Generating secure name records

• US 10,044,582 B2
• Filed: 01/28/2012
• Issued: 08/07/2018
• Est. Priority Date: 01/28/2012
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: A10 Networks Incorporated
• Inventors: Han, Liang, Yang, Yang
• Primary Examiner(s): Chea, Philip
• Assistant Examiner(s): Ahmed, Mohammed
• Application Number:
  US13/360,697
• Publication Number:
  US 20130198385A1
• Time in Patent Office: 2,383 Days
• Field of Search: 709226
• CPC Class Codes: H04L 12/6418 Hybrid transport
• CPC Class Codes: H04L 2101/69 using geographic information, e.g. room number
• CPC Class Codes: H04L 41/5058 Service discovery by the service manager
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 61/302 Administrative registration, e.g. for domain names at internet corporation for assigned names and numbers [ICANN]
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]

Abstract

A method to generate name records by a service gateway includes: receiving a name service request including a name from a host; creating a name service request using the name; sending the name service request to a name service server; receiving a response from the name service server, the response including a service server name record with one or more service server name entries corresponding to the name; generating and storing service gateway name records using the name and the name entries; and sending a selected service gateway name record to the host as a response to the name service request. When a subsequent name service request including the name is received, the service gateway compares the name against the stored service gateway name records, and in response to finding a match, sending the given service gateway name record as a response to the subsequent name service request.

Claims

1. A method to generate secure name records by a service gateway comprising a processor, the method comprising:

receiving a name service request from a host, the name service request comprising a name;

obtaining a service server name record from a name service server, the service server name record comprising a plurality of name entries corresponding to the name, wherein a first name entry of the plurality of name entries is associated with a first server and a second name entry of the plurality of name entries is associated with a second server, the first server and the second server providing a service to the host;

generating and storing a plurality of service gateway name records associated with the name, the service gateway name records each including the name and one of the plurality of name entries from the service server name record, the generating the plurality of service gateway name records being based on a determined plurality of name entry combinations from the name service server according to a service policy, the service policy consisting of a location based policy, a traffic management policy, or a security policy;

determining a violation of the location based policy, the traffic management policy, or the security policy by a name entry combination from the determined plurality of name entry combinations;

based on the determining of the violation, excluding the name entry combination from generating one of the plurality of service gateway name records for the name entry combination; and

sending a service gateway name record from the plurality of service gateway name records to the host as a response to the name service request, wherein each further service gateway name record of the plurality of service gateway name records is sent to the host in response to one of further name service requests associated with the name and received from the host, the service gateway name record and the each further service gateway name record of the plurality of service gateway name records being generated upon the receiving the name service request associated with the name and prior to receiving the further name service requests associated with the name, the each further service gateway name record including the name and a further name entry of the plurality of name entries from the service server name record.

2. The method of claim 1, wherein the obtaining comprises:

creating a name service request using the name;

sending the name service request to the name service server; and

receiving a response to the name service request from the name service server, the response comprising the service server name record, the service server name record comprising the at least two service server name entries corresponding to the name.

3. The method of claim 1, further comprising:

receiving a subsequent name service request comprising the name;

comparing the name against the stored plurality of service gateway name records; and

in response to determining a match with a given service gateway name record of the stored plurality of service gateway name records, sending the given service gateway name record as a response to the subsequent name service request.

4. The method of claim 3, further comprising:

in response to determining no match with the stored plurality of service gateway name records, creating a name service request using the name; and

sending the name service request to the name service server.

5. The method of claim 1, wherein the generating further comprises:

determining the plurality of name entry combinations as N out of the M name entries obtained from the name service server;

creating a first service gateway name record using the name and at least two name entry combinations of the plurality of name entry combinations; and

creating a second service gateway name record using the name and another at least two name entry combinations of the plurality of name entry combinations, according to a storage capacity of the service gateway.

6. The method of claim 5, wherein the creating the first service gateway name record comprises:

creating the service gateway name record using the name and the at least two name entry combinations according to a service policy.

7. The method of claim 5, wherein the plurality of name entry combinations comprises an ordered number of the name entry combinations.

8. The method of claim 1, wherein the sending the service gateway name record comprises:

determining a status for each of the at least two servers corresponding to the service gateway name record; and

in response to determining that the status indicates each of the at least two servers do not have a service problem, sending the service gateway name record to the host as the response to the name service request.

9. The method of claim 8, wherein the sending further comprises:

in response to determining that the status indicates the at least two servers corresponding to the service gateway name record each have a service problem, not sending the service gateway name record to the host.

10. The method of claim 1, wherein the sending the service gateway name record comprises:

encrypting the service gateway name record; and

sending the encrypted service gateway name record to the host as the response to the name service request.

11. A non-transitory computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for generating secure name records, the method comprising:

receiving a name service request from a host, the name service request comprising a name;

obtaining a service server name record from a name service server, the service server name record comprising a plurality of name entries corresponding to the name, wherein a first name entry of the plurality of name entries is associated with a first server and a second name entry of the plurality of name entries is associated with a second server, the first server and the second server providing a service to the host;

generating and storing a plurality of service gateway name records associated with the name, the service gateway name records each including the name and one of the plurality of name entries from the service server name record, the generating the plurality of service gateway name records being based on a determined plurality of name entry combinations from the name service server according to a service policy, the service policy consisting of a location based policy, a traffic management policy, or a security policy;

determining a violation of the location based policy, the traffic management policy, or the security policy by a name entry combination from the determined plurality of name entry combinations;

based on the determining of the violation, excluding the name entry combination from generating one of the plurality of service gateway name records for the name entry combination; and

sending a service gateway name record from the plurality of service gateway name records to the host as a response to the name service request, wherein each further service gateway name record of the plurality of service gateway name records is sent to the host in response to one of further name service requests associated with the name and received from the host, the service gateway name record and the each further service gateway name record of the plurality of service gateway name records being generated upon the receiving the name service request associated with the name and prior to receiving the further name service requests associated with the name, the each further service gateway name record including the name and a further name entry of the plurality of name entries from the service server name record.

12. The non-transitory computer-readable storage medium of claim 11, wherein the obtaining comprises:

creating a name service request using the name;

sending the name service request to the name service server; and

receiving a response to the name service request from the name service server, the response comprising the service server name record, the service server name record comprising the at least two service server name entries corresponding to the name.

13. The non-transitory computer-readable storage medium of claim 11 wherein the method further comprises:

receiving a subsequent name service request comprising the name;

comparing the name against the stored plurality of service gateway name records; and

in response to determining a match with a given service gateway name record of the stored plurality of service gateway name records, sending the given service gateway name record as a response to the subsequent name service request.

14. The non-transitory computer-readable storage medium of claim 13 wherein the method further comprises:

in response to determining no match with the plurality of service gateway name records, creating a name service request using the name; and

sending the name service request to the name service server.

15. The non-transitory computer-readable storage medium of claim 11, wherein the generating further comprises:

determining the plurality of name entry combinations as N out of the M name entries obtained from the name service server;

creating a first service gateway name record using the name and at least two name entry combinations of the plurality of name entry combinations; and

creating a second service gateway name record using the name and another at least two name entry combinations of the plurality of name entry combinations, according to a storage capacity of the service gateway.

16. The non-transitory computer-readable storage medium of claim 15, wherein the creating the first service gateway name record comprises:

creating the service gateway name record using the name and the at least two name entry combinations according to a service policy.

17. The non-transitory computer-readable storage medium of claim 11, wherein the sending the service gateway name record comprises:

determining a status for each of the at least two servers corresponding to the service gateway name record;

in response to determining that the status indicates the at least two servers do not have a service problem, sending the service gateway name record to the host as the response to the name service request.

18. The non-transitory computer-readable storage medium of claim 17, wherein the sending further comprises:

in response to determining that the status indicates that the at least two servers corresponding to the service gateway name record each have a service problem, not sending the service gateway name record to the host.

19. The non-transitory computer-readable storage medium of claim 11, wherein the sending the service gateway name record comprises:

encrypting the service gateway name record; and

sending the encrypted service gateway name record to the host as the response to the name service request.

20. A service gateway, comprising:

a processor; and

a memory communicatively coupled to the processor, the memory storing instructions executable by the processor to perform a method comprising;

receiving a name service request from a host, the name service request comprising a name;

obtaining a service server name record from a name service server, the service server name record comprising a plurality of name entries corresponding to the name, wherein a first name entry of the plurality of name entries is associated with a first server and a second name entry of the plurality of name entries is associated with a second server, the first server and the second server providing a service to the host;

generating and storing a plurality of service gateway name records associated with the name, being based on a determined plurality of name entry combinations according to a service policy, using the name and the name entries from the service server name record, each of the plurality of service gateway name records including the name and the name entries from the service server name record, the service policy consisting of a location based policy, a traffic management policy, or a security policy;

determining a violation of the location based policy, the traffic management policy, or the security policy by a name entry combination from the determined plurality of name entry combinations;

based on the determining of the violation, excluding the name entry combination from generating one of the plurality of service gateway name records for the name entry combination; and

sending a service gateway name record from the plurality of service gateway name records to the host as a response to the name service request, wherein each further service gateway name record of the plurality of service gateway name records is sent to the host in response to one of further name service requests associated with the name and received from the host, the service gateway name record and the each further service gateway name record of the plurality of service gateway name records being generated upon the receiving the name service request associated with the name and prior to receiving the further name service requests associated with the name, the each further service gateway name record including the name and a further name entry of the plurality of name entries from the service server name record.

21. The service gateway of claim 20, wherein the obtaining comprises:

creating a name service request using the name;

sending the name service request to the name service server; and

receiving a response to the name service request from the name service server, the response comprising the service server name record, the service server name record comprising the at least two service server name entries corresponding to the name.

22. The service gateway of claim 20, wherein the method further comprises:

receiving a subsequent name service request comprising the name;

comparing the name against the stored plurality of service gateway name records; and

in response to determining a match with a given service gateway name record of the stored plurality of service gateway name records, sending the given service gateway name record as a response to the subsequent name service request.

23. The service gateway of claim 22, wherein the method further comprises:

in response to determining no match with the plurality of service gateway name records, creating a name service request using the name; and

sending the name service request to the name service server.

24. The service gateway of claim 20, wherein the generating further comprises:

determining the plurality of name entry combinations as N out of the M name entries obtained from the name service server;

creating a first service gateway name record using the name and at least two name entry combinations of the plurality of name entry combinations; and

creating a second service gateway name record using the name and another at least two name entry combinations of the plurality of name entry combinations, according to a storage capacity of the service gateway.

25. The service gateway of claim 24, wherein the creating the first service gateway name record comprises:

creating the service gateway name record using the name and the at least two name entry combinations according to a service policy.

26. The service gateway of claim 20, wherein the sending the service gateway name record comprises:

determining a status for each of the at least two servers corresponding to the service gateway name record;

in response to determining that the status indicates the at least two servers do not have a service problem, sending the service gateway name record to the host as the response to the name service request.

27. The service gateway of claim 26, wherein the sending further comprises:

in response to determining that the status indicates that the at least two servers corresponding to the service gateway name record each have a service problem, not sending the service gateway name record to the host.

28. The service gateway of claim 20, wherein the sending the service gateway name record comprises:

encrypting the service gateway name record; and

sending the encrypted service gateway name record to the host as the response to the name service request.