SECURE RESOURCE NAME RESOLUTION USING A CACHE

• US 20100034381A1
• Filed: 08/08/2008
• Published: 02/11/2010
• Est. Priority Date: 08/08/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Meren, Libby, Trace, Rob M.
• Granted Patent: US 8,429,715 B2
• Time in Patent Office: Days
• US Class Current: 380/255
• CPC Class Codes: H04L 45/742 Route cache; Operation thereof
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/58 Caching of addresses or names
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

Techniques for securing name resolution technologies and for ensuring that name resolution technologies can function in modern networks that have a plurality of overlay networks accessible via a single network interface. In accordance with some of the principles described herein, a set of resolution parameters may be implemented by a user to be used during a name resolution process. In some implementations, when an identifier is obtained for a network resource, the identifier may be stored in a cache with resolution parameters that were used in obtaining the identifier. When a new name resolution request is received, the cache may be examined to determine whether a corresponding second identifier is in the cache, and whether resolution parameters used to retrieve the second identifier in the cache match the resolution parameters for the new resolution request. If so, the second identifier may be returned from the cache.

Claims

1. A method comprising:

(A) accepting as input a first identifier for a network resource;

(B) consulting a collection of sets of resolution parameters to determine a set of applicable resolution parameters that apply to the first identifier;

(C) obtaining a second identifier for the network resource using the set of applicable resolution parameters; and

(D) storing in a cache the second identifier and at least one identifier for the set of applicable resolution parameters used in the act (C).

2. The method of claim 1, wherein the at least one identifier for the set of applicable resolution parameters comprises the set of applicable resolution parameters.

3. The method of claim 1, wherein the at least one identifier for the set of applicable resolution parameters comprises a time at which the second identifier is obtained.

4. The method of claim 1, wherein the consulting of act (B) comprises:

(B1) comparing the first identifier of the network resource to patterns associated with each of the sets of resolution parameters in the collection to determine whether each set of resolution parameters applies to the first identifier.

5. The method of claim 1, wherein the obtaining of act (C) comprises:

(C1) using the set of applicable resolution parameters to encrypt a communication channel according to an encryption protocol specified by at least one parameter of the set of applicable resolution parameters.

6. The method of claim 1, wherein the obtaining of act (C) comprises:

(C1) using the set of applicable resolution parameters to establish a communication channel to a resolution resource specified by at least one parameter of the set of applicable resolution parameters.

7. At least one computer-readable storage medium encoded with computer-executable instructions that, when executed, cause a computer to perform a method, the method comprising:

(A) accepting as input a first identifier for a network resource;

(B) consulting a collection of sets of resolution parameters to determine a set of applicable resolution parameters that apply to the first identifier;

(C) reviewing the contents of a cache of identifiers to determine whether a second identifier corresponding to the first identifier is present in the cache, the cache comprising, for each identifier in the cache, stored resolution parameters under which the second identifier was obtained;

(D) when the second identifier is present, comparing the stored resolution parameters under which the second identifier was obtained to the set of applicable resolution parameters; and

(E) when the stored resolution parameters match the set of applicable resolution parameters, returning the second identifier from the cache.

8. The at least one computer-readable storage medium of claim 7, wherein the method further comprises:

(F) when the stored resolution parameters do not match the set of applicable resolution parameters, obtaining a second identifier for the network resource, the obtaining comprising conducting a name resolution process over a network to determine the second identifier for the network resource based on the first identifier, wherein the name resolution process is governed by the set of applicable resolution parameters.

9. The at least one computer-readable storage medium of claim 7, wherein the act (D) of determining whether the stored resolution parameters match the set of applicable resolution parameters comprises:

(D1) determining whether the stored resolution parameters exactly match the set of applicable resolution parameters.

10. The at least one computer-readable storage medium of claim 9, wherein the act (D1) comprises:

(D2) determining whether the set of applicable resolution parameters has been unchanged since a time at which the second identifier was retrieved.

11. The at least one computer-readable storage medium of claim 7, wherein the act (D) of determining whether the stored resolution parameters match the set of applicable resolution parameters comprises:

(D1) determining whether the stored resolution parameters are at least as secure as the set of applicable resolution parameters.

12. The at least one computer-readable storage medium of claim 7, wherein the at least one identifier for the stored resolution parameters is the set of resolution parameters used to retrieve the second identifier stored in the cache.

13. The at least one computer-readable storage medium of claim 7, wherein the at least one identifier for the stored resolution parameters is a time at which the second identifier stored in the cache was retrieved.

14. The at least one computer-readable storage medium of claim 7, wherein the first identifier is a textual identifier and the second identifier is a numeric identifier.

15. An apparatus comprising:

at least one tangible computer-readable storage medium adapted to store a plurality of instances of a data structure comprising a second identifier for a network resource and at least one identifier for a set of resolution parameters that were used to retrieve the second identifier; and

at least one processor adapted to execute a name resolution process, the name resolution process comprising;

accepting a first identifier for a network resource;

determining a set of applicable resolution parameters to govern a resolution process;

reviewing the plurality of instances of the data structure to determine whether any of the second identifier correspond to the first identifier;

when any of the second identifier correspond to the first identifier, determining whether the at least one identifier for the set of resolution parameters used to retrieve the second identifier match the set of applicable resolution parameters; and

when the stored resolution parameters match the set of applicable resolution parameters, returning the second identifier from the cache.

16. The apparatus of claim 15, wherein the name resolution process further comprises:

(F) when the stored resolution parameters do not match the set of applicable resolution parameters, obtaining a second identifier for the network resource, the obtaining comprising conducting a name resolution process to determine the first identifier corresponding to the second identifier based on the second identifier, wherein the name resolution process is governed by the set of applicable resolution parameters.

17. The apparatus of claim 15, wherein the at least one identifier for the stored resolution parameters is the set of resolution parameters used to retrieve the second identifier stored in the cache.

18. The apparatus of claim 15, wherein determining whether the at least one identifier for the stored resolution parameters matches the set of applicable resolution parameters comprises determining whether the stored resolution parameters exactly match the set of applicable resolution parameters.

19. The apparatus of claim 18, wherein determining whether the at least one identifier for the stored resolution parameters exactly matches the set of applicable resolution parameters comprises determining whether the set of applicable resolution parameters has been unchanged since a time at which the second identifier was retrieved.

20. The apparatus of claim 15, wherein the first identifier is a textual identifier and the second identifier is a numeric identifier.