Entity policy contexts for secure DNS resolution
AssigneeMcAfee, Inc.
InventorsRajagopalan Sundararajan, Premananda Das
Life of this patent
Estimating the term…
Abstract
There is described herein a computer-implemented system and method for providing domain name system (DNS) over hypertext transfer protocol secure (HTTPS) (DoH) resolution for a domain, including forming a DoH query for an entity, comprising inserting an entity access token into a uniform resource identifier (URI) template; sending the DoH query to a DoH service; resolving the DoH query, comprising using the entity access token to determine an entity context policy for the DoH query; and returning a DoH response that enacts the entity context policy.
Claims20
A computer-implemented method of providing domain name system (DNS) over hypertext transfer protocol secure (HTTPS) (i.e., DoH) resolution for a domain, comprising:
- forming an encrypted DoH query for a person or group of persons, comprising encoding an entity access token into a uniform resource identifier (URI) template, wherein the entity access token comprises an account identifier for the person or group of persons;
- sending the encrypted DoH query to a DoH service;
- resolving the encrypted DoH query, comprising decrypting the DoH query and using the entity access token to determine access policy for the person or group of persons, wherein the access policy relates to permission for the person or group of persons to access to a website associated with the DoH query;
- returning a DoH response with an IP address for the website;
- and enforcing the access policy on a user endpoint device.
One or more tangible, nontransitory computer-readable storage media having stored thereon executable instructions to:
- provide a virtual private network (VPN) to interoperate with a domain name system (DNS) over hypertext transfer protocol secure (HTTPS) (i.e., DoH) resolution client, wherein the VPN is segregated from network data streams;
- receive, from a human user, a request to resolve a domain name;
- form an encrypted DoH query for the human user, comprising encoding account identifier for the human user into a uniform resource identifier (URI) template, and encrypting the DoH query;
- send the encrypted DoH query to a DoH resolution server;
- receive an encrypted response from the DoH resolution server, wherein the encrypted response includes an IP address for a website the human user is attempting to access and/or a permission policy for accessing the website;
- and enforcing the permission policy.
One or more tangible, nontransitory computer-readable storage media having stored thereon instructions to provide a domain name system (DNS) over hypertext transfer protocol secure (HTTPS) (i.e., DoH) resolution server, the instructions to:
- receive, from a client device, an encrypted DoH resolution request for a domain on behalf of a human user, wherein the encrypted DoH resolution request includes an account token associated with the human user encoded within a URI template of the encrypted DoH resolution request;
- decrypt the DoH resolution request;
- resolve the domain, comprising finding an IP address for the domain and using the account token to locate an access permission policy for the human user related to the domain;
- and
- returning an encrypted DoH response, including the IP address and/or the access permission policy.
Dependencies are inferred from the claim text.