Restricting communication over an encrypted network connection to internet domains that share common IP addresses and shared SSL certificates
An apparatus prevents communication by a client device to a domain that cannot be uniquely identified by relocating the DNS mapping of the domain to a destination IP Address that is uniquely identifiable and that represents a location of an apparatus that provides a data path to the domain.
1. A computer-implemented method executed by one or more hardware processors, the method comprising:
receiving an encrypted request for a resource, the encrypted request directed to a particular IP address;
determining that the particular IP address is a spoofed IP address associated with a particular domain name;
determining that the encrypted request is directed to the particular domain name based on the association between the spoofed IP address and the particular domain name, wherein the determination is made without decrypting the encrypted request; and
selectively allowing the encrypted request based at least in part on determining that the encrypted request is directed to the particular domain name.
2. The method of claim 1 , wherein selectively allowing the encrypted request includes:
determining that the encrypted request should be blocked based at least in part on a rule associated with the particular domain name; and
blocking the encrypted request.
3. The method of claim 1 , wherein selectively allowing the encrypted request includes:
determining that the encrypted request should be allowed based at least in part on a rule associated with the particular domain name; and
forwarding the encrypted request to a corresponding IP address for the particular domain name.
4. The method of claim 1 , wherein the association between the spoofed IP address and the particular domain name is created by a domain name server in response to receiving a request to resolve the particular domain name.
5. The method of claim 1 , wherein the spoofed IP address includes an IP port.
6. The method of claim 1 , wherein receiving the encrypted request for the resource includes receiving a request according to Hypertext Transfer Protocol Secure (HTTPS).
7. A non-transitory, computer-readable medium storing instructions operable when executed to cause at least one hardware processor to perform operations comprising:
receiving an encrypted request for a resource, the encrypted request directed to a particular IP address;
determining that the particular IP address is a spoofed IP address associated with a particular domain name;
determining that the encrypted request is directed to the particular domain name based on the association between the spoofed IP address and the particular domain name, wherein the determination is made without decrypting the encrypted request; and
selectively allowing the encrypted request based at least in part on determining that the encrypted request is directed to the particular domain name.
8. The non-transitory, computer-readable medium of claim 7 , wherein selectively allowing the encrypted request includes:
determining that the encrypted request should be blocked based at least in part on a rule associated with the particular domain name; and
blocking the encrypted request.
9. The non-transitory, computer-readable medium of claim 7 , wherein selectively allowing the encrypted request includes:
determining that the encrypted request should be allowed based at least in part on a rule associated with the particular domain name; and
forwarding the encrypted request to a corresponding IP address for the particular domain name.
10. The non-transitory, computer-readable medium of claim 7 , wherein the association between the spoofed IP address and the particular domain name is created by a domain name server in response to receiving a request to resolve the particular domain name.
11. The non-transitory, computer-readable medium of claim 7 , wherein the spoofed IP address includes an IP port.
12. The non-transitory, computer-readable medium of claim 7 , wherein receiving the encrypted request for the resource includes receiving a request according to Hypertext Transfer Protocol Secure (HTTPS).
13. A system comprising:
memory for storing data; and
one or more hardware processors operable to perform operations comprising:
receiving an encrypted request for a resource, the encrypted request directed to a particular IP address;
determining that the particular IP address is a spoofed IP address associated with a particular domain name;
determining that the encrypted request is directed to the particular domain name based on the association between the spoofed IP address and the particular domain name, wherein the determination is made without decrypting the encrypted request; and
selectively allowing the encrypted request based at least in part on determining that the encrypted request is directed to the particular domain name.
14. The system of claim 13 , wherein selectively allowing the encrypted request includes:
determining that the encrypted request should be blocked based at least n part on a rule associated with the particular domain name; and
blocking the encrypted request.
15. The system of claim 13 , wherein selectively allowing the encrypted request includes:
determining that the encrypted request should be allowed based at least in part on a rule associated with the particular domain name; and
forwarding the encrypted request to a corresponding IP address for the particular domain name.
16. The system of claim 13 , wherein the association between the spoofed IP address and the particular domain name is created by a domain name server in response to receiving a request to resolve the particular domain name.
17. The system of claim 13 , wherein the spoofed IP address includes an IP port.