Securing mDNS in enterprise networks
View Patent ↗Methods, systems and computer readable media for securing mDNS in enterprise networks are described. In some implementations, the method can include authorizing one or more service advertisements and validating one or more service advertisements. The method can also include adding one or more information details to a record associated with an advertised service.
1. A computer implemented method for securing a multicast domain name system in an enterprise network, the method comprising:
receiving at a network device, multicast domain name system (mDNS) packets comprising one or more service advertisement records of a service; and
in response to receiving the mDNS packets comprising the one or more service advertisement records of the service:
transmitting, by the network device to a server with valid service records of known services, a request for an indication of whether the service is valid;
in response to receiving, from the server, a response that indicates that the service is valid, validating, at the network device, the one or more service advertisement records by including the one or more service advertisement records in the mDNS packets;
in response to receiving, from the server, a response that indicates that the service is not valid, excluding the one or more service advertisement records from the mDNS packets; and
sending, by the network device, the mDNS packets to a client device.
2. The method of claim 1 , further comprising:
retrieving an allow/deny list associated with the client device in response to a successful authentication of the client device;
storing the allow/deny list with an authentication context for the client device;
distributing the authentication context to access points and wireless switching planes within the enterprise network;
comparing the one or more service advertisement records against the allow/deny list;
in response to the one or more service advertisement records being authorized, allowing the one or more service advertisement records in the mDNS packets; and
in response to the one or more service advertisement records not being authorized, removing the one or more service advertisement records from the mDNS packets.
3. The method of claim 1 , further comprising:
caching, at the network device, the response from the server so as to speed up processing of the one or more service advertisement records.
4. The method of claim 1 , further comprising:
determining, by the network device, to validate the service in response to the service being on a first list of services to validate.
5. The method of claim 1 , further comprising:
adding user details to a mDNS service discovery message, wherein the user details include authentication information about publication of the service; and
displaying the user details at the client device.
6. The method of claim 5 , wherein the adding user details to the mDNS service discovery message includes adding the user details to a TXT record of the mDNS service discovery message.
7. The method of claim 5 , further comprising creating a TXT record for a service advertisement that does not have a TXT record.
8. A system for securing a multicast domain name system in an enterprise network, the system comprising one or more processors configured to:
receive multicast domain name system (mDNS) packets comprising one or more service advertisement records of a service; and
in response to receiving the mDNS packets comprising the one or more service advertisement records of the service:
transmit, to a server with valid service records of known services, a request for an indication of whether the service is valid;
in response to receiving, from the server, a response that indicates that the service is valid, validate the one or more service advertisement records by including the one or more service advertisement records in the mDNS packets;
in response to receiving, from the server, a response that indicates that the service is not valid, exclude the one or more service advertisement records from the mDNS packets; and
send the mDNS packets to a client device.
9. The system of claim 8 , wherein the one or more processors are further configured to:
retrieve an allow/deny list associated with the client device in response to a successful authentication of the client device;
store the allow/deny list with an authentication context for the client device;
distribute the authentication context to access points and wireless switching planes within the enterprise network;
compare the one or more service advertisement records against the allow/deny list;
in response to the one or more service advertisement records being authorized, allow the one or more service advertisement records in the mDNS packets; and
in response to the one or more service advertisement records not being authorized, remove the one or more service advertisement records from the mDNS packets.
10. The system of claim 8 , wherein the one or more processors are further configured to:
add user details to a mDNS service discovery message, wherein the user details include authentication information about publication of the service; and
display the user details at the client device.
11. The system of claim 8 , wherein the one or more processors are further configured to:
determine to validate the service in response to the service being on a first list of services to validate,
wherein the system stores the first list of services to validate and a second list of services not to validate.
12. A nontransitory computer readable medium having stored thereon software instructions that, when executed by a processor, cause the processor to perform operations including:
receiving multicast domain name system (mDNS) packets comprising one or more service advertisement records of a service; and
in response to receiving the mDNS packets comprising the one or more service advertisement records of the service and the service being on a list of services to be validated:
transmitting, to a server with valid service records of known services, a request for an indication of whether the service is valid;
in response to receiving, from the server, a response that indicates that the service is valid, validating the one or more service advertisement records by including the one or more service advertisement records in the mDNS packets;
in response to receiving, from the server, a response that indicates that the service is not valid, excluding the one or more service advertisement records from the mDNS packets; and
sending the mDNS packets to a client device.
13. The nontransitory computer readable medium of claim 12 , wherein the operations further comprise:
retrieving an allow/deny list associated with the client device in response to a successful authentication of the client device;
storing the allow/deny list with an authentication context for the client device;
distributing the authentication context to access points and wireless switching planes within the network;
comparing the one or more service advertisement records against the allow/deny list;
in response to the one or more service advertisement records being authorized, including the one or more service advertisement records in the mDNS packets; and
in response to the one or more service advertisement records not being authorized, removing the one or more service advertisement records from the mDNS packets.
14. The nontransitory computer readable medium of claim 12 , wherein the operations further comprise caching the response from the server so as to speed up processing of the one or more service advertisement records.
15. The nontransitory computer readable medium of claim 12 , wherein the operations further comprise determining to validate the service in response to the service being on a first list of services to validate.
16. The nontransitory computer readable medium of claim 12 , wherein the operations further comprise:
adding user details to a mDNS service discovery message, wherein the user details include authentication information about a user publishing the service; and
displaying the user details at the client device.
17. The nontransitory computer readable medium of claim 16 , wherein the adding user details to the mDNS service discovery message includes adding the user details to a TXT record of the mDNS service discovery message.