# US 11,909,771 B2 · Role-based policy DNS response for network security user notifications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,771 B2 - Document ID: US11909771B2 - Status: Granted - Kind: B2 - Application number: 16/889,102 - Filed: 2020-06-01 - Published: 2021-12-02 - Granted: 2024-02-20 - Earliest claimed: 2020-06-01 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Darrin Joseph Miller; Kevin Patrick Regan; Einar Nilsen-Nygaard - Web page: https://patentgrep.com/patent/US11909771B2 ## CPC - H04L 63/104: {Grouping of entities} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L 61/4511: using domain name system [DNS] - H04L 61/5007: Internet protocol [IP] addresses - H04L 63/102: {Entity profiles} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A Domain Name System (DNS) device stores data indicative of a user device and data indicative of a policy setting a level of access of the user device to a responding device. The DNS device receives, from the user device, a request for an Internet Protocol address of the responding device. The DNS device determines, based upon the request and the data indicative of the user device, that the policy applies to the request. The DNS device applies the policy in response to the determining. ## Claims ### Claim 1 A method comprising: storing, at a Domain Name System (DNS) device, data indicative of a role associated with a user device and data indicative of a policy setting a level of access of the user device to a responding device, wherein the data indicative of the role associated with the user device indicates a security level for the user device within an enterprise network environment; obtaining, from the user device at the DNS device, a request for an Internet Protocol (IP) address of the responding device; determining, at the DNS device based upon the request and the data indicative of the role associated with the user device, that the policy applies to the request; and applying the policy in response to the determining, wherein applying the policy comprises providing, to the user device, data indicative of an IP address of a notification server to redirect the user device from the responding device to the notification server to provide the user device with an indication of the applying the policy by the DNS device. ### Claim 2 (depends on 1) The method of claim 1, wherein the role associated with the user device is based upon a role associated with a user of the user device. ### Claim 3 (depends on 1) The method of claim 1, wherein the policy sets the level of access of the user device to the responding device based upon the role associated with the user device. ### Claim 4 (depends on 1) The method of claim 1, wherein applying the policy comprises denying the user device access to the responding device. ### Claim 5 (depends on 1) The method of claim 1, further comprising obtaining, at the DNS device, the data indicative of the role associated with the user device from a policy server. ### Claim 6 (depends on 1) The method of claim 1, wherein the policy comprises an enterprise policy. ### Claim 7 An apparatus comprising: one or more memories; one or more network interfaces; and one or more processors configured to perform operations on behalf of a Domain Name System (DNS) device such that the one or more processors are configured to: store, in the one or more memories, data indicative of a role associated with a user device and data indicative of a policy setting a level of access of the user device to a responding device, wherein the data indicative of the role associated with the user device indicates a security level for the user device within an enterprise network environment; obtain, via the one or more network interfaces from the user device, a request for an Internet Protocol (IP) address of the responding device; determine, based upon the request and the data indicative of the role associated with the user device, that the policy applies to the request; and apply the policy in response to determining that the policy applies to the request, by providing, to the user device, data indicative of an IP address of a notification server to redirect the user device from the responding device to the notification server to provide the user device with an indication of application of the policy by the DNS device. ### Claim 8 (depends on 7) The apparatus of claim 7, wherein the role associated with the user device is based upon a role associated with a user of the user device. ### Claim 9 (depends on 7) The apparatus of claim 7, wherein the policy sets the level of access of the user device to the responding device based upon the role associated with the user device. ### Claim 10 One or more tangible non-transitory computer-readable mediums encoded with instructions, wherein the instructions, when executed by one or more processors, cause the one or more processors to: store, at a Domain Name System (DNS) device, data indicative of a role associated with a user device and data indicative of a policy setting a level of access of the user device to a responding device, wherein the data indicative of the role associated with the user device indicates a security level for the user device within an enterprise network environment; obtain, from the user device at the DNS device, a request for an Internet Protocol (IP) address of the responding device; determine, at the DNS device based upon the request and the data indicative of the role associated with the user device, that the policy applies to the request; and apply the policy in response to determining that the policy applies to the request by providing, to the user device, data indicative of an IP address of a notification server to redirect the user device from the responding device to the notification server to provide the user device with an indication of application of the policy by the DNS device. ### Claim 11 (depends on 10) The one or more tangible non-transitory computer-readable mediums of claim 10, wherein the role associated with the user device is based upon a role associated with a user of the user device. ### Claim 12 (depends on 10) The one or more tangible non-transitory computer-readable mediums of claim 10, wherein the policy sets the level of access of the user device to the responding device based upon the role associated with the user device. ### Claim 13 (depends on 7) The apparatus of claim 7, wherein the one or more processors are configured to apply the policy by denying the user device access to the responding device. ### Claim 14 (depends on 7) The apparatus of claim 7, wherein the one or more processors are configured to obtain the data indicative of the role associated with the user device from a policy server. ### Claim 15 (depends on 10) The one or more tangible non-transitory computer-readable mediums of claim 10, wherein the instructions that apply the policy deny the user device access to the responding device. ### Claim 16 (depends on 10) The one or more tangible non-transitory computer-readable mediums of claim 10, wherein the instructions cause the DNS device to obtain the data indicative of the role associated with the user device from a policy server. ### Claim 17 (depends on 7) The apparatus of claim 7, wherein the policy comprises an enterprise policy. ### Claim 18 (depends on 1) The method of claim 1, wherein the data indicative of the role associated with the user device comprises a security group tag. ### Claim 19 (depends on 7) The apparatus of claim 7, wherein the data indicative of the role associated with the user device comprises a security group tag. ### Claim 20 (depends on 10) The one or more tangible non-transitory computer-readable mediums of claim 10, wherein the data indicative of the role associated with the user device comprises a security group tag.