Restricting communication over an encrypted network connection to internet domains that share common IP addresses and shared SSL certificates

• US 10,257,157 B2
• Filed: 05/17/2018
• Issued: 04/09/2019
• Est. Priority Date: 04/24/2012
• Status: Active Grant

• Current Assignee: iBoss
• Original Assignee: iBoss
• Inventors: Martini, Paul Michael
• Primary Examiner(s): Shaw, Brian F
• Application Number:
  US15/982,753
• Publication Number:
  US 20180270192A1
• Time in Patent Office: 327 Days
• Field of Search: 726 26
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

An apparatus prevents communication by a client device to a domain that cannot be uniquely identified by relocating the DNS mapping of the domain to a destination IP Address that is uniquely identifiable and that represents a location of an apparatus that provides a data path to the domain.

Claims

1. A computer-implemented method executed by one or more hardware processors, the method comprising:

receiving an encrypted request for a resource, the encrypted request directed to a particular IP address;

determining that the particular IP address is a spoofed IP address associated with a particular domain name;

determining that the encrypted request is directed to the particular domain name based on the association between the spoofed IP address and the particular domain name, wherein the determination is made without decrypting the encrypted request; and

selectively allowing the encrypted request based at least in part on determining that the encrypted request is directed to the particular domain name.

2. The method of claim 1, wherein selectively allowing the encrypted request includes:

determining that the encrypted request should be blocked based at least in part on a rule associated with the particular domain name; and

blocking the encrypted request.

3. The method of claim 1, wherein selectively allowing the encrypted request includes:

determining that the encrypted request should be allowed based at least in part on a rule associated with the particular domain name; and

forwarding the encrypted request to a corresponding IP address for the particular domain name.

4. The method of claim 1, wherein the association between the spoofed IP address and the particular domain name is created by a domain name server in response to receiving a request to resolve the particular domain name.

5. The method of claim 1, wherein the spoofed IP address includes an IP port.

6. The method of claim 1, wherein receiving the encrypted request for the resource includes receiving a request according to Hypertext Transfer Protocol Secure (HTTPS).

7. A non-transitory, computer-readable medium storing instructions operable when executed to cause at least one hardware processor to perform operations comprising:

receiving an encrypted request for a resource, the encrypted request directed to a particular IP address;

determining that the particular IP address is a spoofed IP address associated with a particular domain name;

determining that the encrypted request is directed to the particular domain name based on the association between the spoofed IP address and the particular domain name, wherein the determination is made without decrypting the encrypted request; and

selectively allowing the encrypted request based at least in part on determining that the encrypted request is directed to the particular domain name.

8. The non-transitory, computer-readable medium of claim 7, wherein selectively allowing the encrypted request includes:

determining that the encrypted request should be blocked based at least in part on a rule associated with the particular domain name; and

blocking the encrypted request.

9. The non-transitory, computer-readable medium of claim 7, wherein selectively allowing the encrypted request includes:

determining that the encrypted request should be allowed based at least in part on a rule associated with the particular domain name; and

forwarding the encrypted request to a corresponding IP address for the particular domain name.

10. The non-transitory, computer-readable medium of claim 7, wherein the association between the spoofed IP address and the particular domain name is created by a domain name server in response to receiving a request to resolve the particular domain name.

11. The non-transitory, computer-readable medium of claim 7, wherein the spoofed IP address includes an IP port.

12. The non-transitory, computer-readable medium of claim 7, wherein receiving the encrypted request for the resource includes receiving a request according to Hypertext Transfer Protocol Secure (HTTPS).

13. A system comprising:

memory for storing data; and

one or more hardware processors operable to perform operations comprising;

receiving an encrypted request for a resource, the encrypted request directed to a particular IP address;

determining that the particular IP address is a spoofed IP address associated with a particular domain name;

determining that the encrypted request is directed to the particular domain name based on the association between the spoofed IP address and the particular domain name, wherein the determination is made without decrypting the encrypted request; and

selectively allowing the encrypted request based at least in part on determining that the encrypted request is directed to the particular domain name.

14. The system of claim 13, wherein selectively allowing the encrypted request includes:

determining that the encrypted request should be blocked based at least n part on a rule associated with the particular domain name; and

blocking the encrypted request.

15. The system of claim 13, wherein selectively allowing the encrypted request includes:

determining that the encrypted request should be allowed based at least in part on a rule associated with the particular domain name; and

forwarding the encrypted request to a corresponding IP address for the particular domain name.

16. The system of claim 13, wherein the association between the spoofed IP address and the particular domain name is created by a domain name server in response to receiving a request to resolve the particular domain name.

17. The system of claim 13, wherein the spoofed IP address includes an IP port.