Name resolving in segmented networks

• US 10,659,428 B2
• Filed: 04/02/2019
• Issued: 05/19/2020
• Est. Priority Date: 10/16/2015
• Status: Active Grant

• Current Assignee: Cryptzone North America Inc. (Cryptzone Group AB)
• Original Assignee: Cryptzone North America Inc. (Cryptzone Group AB)
• Inventors: Glazemakers, Kurt, Cellerier, Thomas Bruno Emmanuel
• Primary Examiner(s): Cox, Natisha D
• Application Number:
  US16/373,362
• Publication Number:
  US 20190230059A1
• Time in Patent Office: 413 Days
• Field of Search: None
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 61/2592 using tunnelling or encapsulation
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

A method is provided, in one embodiment, which is performed on a client computing device, the method including: connecting a client computing device with a private network, wherein the private network comprises a plurality of name resolving servers, and each name resolving server is configured to resolve name requests for networking devices in a respective segment of a plurality of segments of the private network; receiving a first name request from a first application on the client computing device; in response to receiving the first name request, forwarding the first name request simultaneously to the plurality of name resolving servers; and selecting a name resolution that is first received from the plurality of name resolving servers in response to the first name request.

Claims

1. A method, comprising:

connecting a client computing device with a plurality of segments of a private network, wherein network access is restricted from one segment to another of the plurality of segments, the private network comprises a plurality of name resolving servers, and each name resolving server is configured to resolve name requests for networking devices in a respective segment of the plurality of segments;

receiving a first name request from a first application on the client computing device;

in response to receiving the first name request, forwarding the first name request simultaneously to the plurality of name resolving servers; and

selecting a name resolution that is first received from the plurality of name resolving servers in response to the first name request.

2. The method of claim 1, further comprising running a name resolving service on the client computing device, wherein the first name request is received by the name resolving service.

3. The method of claim 2, wherein the first name request is forwarded to the plurality of name resolving servers by the name resolving service.

4. The method of claim 1, further comprising registering the client computing device as primary name resolving server for serving name requests for names in the private network received from applications on the client computing device, the name requests including the first name request.

5. The method of claim 1, further comprising returning the selected name resolution to the first application.

6. The method of claim 1, wherein network access is restricted from one segment to another of the plurality of segments.

7. The method of claim 1, further comprising:

providing authentication information to an authentication server; and

in response to successful authentication from the authentication server, receiving a listing of the plurality of name resolving servers.

8. The method of claim 7, further comprising:

in response to successful authentication, receiving a client access list in return, wherein the client access list identifies a selection of networking devices in the private network that the client computing device is authorized to access; and

sending the client access list to at least one gateway that provides access to the respective segments, wherein the client access list enables the at least one gateway to configure a firewall.

9. The method of claim 8, wherein the at least one gateway configures the firewall with firewall rules derived from the client access list to provide network access, in accordance with the firewall rules, by the client computing device to the selection of networking devices.

10. The method of claim 8, wherein the plurality of name resolving servers is specified in the client access list.

11. The method of claim 8, further comprising:

in response to successful authentication from the authentication server, receiving a client tunnel list comprising information for establishing networking tunnels with the at least one gateway to provide access to the respective segments; and

using the client tunnel list for establishing the networking tunnels.

12. The method of claim 11, wherein the plurality of name resolving servers is specified in the client tunnel list.

13. A system, comprising:

at least one processor; and

memory storing instructions programmed to instruct the at least one processor to;

connect a client computing device with a plurality of segments of a private network, wherein network access is restricted from one segment to another of the plurality of segments, the private network comprises a plurality of name resolving servers, and each name resolving server is configured to resolve name requests for networking devices in a respective segment of the plurality of segments;

receive a first name request from an application on the client computing device;

in response to receiving the first name request, forward the first name request simultaneously to the plurality of name resolving servers; and

select a name resolution that is first received from the plurality of name resolving servers in response to the first name request.

14. The system of claim 13, wherein the instructions further instruct the at least one processor to:

receive, over a network from a server, a client access list, wherein the client access list identifies a selection of networking devices in the private network that the client computing device is authorized to access; and

send the client access list to at least one gateway that provides access to the respective segments in order to enable the at least one gateway to configure a firewall.

15. The system of claim 14, wherein the instructions further instruct the at least one processor to receive a client tunnel list comprising information for establishing networking tunnels with the at least one gateway, wherein the plurality of name resolving servers is specified in the client tunnel list.

16. The system of claim 13, wherein the instructions further instruct the at least one processor to register the client computing device as primary name resolving server for serving name requests for names in the private network received from applications on the client computing device, the name requests including the first name request.

17. A non-transitory computer readable storage medium storing instructions configured to instruct a data processing system to:

connect a client computing device with a plurality of segments of a private network, wherein network access is restricted from one segment to another of the plurality of segments, the private network comprises a plurality of name resolving servers, and each name resolving server is configured to resolve name requests for networking devices in a respective segment of the plurality of segments;

in response to receiving a first name request from the client computing device, forward the first name request simultaneously to the plurality of name resolving servers; and

select a name resolution that is first received from the plurality of name resolving servers in response to the first name request.

18. The non-transitory computer readable storage medium of claim 17, wherein the instructions are further configured to instruct the data processing system to:

in response to a successful authentication, receive a client access list, wherein the client access list identifies a selection of networking devices in the private network that the client computing device is authorized to access; and

send the client access list to at least one gateway that provides access to the respective segments in order to enable the at least one gateway to configure a firewall.

19. The non-transitory computer readable storage medium of claim 18, wherein the plurality of name resolving servers is specified in the client access list.

20. The non-transitory computer readable storage medium of claim 17, wherein the instructions are further configured to instruct the data processing system to:

provide authentication information to an authentication server; and

in response to successful authentication from the authentication server, receive a listing of the plurality of name resolving servers.