DOMAIN BASED AUTHENTICATION SCHEME

• US 20140123264A1
• Filed: 01/07/2014
• Published: 05/01/2014
• Est. Priority Date: 11/20/2008
• Status: Active Grant

• Current Assignee: John Francis Mergen, Mark Kevin Shull
• Original Assignee: John Francis Mergen, Mark Kevin Shull
• Inventors: Shull, Mark Kevin, Mergen, John Francis
• Granted Patent: US 9,923,882 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

In one example, a system for authenticating domains operates by authenticating a first domain and the extensions that make up the URI of an initial or primary Internet network call. Thereafter, the system can enable the owner of the first domain to make assertions or statements about additional domains and URIs that make up the rest of the web page, session or application.

Claims

1. A system, comprising:

a user terminal including a domain name stub resolver component and a Domain Name Server (DNS) verifier component;

wherein the domain name stub resolver component is configured to;

determine whether a local cache of the user terminal includes a translation for a Domain Name Server (DNS) portion of a Uniform Resource Identifier (URI) of a network call;

responsive to determining that the local cache does not include the translation, send by the user terminal a transmission to a DNS server; and

responsive to determining that the local cache does include the translation or sending the transmission, obtain a domain name to IP address translation;

wherein the DNS verifier component is configured to;

detect when the domain name stub resolver component is provided with a domain name to IP look up request;

responsive to detecting said providing, obtain an IP address from a predetermined remote service;

compare the domain name to IP address translation obtained by the domain name stub resolver component to the IP address obtained from the predetermined remote service; and

determine whether to identify an exception responsive to a result of the comparison.

2. The system of claim 1, wherein the DNS verifier component is configured to:

responsive to identifying the exception, force a DNS cache of the user terminal to be dumped; and

cause the domain name stub resolver component to repeat the determining and the obtaining after the dump.

3. The system of claim 2, wherein the DNS verifier component is configured to:

compare a next domain name to IP address translation obtained by the domain name stub resolver component to the IP address obtained from the predetermined remote service; and

in response to observing a same mis-match of the next domain name to IP address translation and the IP address obtained from the predetermined remote service as a previous mis-match of the previous domain name to IP address translation and the IP address obtained from the predetermined remote service, generate an error.

4. The system of claim 1, wherein the DNS verifier component is configured to:

responsive to identifying the exception, enable a cacheless DNS checking mode;

cause the domain name stub resolver component to obtain a next domain name to IP address translation after the enabling.

5. The system of claim 4, wherein the DNS verifier component is configured to:

compare the next domain name to IP address translation obtained by the domain name stub resolver component to the IP address obtained from the predetermined remote service; and

in response to observing a same mis-match of the next domain name to IP address translation and the IP address obtained from the predetermined remote service as a previous mis-match of the domain name to IP address translation and the IP address obtained from the predetermined remote service, generate an error.

6. The system of claim 1, wherein the DNS verifier component is configured to:

in response to determining to not identify the exception, determine whether an initiation of a download of content corresponding to the domain name to IP address translation has been deferred or a downloaded portion of the content has been embargoed; and

responsive to determining that the initiation has been deferred or the downloaded portion has been embargoed, initiate the download or releasing the embargo responsive to a result of the comparison.

7. A method, comprising:

determining by a domain name stub resolver component of a user terminal whether a local cache of the user terminal includes a translation for a Domain Name Server (DNS) portion of a Uniform Resource Identifier (URI) of a network call;

responsive to determining that the local cache does not include the translation, generating by the domain name stub resolver component a transmission addressed to a DNS server; and

responsive to determining that the local cache does include the translation or sending the generated transmission, obtaining by the domain name stub resolver component a domain name to IP address translation;

detecting when the domain name stub resolver component is provided with a domain name to IP look up request;

responsive to detecting said providing, obtaining an IP address from a predetermined remote service;

comparing the domain name to IP address translation to the IP address obtained from the predetermined remote service; and

identifying an exception responsive to a result of the comparison.

8. The method of claim 7, further comprising:

responsive to identifying the exception, forcing a DNS cache of the user terminal to be dumped; and

causing the domain name stub resolver component to repeat the determining and the obtaining after the dump.

9. The method of claim 8, further comprising:

comparing a next domain name to IP address translation obtained by the domain name stub resolver component to the IP address obtained from the predetermined remote service; and

in response to observing a same mis-match of the next domain name to IP address translation and the IP address obtained from the predetermined remote service as a previous mis-match of the previous domain name to IP address translation and the IP address obtained from the predetermined remote service, generating an error.

10. The method of claim 7, further comprising:

responsive to identifying the exception, enabling a cacheless DNS checking mode;

causing the domain name stub resolver component to obtain a next domain name to IP address translation after the enabling.

11. The method of claim 10, further comprising:

comparing the next domain name to IP address translation obtained by the domain name stub resolver component to the IP address obtained from the predetermined remote service; and

in response to observing a same mis-match of the next domain name to IP address translation and the IP address obtained from the predetermined remote service as a previous mis-match of the domain name to IP address translation and the IP address obtained from the predetermined remote service, generating an error.

12. The method of claim 7, further comprising:

in response to determining to not identify the exception, determining whether an initiation of a download of content corresponding to the domain name to IP address translation has been deferred; and

responsive to determining that the initiation has been deferred, initiating the download responsive to a result of the comparison.

13. The method of claim 7, further comprising:

in response to determining to not identify the exception, determining whether an initiation of a downloaded portion of content corresponding to the domain has been embargoed; and

responsive to determining that the downloaded portion has been embargoed, releasing the embargo responsive to a result of the comparison.