Verisign, Inc.

Sameer Thakar

Eric Osterweil

Nathan Glenn

Michael Kaczmarek

In one embodiment, a privacy and security engine enables a user to specify a recursive resolver for a domain name service (DNS) resolution process. The privacy and security engine receives default DNS settings that specify a default recursive resolver to be implemented as a recursive resolver for the DNS resolution process. The default DNS settings are provided by an underlying mobile operator network to which the user device is connected. The privacy and security engine causes the user device to disregard the default DNS settings and implement customized DNS settings that specify a preferred recursive resolver to be implemented as the recursive resolver for the DNS resolution process. The customized DNS settings are associated with an activated privacy and security mode. Unlike conventional approaches to overriding DNS settings, the user is able to specify the recursive resolver that implements the DNS resolution process irrespective of the underlying network.

Techniques for directing a domain name service (DNS) resolution process

Various embodiments disclosed herein provide techniques for transmitting an email message over a network. An email forwarding application executing on an email server receives a first request from a first device within the network to resolve an email address of an email recipient, where the email address is associated with a first domain. The email forwarding application determines that the email recipient is associated with a second domain. The email forwarding application transmits, to the first device, a first response to the first request that identifies the email recipient and the second domain.

Techniques for email portability

Various embodiments of the invention disclosed herein provide techniques for associating a firewall policy with a dynamic domain name system (DNS) hostname. A policy configuration portal associates a first hostname with a first network address. The policy configuration portal sets firewall policy configuration associated with the first hostname to include the first network address. The policy configuration portal receives a first message that associates a DNS hostname with a second network address. The policy configuration portal, in response to receiving the first message, associates the second network address with the first hostname. The policy configuration portal modifies a firewall policy configuration associated with the first hostname to include the second network address. At least one advantage of the disclosed techniques is that a firewall policy can be implemented for a residential home or small business that employs dynamic IP addressing.

Real-time association of a policy-based firewall with a dynamic DNS hostname

Various embodiments of the invention disclosed herein provide techniques for managing a domain name system (DNS) based attack. An exfiltration and tunneling mitigation platform receives a first DNS request directed to a first domain name. The exfiltration and tunneling mitigation platform determines that a first characteristic associated with a first fully qualified domain name (FQDN) included in the first DNS request exceeds a first threshold value. In response, the exfiltration and tunneling mitigation platform computes a distance between the first FQDN and a second FQDN included in a second DNS request also directed to the first domain name. The exfiltration and tunneling mitigation platform increments a first count value associated with the first domain name based on the distance. At least one advantage of the disclosed techniques is that a DNS-based attack can be detected and mitigated before a significant amount of DNS exfiltration or DNS tunneling has occurred.

Real-time cloud-based detection and mitigation of DNS data exfiltration and DNS tunneling

Provided is a method of digitally securing a digital object from a first user in a first domain to a second user in a second domain using a DNS provider. The method includes accessing, at a client device of the first user, a client-side local policy, wherein the local policy comprises one or more zones managed by one or more DNS providers and secured by DANE using DNSSEC; constructing a DNS query for a cryptographic credential for the second user based, at least in part, on a zone of the one or more zones in the local policy; providing a request for the cryptographic credential for the second user; obtaining the cryptographic credential for the second user from a DNS provider of the one or more DNS providers; digitally securing the digital object using the cryptographic credential; and providing the digital object to the second user.

Growing community of inventors

Leesburg, VA, United States of America

Sameer Thakar