Apparatus and method for domain name resolution

• US 7,003,555 B1
• Filed: 06/23/2000
• Issued: 02/21/2006
• Est. Priority Date: 06/23/2000
• Status: Expired due to Term

• Current Assignee: Lookingglass Cyber Solutions, LLC
• Original Assignee: CloudShield Technologies, Inc. (ZeroFox Holdings, Inc.)
• Inventors: Jungck, Peder J.
• Primary Examiner(s): Etienne, Ario
• Assistant Examiner(s): Todd, Gregory
• Application Number:
  US09/602,286
• Time in Patent Office: 2,069 Days
• Field of Search: 709/217, 709/219, 709/245, 709/246, 370/469, 370/389, 370/475
• US Class Current: 709/219
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/1017 based on a round robin mechanism
• CPC Class Codes: H04L 67/1021 based on client or server locations
• CPC Class Codes: H04L 67/1038 Load balancing arrangements to avoid a single path through a load balancer
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

An apparatus and method for enhancing the infrastructure of a network such as the Internet is disclosed. Multiple edge servers and edge caches are provided at the edge of the network so as to cover and monitor all points of presence. The edge servers selectively intercept domain name translation requests generated by downstream clients, coupled to the monitored points of presence, to subscribing Web servers and provide translations which either enhance content delivery services or redirect the requesting client to the edge cache to make its content requests. Further, network traffic monitoring is provided in order to detect malicious or otherwise unauthorized data transmissions.

Claims

1. An apparatus for facilitating communications between a client and a server over a network, said apparatus comprising:

a request interceptor coupled with said network, said network operative to transmit a plurality of translation requests including a first translation request generated by said client, said first translation request comprising a first address identifying said server, said first translation request being further directed, by said client, to a first address translator coupled with said network and operative to receive said first translation request, to translate said first address into a translated address and to return said translated address to said client via said network thereby facilitating said communications between said client and said server, said request interceptor operative to selectively intercept said first translation request from among said plurality of translation requests prior to receipt by said first address translator, said selective interception being determined based on a criteria other than only that said first translation request is one of said plurality of translation requests;

a request modifier coupled with said request interceptor and operative to modify said first address of said first translation request to a modified address comprising indicia related to said client; and

a request forwarder coupled with said request modifier and operative to forward said first translation request having said modified address to said first address translator.

2. The apparatus of claim 1, wherein said network comprises the Internet.

3. The apparatus of claim 1, wherein said client comprises a computer.

4. The apparatus of claim 1, wherein said client comprises a private network.

5. The apparatus of claim 4, wherein said private network further comprises a private address translator operative to generate said first translation request.

6. The apparatus of claim 1, wherein said first address comprises a domain name and said translated address comprises an internet protocol address.

7. The apparatus of claim 1, wherein said first and modified addresses comprise symbolic network addresses and said translated address comprises a physical network address.

8. The apparatus of claim 1, wherein said first address is characterized by being human comprehensible and said translated address is characterized by being computer readable.

9. The apparatus of claim 1, wherein said client is characterized by a geographic location, said indicia comprising an indication of said geographic location.

10. The apparatus of claim 1, wherein said first client is characterized by a maximum bandwidth handling capability, said indicia comprising an indication of said capability.

11. The apparatus of claim 1, wherein said network comprises one or more communications characteristics, said indicia comprising an indication of said one or more communications characteristics.

12. The apparatus of claim 1, wherein said server further comprises a second address translator coupled with said network, said request forwarder being further operative to forward said first translation request having said modified address to said second address translator based on said first address.

13. The apparatus of claim 1, wherein said request interceptor is coupled with a network router.

14. The apparatus of claim 1, wherein said request interceptor is integrated with said first address translator.

15. The apparatus of claim 1, further comprising a traffic monitor coupled with said network, wherein said network is further operative to transmit data between said client and said server, said traffic monitor operative to monitor said transmitted data.

16. The apparatus of claim 15, wherein said traffic monitor is further operative to detect malicious program code within said transmitted data.

17. The apparatus of claim 15, wherein said traffic monitor is further operative to detect unauthorized data within said transmitted data.

18. The apparatus of claim 15, wherein said traffic monitor is further operative to detect forged communications within said transmitted data.

19. A method of facilitating communications over a network, said network comprising a server and at least one sub-network coupled with said server, said at least one sub-network coupled with a translator and a client, said method comprising:

(a) monitoring said at least one sub-network for a first translation request of a plurality of translation requests, said first translation request generated by said client and directed by said client to said translator, said first translation request comprising a first address to be translated into a translated address by said translator;

(b) intercepting, selectively, said first translation request from among said plurality of translation requests prior to receipt by said translator, based on a criteria other than only that said first translation request is one of said plurality of translation requests;

(c) modifying said first address of said intercepted first translation request into a modified address comprising indicia related to said client; and

(d) forwarding said modified first address of said intercepted first translation request to said translator.

20. The method of claim 19, further comprising:

(e) monitoring said network for a data transmission generated by said client.

21. The method of claim 20, further comprising:

(f) detecting a malicious data transmission generated by said client.

22. The method of claim 20, further comprising:

(f) detecting an unauthorized data transmission generated by said client.