VERIFICATION OF SERVER NAME IN A PROXY DEVICE FOR CONNECTION REQUESTS MADE USING DOMAIN NAMES

• US 20170374017A1
• Filed: 06/27/2016
• Published: 12/28/2017
• Est. Priority Date: 06/27/2016
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Gautam, Venkatesh N., Le, Meixing
• Granted Patent: US 10,326,730 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 2101/668 Internet protocol [IP] address subnets
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching

Abstract

Techniques are presented herein for a proxy device to verify that the server name listed in a connection request message is the name of the server at the IP address listed in the connection request message. The proxy device obtains a domain name server query sent by a client to a domain name server and then obtains a domain name server result that is sent by the domain name server. The proxy device may cache the data of the domain name server result. The proxy device may obtain a connection request message sent by the client seeking a connection with a server, and then compare the connection request message to the cached domain name server result. Finally, the proxy device may apply one or more policies to the connection request message based on the comparison between the connection request message and the domain name server result.

Claims

1. A method comprising:

at a proxy device or process, obtaining a domain name server query sent by a client to a domain name server;

obtaining a domain name server result sent by the domain name server in response to the domain name server query;

caching the domain name server result;

obtaining a connection request message sent by the client seeking a connection with a server;

comparing the connection request message to the domain name server result; and

applying at least one policy to the connection request message based on the comparison between the connection request message and the domain name server result.

2. The method of claim 1, wherein the domain name server result includes a domain name that is queried by the domain name server query and a corresponding first Internet Protocol (IP) address.

3. The method of claim 2, wherein the connection request message includes a second IP address and a server name.

4. The method of claim 3, wherein comparing comprises:

determining, when the second IP address matches the first IP address, whether the server name matches the domain name.

5. The method of claim 4, wherein applying at least one policy comprises:

disallowing the connection between the client and the server when the server name does not match the domain name.

6. The method of claim 5, wherein applying at least one policy comprises:

allowing the connection between the client and the server when the server name matches the domain name.

7. The method of claim 1, wherein the comparing is performed when the connection request from the client is received within a predetermined time interval that the domain name server query is received from the client.

8. The method of claim 1, wherein the connection request message is a Transport Layer Security client hello message, and the comparing comprises comparing content of a server name identification field of the client hello message and destination address of the client hello message with the domain name server result.

9. The method of claim 1, wherein the domain name cache is local to the proxy device or process, or is cloud-based.

10. An apparatus comprising:

a network interface unit configured to enable network communications;

a memory; and

a processor configured to;

at a proxy device or process, obtain a domain name server query sent by a client to a domain name server,

obtain a domain name server result sent by the domain name server in response to the domain name server query,

cache the domain name server result,

obtain a connection request message sent by the client seeking a connection with a server,

compare the connection request message to the domain name server result, and

apply at least one policy to the connection request message based on the comparison between the connection request message and the domain name server result.

11. The apparatus of claim 10, wherein the domain name server result includes a domain name that is queried by the domain name server query and a corresponding first Internet Protocol (IP) address.

12. The apparatus of claim 11, wherein the connection request message includes a second IP address and a server name.

13. The apparatus of claim 12, wherein the processor is further configured to:

determine, when the second IP address matches the first IP address, whether the server name matches the domain name.

14. The apparatus of claim 13, wherein applying at least one policy comprises:

disallowing the connection between the client and the server when the server name does not match the domain name.

15. The apparatus of claim 14, wherein applying at least one policy comprises:

allowing the connection between the client and the server when the server name matches the domain name.

16. One or more non-transitory computer readable storage media of a server in communication with user devices, the computer readable storage media being encoded with software comprising computer executable instructions, and when the software is executed, operable to:

at a proxy device or process, obtain a domain name server query sent by a client to a domain name server;

obtain a domain name server result sent by the domain name server in response to the domain name server query;

cache the domain name server result;

obtain a connection request message sent by the client seeking a connection with a server;

compare the connection request message to the domain name server result; and

apply at least one policy to the connection request message based on the comparison between the connection request message and the domain name server result.

17. The computer readable storage media of claim 16, wherein the domain name server result includes a domain name that is queried by the domain name server query and a corresponding first Internet Protocol (IP) address.

18. The computer readable storage media of claim 17, wherein the connection request message includes a second IP address and a server name.

19. The computer readable storage media of claim 18, further comprising instructions operable to:

determine, when the second IP address matches the first IP address, whether the server name matches the domain name.

20. The computer readable storage media of claim 19, wherein applying at least one policy comprises:

disallow the connection between the client and the server when the server name does not match the domain name; and

allow the connection between the client and the server when the server name matches the domain name.