# US 12,184,608 B2 · Secure DNS using delegated credentials and keyless SSL

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,184,608 B2
- Document ID: US12184608B2
- Status: Granted
- Kind: B2
- Application number: 18/413,449
- Filed: 2024-01-16
- Published: 2024-05-09
- Granted: 2024-12-31
- Earliest claimed: 2021-03-30
- Assignees: McAfee, Inc.
- Applicants: McAfee, LLC
- Inventors: Tirumaleswar Reddy Konda; Shashank Jain; Himanshu Srivastava
- Web page: https://patentgrep.com/patent/US12184608B2

## CPC

- H04L 63/0209: {Architectural arrangements, e.g. perimeter networks or demilitarized zones}
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/3073: {involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing}
- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 9/3271: {using challenge-response}
- H04L 61/4511: using domain name system [DNS]
- H04L 63/04: {for providing a confidential data exchange among entities communicating through data packet networks}
- H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/168: {above the transport layer}
- H04L 67/568: Storing data temporarily at an intermediate stage, e.g. caching
- G06F 8/65: Updates (security arrangements therefor G06F21/57)
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

There is disclosed in an example a gateway device, including a hardware computing platform, and a secure domain name system (DNS) engine having circuitry and stored instructions to-program the circuitry, the secure DNS engine to communicatively couple to an endpoint via a local network, begin a secure DNS transaction with the endpoint, determine whether the endpoint supports delegated credentials, and after determining that the endpoint supports delegated credentials, establish a secure DNS session with the endpoint using a delegated credential.

## Claims

### Claim 1

A computer-implemented method of providing encrypted domain name system (DNS) resolution, comprising:
receiving, from a device of a first network, a delegated cryptographic credential;
connecting to a client endpoint on a second network different from the first network, to provide encrypted DNS resolution services to the client endpoint;
upon determining that the client endpoint supports delegated credentials, providing the encrypted DNS resolution services via the delegated credential; and
upon determining that the client endpoint does not support delegated credentials, providing the encrypted DNS resolution services via keyless encryption.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, wherein the delegated credential is a cryptographic certificate.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1, wherein the delegated credential is not issued directly by a public certificate authority.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, wherein the delegated credential is associated with a fully-qualified domain name (FQDN).

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, further comprising providing caching DNS resolution services to the client endpoint.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1, further comprising providing DNS forwarding for the client endpoint.

### Claim 7 (depends on 1)

The computer-implemented method of claim 1, wherein determining that the client endpoint supports delegated credentials comprises receiving, from the client endpoint, a client hello with a delegated credentials extension.

### Claim 8 (depends on 1)

The computer-implemented method of claim 1, further comprising providing, to the client endpoint, the delegated credential as an extension to a TLS certificate verify message.

### Claim 9 (depends on 8)

The computer-implemented method of claim 8, wherein the extension is an extension to a certificate entry of an end-entity certificate.

### Claim 10 (depends on 1)

The computer-implemented method of claim 1, further comprising, after determining that the client endpoint does not support delegated credentials, providing instructions or a recommendation to update software to support delegated credentials.

### Claim 11 (depends on 1)

The computer-implemented method of claim 1, further comprising, upon determining that the client endpoint does not support encrypted DNS resolution services, providing unsecured legacy DNS services via port 53.

### Claim 12 (depends on 1)

The computer-implemented method of claim 1, further comprising enrolling via enrollment over secure transport (EST) via the first network.

### Claim 13

One or more tangible, nontransitory computer-readable storage media having stored thereon executable instructions to:
receive, from a device of a first network, a delegated cryptographic credential;
connect to a client endpoint on a second network different from the first network, to provide encrypted DNS resolution services to the client endpoint;
upon determining that the client endpoint supports delegated credentials, provide the encrypted DNS resolution services via the delegated credential; and
upon determining that the client endpoint does not support delegated credentials, provide the encrypted DNS resolution services via keyless encryption.

### Claim 14 (depends on 13)

The one or more tangible, nontransitory computer-readable storage media of claim 13, wherein the delegated credential is a cryptographic certificate.

### Claim 15 (depends on 13)

The one or more tangible, nontransitory computer-readable storage media of claim 13, wherein the delegated credential is not issued directly by a public certificate authority.

### Claim 16 (depends on 13)

The one or more tangible, nontransitory computer-readable storage media of claim 13, wherein the delegated credential is associated with a fully-qualified domain name (FQDN).

### Claim 17 (depends on 13)

The one or more tangible, nontransitory computer-readable storage media of claim 13, wherein determining that the client endpoint supports delegated credentials comprises receiving, from the client endpoint, a client hello with a delegated credentials extension.

### Claim 18 (depends on 13)

The one or more tangible, nontransitory computer-readable storage media of claim 13, wherein the instructions are further to provide, to the client endpoint, the delegated credential as an extension to a TLS certificate verify message.

### Claim 19

A home gateway, comprising:
a hardware platform comprising a processor circuit and a memory;
a first network interface to communicatively couple to a first network, the first network comprising a wide area network;
a second network interface to communicatively couple to a second network, comprising a home network; and
instructions encoded within the memory to instruct the processor circuit to:
receive, via the first network, a delegated cryptographic credential;
connect to a client endpoint via the second network, to provide encrypted DNS resolution services to the client endpoint;
upon determining that the client endpoint supports delegated credentials, provide the encrypted DNS resolution services via the delegated credential; and
upon determining that the client endpoint does not support delegated credentials, provide the encrypted DNS resolution services via keyless encryption.

### Claim 20 (depends on 19)

The home gateway of claim 19, wherein the delegated credential is a cryptographic certificate.