Providing privacy enhanced resolution system in the domain name system

• US 8,880,686 B2
• Filed: 12/30/2011
• Issued: 11/04/2014
• Est. Priority Date: 12/30/2011
• Status: Active Grant

• Current Assignee: VeriSign, Inc.
• Original Assignee: VeriSign, Inc.
• Inventors: McPherson, Danny, Osterweil, Eric
• Primary Examiner(s): Beharry, Noel
• Assistant Examiner(s): MUSA, ABDELNABI O
• Application Number:
  US13/340,895
• Publication Number:
  US 20130173825A1
• Time in Patent Office: 1,040 Days
• Field of Search: 709/224, 709/225, 709/226
• US Class Current: 709/224
• CPC Class Codes: H04L 2101/35 containing special prefixes
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00

Abstract

An apparatus and a non-transitory computer-readable medium may perform a method of minimizing the disclosure of a domain name contained in a DNS query. The method may include: determining a first label and a second label associated with a domain name included in a DNS query; querying a first nameserver for the first label without revealing the second label to the first nameserver; receiving a response from the first nameserver directing a resolver to a second nameserver; and querying the second nameserver for the first label and the second label.

Claims

1. A non-transitory computer-readable medium encoded with instructions that, when executed on a processor, perform a method of minimizing the disclosure of a domain name contained in a DNS query, the method comprising:

determining a first label and a second label associated with a domain name included in a DNS query;

generating a false label;

querying a first nameserver for a first internet protocol address associated with the first label and the false label without revealing information related to the second label by removing information related to the second label from the DNS query, wherein the first nameserver is a root nameserver;

receiving a response from the first nameserver, the response including the first internet protocol address directing a resolver to a second nameserver; and

querying the second nameserver for a second internet protocol address associated with the first label and the second label.

2. The non-transitory computer-readable medium of claim 1, the method further comprising:

determining a third label associated with the domain name,

wherein the second nameserver is queried without revealing information related to the third label.

3. The non-transitory computer-readable medium of claim 2, wherein the second nameserver is queried without revealing information related to the third label by removing information related to the third label from the DNS query.

4. The non-transitory computer-readable medium of claim 1, the method further comprising:

determining whether at least one of the first internet protocol address and the second internet protocol address is stored in a cache before querying at least one of the first nameserver and the second nameserver.

5. The non-transitory computer-readable medium of claim 1, wherein the resolver is a stub resolver.

6. The non-transitory computer-readable medium of claim 1, wherein the resolver is a recursive resolver.

7. The non-transitory computer-readable medium of claim 1, wherein the first label is separated from the second label.

8. The non-transitory computer-readable medium of claim 1, the method further comprising:

determining a third label associated with the domain name,

wherein the second nameserver is queried without revealing information related to the third label.

9. A non-transitory computer-readable medium encoded with instructions that, when executed on a processor, perform a method of minimizing the disclosure of a domain name contained in a DNS query, the method comprising:

determining a first label and a second label associated with a domain name included in a DNS query;

generating a false label;

querying a first nameserver for first address information associated with the first label and the false label without revealing the second label to the first nameserver by removing information related to the second label from the DNS query;

receiving a response from the first nameserver including the first address information, the first address information directing a resolver to a second nameserver; and

querying the second nameserver for second address information associated with the first label and the second label.

10. The non-transitory computer-readable medium of claim 9, the method further comprising:

determining a third label associated with the domain name,

wherein the second nameserver is queried for the second address information without revealing information related to the third label.

11. The non-transitory computer-readable medium of claim 10, wherein the second nameserver is queried for the second address information without revealing information related to the third label by removing information related to the third label from the DNS query.

12. The non-transitory computer-readable medium of claim 9, the method further comprising:

determining whether at least one of the first address information and the second address information is stored in a cache before querying at least one of the first nameserver and the second nameserver.

13. The non-transitory computer-readable medium of claim 9, wherein the resolver is one of a stub resolver or a recursive resolver.

14. An apparatus for minimizing the disclosure of a domain name contained in a DNS query, comprising:

a memory; and

a processor communicatively coupled to the memory, the processor being configured to;

determine a first label and a second label associated with a domain name included in a DNS query;

generating a false label;

query a first nameserver for a first internet protocol address associated with the first label and the false label without revealing the second label to the first nameserver by removing information related to the second label from the DNS query;

receive a response from the first nameserver including the first internet protocol address, the first internet protocol address directing a resolver to a second nameserver; and

query the second nameserver for a second internet protocol address associated with the first label and the second label.

15. The apparatus of claim 14, wherein the first internet protocol address is for an authoritative nameserver for the first label.

16. The apparatus of claim 14, wherein the second internet protocol address is for an authoritative nameserver for a namespace including the first label and the second label.

17. The apparatus of claim 14, wherein the processor is further configured to determine a third label associated with the domain name included in the DNS query, and wherein the second nameserver is queried without revealing information related to the third label by removing information related to the third label from the DNS query.

18. A non-transitory computer-readable medium encoded with instructions that, when executed on a processor, perform a method of minimizing the disclosure of a domain name contained in a DNS query, the method comprising:

determining a first label and a second label associated with the domain name included in the DNS query;

generating a false label;

querying a first nameserver associated with the first label and the false label for a first nameserver name without revealing information related to the second label by removing information related to the second label from the DNS query;

receiving a response from the first nameserver, the response including the first nameserver name; and

querying a second nameserver associated with the first nameserver name for a second nameserver name associated with the first label and the second label.

19. The non-transitory computer-readable medium of claim 18, wherein the response further includes an internet protocol address associated with the first nameserver name.

20. The non-transitory computer-readable medium of claim 18, further comprising determining a third label associated with the domain name included in the DNS query, wherein the second nameserver is queried without revealing information related to the third label by removing information related to the third label from the DNS query.