Secure DNS using delegated credentials and keyless SSL
AssigneeMcAfee, Inc.
InventorsTirumaleswar Reddy Konda, Shashank Jain, Himanshu Srivastava
Life of this patent
Estimating the term…
Abstract
There is disclosed in an example a gateway device, including a hardware computing platform, and a secure domain name system (DNS) engine having circuitry and stored instructions to-program the circuitry, the secure DNS engine to communicatively couple to an endpoint via a local network, begin a secure DNS transaction with the endpoint, determine whether the endpoint supports delegated credentials, and after determining that the endpoint supports delegated credentials, establish a secure DNS session with the endpoint using a delegated credential.
Claims20
A computer-implemented method of providing encrypted domain name system (DNS) resolution, comprising:
- receiving, from a device of a first network, a delegated cryptographic credential;
- connecting to a client endpoint on a second network different from the first network, to provide encrypted DNS resolution services to the client endpoint;
- upon determining that the client endpoint supports delegated credentials, providing the encrypted DNS resolution services via the delegated credential;
- and
- upon determining that the client endpoint does not support delegated credentials, providing the encrypted DNS resolution services via keyless encryption.
One or more tangible, nontransitory computer-readable storage media having stored thereon executable instructions to:
- receive, from a device of a first network, a delegated cryptographic credential;
- connect to a client endpoint on a second network different from the first network, to provide encrypted DNS resolution services to the client endpoint;
- upon determining that the client endpoint supports delegated credentials, provide the encrypted DNS resolution services via the delegated credential;
- and
- upon determining that the client endpoint does not support delegated credentials, provide the encrypted DNS resolution services via keyless encryption.
A home gateway, comprising:
- a hardware platform comprising a processor circuit and a memory;
- a first network interface to communicatively couple to a first network, the first network comprising a wide area network;
- a second network interface to communicatively couple to a second network, comprising a home network;
- and
- instructions encoded within the memory to instruct the processor circuit to:
- receive, via the first network, a delegated cryptographic credential;
- connect to a client endpoint via the second network, to provide encrypted DNS resolution services to the client endpoint;
- upon determining that the client endpoint supports delegated credentials, provide the encrypted DNS resolution services via the delegated credential;
- and
- upon determining that the client endpoint does not support delegated credentials, provide the encrypted DNS resolution services via keyless encryption.
Dependencies are inferred from the claim text.