US7296155B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Process and system providing internet protocol security without secure domain resolution
Assignee: Cisco Technology Inc
•
Filing: 2001-12-17
•
Granted: 2007-11-13
•
Expires: 2021-12-17
Abstract
Abstract A system and method providing Internet protocol security without secure domain name resolution are disclosed. A processor that periodically needs to resolve domain names into network addresses has a local DNS server that includes a secure IPSEC cache, a resolver function, a security policy database, and an IPSEC layer. The cache is readable only by the IPSEC layer. Resolved domain names are cached with process and transaction identifiers that uniquely associate the resolved names with an application process and time. When resolution is needed, the cache is used to ensure that IP addresses are resolved from names that came from the application. As a result, IPSEC connections may be established without use of DNSSEC to provide secure domain name resolution.
Inventors
- 👤 Jonathan Trostle
- 👤 William Gossman
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-24 16:32
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/14; H04L63/1441; H04L63/16; H04L63/164
Claims Analysis
Total Claims: 28
Claim 1
Independent Claim
316 words
A computer system providing Internet protocol security without secure domain name resolution, the system comprising: a local domain name service (DNS) server that is communicatively coupled to a processor and that includes a secure Internet security protocol (IPSEC) cache, wherein the secure IPSEC cache comprises a plurality of cache entries, wherein each cache entry comprises a domain name and information that uniquely associates the cache entry with a particular application process or execution time, wherein the secure IPSEC cache is readable only by an Internet protocol (IP) processing layer of an operating system that controls execution of an application program by the processor; a security policy data store that is communicatively coupled to the IP processing layer; a computer-readable medium accessible to the processor and comprising one or more sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of: receiving a message generated as a result of execution of the application program and that contains a domain name to be resolved by the local DNS server; storing, in a first of the cache entries, the domain name contained in the message and identifying information that uniquely associates the first cache entry with a particular application process or execution time; receiving a data packet from the application; in response to receiving the data packet from the application, locating an entry in the secure IPSEC cache, based on the identifying information in the located cache entry, verifying that the domain name in the located entry matches the domain name in the message; querying the security policy data store for an IPSEC policy matching the domain name in the located entry, wherein the IP processing layer verifies that the policy matches the domain name contained in the message; in response to obtaining an IPSEC policy, applying the IPSEC policy to the data packet; and purging the matching entry from the cache.
Claim 2
Dependent Claim
316 words
A computer system providing Internet protocol security without secure domain name resolution, the system comprising: a local domain name service (DNS) server that is communicatively coupled to a processor and that includes a secure Internet security protocol (IPSEC) cache, wherein the secure IPSEC cache comprises a plurality of cache entries, wherein each cache entry comprises a domain name and information that uniquely associates the cache entry with a particular application process or execution time, wherein the secure IPSEC cache is readable only by an Internet protocol (IP) processing layer of an operating system that controls execution of an application program by the processor; a security policy data store that is communicatively coupled to the IP processing layer; a computer-readable medium accessible to the processor and comprising one or more sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of: receiving a message generated as a result of execution of the application program and that contains a domain name to be resolved by the local DNS server; storing, in a first of the cache entries, the domain name contained in the message and identifying information that uniquely associates the first cache entry with a particular application process or execution time; receiving a data packet from the application; in response to receiving the data packet from the application, locating an entry in the secure IPSEC cache, based on the identifying information in the located cache entry, verifying that the domain name in the located entry matches the domain name in the message; querying the security policy data store for an IPSEC policy matching the domain name in the located entry, wherein the IP processing layer verifies that the policy matches the domain name contained in the message; in response to obtaining an IPSEC policy, applying the IPSEC policy to the data packet; and purging the matching entry from the cache.
Claim 3
Dependent Claim
29 words
A computer system as recited in claim 1 , wherein each cache entry further comprises one or more IP addresses that correspond to the domain name for the entry.
Claim 4
Dependent Claim
52 words
A computer system as recited in claim 2 , wherein the step of verifying that the domain name in the located entry matches the domain name contained in the message further comprises the step of searching the secure IPSEC cache for an entry that matches a process identifier of the application program.
Claim 5
Dependent Claim
40 words
A computer system as recited in claim 2 , wherein the information, for each cache entry, that uniquely associates the cache entry with a particular application process or execution time comprises a process identifier value and a transaction identifier value.
Claim 6
Dependent Claim
54 words
A computer system as recited in claim 4 , wherein the step of verifying that the domain name in the located entry matches the domain name contained in the message further comprises the step of searching the secure IPSEC cache for an entry that matches a process and transaction associated with the application program.
Claim 7
Dependent Claim
58 words
A computer system as recited in claim 1 , further comprising the step of querying the security policy database for an IPSEC policy based on an IP address that is resolved from the domain name received from the application program only when a matching cache entry is not found by searching the cache based on the domain name.
Claim 8
Dependent Claim
82 words
A computer system as recited in claim 1 , further comprising the steps of: wherein the message is a request to resolve the domain name into network addresses; resolving the domain name using the local DNS server, resulting in generating one or more network addresses corresponding to the domain name; determining the identifier information that uniquely associates the request with a particular application process or execution time; and storing the network addresses in the first cache entry of the secure IPSEC cache.
Claim 9
Independent Claim
267 words
A method for providing Internet protocol security without secure domain name resolution, the method comprising the computer-implemented steps of: receiving a message generated as a result of execution of an application program and that contains a domain name to be resolved by the local DNS server; storing, in a first cache entry of a secure Internet security protocol (IPSEC) cache, the domain name contained in the message and identifying information that uniquely associates the first cache entry with a particular application process or execution time, wherein the secure IPSEC cache is communicatively coupled to a local domain name service (DNS) server, and wherein the secure IPSEC cache is readable only by an Internet protocol (IP) processing layer of an operating system that controls execution of the application program, and wherein each cache entry comprises information that uniquely associates the cache entry with a particular application process or execution time; receiving a data packet from the application; in response to receiving the data packet from the application, locating an entry in the secure IPSEC cache; based on the identifying information in the located cache entry, verifying that the domain name in the located entry matches the domain name in the message; in response to obtaining an IPSEC policy, querying a security policy data store that is communicatively coupled to the IP processing layer for an IPSEC policy matching the domain name in the located entry, wherein the IP processing layer verifies that the policy matches the domain name contained in the message; applying the IPSEC policy to the data packet; and purging the matching entry from the cache.
Claim 10
Independent Claim
267 words
A method for providing Internet protocol security without secure domain name resolution, the method comprising the computer-implemented steps of: receiving a message generated as a result of execution of an application program and that contains a domain name to be resolved by the local DNS server; storing, in a first cache entry of a secure Internet security protocol (IPSEC) cache, the domain name contained in the message and identifying information that uniquely associates the first cache entry with a particular application process or execution time, wherein the secure IPSEC cache is communicatively coupled to a local domain name service (DNS) server, and wherein the secure IPSEC cache is readable only by an Internet protocol (IP) processing layer of an operating system that controls execution of the application program, and wherein each cache entry comprises information that uniquely associates the cache entry with a particular application process or execution time; receiving a data packet from the application; in response to receiving the data packet from the application, locating an entry in the secure IPSEC cache; based on the identifying information in the located cache entry, verifying that the domain name in the located entry matches the domain name in the message; in response to obtaining an IPSEC policy, querying a security policy data store that is communicatively coupled to the IP processing layer for an IPSEC policy matching the domain name in the located entry, wherein the IP processing layer verifies that the policy matches the domain name contained in the message; applying the IPSEC policy to the data packet; and purging the matching entry from the cache.
Claim 11
Dependent Claim
28 words
A method as recited in claim 8 , wherein each cache entry further comprises one or more IP addresses that correspond to the domain name for the entry.
Claim 12
Dependent Claim
51 words
A method as recited in claim 9 , wherein the step of verifying that the domain name in the located entry matches the domain name contained in the message further comprises the step of searching the secure IPSEC cache for an entry that matches a process identifier of the application program.
Claim 13
Dependent Claim
39 words
A method as recited in claim 9 , wherein the information, for each cache entry, that uniquely associates the cache entry with a particular application process or execution time comprises a process identifier value and a transaction identifier value.
Claim 14
Dependent Claim
53 words
A method as recited in claim 11 , wherein the step of verifying that the domain name in the located entry matches the domain name contained in the message further comprises the step of searching the secure IPSEC cache for an entry that matches a process and transaction associated with the application program.
Claim 15
Dependent Claim
57 words
A method as recited in claim 8 , further comprising the step of querying the security policy database for an IPSEC policy based on an IP address that is resolved from the domain name received from the application program only when a matching cache entry is not found by searching the cache based on the domain name.
Claim 16
Dependent Claim
81 words
A method as recited in claim 8 , further comprising the steps of: wherein the message is a request to resolve the domain name into network addresses; resolving the domain name using the local DNS server, resulting in generating one or more network addresses corresponding to the DNS name; determining the identifier information that uniquely associates the request with a particular application process or execution time; and storing the network addresses in the first cache entry of the secure IPSEC cache.
Claim 17
Dependent Claim
289 words
A computer-readable medium carrying one or more sequences of instructions for providing Internet protocol security without secure domain name resolution, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of: receiving a message generated as a result of execution of an application program and that contains a domain name to be resolved by the local DNS server; storing, in a first cache entry of a secure Internet security protocol (IPSEC) cache, the domain name contained in the message and identifying information that uniquely associates the first cache entry with a particular application process or execution time, wherein the secure IPSEC cache is communicatively coupled to a local domain name service (DNS) server, and wherein the secure IPSEC cache is readable only by an Internet protocol (IP) processing layer of an operating system that controls execution of the application program, and wherein each cache entry comprises information that uniquely associates the cache entry with a particular application process or execution time; receiving a data packet from the application; in response to receiving the data packet from the application, locating an entry in the secure IPSEC cache; based on the identifying information in the located cache entry, verifying that the domain name in the located entry matches the domain name in the message; in response to obtaining an IPSEC policy, querying a security policy data store that is communicatively coupled to the IP processing layer for an IPSEC policy matching the domain name in the located entry, wherein the IP processing layer verifies that the policy matches the domain name contained in the message; applying the IPSEC policy to the data packet; and purging the matching entry from the cache.
Claim 18
Dependent Claim
289 words
A computer-readable medium carrying one or more sequences of instructions for providing Internet protocol security without secure domain name resolution, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of: receiving a message generated as a result of execution of an application program and that contains a domain name to be resolved by the local DNS server; storing, in a first cache entry of a secure Internet security protocol (IPSEC) cache, the domain name contained in the message and identifying information that uniquely associates the first cache entry with a particular application process or execution time, wherein the secure IPSEC cache is communicatively coupled to a local domain name service (DNS) server, and wherein the secure IPSEC cache is readable only by an Internet protocol (IP) processing layer of an operating system that controls execution of the application program, and wherein each cache entry comprises information that uniquely associates the cache entry with a particular application process or execution time; receiving a data packet from the application; in response to receiving the data packet from the application, locating an entry in the secure IPSEC cache; based on the identifying information in the located cache entry, verifying that the domain name in the located entry matches the domain name in the message; in response to obtaining an IPSEC policy, querying a security policy data store that is communicatively coupled to the IP processing layer for an IPSEC policy matching the domain name in the located entry, wherein the IP processing layer verifies that the policy matches the domain name contained in the message; applying the IPSEC policy to the data packet; and purging the matching entry from the cache.
Claim 19
Independent Claim
270 words
An apparatus for providing Internet protocol security without secure domain name resolution, comprising: means for receiving a message generated as a result of execution of an application program and that contains a domain name to be resolved by the local DNS server; means for storing, in a first cache entry of a secure Internet security protocol (IPSEC) cache, the domain name contained in the message and identifying information that uniquely associates the first cache entry with a particular application process or execution time, wherein the secure IPSEC cache is communicatively coupled to a local domain name service (DNS) server, and wherein the secure IPSEC cache is readable only by an Internet protocol (IP) processing layer of an operating system that controls execution of the application program, and wherein each cache entry comprises information that uniquely associates the cache entry with a particular application process or execution time, means for receiving a data packet from the application; in response to receiving the data packet from the application, means for locating an entry in the secure IPSEC cache; based on the identifying information in the located cache entry, means for verifying that the domain name in the located entry matches the domain name in the message; means for querying a security policy data store that is communicatively coupled to the IP processing layer for an IPSEC policy matching the domain name in the located entry, wherein the IP processing layer verifies that the policy matches the domain name contained in the message; means for applying the IPSEC policy to the data packet; and means for purging the matching entry from the cache.
Claim 20
Independent Claim
270 words
An apparatus for providing Internet protocol security without secure domain name resolution, comprising: means for receiving a message generated as a result of execution of an application program and that contains a domain name to be resolved by the local DNS server; means for storing, in a first cache entry of a secure Internet security protocol (IPSEC) cache, the domain name contained in the message and identifying information that uniquely associates the first cache entry with a particular application process or execution time, wherein the secure IPSEC cache is communicatively coupled to a local domain name service (DNS) server, and wherein the secure IPSEC cache is readable only by an Internet protocol (IP) processing layer of an operating system that controls execution of the application program, and wherein each cache entry comprises information that uniquely associates the cache entry with a particular application process or execution time, means for receiving a data packet from the application; in response to receiving the data packet from the application, means for locating an entry in the secure IPSEC cache; based on the identifying information in the located cache entry, means for verifying that the domain name in the located entry matches the domain name in the message; means for querying a security policy data store that is communicatively coupled to the IP processing layer for an IPSEC policy matching the domain name in the located entry, wherein the IP processing layer verifies that the policy matches the domain name contained in the message; means for applying the IPSEC policy to the data packet; and means for purging the matching entry from the cache.
Claim 21
Dependent Claim
28 words
An apparatus as recited in claim 16 , wherein each cache entry further comprises one or more IP addresses that correspond to the domain name for the entry.
Claim 22
Dependent Claim
50 words
A apparatus as recited in claim 17 , wherein the means for verifying that the domain name in the located entry matches the domain name contained in the message further comprises means for searching the secure IPSEC cache for an entry that matches a process identifier of the application program.
Claim 23
Dependent Claim
39 words
A apparatus as recited in claim 18 , wherein the information, for each cache entry, that uniquely associates the cache entry with a particular application process or execution time comprises a process identifier value and a transaction identifier value.
Claim 24
Dependent Claim
52 words
A apparatus as recited in claim 19 , wherein the means for verifying that the domain name in the located entry matches the domain name contained in the message further comprises means for searching the secure IPSEC cache for an entry that matches a process and transaction associated with the application program.
Claim 25
Dependent Claim
56 words
A apparatus as recited in claim 16 , further comprising means for querying the security policy database for an IPSEC policy based on an IP address that is resolved from the domain name received from the application program only when a matching cache entry is not found by searching the cache based on the domain name.
Claim 26
Dependent Claim
81 words
An apparatus as recited in claim 16 , wherein the message is a request to resolve the domain name into network addresses; and further comprising: means for resolving the domain name the local DNS server, resulting in generating one or more network addresses corresponding to the domain name; means for determining identifier information that uniquely associates the request with a particular application process or execution time; and means for storing the network addresses as an entry in the secure IPSEC cache.
Claim 27
Independent Claim
313 words
An apparatus for providing Internet protocol security, without secure domain name resolution, for messages that are carried by a packet-switched data network, comprising: a network interface that is coupled to the data network for receiving one or more packet flows therefrom; a processor; one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of: receiving a message generated as a result of execution of an application program and that contains a domain name to be resolved by the local DNS server; storing, in a first cache entry of a secure Internet security protocol (IPSEC) cache, the domain name contained in the message and identifying information that uniquely associates the first cache entry with a particular application process or execution time, wherein the secure IPSEC cache is communicatively coupled to a local domain name service (DNS) server, and wherein the secure IPSEC cache is readable only by an Internet protocol (IP) processing layer of an operating system that controls execution of the application program, and wherein each cache entry comprises information that uniquely associates the cache entry with a particular application process or execution time; receiving a data packet from the application; in response to receiving the data packet from the application, locating an entry in the secure IPSEC cache; based on the identifying information in the located cache entry, verifying that the domain name in the located entry matches the domain name in the message; in response to obtaining an IPSEC policy, querying a security policy data store that is communicatively coupled to the IP processing layer for an IPSEC policy matching the domain name in the located entry, wherein the IP processing layer verifies that the policy matches the domain name contained in the message; applying the IPSEC policy to the data packet; and purging the matching entry from the cache.
Claim 28
Independent Claim
313 words
An apparatus for providing Internet protocol security, without secure domain name resolution, for messages that are carried by a packet-switched data network, comprising: a network interface that is coupled to the data network for receiving one or more packet flows therefrom; a processor; one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of: receiving a message generated as a result of execution of an application program and that contains a domain name to be resolved by the local DNS server; storing, in a first cache entry of a secure Internet security protocol (IPSEC) cache, the domain name contained in the message and identifying information that uniquely associates the first cache entry with a particular application process or execution time, wherein the secure IPSEC cache is communicatively coupled to a local domain name service (DNS) server, and wherein the secure IPSEC cache is readable only by an Internet protocol (IP) processing layer of an operating system that controls execution of the application program, and wherein each cache entry comprises information that uniquely associates the cache entry with a particular application process or execution time; receiving a data packet from the application; in response to receiving the data packet from the application, locating an entry in the secure IPSEC cache; based on the identifying information in the located cache entry, verifying that the domain name in the located entry matches the domain name in the message; in response to obtaining an IPSEC policy, querying a security policy data store that is communicatively coupled to the IP processing layer for an IPSEC policy matching the domain name in the located entry, wherein the IP processing layer verifies that the policy matches the domain name contained in the message; applying the IPSEC policy to the data packet; and purging the matching entry from the cache.
References Cited (Backward Citations)
US6170012B1
Cited
US6353886B1
Cited
US6253321B1
Cited
US20010052016A1
Cited
US6772348B1
Cited
US6697857B1
Cited
US20040093434A1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2010-11-12 | 2011-05-14 | 2011-11-13 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2014-11-12 | 2015-05-14 | 2015-11-13 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2018-11-12 | 2019-05-14 | 2019-11-13 | $7700.00 | Window Closed / Lapsed |