Method for mitigation of unauthorized data transfer over domain name service (dns)
AssigneeCheck Point Software Technologies Ltd.
InventorsLiad MIZRACHI, Oded VANUNU, Avi GIMPEL, Dikla BARDA, Roi PAZ
Life of this patent
Estimating the term…
Abstract
Methods and systems for prevent unauthorized use of a Domain Name System (DNS) channel in an organization are disclosed. These methods and systems comprise elements of hardware and software for receiving a packet; determining whether the packet is a DNS packet or a non-DNS packet; if the packet is a DNS packet, determining whether the destination address of the packet denotes a legitimate DNS server; and, according to whether the destination address of the packet denotes a legitimate DNS server, permitting the packet.
Claims16
A method for preventing unauthorized use of a Domain Name Service (DNS) channel, comprising:
- a) receiving a packet
- b) determining whether the packet is a DNS packet or a non-DNS packet
- c) when the packet is a DNS packet, determining whether the destination address of the packet denotes a legitimate DNS server
- d) according to whether the destination address of the packet denotes a legitimate DNS server, permitting the packet.
A computer system for preventing unauthorized use of a Domain Name Service (DNS) channel, comprising:
- a storage medium for storing computer components;
- and
- a computerized processor for executing the computer components comprising:
- a first computer component for receiving a packet;
- a second computer component for determining whether the packet is a DNS packet or a non-DNS packet;
- a third computer component for, when the packet is a DNS packet, determining whether the destination address of the packet denotes a legitimate DNS server;
- and
- a fourth computer component for, according to whether the destination address of the packet denotes a legitimate DNS server, permitting the packet.
A computer-usable non-transitory storage medium having a computer program embodied thereon for causing a suitable programmed system to prevent unauthorized use of a DNS channel, by performing the following steps when such program is executed on the system, the steps comprising:
- a) receiving a packet
- b) determining whether the packet is a DNS packet or a non-DNS packet
- c) when the packet is a DNS packet, determining whether the destination address of the packet denotes a legitimate DNS server
- d) according to whether the destination address of the packet denotes a legitimate DNS server, permitting the packet.
Dependencies are inferred from the claim text.