US 2026/0238685 A1 · SECURE CONDITIONAL DOMAIN NAME SYSTEM OPERATION

Abstract

Some embodiments enhance the security of domain name resolution and other DNS operations, by automatically intercepting the DNS operation, determining an associated device identity or ascertaining an associated user identity, and enforcing a security policy based on at least the DNS operation and based on at least one of the identities. Some securable DNS operations include resolution requests, reverse lookups from IP addresses to domain names, DNS record accesses, mail server mappings, redirection, forwarding, and DNS record cache operations. Enforcing the policy includes, e.g., preventing a result requested by the DNS operation, permitting computational progress toward the requested result, allowing a different result, modifying a DNS record, or flushing a DNS record from a cache. In some embodiments, DNS operation security functionality utilizes or implements a conditional access security functionality, thereby providing, e.g., a secure conditional domain name resolution.

Claims20

Dependent claims

A computing system configured to secure domain name system (DNS) operations, the computing system comprising:

a digital memory;
a processor set in operable communication with the digital memory;
and
a domain name system operations security component stored in the digital memory and executable by the processor set to:
intercept a domain name system operation associated with at least one of a user identity or a device identity;
enforce a security policy to produce an initial domain name system response;
after producing the initial domain name system response, monitor one or more security signals associated with the user identity or the device identity;
detect a change in at least one of the one or more security signals while the initial domain name system response remains usable;
and
in response to detecting the change, automatically modify domain name system state without receipt of a new domain name system operation.

7 more elements

A method of securing domain name system operations, the method comprising:

automatically intercepting a domain name system operation requesting resolution of a domain name to a domain name system result;
determining at least one of a device identity associated with the domain name system operation or a user identity associated with the domain name system operation;
evaluating a security policy that specifies a plurality of conditions required to permit the domain name system result;
determining, at a time of intercepting, that a non-empty proper subset of the plurality of conditions is satisfied and that at least one condition of the plurality of conditions is not satisfied;
and
in response to determining that the non-empty proper subset is satisfied, enforcing the security policy by permitting partial execution of the domain name system operation while preventing completion of the domain name system result, without completing resolution to the domain name system result,
wherein completion of the domain name system operation to produce the domain name system result is permitted upon determining that the plurality of conditions are satisfied.

4 more elements

A non-transitory computer-readable storage device storing instructions that, when executed by one or more processors of a computing system, cause the computing system to:

intercept a domain name system operation requesting resolution of a domain name to a domain name system result;
determine at least one of a device identity associated with the domain name system operation or a user identity associated with the domain name system operation;
evaluate a security policy that specifies a plurality of conditions required to permit the domain name system result;
determine, at a time of intercepting, that at least one, but fewer than all, of the plurality of conditions is satisfied;
and
in response to determining that at least one, but fewer than all, of the plurality of conditions is satisfied, enforce the security policy by permitting partial execution of the domain name system operation while preventing completion of the domain name system result, without completing resolution to the domain name system result,
wherein completion of the domain name system operation to produce the domain name system result is permitted upon determining that the plurality of conditions are satisfied.

4 more elements

Dependencies are inferred from the claim text.

Secure conditional domain name system operation

Life of this patent

Secure conditional domain name system operation

Life of this patent

Abstract

Claims20