# US 9,521,060 B2 · Identifying services provided over secured connections using DNS caching > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,521,060 B2 - Document ID: US9521060B2 - Status: Granted - Kind: B2 - Application number: 14/341,809 - Filed: 2014-07-27 - Published: 2016-01-28 - Granted: 2016-12-13 - Earliest claimed: 2014-07-27 - Assignees: Vasona Networks, Inc. - Applicants: Vasona Networks Inc. - Inventors: Ofer Weill; Roni Bar-Yanai; Ishai Asa - Web page: https://patentgrep.com/patent/US9521060B2 ## CPC - H04L 65/1069: Session establishment or de-establishment - H04L 41/0894: Policy-based network configuration management - H04L 43/062: related to network traffic - H04L 43/12: Network monitoring probes - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 47/2483: involving identification of individual flows - H04L 61/2503: Translation of Internet protocol [IP] addresses - H04L 61/4511: using domain name system [DNS] - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 67/568: Storing data temporarily at an intermediate stage, e.g. caching - H04L 41/5019: Ensuring fulfilment of SLA - H04L 41/5058: {Service discovery by the service manager} - H04L 47/24: Traffic characterised by specific attributes, e.g. priority or QoS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for communication includes intercepting Domain Name System (DNS) messages that are sent in a communication network in preparation for setting up respective communication sessions that provide respective services associated with respective service types. DNS information that is indicative of the respective service types is extracted from the intercepted DNS messages, and the extracted DNS information is cached. A service type associated with a given communication session is identified using the cached DNS information, and a traffic policy is applied to the given communication session depending on the identified service type. ## Claims ### Claim 1 A method for communication, comprising: intercepting Domain Name System (DNS) messages that are sent in a communication network in preparation for setting up respective communication sessions that provide respective services associated with respective service types; extracting from the intercepted DNS messages DNS information that is indicative of the respective service types, including extracting Uniform Resource Identifiers (URIs) identifying hosts in the communication network to which users attempt to connect, and respective IP addresses of the hosts, and mapping the extracted URIs to one or more predefined service types; caching the extracted DNS information, including caching the extracted IP addresses and the one or more service types in association with one another; identifying a service type associated with a given communication session using the cached DNS information, by intercepting in traffic of the given communication session a host IP address of a host associated with the given communication session, retrieving a cached host URI that is associated with the host IP address, and mapping the host URI to respective one or more predefined service types; and applying a traffic policy to the given communication session depending on the identified service type. ### Claim 2 (depends on 1) The method according to claim 1, wherein the given communication session delivers a respective service over a secured connection. ### Claim 3 (depends on 1) The method according to claim 1, wherein identifying the service type comprises intercepting a session initiation request message that a user sends to a host to establish the given communication session, and if the initiation request message includes a Session Name Indication (SNI), mapping the SNI to a respective predefined service type. ### Claim 4 (depends on 1) The method according to claim 1, wherein identifying the service type comprises monitoring flow characteristics of the given communication session, and identifying the service type based on the flow characteristics. ### Claim 5 (depends on 1) The method according to claim 1, wherein applying the traffic policy comprises changing a rate of data delivery of traffic of the given communication session. ### Claim 6 (depends on 1) The method according to claim 1, wherein applying the traffic policy comprises applying the traffic policy based on congestion conditions that evolve in the communication network. ### Claim 7 A method for communication, comprising: intercepting Domain Name System (DNS) messages that are sent in a communication network in preparation for setting up respective communication sessions that provide respective services associated with respective service types; extracting from the intercepted DNS messages DNS information that is indicative of the respective service types, including Uniform Resource Identifiers (URIs) identifying hosts in the communication network to which users attempt to connect, and respective IP addresses of the hosts, and mapping the extracted URIs to one or more predefined service types, and caching the extracted DNS information, including caching the extracted IP addresses and the one or more service types in association with one another; and identifying a service type associated with a given communication session using the cached DNS information, and applying a traffic policy to the given communication session depending on the identified service type, wherein the communication sessions are associated with respective users consuming the respective services, and with respective geographical areas over which the communication sessions are delivered, and wherein caching the DNS information comprises caching the IP address and identified service type locally per user and globally per geographical area, and wherein identifying the service type comprises retrieving the globally cached service type only if retrieving the locally cached service type fails. ### Claim 8 (depends on 7) The method according to claim 7, wherein applying the traffic policy comprises applying the traffic policy separately per user. ### Claim 9 (depends on 7) The method according to claim 7, wherein applying the traffic policy comprises applying the traffic policy separately per the geographical area. ### Claim 10 A method for communication, comprising: intercepting Domain Name System (DNS) messages that are sent in a communication network in preparation for setting up respective communication sessions that provide respective services associated with respective service types; extracting from the intercepted DNS messages DNS information that is indicative of the respective service types, and caching the extracted DNS information; and identifying a service type associated with a given communication session using the cached DNS information, and applying a traffic policy to the given communication session depending on the identified service type, wherein identifying the service type comprises intercepting a certificate that a host sends to a user in setting up the given communication session, and mapping service-type related information embedded in the certificate to one or more predefined service types. ### Claim 11 An apparatus, comprising: a cache memory; and a processor, which is configured to: intercept Domain Name System (DNS) messages that are sent in a communication network in preparation for setting up respective communication sessions that provide respective services associated with respective service types, extract from the intercepted DNS messages DNS information that is indicative of the respective service types, including extracting Uniform Resource Identifiers (URIs) identifying hosts in the communication network to which users attempt to connect; extract respective IP addresses of the hosts; map the extracted URIs to one or more predefined service types; cache the extracted DNS information, including caching the extracted IP addresses and the one or more service types in association with one another; identify a service type associated with a given communication session by intercepting in traffic of the given communication session a host IP address of a host associated with the given communication session, retrieving a cached host URI that is associated with the host IP address, and mapping the host URI and host IP address to respective one or more predefined service types; and apply a traffic policy to the given communication session depending on the identified service type. ### Claim 12 (depends on 11) The apparatus according to claim 11, wherein the given communication session delivers a respective service over a secured connection. ### Claim 13 (depends on 11) The apparatus according to claim 11, wherein the processor is configured to identify the service type by intercepting a session initiation request message that a user sends to a host to establish the given communication session, and, if the initiation request message includes a Session Name Indication (SNI), to map the SNI to a respective predefined service type. ### Claim 14 (depends on 11) The apparatus according to claim 11, wherein the processor is configured to identify the service type by monitoring flow characteristics of the given communication session, and to identify the service type based on the flow characteristics. ### Claim 15 (depends on 11) The apparatus according to claim 11, wherein the processor is configured to apply the traffic policy by changing a rate of data delivery of traffic of the given communication session. ### Claim 16 (depends on 11) The apparatus according to claim 11, wherein the processor is configured to apply the traffic policy based on congestion conditions that evolve in the communication network. ### Claim 17 An apparatus, comprising: a cache memory; and a processor, which is configured to: intercept Domain Name System (DNS) messages that are sent in a communication network in preparation for setting up respective communication sessions that provide respective services associated with respective service types; extract from the intercepted DNS messages DNS information that is indicative of the respective service types; cache the extracted DNS information; identify a service type associated with a given communication session using the cached DNS information; and apply a traffic policy to the given communication session depending on the identified service type, wherein the communication sessions are associated with respective users consuming the respective services, and wherein the processor is further configured to cache the DNS information separately per user, and to apply the traffic policy separately per user. ### Claim 18 An apparatus, comprising: a cache memory; and a processor, which is configured to: intercept Domain Name System (DNS) messages that are sent in a communication network in preparation for setting up respective communication sessions that provide respective services associated with respective service types; extract from the intercepted DNS messages DNS information that is indicative of the respective service types; cache the extracted DNS information; identify a service type associated with a given communication session using the cached DNS information; and apply a traffic policy to the given communication session depending on the identified service type, wherein the communication sessions are associated with respective geographical areas over which the communication sessions are delivered, and wherein the processor is further configured to cache the DNS information separately per geographical area, and to apply the traffic policy separately per the geographical area. ### Claim 19 An apparatus, comprising: a cache memory; and a processor, which is configured to: intercept Domain Name System (DNS) messages that are sent in a communication network in preparation for setting up respective communication sessions that provide respective services associated with respective service types; extract from the intercepted DNS messages DNS information that is indicative of the respective service types; cache the extracted DNS information; identify a service type associated with a given communication session using the cached DNS information by intercepting a certificate that a host sends to a user in setting up the given communication session, to map service-type related information embedded in the certificate to one or more predefined service types; and apply a traffic policy to the given communication session depending on the identified service type.