Name resolving in segmented networks

• US 10,284,517 B2
• Filed: 11/01/2017
• Issued: 05/07/2019
• Est. Priority Date: 10/16/2015
• Status: Active Grant

• Current Assignee: Cryptzone North America Inc. (Cryptzone Group AB)
• Original Assignee: Cryptzone North America Inc. (Cryptzone Group AB)
• Inventors: Glazemakers, Kurt, Cellerier, Thomas Bruno Emmanuel
• Primary Examiner(s): Cox, Natisha D
• Application Number:
  US15/800,953
• Publication Number:
  US 20180069826A1
• Time in Patent Office: 552 Days
• Field of Search: None
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 61/2592 using tunnelling or encapsulation
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

A method is provided, in one embodiment, which is performed on a client computing device, the method including: connecting a client computing device with a private network, wherein the private network comprises a plurality of name resolving servers, and each name resolving server is configured to resolve name requests for networking devices in a respective segment of a plurality of segments of the private network; receiving a first name request from a first application on the client computing device; in response to receiving the first name request, forwarding the first name request simultaneously to the plurality of name resolving servers; and selecting a name resolution that is first received from the plurality of name resolving servers in response to the first name request.

Claims

1. A method, comprising:

connecting a client computing device with a private network, wherein the private network comprises a plurality of name resolving servers, and each name resolving server is configured to resolve name requests for networking devices in a respective segment of a plurality of segments of the private network;

providing authentication information to an authentication server;

in response to successful authentication from the authentication server, receiving a list of the plurality of name resolving servers, the list including networking addresses of the name resolving servers;

receiving a name request from an application on the client computing device;

in response to receiving the name request, forwarding the name request simultaneously to the plurality of name resolving servers, wherein the name request is forwarded to network addresses retrieved from the list; and

selecting a name resolution that is first received from the plurality of name resolving servers in response to the name request.

2. The method of claim 1, further comprising running a name resolving service on the client computing device, wherein the name request is received by the name resolving service.

3. The method of claim 2, wherein the name request is forwarded to the plurality of name resolving servers by the name resolving service.

4. The method of claim 1, further comprising registering the client computing device as primary name resolving server for serving name requests for names in the private network received from applications on the client computing device, the name requests including the name request received from the application on the client computing device.

5. The method of claim 1, further comprising returning the selected name resolution to the application on the client computing device.

6. The method of claim 1, wherein network access is restricted from one segment to another of the plurality of segments.

7. The method of claim 1, wherein the list of the plurality of name resolving servers is a client access list, and the client access list further identifies a selection of networking devices in the private network that the client computing device is authorized to access, the method further comprising:

sending the client access list to at least one gateway that provides access to the respective segments, wherein the client access list enables the at least one gateway to configure a firewall.

8. The method of claim 7, wherein the at least one gateway configures the firewall with firewall rules derived from the client access list to provide network access, in accordance with the firewall rules, by the client computing device to the selection of networking devices.

9. The method of claim 1, wherein the list of the plurality of name resolving servers is a client tunnel list, and the client tunnel list further includes information for establishing networking tunnels with at least one gateway to provide access to the respective segments.

10. The method of claim 1, wherein the list of the plurality of name resolving servers is a client access list that identifies networking devices that the client computing device is authorized to access.

11. A system, comprising:

at least one processor; and

memory storing instructions programmed to instruct the at least one processor to;

connect a client computing device with a private network, wherein the private network comprises a plurality of name resolving servers, and each name resolving server is configured to resolve name requests for networking devices in a respective segment of a plurality of segments of the private network;

provide authentication information to an authentication server;

in response to successful authentication from the authentication server, receive a list of the plurality of name resolving servers;

receive a name request from an application on the client computing device;

in response to receiving the name request, forward the name request simultaneously to the plurality of name resolving servers in the list; and

select a name resolution that is first received from the plurality of name resolving servers in response to the name request.

12. The system of claim 11, wherein the list is a client access list, the client access list identifies a selection of networking devices in the private network that the client computing device is authorized to access, and the instructions further instruct the at least one processor to:

send the client access list to at least one gateway that provides access to the respective segments in order to enable the at least one gateway to configure a firewall.

13. The system of claim 12, wherein the instructions further instruct the at least one processor to receive a client tunnel list comprising information for establishing networking tunnels with the at least one gateway.

14. The system of claim 11, wherein the instructions further instruct the at least one processor to register the client computing device as primary name resolving server for serving name requests for names in the private network received from applications on the client computing device, the name requests including the name request received from the application on the client computing device.

15. A non-transitory computer readable storage medium storing instructions configured to instruct a data processing system to:

connect a client computing device with a private network, wherein the private network comprises a plurality of name resolving servers, and each name resolving server is configured to resolve name requests for networking devices in a respective segment of a plurality of segments of the private network;

provide authentication information to an authentication server;

in response to successful authentication from the authentication server, receive an identification of the plurality of name resolving servers;

in response to receiving a name request from the client computing device, forward the name request simultaneously to the identified name resolving servers; and

select a name resolution that is received from the plurality of name resolving servers in response to the name request.

16. The non-transitory computer readable storage medium of claim 15, wherein the instructions are further configured to instruct the data processing system to:

in response to a successful authentication, receive a client access list, wherein the client access list identifies a selection of networking devices in the private network that the client computing device is authorized to access; and

send the client access list to at least one gateway that provides access to the respective segments in order to enable the at least one gateway to configure a firewall.

17. The non-transitory computer readable storage medium of claim 16, wherein the name resolving servers are identified by the client access list.