Granted Patent B2

US 12,375,442 · App. 17/503,763 · Granted Jul 29, 2025

Inventors: Marwan Fayed (St Andrews, GB); Pavel Odintsov (London, GB); Sami Matias Kerola (London, GB)

H04L61/4511H04L61/5007H04L63/1458

Abstract

Claims (90)

1. A method, comprising:

receiving, at a first authoritative domain name system (DNS) server, a first plurality of DNS queries for a first plurality of hostnames, wherein the first plurality of hostnames is at least one thousand;

answering each of the first plurality of DNS queries with a same first single IP address, wherein each of a plurality of servers of a distributed cloud computing network is capable of receiving traffic addressed to the same first single IP address;

receiving, by at least some of the plurality of servers of the distributed cloud computing network from a first plurality of client devices, requests for content that are addressed to the same first single IP address;

for each received request from one of the first plurality of client devices, performing:

determining a hostname to which the request is directed based on a Server Name Indication (SNI) field or an HTTP host header field associated with that request,

transmitting the request to an origin server for the determined hostname,

receiving a response from the origin server responsive to the transmitted request, and

transmitting the response to the requesting client device;

receiving, at a second authoritative DNS server, a second plurality of DNS queries for the first plurality of hostnames;

answering each of the second plurality of DNS queries with a same second single IP address, wherein each of the plurality of servers is capable of receiving traffic addressed to the same second single IP address, and wherein the same first single IP address is different from the same second single IP address;

receiving, by at least some of the plurality of servers of the distributed cloud computing network from a second plurality of client devices, requests for content that are addressed to the same second single IP address; and

for each received request from one of the second plurality of client devices, performing:

determining a hostname to which the request is directed based on a Server Name Indication (SNI) field or an HTTP host header field associated with that request,

transmitting the request to an origin server for the determined hostname,

receiving a response from the origin server responsive to the transmitted request, and

transmitting the response to the requesting client device.

2. The method of claim 1 , further comprising:

detecting a layer 7 attack directed to a first hostname of the first plurality of hostnames; and

responsive to the detected layer 7 attack, binding an IP address that is not the same first single IP address to an address record for the first hostname such that subsequent DNS queries for that address record return the bound IP address instead of the same first single IP address.

3. A system, comprising:

a first authoritative domain name system (DNS) server adapted to:

receive a first plurality of DNS queries for address records for a first plurality of hostnames, wherein the first plurality of hostnames is at least one thousand, and

answer each of the first plurality of DNS queries with a same first single IP address, wherein each of a plurality of servers of a distributed cloud computing network is capable of receiving traffic addressed to the same first single IP address;

a second authoritative DNS server adapted to:

receive a second plurality of DNS queries for address records for the first plurality hostnames, and

answer each of the second plurality of DNS queries with a same second single IP address, wherein each of the plurality of servers are capable of receiving traffic addressed to the same second single IP address, wherein the same first single IP address is different from the same second single IP address, and wherein each of the plurality of servers is capable of receiving traffic addressed to the same second single IP address;

a first portion of the plurality of servers, wherein each of the first portion of the plurality of servers is adapted to:

receive requests from a first plurality of client devices for content addressed to the same first single IP address, and

for each received request from one of the first plurality of client devices,

determine a hostname to which the request is directed based on a Server Name Indication (SNI) field or an HTTP host header field associated with that request,

transmit that request to an origin server for the determined hostname,

receive a response from the origin server responsive to the transmitted request, and

transmit the response to the requesting client device; and

a second portion of the plurality of servers, wherein each of the second portion of the plurality of servers is adapted to:

receive requests from a second plurality of client devices for content addressed to the same second single IP address, and

for each received request from one of the second plurality of client devices,

determine a hostname to which the request is directed based on a Server Name Indication (SNI) field or an HTTP host header field associated with that request,

transmit that request to an origin server for the determined hostname,

receive a response from the origin server responsive to the transmitted request, and

transmit the response to the requesting client device.

4. The system of claim 3 , wherein the first authoritative DNS server is further adapted to:

responsive to a detected layer 7 attack directed to a particular hostname of the plurality of hostnames, bind one or more IP addresses that are not the same first single IP address to an address record for that particular hostname such that subsequent DNS queries for that address record return the bound one or more IP addresses instead of the same first single IP address.

5. A system, comprising:

a first non-transitory machine-readable storage medium that provides instructions that, when executed by a processing system of a first authoritative domain name system (DNS) server cause first operations to be performed including:

receiving a first plurality of DNS queries for a first plurality of hostnames, wherein the first plurality of hostnames is at least one thousand, and

answering each of the first plurality of DNS queries with a same first single IP address, wherein each of a plurality of servers of a distributed cloud computing network is capable of receiving traffic addressed to the same first single IP address;

a second non-transitory machine-readable storage medium that provides instructions that, when executed by a processing system of a second authoritative DNS server cause second operations to be performed including:

receiving a second plurality of DNS queries for the first plurality of hostnames, and

answering each of the second plurality of DNS queries with a same second single IP address, wherein each of the plurality of servers is capable of receiving traffic addressed to the same second single IP address, and wherein the same first single IP address is different from the same second single IP address; and

a third non-transitory machine-readable storage medium that provides instructions that, when executed by a processing system of one of the plurality of servers of the distributed cloud computing network cause third operations to be performed including:

receiving, at the one of the plurality of servers of the distributed cloud computing network from a first client device, a first request for content that is addressed to the same first single IP address,

determining the hostname to which the first request is directed based on a Server Name Indication (SNI) field or an HTTP host header field associated with the first request for content,

transmitting the first request to a first origin server for the determined hostname,

receiving a first response from the first origin server responsive to the transmitted first request, and

transmitting the first response to the first client device; and

a fourth non-transitory machine-readable storage medium that provides instructions that, when executed by a processing system of a second one of the plurality of servers of the distributed cloud computing network cause fourth operations to be performed including:

receiving, at the second one of the plurality of servers of the distributed cloud computing network from a second client device, a second request for content that is addressed to the same second single IP address,

determining the hostname to which the second request is directed based on a Server Name Indication (SNI) field or an HTTP host header field associated with the second request for content,

transmitting the second request to a second origin server for the determined hostname,

receiving a second response from the second origin server responsive to the transmitted second request, and

transmitting the second response to the second client device.

6. The system of claim 5 , wherein the third operations further comprise:

responsive to a detected layer 7 attack directed to a particular hostname of the first plurality of hostnames, binding an IP address that is not the same first single IP address to an address record for that particular hostname such that subsequent DNS queries for that address record return the bound IP address instead of the same first single IP address.

7. The method of claim 1 , further comprising:

wherein the answering each of the first plurality of DNS queries with the same first single IP address is done in a first period;

receiving, at the first authoritative DNS server during a second period, a third plurality of DNS queries for a second plurality of hostnames, wherein the first period is different from the second period;

answering each of the third plurality of DNS queries with a same third single IP address, wherein the same first single IP address is different from the same third single IP address; and

receiving, at the plurality of servers of the distributed cloud computing network from the third plurality of client devices, requests for content that are addressed to the same third single IP address.

8. The method of claim 1 , further comprising:

receiving, at the first authoritative DNS server, a third DNS query for a second hostname that is not one of the first plurality of hostnames; and

answering the third DNS query with a third IP address that is different from the same first single IP address.

9. The method of claim 1 , further comprising:

providing a signed zone file to one or more DNS resolvers that maps the first plurality of hostnames with the same first single IP address.

10. The system of claim 3 , wherein the first authoritative DNS server is further adapted to:

receive a third DNS query for a second hostname that is not one of the first plurality of hostnames; and

answer the third DNS query with a third IP address that is different from the same first single IP address.

11. The system of claim 3 , wherein the first authoritative DNS server is further adapted to:

provide a signed zone file to one or more DNS resolvers that maps the first plurality of hostnames with the same first single IP address.

12. The system of claim 5 , further comprising:

wherein the answering each of the first plurality of DNS queries with the same first single IP address is done in a first period, and wherein the first operations further include:

receiving, at the first authoritative DNS server during a second period, a third plurality of DNS queries for a second plurality of hostnames, wherein the first period is different from the second period, and

answering each of the third plurality of DNS queries with a same third single IP address, wherein the same first single IP address is different from the same third single IP address; and

wherein the third operations further include:

receiving, at the one of the plurality of servers of the distributed cloud computing network from at least some of the plurality of client devices, requests for content that are addressed to the same second single IP address.

13. The system of claim 5 , wherein the first operations further include:

receiving a third DNS query for a second hostname that is not one of the first plurality of hostnames; and

answering the third DNS query with a third IP address that is different from the same first single IP address.

14. The system of claim 5 , wherein the first operations further include:

providing a signed zone file to one or more DNS resolvers that maps the first plurality of hostnames with the same first single IP address.

Assignments (2)

Continuity (2)

References Cited (54)