indicative of a network policy for the node based on the metadata information about the node extracted from the DNS query;
- and
- including, by the DNS service, the policy information in a DNS response sent back to the node, wherein the device determines the network policy for the node based on the policy information included in the DNS response after intercepting the DNS response and implements the network policy for the node within the network.
An apparatus, comprising:
- one or more network interfaces to communicate with a network;
- a processor coupled to the network interfaces and configured to execute one or more processes;
- and
- a memory configured to store a process executable by the processor, the process when executed configured to:
- intercept a Domain Name System (DNS) query sent by a node in the network to a DNS service;
- insert metadata information about the node into the DNS query before sending the DNS query on to the DNS service;
- intercept a DNS response sent from the DNS service back to the node in response to the DNS query;
- extract policy information indicative of a network policy for the node from the DNS response, wherein the DNS service generates the policy information based on the metadata information in the DNS query and includes the policy information in the DNS response;
- determine the network policy for the node based on the extracted policy information after intercepting the DNS response;
- and
- implement the network policy for the node within the network.
Dependencies are inferred from the claim text.