DEFEATING CACHE RESISTANT DOMAIN NAME SYSTEMS

• US 20090216903A1
• Filed: 02/22/2008
• Published: 08/27/2009
• Est. Priority Date: 02/22/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Elson, Jeremy Eric, Douceur, John R., Howell, Jonathan Ryan
• Granted Patent: US 7,865,618 B2
• Time in Patent Office: Days
• US Class Current: 709/245
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 61/58 Caching of addresses or names

Abstract

Domain name caching mechanisms are provided to address cache-defeating approaches. Domain name lookup requests are processed and cached information associated with a non-identical domain name returned in response. Cache-defeating behavior including nonce injection can be detected or inferred and employed to map domain name requests to previously cached information thereby exposing the benefits of caching.

Claims

1. A domain name caching system, comprising:

a receiver component that receives a domain name lookup request; and

a resolver component that returns information from a cache for a non-identical domain name in response to the request.

2. The system of claim 1, at least one of the requested or cached domain names includes a nonce.

3. The system of claim 2, further comprising a nonce detection component that detects a nonce or nonce pattern within a domain name.

4. The system of claim 3, further comprising an inference component that infers the presence and/or position of a nonce.

5. The system of claim 4, further comprising a component that facilitates location of the nonce based on characteristics of a nonce protocol.

6. The system of claim 4, further comprising a request component that facilitates location of the nonce as a function of characteristics of a request stream.

7. The system of claim 6, the request stream component analyzes similarity of results of a variety of requests.

8. The system of claim 4, further comprising a component that facilitates location of the nonce as a function of characteristics of domain name server software.

9. The system of claim 2, further comprising a component that verifies that requests with new nonces return results consistent with prior requests to validate nonce inferences.

10. A domain name caching method, comprising:

receiving a domain name;

identifying a non-identical domain name record in cache; and

returning a cached IP address associated with the non-identical domain name.

11. The method of claim 10, further comprising detecting a domain name pattern including a nonce.

12. The method of claim 11, comprising detecting the pattern as a function of characteristics of a nonce-protocol.

13. The method of claim 11, comprising detecting the pattern as a function of known name patterns.

14. The method of claim 11, comprising detecting the pattern as a function of characteristics of a request stream.

15. The method of claim 11, comprising detecting the pattern as a function of common characteristics of a nonce.

16. The method of claim 11, comprising detecting the pattern based on identical or similar replies to a variety of requests.

17. The method of claim 11, comprising detecting the pattern as a function of characteristics of a known software implementation.

18. The method of claim 11, further comprising verifying the pattern by synthesizing requests with new nonces, and verifying that the replies are consistent with results of prior client requests.

19. A domain name caching system, comprising:

means for caching a result of a domain name lookup; and

means for serving the result in response to a subsequent lookup for an un-identical, nonce-bearing domain name.

20. The system of claim 19, further comprising a means for detecting a domain name pattern including a nonce to facilitate identification equivalent names.