Method and apparatus for restricting access to private information in domain name systems by redirecting query requests

• US 5,805,820 A
• Filed: 07/15/1996
• Issued: 09/08/1998
• Est. Priority Date: 07/15/1996
• Status: Expired due to Term

• Current Assignee: RPX Corporation
• Original Assignee: AT&T Corporation (AT&T, Inc.)
• Inventors: Cheswick, William Roberts, Bellovin, Steven Michael
• Primary Examiner(s): Black, Thomas G.
• Assistant Examiner(s): HOMERE, JEAN RAYMOND
• Application Number:
  US08/679,466
• Time in Patent Office: 785 Days
• Field of Search: 707/9, 707/10, 395/187.01, 395/188.01, 395/200.33, 395/200.48, 395/200.55, 395/200.59
• US Class Current: 709/225
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A device and method redirect query requests to restrict access to private information of a domain in a domain name system. The device includes a switching device that redirects query requests for the private information from within the domain to a device within the domain. The private information includes IP addresses and domain names. All the devices in the domain may be modified to direct all query requests to the switching device or the switching device may be incorporated into a firewall of the domain.

Claims

1. A subsystem in a domain name system that restricts access to private information of a first domain, the first domain being coupled to a second domain, the subsystem comprising:

a first device of the first domain; and

a switching device coupled to the first device, the switching device receiving a communication from the first device of the first domain being directed to a device of the second domain, the communication including a first request for the private information of the first domain, the switching device redirecting the first request for the private information to a second device in the first domain.

2. The subsystem of claim 1, wherein the communication includes a second request for information that is not private information of the first domain, the switching device forwarding the second request to the device of the second domain.

3. The subsystem of claim 1, wherein the second device is a name server of the first domain.

4. The subsystem of claim 1, wherein the private information is at least one of a domain name of a device in the first domain and an IP address of the device in the first domain.

5. The subsystem of claim 1, wherein the first domain comprises a plurality of devices, the plurality of devices being modified to direct all communications with the second domain to the switching device.

6. The subsystem of claim 1, wherein the first device is one of a name server and a resolver, requests for information from devices in the first domain other than the first device being directed to the first device.

7. The subsystem of claim 1, wherein the switching device is part of a firewall of the first domain.

8. A method of operation of a subsystem in a domain name system for restricting access to private information of a first domain, the first domain being coupled to a second domain, the method comprising:

receiving a communication from a first device of the first domain that is directed to a device of the second domain, the communication including a first request for the private information of the first domain; and

redirecting the first request for the private information of the first domain to a second device of the first domain.

9. The method of claim 8, further comprising:

forwarding a second request of the communication from the first device to the device of the second domain, the second request requesting information not private to the first domain.

10. The method of claim 8, wherein the second device is a name server of the first domain.

11. The method of claim 8, wherein the private information is at least one of a domain name and an IP address in the first domain.

12. An apparatus for use in a domain name system, comprising:

a first device of a first domain; and

a switching device that receives a communication from the first device of the first domain, the communication including a first request for private information of the first domain, and being directed to a device of a second domain, the switching device redirecting the first request for the private information to a second device in the first domain.

13. The apparatus of claim 12, wherein the communication includes a second request for information that is not private information of the first domain, the switching device forwarding the second request to the device of the second domain.

14. The apparatus of claim 12, wherein the second device is a name server of the first domain.

15. The apparatus of claim 12, wherein the private information is at least one of a domain name of a device in the first domain and an IP address of the device in the first domain.

16. The apparatus of claim 12, wherein the switching device is part of a firewall of the first domain.

17. A method of operation of an apparatus in a domain name system for restricting access to private information of a first domain, the first domain being coupled to a second domain, the method comprising:

receiving a communication from a first device of the first domain that is directed to a device of the second domain, the communication including a first request for the private information of the first domain; and

redirecting the first request for the private information of the first domain to a second device of the first domain.

18. The method of claim 17, further comprising:

forwarding a second request of the communication from the first device to the device of the second domain, the second request requesting information not private to the first domain.

19. The method of claim 17, wherein the second device is a name server of the first domain.

20. The method of claim 17, wherein the private information is at least one of a domain name and an IP address in the first domain.