# US 2024/0205221 A1 · Provisioning of encrypted dns services

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2024/0205221 A1
- Document ID: US20240205221A1
- Status: Published application
- Kind: A1
- Application number: 18/419,313
- Filed: 2024-01-22
- Published: 2024-06-20
- Earliest claimed: 2020-02-11
- Assignees: McAfee, Inc.
- Applicants: McAfee, LLC
- Inventors: Tirumaleswar Reddy Konda; Shashank Jain; Himanshu Srivastava; Naveen Kumar Reddy Kandadi; Piyush Pramod Joshi
- Web page: https://patentgrep.com/patent/US20240205221A1

## CPC

- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- G16Y 30/10: Security thereof
- H04L 9/0838: {Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061)}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04L 12/4625: {Single bridge functionality, e.g. connection of two networks over a single bridge}
- H04L 61/4511: using domain name system [DNS]
- H04L 61/58: Caching of addresses or names
- H04L 61/59: using proxies for addressing
- H04L 63/0281: {Proxies}
- H04L 63/0464: {using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/166: {at the transport layer}
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/168: {above the transport layer}
- H04L 2101/663: Transport layer addresses, e.g. aspects of transmission control protocol [TCP] or user datagram protocol [UDP] ports
- H04L 2209/805: Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G16Y: INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT]

## Abstract

There is disclosed in one example an enrollment over secure transport (EST)-capable gateway device, including: a hardware platform including a processor and a memory; a first network interface to communicatively couple to an external network, including an external DNS server; a second network interface to communicatively couple to a home network; a caching DNS server including a local DNS cache, and logic to provide DNS services to the home network; and an EST proxy to authenticate to a local endpoint on the home network, provision a DNS server certificate on the local endpoint, provision an authentication domain name (ADN) on the local endpoint, and provide encrypted domain name system (DNS) services to the local endpoint.

## Claims

### Claim at position 1

1-20. (canceled)

### Claim 21

A method of an endpoint device accessing a trusted domain name system (DNS) server, comprising:
connecting to an untrusted wireless access point (WAP);
using a DNS resolver of the untrusted WAP to resolve an address for the trusted DNS server;
creating a local proxy to the trusted DNS server; and
tunneling DNS traffic of the endpoint device to the trusted DNS server via the local proxy.

### Claim 22 (depends on 21)

The method of claim 21, wherein the trusted DNS server is an encrypted DNS server.

### Claim 23 (depends on 21)

The method of claim 21, wherein the trusted DNS server is a cloud-based DNS server.

### Claim 24 (depends on 21)

The method of claim 21, wherein the trusted DNS server is a cloud-based DNS server for an internet service provider (ISP) associated with the endpoint device.

### Claim 25 (depends on 21)

The method of claim 21, wherein resolving an address for the trusted DNS server comprises resolving a fully-qualified domain name (FQDN) for the trusted DNS server.

### Claim 26 (depends on 25)

The method of claim 25, further comprising extracting the FQDN from a DNS-ID field for a server certificate of the trusted DNS server.

### Claim 27 (depends on 21)

The method of claim 21, further comprising cryptographically verifying the trusted DNS server before creating the local proxy.

### Claim 28 (depends on 27)

The method of claim 27, wherein cryptographically verifying comprises verifying an authentication domain name (ADN) of the trusted DNS server against a server certificate of the DNS server.

### Claim 29 (depends on 28)

The method of claim 28, further comprising receiving the server certificate during a transport layer security (TLS) handshake with the trusted DNS server.

### Claim 30 (depends on 28)

The method of claim 28, further comprising receiving a client certificate for the endpoint device via enrollment over secure transport (EST).

### Claim 31 (depends on 30)

The method of claim 30, further comprising authenticating the endpoint device to the DNS server via the client certificate.

### Claim 32 (depends on 21)

The method of claim 21, wherein tunneling DNS traffic comprises tunneling unencrypted DNS traffic.

### Claim 33 (depends on 21)

The method of claim 21, further comprising providing a DNS stub resolver on the endpoint device to tunnel the DNS traffic.

### Claim 34 (depends on 21)

The method of claim 21, further comprising receiving from the trusted DNS server a security action to take on a resolved domain name, and effecting the security action.

### Claim 35 (depends on 21)

The method of claim 21, wherein the trusted DNS server is a DNS over transport layer security (DOT) server.

### Claim 36 (depends on 21)

The method of claim 21, wherein the trusted DNS server is a DNS over hypertext transfer protocol secure (DoH) server.

### Claim 37

One or more tangible, nontransitory computer-readable storage media having stored thereon executable instructions to instruct an endpoint device to:
connect to an untrusted wireless access point (WAP);
use a DNS resolver of the untrusted WAP to resolve an address for a trusted DNS server;
create a local proxy to the trusted DNS server; and
tunnel DNS traffic of the endpoint device to the trusted DNS server via the local proxy.

### Claim 38 (depends on 37)

The one or more tangible, nontransitory computer-readable storage media of claim 37, wherein the trusted DNS server is an encrypted DNS server.

### Claim 39

An endpoint device, comprising:
a hardware platform comprising a processor circuit and a memory; and
instructions encoded within the memory to instruct the processor circuit to:
connect to an untrusted wireless access point (WAP);
use a DNS resolver of the untrusted WAP to resolve an address for a trusted DNS server;
create a local proxy to the trusted DNS server; and
tunnel DNS traffic of the endpoint device to the trusted DNS server via the local proxy.

### Claim 40 (depends on 39)

The endpoint device of claim 39, wherein the trusted DNS server is an encrypted DNS server.