Centralized consent vendors for managing network-based consent contracts
Techniques for creating consent contracts for devices that indicate whether the devices consent to receiving network-based communications from other devices. Further, the techniques include enforcing the consent contracts such that network-based communications are either allowed or disallowed in the network-communications layer prior to the network communications reaching the devices. Rather than simply allowing a device to communicate with any other device over a network, the techniques described herein include building in consent for network-based communications where the consent is consulted at one or more points in a communication process to make informed decisions about network-based traffic.
1. A method for managing consent contracts for network communications, the method comprising:
receiving, by a Domain Name System (DNS) provider and from a plurality of receiving devices, consent data comprising conditions associated with receiving the network communications from one or more sending devices;
in response to receiving the consent data, generating, by the DNS provider, the consent contracts for the plurality of receiving devices, wherein the consent contract indicates that a receiving device of the plurality of receiving devices has consented to receiving the network communications from one or more particular sending devices and is valid for a period of time;
storing, by DNS provider, the consent contracts;
receiving, from a first device, a DNS request at a DNS server of the DNS provider, the DNS request indicating a request to translate a domain name into an Internet Protocol (IP) address associated with a second device;
determining, at the DNS server, that a particular consent contract indicates that the second device has consented to receiving the network communications from the first device, the particular consent contract limiting the network communications to a particular communication type or a particular purpose associated with the network communication;
in response to determining that the particular consent contract is valid and indicates that the second device has consented to receiving the network communications of the particular communication type or the particular purpose from the first device:
determining, at the DNS server, that the IP address corresponds to the domain name; and
sending, from the DNS server, a DNS response to the first device that includes the IP address; or
in response to determining that the particular consent contract is invalid or indicates that the second device has not consented to receiving the network communications of the particular type or the particular purpose from the first device:
refraining, by the DNS server, from sending the IP address to the first device; or
sending, from the DNS server, a response to the first device indicating a rejection of the DNS request.
2. The method of claim 1 , further comprising:
receiving, from the first device, first data indicating a set of permissions granted to the first device; and
determining that the second device has provided second data indicating consent to receive the network communications from devices with the set of permissions.
3. The method of claim 1 , wherein the consent data further comprises one or more of:
a first range of addresses associated with the sending devices with which the second device has consented to communicating;
a second range of addresses associated with the sending devices with which the second device has restricted from communicating;
a first indication that that the second device consents to communicate with the sending devices that desire to send the network communications of the particular communication type; or
a second indication that that the second device consents to communicate with the sending devices that desire to establish a connection of a particular connection type.
4. The method of claim 1 , further comprising:
receiving the consent data indicating that the second device has consented to receiving the type of network communication comprising layer-3 or layer-4 traffic from the first device; and
generating the particular consent contract to allow the network communications where the network communications are the layer-3 or the layer-4 traffic from the first device.
5. The method of claim 1 , wherein:
the particular consent contract includes a mapping between a first device identifier associated with the first device and a second device identifier associated with the second device; and
determining that the particular consent contract indicates that the second device has consented to receiving the network communications from the first device includes:
determining that the DNS request includes the first device identifier;
using the first device identifier, identifying the mapping; and
determining, using the mapping, that the first device identifier is mapped to the second device identifier.
6. The method of claim 1 , further comprising:
receiving consent data indicating that the second device has consented to receiving the type of network communication comprising layer-5, layer-6, or layer-7 traffic from the first device; and
generating the particular consent contract using the consent data.
7. A certificate authority (CA) system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
issuing a signed certificate to a server;
receiving consent data associated with the server, the consent data comprising conditions associated with the server receiving network communications;
in response to receiving the consent data, generating consent contracts for the server, wherein the consent contracts indicate that the server has agreed to receive the network communications of a particular communication type from one or more particular sending devices;
receiving, from a client device, a request to validate the signed certificate;
determining, by the CA system and using the consent contracts, whether the client device is permitted to send the network communications to the server and whether the network communications are of the particular communication type;
in response to determining that the client device is permitted to send the network communications to the server and that the network communications are of the particular communication type:
validating the signed certificate for the client device; and
notifying the client device that the signed certificate is valid; or
in response to determining that the client device is not permitted to send the network communications to the server:
refraining from validating the signed certificate; or
refraining from notifying the client device that the signed certificate is valid.
8. The CA system of claim 7 , the operations further comprising:
receiving, from the client device, first data indicating a set of permissions granted to the client device; and
determining that the server has provided second data indicating consent to receive receiving the network communications from devices with the set of permissions.
9. The CA system of claim 7 , the consent data further comprising at least one of:
a first range of addresses associated with devices with which the server has consented to communicating;
a second range of addresses associated with devices with which the server has restricted from communicating;
a first indication that that the server consents to communicate with devices that desire to send the network communications of the particular communication type;
a second indication that that the server consents to communicate with devices that desire to establish a connection of a particular connection type; or
a third indication that that the second device consents to communicate with devices that desire to send the network communications for a particular purpose.