Verisign, Inc.

Other

Danny McPherson

Eric Osterweil

Joseph M Waldron

Matthew Thomas

Abedelaziz Mohaisen

G Craig Murray

Tomofumi Okubo

Qi Alfred Chen

Ashkan Nikravesh

Gautam Gudavalli

A Domain Name System ('DNS') package, a non-transitory computer-readable medium, and a method for providing domain name resolution services are disclosed. The system can include one or more built-in DNS hierarchy databases configured for deployment within a network, wherein the one or more built-in DNS hierarchy databases stores DNS records. The system can also include a recursive name server, wherein the recursive name server is configured to query the one or more built-in DNS hierarchy databases during domain name resolution, the recursive name server configured to select the one or more built-in DNS hierarchy databases based on a policy indicating a preference for the one or more built-in DNS hierarchy databases over a domain name server located outside of the network. Furthermore, the system can include a recursive name server database configured to store DNS records for the recursive name server.

DNS package in a network

Embodiments relate to systems, devices, non-transitory computer-readable storage media, and computer-implemented methods for resolving DNS requests by receiving a first Domain Name System (DNS) resolution request, extracting first contextual data from the first DNS resolution request, determining to apply a first resolution rule based on the first contextual data and a contextual condition, forwarding the first DNS resolution request to a DNS resolver based on applying the first resolution rule, receiving a second DNS resolution request, extracting second contextual data from the second DNS resolution request, determining to apply a second resolution rule based on the second contextual data and the contextual condition, and retrieving a resource in response to the second DNS resolution request based on applying the second resolution rule.

Systems, devices, and methods for polymorphic domain name resolution

A method, system, and computer-readable memory containing instructions include receiving a DNS request containing authentication information, validating the authentication information, determining an appropriate action to take based on the validating status, and taking the appropriate action. Actions may include responding with an individualized network layer address or service location address, delaying sending a response message, sending a network layer address or service location address corresponding to a site containing authentication information, and sending a response with a network layer address or service location address with a web address configured to mimic the website related to the requested resource.

Authenticated name resolution

Systems, devices and methods for a Domain Name Data Networking (DNDN) content delivery system are disclosed. Embodiments perform operations including obtaining a content object having a unique identifier. The operations also include storing a local instance of the content object in association with DNS resource records and the unique identifier. The operations further include providing the local instance of the content to a client in response to receiving a request from the client including the unique identifier.

Methods and systems for domain name data networking

Some embodiments provide a technique for detecting highly-vulnerable domain names and remediating associated problems. The technique can include collecting DNS data representing a requests to the DNS over a period of time and determining a subset of the DNS data representing DNS-based service discovery requests to unregistered domains over the period of time. The technique can also include, for each of the unregistered domains, determining a query ratio and a persistence ratio. The technique can also include ranking the unregistered domains according to a metric that includes the query ratios and the persistence ratios, such that a ranked list of domain names is produced and outputting an initial segment of the ranked list of domain names as the highly-vulnerable domain names. The technique can also include remediating attacks on at least one of the highly-vulnerable domain names.

Detecting and remediating highly vulnerable domain names using passive DNS measurements

A Domain Name System ('DNS') package and a method for providing domain name resolution services in a partitioned network are disclosed. The system may include one or more built-in root name servers; one or more built-in top level domain ('TLD') name servers; and a recursive name server. The recursive name server may be configured to query the one or more built-in root name servers during domain name resolution. Moreover, the one or more built-in root name servers may be configured to provide a network address corresponding to one of the built-in TLD name servers in response to a domain name resolution query sent by the recursive name server.

DNS package in a partitioned network

Systems and methods for detecting spoofed traffic include determining a first hop count of a first data query from a first transmitting device to a first server, determining a second hop count of a second data query from the first transmitting device to a second server, determining a third hop count of a third data query appearing to be from the first transmitting device to the first server, and determining a fourth hop count of a fourth data query appearing to be from the first transmitting device to the second server. The third and fourth hop counts are compared to the first and second hop counts, respectively. It is determined whether the third hop count differs from the first hop count by more than a predetermined amount.

Anycast-based spoofed traffic detection and mitigation

An apparatus and a non-transitory computer-readable medium may perform a method of minimizing the disclosure of a domain name contained in a DNS query. The method may include determining a first label and a second label associated with a domain name included in a DNS query. A first nameserver may be queried for a first resource record type associated with the first label without revealing information related to the second label by removing information related to the second label from the DNS query. A response may be received from the first nameserver, and the response may include the first resource record type which directs a resolver to a second nameserver. The second nameserver may be queried for a second resource record type associated with the first label and the second label.

Providing privacy enhanced resolution system in the domain name system

A method, system, and computer-readable memory containing instructions include receiving a DNS request containing information related to user-specific information, device-specific information, and/or authentication information, analyzing the information, determining an appropriate action to take based on analyzing the status, and taking the appropriate action. Actions may include responding with an individualized network layer address or service location address, delaying sending a response message, sending a network layer address or service location address corresponding to a site containing authentication information, and sending a response with a network layer address or service location address with a web address configured to mimic the website related to the requested resource.

Growing community of inventors

Leesburg, VA, United States of America

Danny McPherson