Cross-Domain HTTP Requests Using DNS Rebinding

• US 20170063778A1
• Filed: 08/25/2016
• Published: 03/02/2017
• Est. Priority Date: 08/26/2015
• Status: Active Grant

• Current Assignee: Pulsepoint Incorporated (Pulsepoint Holdings LLC)
• Original Assignee: Pulsepoint Incorporated (Pulsepoint Holdings LLC)
• Inventors: Rachitskiy, Yevgeniy, Litvin, Leonid
• Granted Patent: US 10,536,425 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/58 Caching of addresses or names
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 67/567 Integrating service provisioning from a plurality of service providers

Abstract

Cross-domain requests by DNS name rebinding. A domain name server at a first domain name receives an initialization request from a user agent device. The request designates a class of domain names to be resolved to an IP address belonging to a second domain name to which the user agent device seeks to issue a safe cross-domain request. That request will be directed to the first domain name, but serviced by a server belonging to the second. In a DNS cache of the user agent, the first domain name is bound to an IP address belonging to the first domain, and to an IP address belonging to the second domain name. This binding is established by providing two or more IP address resource records resolving the designation of the class of domain names, having the relevant IP addresses, and ensuring that the first domain name is pinned to the first IP address in a DNS cache of the user agent device, and that others of the IP addresses are stored in the user agent'"'"'s DNS cache as alternative binding(s) to the first domain name, and then invalidating the first IP address, so that the binding falls through to an alternative one of the IP addresses.

Claims

1. A method, comprising the steps of:

at a domain name server at a first domain name, receiving an initialization request from a user agent device, the initialization request designating a class of domain names to be resolved to an IP address belonging to a second domain name to which the user agent device seeks to issue a safe cross-domain request to be subsequently directed to the first domain name, the second domain name being a public domain name that is different than the first domain name;

establishing in a Domain Name System (DNS) address cache a binding of the first domain name to an IP address belonging to the second domain name, by;

sending one or more responses to the user agent device, the response(s) providing two or more IP address resource records resolving the designation of the class of domain names;

one of the IP address resource records having a first IP address belonging to a computer within the domain of the first domain name,

other of the provided IP address resource records having IP addresses for computers within domains belonging to the designated class of domain names, and having been evaluated by the domain name server to be eligible to service the cross-domain request to be subsequently issued by the user agent;

ensuring that the first domain name is pinned to the first IP address in a DNS address cache of the user agent device, and that others of the IP addresses are stored in the user agent'"'"'s DNS address cache as alternative binding(s) to the first domain name;

sending a message to the user agent device to cause the user agent device to unpin the first IP address, and to bind the first domain name to an alternative one of the IP addresses from among the other stored IP addresses, and

sending messages to enable the user agent device to issue an HTTP request addressed to the first domain name and to be routed to the IP address that belongs to or is to be resolved to a computer of the second domain name, to be serviced by a computer at the second domain name.

2. A computer system, comprising:

one or more processors designed to execute instructions;

one or more nontransitory, machine-readable memories storing program instructions for execution by the processor(s), the instructions programmed to cause the processor(s) to;

issue an initialization request to a domain name server at a first domain name, the initialization request designating a class of domain names to be resolved to an internet protocol (IP) address belonging to a second domain name, from which the user agent device is to seek to issue a safe cross-domain request to be subsequently directed to the first domain name, the second domain name being a public domain name that is different than the first domain name;

in a Domain Name System (DNS) address cache, establish a binding of the first domain name to an IP address belonging to the second domain name; and

send a cross-domain Hypertext Transfer Protocol (HTTP) request addressed to the first domain name and routed to the IP address that belongs to or is to be resolved to a computer of the second domain name, to be serviced by a computer at the second domain name.

3. The computer system of claim 2, wherein:

the initialization request designates the class of domain names as qualification of a fully-qualified hostname within the first domain name.

4. The computer system of claim 2, the instructions further programmed to cause the processor(s) to:

receive a response from the domain name server, the response to return to the user agent device two or more IP address resource records to resolve the designation of the class of domain names;

one of the returned IP address resource records having a first IP address belonging to a computer within the domain of the first domain name,

other of the returned IP address resource records having IP addresses for computers within domains belonging to the designated class of domain names, and having been evaluated by the domain name server to be eligible to service the cross-domain request to be subsequently issued by the user agent;

ensure that the first domain name is pinned to the first IP address in a DNS address cache of the user agent device, and that others of the IP addresses are stored in the user agent'"'"'s DNS address cache as alternative binding(s) to the first domain name.

5. The computer system of claim 4, the instructions further programmed to cause the processor(s) to:

unpin the pinned first IP address and binding to the first domain name an alternative one of the IP addresses chosen from among the stored IP addresses.

6. The computer system of claim 2:

the instructions to establish of a binding of the first domain name to an IP address belonging to the second domain name being further programmed to cause the processor to;

in the DNS address cache, establish two or more IP addresses for translation of the first domain name;

send a request over the internet to the first domain name, including resolving the first domain name of the request to the first of the IP addresses in the DNS address cache;

receive a reply to the request, and evaluating the source of the reply; and

if the evaluation determines that the reply is received from an undesired node of the internet, invalidate the translation from the first domain name to the undesired IP addresses from the DNS address cache.

7. The computer system of claim 2, the instructions further programmed to cause the processor(s) to:

establish the binding by sending a request from the user agent device that is designed to fail, and on receipt of a fail response, taking an action toward establishing the binding.

8. The computer system of claim 7, the instructions further programmed to cause the processor(s) to:

in response to a request from the user agent to test an ordering of the IP addresses stored in the user agent'"'"'s DNS address cache, receive a failure response, and in response thereto, invalidate the received IP addresses.

9. The computer system of claim 7, the instructions further programmed to cause the processor(s) to:

in response to a request designed to invalidate the pinned IP address in the user agent'"'"'s DNS address cache, receive a failure response, and in response thereto, rebind the first domain name to another of the addresses received in the IP address resource records.

10. The computer system of claim 2, wherein:

the designation of a class of domain names is encoded into a hostname of the initialization request.

11. The computer system of claim 2, wherein:

the designation of a class of domain names is a specification of a specific second domain name specified in a request from the user agent.

12. The computer system of claim 2, wherein:

the designation of a class of domain names is a specification of a class of service to be requested, to be submitted to the domain name server to be resolved to a specific IP address belonging to a computer belonging to the second domain name from among a plurality of computers having the capability to provide the requested service.

13. A method, comprising the steps of:

at a domain name server at a first domain name, receiving an initialization request from a user agent device, the initialization request designating a class of domain names to be resolved to an IP address belonging to a second domain name, to which the user agent device seeks to issue a safe cross-domain request to be subsequently directed to the first domain name, the second domain name being a public domain name that is different than the first domain name;

establishing in a Domain Name System (DNS) address cache a binding of the first domain name to an IP address belonging to the second domain name, and sending messages to enable the user agent device to issue an Hypertext Transfer Protocol (HTTP) request addressed to the first domain name and to be routed to the IP address that belongs to or is to be resolved to a computer of the second domain name, to be serviced by a computer at the second domain name.

14. The method of claim 13, further comprising the steps of:

sending a response to the user agent device, the response providing two or more IP address resource records resolving the designation of the class of domain names;

one of the provided IP address resource records having a first IP address belonging to a computer within the domain of the first domain name, and

other of the provided IP address resource records having IP addresses for computers within domains belonging to the designated class of domain names, and having been evaluated by the domain name server to be eligible to service the cross-domain request to be subsequently issued by the user agent; and

ensuring that the first domain name is pinned to the first IP address in a DNS address cache of the user agent device, and that others of the IP addresses are stored in the user agent'"'"'s DNS address cache as alternative binding(s) to the first domain name.

15. The method of claim 14, further comprising the steps of:

sending a message to the user agent device to cause the user agent device to unpin the first IP address, and to bind the first domain name to an alternative one of the IP addresses from among the other stored IP addresses.

16. The method of claim 14, further comprising the steps of:

managing a pool of IP addresses corresponding to the first domain name, an IP address to be checked out of the pool for a period of time to maintain disambiguation among pending requests to bind the first domain name to IP addresses belonging to the second domain name.

17. The method of claim 13, further comprising the step of:

establishing the binding at least in part by sending a request from the user agent device that is designed to fail, and on receipt of a fail response, taking an action toward establishing the binding.

18. The method of claim 17, further comprising the step of:

in response to a request from the user agent to test an ordering of the IP addresses stored in the user agent'"'"'s DNS address cache, receiving a failure response designed to indicate to the user agent that the IP addresses are not in a desired order.

19. The domain name server of claim 17, further comprising the step of:

receiving a failure response designed to invalidate the pinned IP address in the user agent'"'"'s DNS address cache, and causing the user agent'"'"'s DNS address cache to rebind the associated hostname to another of the addresses received in the IP address resource records.

20. The method of claim 13, further comprising the step of:

evaluating the initialization request, which designates the class of domain names as qualification of a fully-qualified hostname within the first domain name, to identify the class of domain names to be resolved to the second IP address.

21. The method of claim 13, further comprising the step of:

evaluating the initialization request to identify a specific second domain name specified in the initialization request.

22. The method of claim 13, further comprising the step of:

evaluating the initialization request to identify a class of domain names specified in the initialization request, being a designation of a service requested by the user agent, and resolving the designation of service to a specific IP address belonging to a computer belonging to the second domain name from among a plurality of computers having the capability to provide the requested service.

23. A domain name server, comprising:

one or more processors designed to execute instructions;

an internet connection at which the domain name server is programmed to receive and send messages at a first domain name;

one or more nontransitory, machine-readable memories storing program instructions for execution by the processor(s), the instructions programmed to cause the processor(s) to;

receive an initialization request from a user agent device, the initialization request designating a class of domain names to be resolved to an IP address belonging to a second domain name, to which the user agent device seeks to issue a safe cross-domain request to be subsequently directed to the first domain name, the second domain name being a public domain name that is different than the first domain name;

establish in a Domain Name System (DNS) address cache a binding of the first domain name to an IP address belonging to the second domain name, and to send messages to enable the user agent device to issue an Hypertext Transfer Protocol (HTTP) request addressed to the first domain name and to be routed to the IP address that belongs to or is to be resolved to a computer of the second domain name, to be serviced by a computer at the second domain name.

24. The domain name server of claim 23, the instructions being further programmed to cause the processor to:

at the user agent device, receiving a response from the domain name server, the response returning to the user agent device two or more IP address resource records resolving the designation of the class of domain names;

one of the returned IP address resource records having a first IP address belonging to a computer within the domain of the first domain name,

other of the returned IP address resource records having IP addresses for computers within domains belonging to the designated class of domain names, and having been evaluated by the domain name server to be eligible to service the cross-domain request to be subsequently issued by the user agent;

ensuring that the first domain name is pinned to the first IP address in a DNS address cache of the user agent device, and that others of the IP addresses are stored in the user agent'"'"'s DNS address cache as alternative binding(s) to the first domain name.

25. The domain name server of claim 24, the instructions being further programmed to cause the processor to:

at the user agent device, unpinning the pinned first IP address and binding to the first domain name an alternative one of the IP addresses chosen from among the stored IP addresses.

26. The domain name server of claim 23, the instructions being further programmed to cause the processor or target belonging to the second domain name to:

send a failure response to the user agent device, the failure response designed to advance the user agent toward binding the first domain name to an IP address belonging to the second domain name.

27. The domain name server of claim 26, instructions being further programmed to cause the user agent to:

in response to a request from the user agent to test an ordering of the IP addresses stored in the user agent'"'"'s DNS address cache, receive a failure response designed to indicate to the user agent that the IP addresses are not in a desired order.

28. The domain name server of claim 23, instructions being further programmed to cause the user agent to:

receive a failure response designed to invalidate the pinned IP address in the user agent'"'"'s DNS address cache, and cause the user agent'"'"'s DNS address cache to rebind the associated hostname to another of the addresses received in the IP address resource records.

29. The domain name server of claim 24, the instructions being further programmed to cause the processor to:

manage a pool of IP addresses belonging to the first domain name, an IP address to be checked out of the pool for a period of time to maintain disambiguation among pending requests to bind the first domain name to IP addresses belonging to the second domain name.

30. The domain name server of claim 23, the instructions being further programmed to cause the processor to:

evaluate the initialization request, which designates the class of domain names as qualification of a fully-qualified hostname within the first domain name, to identify the class of domain names to be resolved to the second IP address.

31. The domain name server of claim 23, the instructions being further programmed to cause the processor to:

evaluate the initialization request to identify a specific second domain name specified in the initialization request, and to resolve that second domain name to an IP address belonging to that second domain name, to be returned to the user agent.

32. The domain name server of claim 23, the instructions being further programmed to cause the processor to:

evaluate the initialization request to identify a class of domain names specified in the initialization request, being a designation of a service requested by the user agent, and to resolve the designation of service to a specific IP address belonging to a computer belonging to the second domain name from among a plurality of computers having the capability to provide the requested service.

33. A method, comprising the steps of:

at a user agent device, issuing an initialization request to a domain name server at a first domain name, the initialization request designating a class of domain names to be resolved to an IP address belonging to a second domain name from which the user agent device seeks to request a safe cross-domain service, the second domain name being different than the first domain name;

at the user agent device, receiving a response from the domain name server, the response returning to the user agent device two or more IP address resource records resolving the designation of the class of domain names;

one of the returned IP address resource records having a first IP address belonging to a computer within the domain of the first domain name,

other of the returned IP address resource records having IP addresses for computers within domains belonging to the designated class of domain names, and having been evaluated by the domain name server to be eligible to service the cross-domain service requested by the user agent;

ensuring that the first domain name is pinned to the first IP address in a Domain Name System (DNS) address cache of the user agent device, and that others of the IP addresses are stored in the user agent'"'"'s DNS address cache as alternative binding(s) to the first domain name;

at the user agent device, in response to a request to the first IP address, unpinning the first IP address and binding to the first domain name an alternative one of the IP addresses chosen from among the other stored IP addresses; and

from the user agent device, issuing a request to a computer of the second domain name by sending a request addressed to the first domain name, and by the DNS address cache, resolving the first domain name to an IP address that belongs to or is to be resolved to a computer of the second domain name.

34. The method of claim 33, wherein:

the initialization request designates the service to be requested by qualification of a hostname within the first domain name.

35. The method of claim 33, further comprising the steps of:

establishing the binding by sending a request from the user agent device that is designed to fail, and on receipt of a fail response, taking an action toward establishing the binding.

36. The method of claim 33, wherein:

the designation of a class of domain names is a specification of a specific second domain name.

37. The method of claim 33, wherein:

the designation of a class of domain names is encoded into a hostname of the initialization request.

38. The method of claim 33, wherein:

the designation of a class of domain names is a specification of a class of service to be requested, submitted to the domain name server to be resolved to a specific second domain name from among a plurality of computers having the capability to provide the requested service.

39. The method of claim 34, further comprising:

ensuring the pinning by a loop of attempts to establish the pin of a first IP address to the first domain name.

40. The method of claim 34, further comprising:

ensuring the pinning by a issuing a set of parallel requests to establish the pin of a first IP address to the first domain name.

41. A method, comprising the steps of:

at a domain name server at a first domain name, receiving an initialization request from a user agent device, the initialization request designating a class of domain names to be resolved to an IP address belonging to a second domain name to which the user agent device seeks to issue a safe cross-domain request, the second domain name being different than the first domain name;

sending a response to the user agent device, the response providing two or more internet protocol (IP) address resource records resolving the designation of the class of domain names;

one of the IP address resource records having a first IP address belonging to a computer within the domain of the first domain name,

other of the provided IP address resource records having IP addresses for computers within domains belonging to the designated class of domain names, and having been evaluated by the domain name server to be eligible to service the cross-domain request to be subsequently issued by the user agent;

ensuring that the first domain name is pinned to the first IP address in a Domain Name System (DNS) address cache of the user agent device, and that others of the IP addresses are stored in the user agent'"'"'s DNS address cache as alternative binding(s) to the first domain name;

sending a message to the user agent device to cause the user agent device to unpin the first IP address, and to bind the first domain name to an alternative one of the IP addresses from among the other stored IP addresses, and sending messages to enable the user agent device to issue an HTTP request addressed to the first domain name and to be routed to the IP address that belongs to or is to be resolved to a computer of the second domain name, to be serviced by a computer at the second domain name.

42. The method of claim 41, further comprising the steps of:

managing a pool of IP addresses corresponding to the first domain name, an IP address to be checked out of the pool for a period of time to maintain disambiguation among pending requests to bind the first domain name to IP addresses belonging to the second domain name.

43. The method of claim 41, further comprising the steps of:

establishing the binding by sending a request from the user agent device that is designed to fail, and on receipt of a fail response, taking an action toward establishing the binding.

44. The method of claim 41, further comprising the step of:

analyzing a hostname of the initialization request to obtain the designation of the class of domain names, and resolving the designation to the second domain name.

45. The method of claim 41, wherein:

analyzing the initialization request to obtain a class of service requested by the user agent, and resolving that service to a second domain name of a computer designed to provide that service to the requesting user agent.

46. A domain name server, comprising:

one or more processors designed to execute instructions;

an internet connection at which a domain name server is programmed to receive and send messages at a first domain name;

one or more nontransitory, machine-readable memories storing program instructions for execution by the processor(s), the instructions programmed to cause the processor(s) to;

receive an initialization request from a user agent device, the initialization request designating a class of domain names to be resolved to an internet protocol (IP) address belonging to a second domain name to which the user agent device seeks to issue a safe cross-domain request, the second domain name being different than the first domain name;

send a response to the user agent device, the response providing two or more IP address resource records resolving the designation of the class of domain names;

one of the IP address resource records having a first IP address belonging to a computer within the domain of the first domain name,

other of the provided IP address resource records having IP addresses for computers within domains belonging to the designated class of domain names, and having been evaluated by the domain name server to be eligible to service the cross-domain request to be subsequently issued by the user agent;

ensure that the first domain name is pinned to the first IP address in a Domain Name System (DNS) address cache of the user agent device, and that others of the IP addresses are stored in the user agent'"'"'s DNS address cache as alternative binding(s) to the first domain name;

send a message to the user agent device to cause the user agent device to unpin the first IP address, and to bind the first domain name to an alternative one of the IP addresses from among the other stored IP addresses, and to send messages to enable the user agent device to issue an HTTP request addressed to the first domain name and to be routed to an IP address that belongs to or is to be resolved to a computer of the second domain name, to be serviced by a computer at the second domain name.

47. The domain name server of claim 46, the instructions being further programmed to cause the processor to:

manage a pool of IP addresses corresponding to the first domain name, an IP address to be checked out of the pool for a period of time to maintain disambiguation among pending requests to bind the first domain name to IP addresses belonging to the second domain name.

48. The domain name server of claim 46, the instructions being further programmed to cause the processor to:

send a failure response to the user agent device, the failure response designed to advance the user agent toward binding the first domain name to an IP address belonging to the second domain name.

49. The domain name server of claim 46, the instructions being further programmed to cause the processor to:

evaluate the initialization request, which designates the class of domain names as qualification of a fully-qualified hostname within the first domain name, to identify the class of domain names to be resolved to the second IP address.

50. The domain name server of claim 46, the instructions being further programmed to cause the processor to:

evaluate the initialization request to identify a specific second domain name specified in the initialization request, and to resolve that second domain name to an IP address belonging to that second domain name to return to the user agent.

51. The domain name server of claim 46, the instructions being further programmed to cause the processor to:

evaluate the initialization request to identify a class of domain names specified in the initialization request, being a designation of a service requested by the user agent, and to resolve the designation of service to a specific IP address belonging to a computer belonging to the second domain name from among a plurality of computers having the capability to provide the requested service.

52. A method, comprising the steps of:

in a Domain Name System (DNS) address cache, establishing two or more internet protocol (IP) addresses for translation of a single domain name;

sending a request over the internet to the domain name, including resolving the domain name of the request to a one of the IP addresses in the DNS address cache;

receiving a reply to the request, and evaluating the source of the reply; and

if the evaluation determines that the reply is received from an undesired node of the internet, invalidating the translation from the domain name to the undesired IP addresses from the DNS address cache.

53. The method of claim 52, further comprising the steps of:

at a user agent device, issuing an initialization request to a domain name server at a first domain name, the initialization request designating a class of domain names to be resolved to an IP address belonging to a second domain name, from which the user agent device is to seek to issue a safe cross-domain request to be subsequently directed to the first domain name, the second domain name being a public domain name that is different than the first domain name;

in the DNS address cache, establishing a binding of the first domain name to an IP address belonging to the second domain name; and

from the user agent device, sending a cross-domain Hypertext Transfer Protocol (HTTP) request addressed to the first domain name and routed to the IP address that belongs to or is to be resolved to a computer of the second domain name, to be serviced by a computer at the second domain name.

54. The method of claim 52, further comprising the steps of:

at a user agent device, issuing an initialization request to a domain name server at a first domain name, the initialization request designating a class of domain names to be resolved to an IP address belonging to a second domain name from which the user agent device seeks to request a safe cross-domain service, the second domain name being different than the first domain name;

at the user agent device, receiving a response from the domain name server, the response returning to the user agent device two or more IP address resource records resolving the designation of the class of domain names;

one of the returned IP address resource records having a first IP address belonging to a computer within the domain of the first domain name,

other of the returned IP address resource records having IP addresses for computers within domains belonging to the designated class of domain names, and having been evaluated by the domain name server to be eligible to service the cross-domain service requested by the user agent;

ensuring that the first domain name is pinned to the first IP address in a Domain Name System (DNS) address cache of the user agent device, and that others of the IP addresses are stored in the user agent'"'"'s DNS address cache as alternative binding(s) to the first domain name;

at the user agent device, in response to a request to the first IP address, unpinning the first IP address and binding to the first domain name an alternative one of the IP addresses chosen from among the other stored IP addresses; and

from the user agent device, issuing a request to a computer of the second domain name by sending a request addressed to the first domain name, and by the DNS address cache, resolving the first domain name to an IP address that belongs to or is to be resolved to a computer of the second domain name.