Apparatus and method for domain name resolution

• US 8,694,610 B2
• Filed: 10/26/2005
• Issued: 04/08/2014
• Est. Priority Date: 06/23/2000
• Status: Expired due to Term

• Current Assignee: Lookingglass Cyber Solutions, LLC
• Original Assignee: CloudShield Technologies, Inc. (ZeroFox Holdings, Inc.)
• Inventors: Jungck, Peder J.
• Primary Examiner(s): TODD, GREGORY G
• Application Number:
  US11/259,160
• Publication Number:
  US 20060075139A1
• Time in Patent Office: 3,086 Days
• Field of Search: 709/217, 709/219, 709/245, 709/246, 370/389, 370/469, 370/475
• US Class Current: 709/219
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/1017 based on a round robin mechanism
• CPC Class Codes: H04L 67/1021 based on client or server locations
• CPC Class Codes: H04L 67/1038 Load balancing arrangements to avoid a single path through a load balancer
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

An apparatus and method for enhancing the infrastructure of a network such as the Internet. Multiple edge servers and edge caches may be provided at the edge of the network so as to cover and monitor all points of presence. There may be downstream clients coupled to the points of presence. The edge servers may selectively intercept domain name translation requests generated by the downstream clients for subscribing Web servers. The edge servers may provide translations which either enhance content delivery services, or redirect the requesting client to the edge cache to make its content requests. Further, network traffic monitoring may be provided in order to detect malicious or otherwise unauthorized data transmissions.

Claims

1. An apparatus for facilitating communications between a client and a server over a network, said apparatus comprising:

a processor coupled with said network, said network operative to transmit a plurality of translation requests including a first translation request generated by said client, said first translation request comprising a first address identifying said server, said first translation request being directed, by said client, to a first address translator separate from said processor, said first address translator being coupled with said network;

said processor being operative to selectively intercept said first translation request from among said plurality of translation requests prior to receipt by said first address translator, said selective interception being determined based on a criteria other than only that said first translation request is one of said plurality of translation requests;

wherein said first address translator is operative to translate said first address into a first translated address when said first translation request is not selectively intercepted, and said first address translator is operative to return said first translated address to said client via said network thereby facilitating said communications between said client and said server; and

said processor being further operative to modify said first address of said first translation request to a modified address when selectively intercepted, wherein said processor is further operative to forward said first translation request having said modified address to said first address translator, wherein said first address translator, upon receipt of said first translation request having said modified address, being operative to translate said modified address into a second translated address and to return said second translated address to said client via said network, wherein said first translated address returnable to the client by said first address translator is different from said second translated address returnable to the client by said first address translator.

2. The apparatus of claim 1, wherein said network comprises the Internet.

3. The apparatus of claim 1, wherein said client comprises a computer.

4. The apparatus of claim 1, wherein said client comprises a private network.

5. The apparatus of claim 4, wherein said private network further comprises a private address translator operative to generate said first translation request.

6. The apparatus of claim 1, wherein said first address comprises a domain name and said first translated and second translated addresses comprise internet protocol addresses.

7. The apparatus of claim 1, wherein said first address comprises a symbolic network address and said first translated and second translated addresses comprise physical network addresses.

8. The apparatus of claim 7, wherein said first translated address is associated with said first server and said second translated address is associated with a first cache.

9. The apparatus of claim 1, wherein said first address is characterized by being human comprehensible and said first translated and second translated addresses are characterized by being computer readable.

10. The apparatus of claim 1, wherein said second translated address identifies a cache affiliated with said server and proximate to said client.

11. The apparatus of claim 10, wherein said apparatus further comprises said cache, said cache being coupled with said processor.

12. The apparatus of claim 10, wherein said proximity comprises geographic proximity.

13. The apparatus of claim 10, wherein said network further comprises a topology, said proximity comprising logical proximity based on said topology.

14. The apparatus of claim 1, wherein said processor is coupled with a network router.

15. The apparatus of claim 1, further comprising a traffic monitor coupled with said network, wherein said network is further operative to transmit data between said client and said server, said traffic monitor operative to monitor said transmitted data.

16. The apparatus of claim 15, wherein said traffic monitor is further operative to detect malicious program code within said transmitted data.

17. The apparatus of claim 15, wherein said traffic monitor is further operative to detect unauthorized data within said transmitted data.

18. The apparatus of claim 15, wherein said traffic monitor is further operative to detect forged communications within said transmitted data.

19. A method of facilitating communications over a network, said network comprising a server and at least one sub-network coupled with said server, said at least one sub-network coupled with a first address translator and a client, said method comprising:

a. monitoring said at least one sub-network for a first translation request from a plurality of translation requests, said-first translation request generated by said client and directed by said client to said first address translator, said first translation request comprising a first address intended to be translated into a first translated address by said first address translator;

b. intercepting, selectively by a device separate from said first address translator, said first translation request from among said plurality of translation requests prior to receipt by said address translator and prior to translation of said first address thereby, said selective interception being based on a criteria other than only that said first translation request is one of said plurality of translation requests; and

c. modifying said first address of said first translation request to a modified address when selectively intercepted and forwarding said first translation request having said modified address to said first address translator, said modified address intended to be translated by said first address translator into a second translated address different from the first translated address, the first translated address and the second translated address being returnable to the client by said first address translator, wherein said second translated address is generated when the first translation request is selectively intercepted and said first translated address is generated when said first translation request is not selectively intercepted.

20. The method of claim 19, wherein said first address is a domain name, said first translated address is a first internet protocol address and said second translated address is a second internet protocol address different from said first internet protocol address.

21. The method of claim 19, wherein said second translated address is associated with a cache affiliated with said server.

22. The method of claim 21, wherein (c) further comprises determining said second translated address to be an address associated with a proximately optimal cache affiliated with said server relative to said client.

23. The method of claim 22, wherein said cache is geographically optimal.

24. The method of claim 22, wherein said cache is proximately optimal based on a topology of said network.

25. An apparatus for facilitating communications between first and second clients and first and second servers over a network, said apparatus comprising:

a processor coupled with said network, said network operative to transmit a plurality of translation requests including a first translation request generated by said first client and a second translation request generated by said second client, said first translation request comprising a first address identifying said first server and said second translation request comprising a second address identifying said second server, said first translation request being directed by said first client to a first address translator separate from said processor and said second translation request being directed by said second client to said first address translator, said first address translator being coupled with said network and operative to, if said first and second translation requests are received, translate said first address into a first translated address and translate said second address into a second translated address and to return said first translated address to said first client and return said second translated address to said second client via said network thereby facilitating said communications between said first and second clients and said first and second servers;

a request interceptor coupled with said processor and operative to cause said processor to selectively intercept said first and second translation requests from among said plurality of translation requests prior to receipt by said first address translator, said selective interception being determined based on a criteria other than only that each of said first and second translation requests is one of said plurality of translation requests;

a request modifier coupled with said request interceptor and operative to modify said first address of said first translation request to a modified address when said first translation request is selectively intercepted by said request interceptor;

a request forwarder coupled with said request interceptor and said request modifier and operative to forward said second translation request to a second address translator coupled with said processor when said second translation request is selectively intercepted by said request interceptor, and operative to forward said modified first translation request to said first address translator when said first translation request is selectively intercepted by said request interceptor, wherein said first address translator, upon receipt of said first translation request having said modified address, being operative to translate said modified address into a third translated address different from said first translated address and to return said third translated address to said first client via said network; and

wherein said second address translator is operative, upon receipt of the second translation request, to translate said second address of said second translation request into a fourth translated address different from said second translated address and return said fourth translated address to said second client via said network.

26. A method of facilitating communications over a network, said network comprising first and second servers and at least one sub-network coupled with said first and second servers, said at least one sub-network coupled with a translator and first and second clients, said method comprising:

a. monitoring said at least one sub-network for first and second translation requests of a plurality of translation requests, said first translation request generated by said first client and directed by said first client to said translator and said second translation request generated by said second client and directed by said second client to said translator, said first translation request comprising a first address and said second translation request comprising a second address;

b. intercepting, selectively by a device separate from said translator, said first and second translation requests from among said plurality of translation requests prior to receipt by said translator based on a criteria other than only that each of said first and second translation requests is one of said plurality of translation requests, wherein said first address is translated into a first translated address by said translator when said first translation request is not selectively intercepted and said second address is translated into a second translated address by said translator when said second translation request is not selectively intercepted; and

c. modifying said first address of said intercepted first translation request into a modified address forwarding said modified first translation request to said translator, said translator, upon receipt of said first translation request having said modified address, being operative to translate said modified address into a third translated address different from said first translated address and to return said third translated address to said first client via said network and said translator being operative to translate said second address of said intercepted second translation request into a fourth translated address different from said second translated address and return said fourth translated address to said second client.