Identifying services provided over secured connections using DNS caching

A method for communication, comprising:

• intercepting Domain Name System (DNS) messages that are sent in a communication network in preparation for setting up respective communication sessions that provide respective services associated with respective service types;
• extracting from the intercepted DNS messages DNS information that is indicative of the respective service types, including Uniform Resource Identifiers (URIs) identifying hosts in the communication network to which users attempt to connect, and respective IP addresses of the hosts, and mapping the extracted URIs to one or more predefined service types, and caching the extracted DNS information, including caching the extracted IP addresses and the one or more service types in association with one another;
• and
• identifying a service type associated with a given communication session using the cached DNS information, and applying a traffic policy to the given communication session depending on the identified service type,
• wherein the communication sessions are associated with respective users consuming the respective services, and with respective geographical areas over which the communication sessions are delivered, and wherein caching the DNS information comprises caching the IP address and identified service type locally per user and globally per geographical area, and wherein identifying the service type comprises retrieving the globally cached service type only if retrieving the locally cached service type fails.

A method for communication, comprising:

• intercepting Domain Name System (DNS) messages that are sent in a communication network in preparation for setting up respective communication sessions that provide respective services associated with respective service types;
• extracting from the intercepted DNS messages DNS information that is indicative of the respective service types, and caching the extracted DNS information;
• and
• identifying a service type associated with a given communication session using the cached DNS information, and applying a traffic policy to the given communication session depending on the identified service type,
• wherein identifying the service type comprises intercepting a certificate that a host sends to a user in setting up the given communication session, and mapping service-type related information embedded in the certificate to one or more predefined service types.

An apparatus, comprising:

• a cache memory;
• and
• a processor, which is configured to:
• intercept Domain Name System (DNS) messages that are sent in a communication network in preparation for setting up respective communication sessions that provide respective services associated with respective service types,
• extract from the intercepted DNS messages DNS information that is indicative of the respective service types, including extracting Uniform Resource Identifiers (URIs) identifying hosts in the communication network to which users attempt to connect;
• extract respective IP addresses of the hosts;
• map the extracted URIs to one or more predefined service types;
• cache the extracted DNS information, including caching the extracted IP addresses and the one or more service types in association with one another;
• identify a service type associated with a given communication session by intercepting in traffic of the given communication session a host IP address of a host associated with the given communication session, retrieving a cached host URI that is associated with the host IP address, and mapping the host URI and host IP address to respective one or more predefined service types;
• and
• apply a traffic policy to the given communication session depending on the identified service type.

An apparatus, comprising:

• a cache memory;
• and
• a processor, which is configured to:
• intercept Domain Name System (DNS) messages that are sent in a communication network in preparation for setting up respective communication sessions that provide respective services associated with respective service types;
• extract from the intercepted DNS messages DNS information that is indicative of the respective service types;
• cache the extracted DNS information;
• identify a service type associated with a given communication session using the cached DNS information;
• and
• apply a traffic policy to the given communication session depending on the identified service type,
• wherein the communication sessions are associated with respective users consuming the respective services, and wherein the processor is further configured to cache the DNS information separately per user, and to apply the traffic policy separately per user.

An apparatus, comprising:

• a cache memory;
• and
• a processor, which is configured to:
• intercept Domain Name System (DNS) messages that are sent in a communication network in preparation for setting up respective communication sessions that provide respective services associated with respective service types;
• extract from the intercepted DNS messages DNS information that is indicative of the respective service types;
• cache the extracted DNS information;
• identify a service type associated with a given communication session using the cached DNS information;
• and
• apply a traffic policy to the given communication session depending on the identified service type,
• wherein the communication sessions are associated with respective geographical areas over which the communication sessions are delivered, and wherein the processor is further configured to cache the DNS information separately per geographical area, and to apply the traffic policy separately per the geographical area.

An apparatus, comprising:

• a cache memory;
• and
• a processor, which is configured to:
• intercept Domain Name System (DNS) messages that are sent in a communication network in preparation for setting up respective communication sessions that provide respective services associated with respective service types;
• extract from the intercepted DNS messages DNS information that is indicative of the respective service types;
• cache the extracted DNS information;
• identify a service type associated with a given communication session using the cached DNS information by intercepting a certificate that a host sends to a user in setting up the given communication session, to map service-type related information embedded in the certificate to one or more predefined service types;
• and
• apply a traffic policy to the given communication session depending on the identified service type.