Secure resource name resolution

• US 8,762,554 B2
• Filed: 11/20/2012
• Issued: 06/24/2014
• Est. Priority Date: 08/08/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Trace, Rob M., Meren, Libby
• Primary Examiner(s): Meky, Moustafa M
• Application Number:
  US13/682,238
• Publication Number:
  US 20130080649A1
• Time in Patent Office: 581 Days
• Field of Search: 709200-203, 709217-229, 709/230
• US Class Current: 709/229
• CPC Class Codes: G06F 15/17306 Intercommunication techniques
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

Techniques for securing name resolution technologies and for ensuring that name resolution technologies can function in modern networks that have a plurality of overlay networks accessible via a single network interface. In accordance with some of the principles described herein, a set of resolution parameters may be implemented by a user, such as an end user or an administrator, to be used during a name resolution process for securing the process and/or for conducting the process in an overlay network. In some implementations, the set of resolution parameters may be maintained as a table of rules, and used to govern name resolution processes. For example, resolution parameters may be created that govern a DNSSEC session, or that govern how to communicate with networks implemented with Microsoft'"'"'s Direct Access overlay technologies, or that govern communications using any other networking technology.

Claims

1. A method of resolving a name using a name resolution policy table on a client computer, the method comprising:

invoking a group policy protocol to access group policy settings on a group policy server;

retrieving a collection of resolution parameters from the group policy server, the collection of resolution parameters governing communication with a remote computing device;

parsing the resolution parameters received from the group policy server; and

saving the resolution parameters locally on the client computer system to populate the name resolution policy table with the collection of resolution parameters.

2. The method of claim 1, further comprising:

accepting as input a first identifier for a network resource;

consulting the name resolution policy table to determine a set of applicable resolution parameters that apply to the first identifier; and

obtaining a second identifier for the network resource from the remote computing device, the obtaining comprising conducting a name resolution process to determine the second identifier for the network resource based on the first identifier, wherein the name resolution process is governed by the set of applicable resolution parameters.

3. The method of claim 2, wherein the obtaining further comprises:

transmitting to the remote computing device a name resolution request in accordance with the set of applicable resolution parameters.

4. The method of claim 2, wherein the name resolution policy table comprises a plurality of sets of resolution parameters and wherein consulting the name resolution policy table comprises:

comparing the first identifier of the network resource to patterns associated with each of the sets of resolution parameters to determine whether each set of resolution parameters applies to the first identifier.

5. The method of claim 2, wherein the first identifier is a textual identifier for the network resource and the second identifier is a numeric identifier for the network resource.

6. The method of claim 2, wherein some of the resolution parameters comprise information on one or more types of encryption to be used.

7. The method of claim 2, wherein the resolution parameters comprise identifiers for one or more network resources with which information is to be exchanged during the name resolution process.

8. The method of claim 2, wherein the name resolution process is a process in accordance with global fallback parameters.

9. The method of claim 2, wherein the name resolution process is a process in accordance with global parameters in combination with applicable resolution parameters.

10. The method of claim 2, wherein the name resolution process is adapted to function with an overlay network implemented using Direct Access.

11. A computer-readable storage medium on which is encoded computer-executable instructions that, when executed, cause a computer to perform a method of resolving a name using a name resolution policy table on a client computer, the method comprising:

invoking a group policy protocol to access group policy settings on a group policy server;

retrieving a collection of resolution parameters from the group policy server, the collection of resolution parameters governing communication with a remote computing device;

parsing the resolution parameters received from the group policy server; and

saving the resolution parameters locally on the client computer system to populate the name resolution policy table with the collection of resolution parameters.

12. The computer-readable storage medium of claim 11, wherein the method further comprises:

accepting as input a first identifier for a network resource;

consulting the name resolution policy table to determine a set of applicable resolution parameters that apply to the first identifier; and

obtaining a second identifier for the network resource from the remote computing device, the obtaining comprising conducting a name resolution process to determine the second identifier for the network resource based on the first identifier, wherein the name resolution process is governed by the set of applicable resolution parameters.

13. The computer-readable storage memory of claim 12, wherein the obtaining further comprises:

transmitting to the remote computing device a name resolution request in accordance with the set of applicable resolution parameters.

14. The computer-readable storage memory of claim 12, wherein the name resolution policy table comprises a plurality of sets of resolution parameters and wherein consulting the name resolution policy table comprises:

comparing the first identifier of the network resource to patterns associated with each of the sets of resolution parameters to determine whether each set of resolution parameters applies to the first identifier.

15. The computer-readable storage memory of claim 12, wherein the first identifier is a textual identifier for the network resource and the second identifier is a numeric identifier for the network resource.

16. The computer-readable storage memory of claim 12, wherein some of the resolution parameters comprise information on one or more types of encryption to be used.

17. The computer-readable storage memory of claim 12, wherein the resolution parameters comprise identifiers for one or more network resources with which information is to be exchanged during the name resolution process.

18. The computer-readable storage memory of claim 12, wherein the name resolution process is a process in accordance with global fallback parameters.

19. The computer-readable storage memory of claim 12, wherein the name resolution process is a process in accordance with global parameters in combination with applicable resolution parameters.

20. A system comprising:

a processor; and

a memory, the memory for storing instructions which, when executed by the processor, performs a method of resolving a name using a name resolution policy table on a client computer, the method comprising;

invoking a group policy protocol to access group policy settings on a group policy server;

retrieving a collection of resolution parameters from the group policy server, the collection of resolution parameters governing communication with a remote computing device;

parsing the resolution parameters received from the group policy server; and

saving the resolution parameters locally on the client computer system to populate the name resolution policy table with the collection of resolution parameters.