US 12,568,138 B2Granted

DNS load balancing via request routing

AssigneeCapital One Services, LLC

InventorsSeven Starosta, Jeffrey M. Tejnecky, Brandon Krouse

Life of this patent

Estimating the term…

Loading patent…

Abstract

Methods, systems, and apparatuses are described herein for management of a Domain Name System (DNS) system. The system comprises numerous improvements, many related to CNAME records of the DNS. A computing device may manage authentication for a DNS using shared authentication credentials of a first authentication framework. In this manner, a wide variety of users might authenticate themselves using a first framework and use authentication credentials for a second framework to access a DNS. The computing device may further protect DNS servers from Denial of Service (DOS) attacks by bifurcating read and write requests to a DNS to different servers, such that attacks on read requests do not affect all of the DNS. The computing device may further validate DNS requests using, for example, natural language processing to avoid typographical errors inadvertently creating DNS zones.

Claims20

Dependent claims

A system configured to protect Domain Name System (DNS) servers from Denial of Service (DOS) attacks, the system comprising:

a computing device;
a first DNS server;
and
a second DNS server;
wherein the computing device is configured to:
receive, via an Application Programming Interface (API) and during a first time period, a first DNS request;
based on determining that the first DNS request comprises a requested change to a first DNS record, based on authenticating one or more first authentication credentials in the first DNS request, and based on comparing a first quantity of DNS requests received during the first time period to a threshold associated with DNS attacks;
modify the first DNS request to replace the one or more first authentication credentials in the first DNS request with shared authentication credentials;
and
route the modified first DNS request to the first DNS server;
receive, via the API and during a second time period different from the first time period, a second DNS request;
and
based on determining that the second DNS request comprises a read request associated with the first DNS record, based on authenticating one or more second authentication credentials in the second DNS request, and based on comparing a second quantity of DNS requests received during the second time period to the threshold associated with DNS attacks;
modify the second DNS request to replace the one or more second authentication credentials in the second DNS request with the shared authentication credentials;
and
route the modified second DNS request to the second DNS server;
receive, via the API and during a third time period different from the first time period and the second time period, a third DNS request comprising either or both the one or more first authentication credentials or the one or more second authentication credentials;
and
based on comparing a third quantity of DNS requests received during the third time period to the threshold associated with DNS attacks, prevent transmission of the third DNS request to the first DNS server or the second DNS server;
wherein the first DNS server is configured to:
receive the modified first DNS request;
modify, based on authenticating the shared authentication credentials and based on the modified first DNS request, a DNS record;
and
transmit the modified DNS record to the second DNS server;
and
wherein the second DNS server is configured to:
store the modified DNS record;
receive the modified second DNS request;
and
provide, in response to the modified second DNS request and based on authenticating the shared authentication credentials, the modified DNS record.

27 more elements

A method configured to protect Domain Name System (DNS) servers from Denial of Service (DoS) attacks, the method comprising:

receiving, by a computing device, via an Application Programming Interface (API), and during a first time period a first DNS request;
based on determining that the first DNS request comprises a requested change to a first DNS record, based on authenticating one or more first authentication credentials in the first DNS request, and based on comparing a first quantity of DNS requests received during the first time period to a threshold associated with DNS attacks;
modifying the first DNS request to replace the one or more first authentication credentials in the first DNS request with shared authentication credentials;
and
routing, by the computing device, the modified first DNS request to a first DNS server;
receiving, by the computing device, via the API, and during a second time period different from the first time period, a second DNS request;
based on determining that the second DNS request comprises a read request associated with the first DNS record, based on authenticating one or more second authentication credentials in the second DNS request, and based on comparing a second quantity of DNS requests received during the second time period to the threshold associated with DNS attacks;
modifying the second DNS request to replace the one or more second authentication credentials in the second DNS request with the shared authentication credentials;
and
routing, by the computing device, the modified second DNS request to a second DNS server;
receiving, via the API and during a third time period different from the first time period and the second time period, a third DNS request comprising either or both the one or more first authentication credentials or the one or more second authentication credentials;
and
based on comparing a third quantity of DNS requests received during the third time period to the threshold associated with DNS attacks, preventing transmission of the third DNS request to the first DNS server or the second DNS server;
receiving, by the first DNS server, the modified first DNS request;
modifying, by the first DNS server and based on authenticating the shared authentication credentials, a DNS record based on the first DNS request;
transmitting, by the first DNS server, the modified DNS record to the second DNS server;
storing, by the second DNS server, the modified DNS record;
receiving, by the second DNS server, the modified second DNS request;
and
providing, by the second DNS server, in response to the modified second DNS request, and, based on authenticating the shared authentication credentials, the modified DNS record.

17 more elements

One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors, cause a computing device to:

receive, via an Application Programming Interface (API) and during a first time period, a first DNS request;
based on determining that the first DNS request comprises a requested change to a first DNS record, based on authenticating one or more first authentication credentials in the first DNS request, and based on comparing a first quantity of DNS requests received during the first time period to a threshold associated with DNS attacks;
modify the first DNS request to replace the one or more first authentication credentials in the first DNS request with shared authentication credentials;
and
route the modified first DNS request to a first DNS server;
receive, via the API and during a second time period different from the first time period, a second DNS request;
and
based on determining that the second DNS request comprises a read request associated with the first DNS record, based on authenticating one or more second authentication credentials in the second DNS request, and based on comparing a second quantity of DNS requests received during the second time period to the threshold associated with DNS attacks;
modify the second DNS request to replace the one or more second authentication credentials in the second DNS request with the shared authentication credentials;
and
route the modified second DNS request to a second DNS server;
receive, via the API and during a third time period different from the first time period and the second time period, a third DNS request comprising either or both the one or more first authentication credentials or the one or more second authentication credentials;
and
based on comparing a third quantity of DNS requests received during the third time period to the threshold associated with DNS attacks, prevent transmission of the third DNS request to the first DNS server or the second DNS server;
wherein the instructions, when executed by the one or more processors, further cause the first DNS server to:
receive the modified first DNS request;
modify, based on authenticating the shared authentication credentials, a DNS record based on the first DNS request;
and
transmit the modified DNS record to the second DNS server;
and
wherein the instructions, when executed by the one or more processors, further cause the second DNS server to:
store the modified DNS record;
receive the modified second DNS request;
and
provide, in response to the modified second DNS request and based on authenticating the shared authentication credentials, the modified DNS record.

22 more elements

Dependencies are inferred from the claim text.

Facts

Application: 18/631,652Filed 10 Apr 2024
Published: US 2025/0323973 A116 Oct 2025
Granted: 3 Mar 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

H04L 67/1038
For accessing one among a plurality of replicated servers: load balancing arrangements to avoid a single path through a load balancer
H04L 61/4511
Using standardised directories; using standardised directory access protocols: using domain name system [DNS]
H04L 63/10
Network architectures or network communication protocols for network security: for controlling access to devices or network resources
H04L 63/1458
Countermeasures against malicious traffic: denial of Service