# US 11,444,944 B2 · Privacy and security enabled domain name system with optional zero-touch provisioning

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,444,944 B2
- Document ID: US11444944B2
- Status: Granted
- Kind: B2
- Application number: 16/788,046
- Filed: 2020-02-11
- Published: 2021-08-12
- Granted: 2022-09-13
- Earliest claimed: 2020-02-11
- Assignees: McAfee, Inc.
- Applicants: McAfee, LLC
- Inventors: Tirumaleswar Reddy Konda; Shashank Jain; Himanshu Srivastava; Naveen Kumar Reddy Kandadi; Piyush Pramod Joshi
- Web page: https://patentgrep.com/patent/US11444944B2

## CPC

- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- G16Y 30/10: Security thereof
- H04L 9/0838: {Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061)}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04L 12/4625: {Single bridge functionality, e.g. connection of two networks over a single bridge}
- H04L 61/4511: using domain name system [DNS]
- H04L 61/58: Caching of addresses or names
- H04L 61/59: using proxies for addressing
- H04L 63/0281: {Proxies}
- H04L 63/0464: {using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/166: {at the transport layer}
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/168: {above the transport layer}
- H04L 2101/663: Transport layer addresses, e.g. aspects of transmission control protocol [TCP] or user datagram protocol [UDP] ports
- H04L 2209/805: Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G16Y: INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT]

## Abstract

There is disclosed in one example an enrollment over secure transport (EST)-capable gateway device, including: a hardware platform including a processor and a memory; a first network interface to communicatively couple to an external network, including an external DNS server; a second network interface to communicatively couple to a home network; a caching DNS server including a local DNS cache, and logic to provide DNS services to the home network; and an EST proxy to authenticate to a local endpoint on the home network, provision a DNS server certificate on the local endpoint, provision an authentication domain name (ADN) on the local endpoint, and provide encrypted domain name system (DNS) services to the local endpoint.

## Claims

### Claim 1

An enrollment over secure transport (EST)-capable gateway device, comprising:
a hardware platform comprising a processor circuit and a memory;
a first network interface to communicatively couple to an external network, including an external domain name system (DNS) server;
a second network interface to communicatively couple to a home network; and
instructions encoded within the memory to instruct the processor circuit to provide:
a caching domain name system (DNS) server comprising a local domain name system (DNS) cache, and logic to provide domain name system (DNS) services to the home network; and
an enrollment over secure transport (EST) proxy to authenticate to a local endpoint on the home network, provision a domain name system (DNS) server certificate on the local endpoint, provision an authentication domain name (ADN) on the local endpoint, and provide encrypted domain name system (DNS) services to the local endpoint;
wherein the EST proxy is further to receive a client identity certificate enroll request, create a unique identifier for the local endpoint, enroll the local endpoint on an internet service provider (ISP) domain name system (DNS) server with the unique identifier, and receive an ISP's domain name system over transport layer security/domain name system over hypertext transfer protocol secure (DTLS/DoH) capable (DNS) server certificate;
wherein receiving the ISP's DTLS/DoH capable DNS server certificate comprises discovering an enrollment over secure transport (EST) server on a network of the ISP, establishing a provisional transport layer secure (TLS) connection with the EST server, authenticating the EST server, and receiving the ISP's server certificate.

### Claim 2 (depends on 1)

The EST-capable gateway device of claim 1, wherein the encrypted DNS services comprise DNS over transport layer security (DNS over TLS).

### Claim 3 (depends on 1)

The EST-capable gateway device of claim 1, wherein the encrypted DNS services comprise DNS over hypertext transfer protocol secure (DOH).

### Claim 4 (depends on 1)

The EST-capable gateway device of claim 1, further comprising executable instructions to enforce a manufacturer usage description (MUD) for an internet of things (IoT) device.

### Claim 5 (depends on 1)

The EST-capable gateway device of claim 1, further comprising instructions to enforce domain name-based parental controls.

### Claim 6 (depends on 1)

The EST-capable gateway device of claim 1, further comprising instructions to enforce a domain name-based access control list (ACL).

### Claim 7 (depends on 1)

The EST-capable gateway device of claim 1, wherein discovering the EST server comprises using standard discovery protocols.

### Claim 8 (depends on 1)

The EST-capable gateway device of claim 1, wherein authenticating to the EST server comprises authenticating via Password-Authenticated Key Agreement (PAKE).

### Claim 9 (depends on 1)

The EST-capable gateway device of claim 1, wherein the EST proxy is further to add an encrypted universally unique identifier (UUID) to a transmission control protocol (TCP) option in a session initiation packet.

### Claim 10

One or more tangible, non-transitory computer-readable storage media having stored thereon executable instructions to:
communicatively coupling a first network interface to an external network, including an external domain name system (DNS) server;
communicatively coupling a second network interface to a home network; and
provide by a caching domain name system (DNS) server, comprising a local domain name system (DNS) cache, and logic to provide domain name system (DNS) services to the home network;
provide encrypted DNS services to the home network, comprising authenticating, by an enrollment over secure transport (EST) proxy, to a local endpoint on the home network, provisioning a domain name system (DNS) server certificate on the local endpoint, provisioning an authentication domain name (ADN) on the local endpoint;
wherein providing encrypted DNS services to the home network further comprises receiving, by the EST proxy, a client identity certificate enroll request, creating a unique identifier for the local endpoint, enrolling the local endpoint on an internet service provider (ISP) DNS server with the unique identifier, and receiving an ISP's domain name system over transport layer security/domain name system over hypertext transfer protocol secure (DTLS/DoH) capable DNS server certificate;
wherein receiving the ISP's DTLS/DoH capable DNS server certificate comprises discovering an enrollment over secure transport (EST) server on a network of the ISP; establishing a provisional transport layer secure (TLS) connection with the EST server; authenticating the EST server; and receiving the ISP's server certificate.

### Claim 11 (depends on 10)

The one or more tangible, non-transitory computer-readable media of claim 10, wherein the instructions are further to:
communicatively couple to a cloud service;
communicatively couple to a remote endpoint via the cloud service; and
provide encrypted DNS services to the remote endpoint via the cloud service.

### Claim 12 (depends on 11)

The one or more tangible, non-transitory computer-readable media of claim 11, wherein communicatively coupling to the remote endpoint comprises communicatively coupling to a lightweight enrollment over secure transport (EST) agent of the remote endpoint.

### Claim 13

A computer-implemented method of provisioning a privacy & security enabled DNS services via an enrollment over secure transport (EST) proxy on a home gateway, comprising:
communicatively coupling a first network interface to an external network, including an external DNS server;
communicatively coupling a second network interface to a home network; and
provide by a caching domain name system (DNS) server, comprising a local domain name system (DNS) cache, and logic to provide domain name system (DNS) services to the home network;
providing encrypted DNS services to the home network, comprising authenticating, by an enrollment over secure transport (EST) proxy, to a local endpoint on the home network, provisioning a domain name system (DNS) server certificate on the local endpoint, and provisioning an authentication domain name (ADN) on the local endpoint;
wherein providing encrypted DNS services to the local endpoint further comprises receiving, by an EST proxy, a client identity certificate enroll request, creating a unique identifier for the local endpoint, enrolling the local endpoint on an internet service provider (ISP) domain name system (DNS) server with the unique identifier, and receiving an ISP's domain name system over transport layer security/domain name system over hypertext transfer secure (DTLS/DoH) Capable DNS server certificate;
wherein receiving the ISP's DTLS/DoH capable DNS server certificate comprises discovering an enrollment over secure transport (EST) server on a network of the ISP; establishing a provisional transport layer secure (TLS) connection with the EST server; authenticating the EST server; and receiving the ISP's server certificate.

### Claim 14 (depends on 13)

The method of claim 13, further comprising adding an encrypted universally unique identifier (UUID) to a transmission control protocol (TCP) option in a session initiation packet.

### Claim 15 (depends on 13)

The method of claim 13, wherein the caching DNS server is to provide DNS over transport layer security (DTLS).

### Claim 16 (depends on 13)

The method of claim 13, wherein the caching DNS server is to provide DNS over hypertext transfer protocol secure (DoH).