Granted Patent B2

US 12,302,091 · App. 18/023,765 · Granted May 13, 2025

Inventors: Miguel Angel Muñoz De La Torre Alonso (Madrid, ES); Maria Luisa Mas Rosique (Tres Cantos, ES); Marcus Ihlar (Älvsjö, SE)

Assignee: Telefonaktiebolaget LM Ericsson (publ)

H04W12/033H04L61/4511H04W12/0431

Abstract

Claims (40)

1. A method for deactivating Server Name Indication, SNI, (SNI) encryption in a telecommunication network, wherein the telecommunication network comprises a Domain Name System (DNS) server, the method comprising the steps of:

receiving, by the DNS server, from a user equipment (UE) a DNS query comprising a Domain Name to be converted to an Internet Protocol (IP) address;

determining, by the DNS server, that SNI encryption is to be deactivated for subsequent traffic associated with the Domain Name;

forwarding, by the DNS server, the DNS query to an external DNS server, wherein the DNS query comprises the Domain Name and a request for deactivating SNI encryption;

receiving, by the DNS server, from the external DNS server, a DNS answer, wherein the DNS answer comprises the converted IP address and wherein the DNS answer is free from encryption keys for encrypting SNI; and

forwarding, by the DNS server, the DNS answer comprising the converted IP address to the UE, wherein the DNS answer is free from encryption keys such that the UE is not able to encrypt the SNI in the subsequent traffic.

2. The method of claim 1 , wherein the step of determining further comprises:

transmitting, by the DNS server, to a Policy and Charging function entity, a user consent request for querying whether the UE has provided a consent for deactivating the SNI encryption; and

receiving, by the DNS server, from the Policy and Charging function entity, a user consent response comprising an indication that the UE has provided the consent for deactivating the SNI encryption.

3. The method of claim 2 ,

wherein the received DNS query and the transmitted user consent request comprise an IP address of the UE for enabling the Policy and Charging function entity to determine whether the UE has provided the user consent.

4. The method of claim 1 , wherein the step of forwarding the DNS query comprises:

forwarding, by the DNS server, the DNS query to an external DNS server, wherein the DNS query comprises an operator identification for identifying an operator of the telecommunication network thereby enabling the external DNS server to determine whether Server Name Indication, SNI, (SNI) encryption may be deactivated for the operator.

5. The method of claim 1 , wherein the DNS answer is free from encryption keys being any of a public key corresponding to the Domain Name and an Encrypted server name indication, ESNI, key corresponding to the Domain Name.

6. A method for supporting of deactivating Server Name Indication (SNI) encryption in a telecommunication network, wherein the telecommunication network comprises a Domain Name System (DNS) server, and a Policy and Charging function entity, the method comprising the steps of:

receiving, by the Policy and Charging function entity, from the DNS server, a user consent request for querying whether the UE has provided a consent for deactivating the SNI encryption;

determining, by the Policy and Charging function entity that the UE has provided the consent for deactivating the SNI encryption; and

transmitting, by the Policy and Charging function entity, to the DNS server, a user consent response comprising an indication that the UE has provided the consent for deactivating the SNI encryption.

7. The method of claim 6 , wherein the received user consent request comprise an IP address of the UE, wherein the step of determining comprises:

determining that the UE has provided the consent based on the received IP address of the UE.

8. The method of claim 7 , wherein the method comprises the initial steps of:

transmitting, by the Policy and Charging function entity, to a Unified Data Repository, UDR, a Query Request message for retrieving policy data of the UE;

receiving, by the Policy and Charging function entity, from the Unified Data Repository, UDR, a Query Response message, wherein the Query Response message comprises the indication that the UE has provided the consent for deactivating the SNI encryption;

storing, by the Policy and Charging function entity, the received indication that the UE has provided the consent for deactivating the SNI encryption.

9. A method for supporting of deactivating Server Name Indication (SNI) encryption in a telecommunication network, by an external Domain Name System (DNS) server in an Internet Protocol (IP) communication system, wherein the external DNS server is arranged to communicate with a DNS server in a telecommunication network, wherein the method comprises the steps of:

receiving, by the external DNS server, from the DNS server in the telecommunication network, a DNS query comprising a Domain Name to be converted to an Internet Protocol (IP) address, and comprising a request for deactivating SNI encryption;

converting, by the external DNS server, the Domain Name to the IP address;

determining, by the external DNS server, that the SNI encryption may be deactivated for the Domain Name; and

transmitting, by the external DNS server, to the DNS server in the telecommunication network a DNS answer, wherein the DNS answer comprises the converted IP address and wherein the DNS answer is free from encryption keys for encrypting the SNI.

10. The method of claim 9 , wherein the received DNS query comprises an operator identification for identifying an operator of the telecommunication network, and wherein the step of determining comprises:

determining that the SNI encryption may be deactivated for the Domain Name based on the operator identification.

11. A Domain Name System (DNS) server arranged for operating in a telecommunication network and for deactivating Server Name Indication (SNI) encryption in the telecommunication network,

receive equipment arranged for receiving, from a user equipment (UE) a DNS query comprising a Domain Name to be converted to an Internet Protocol (IP) address;

process equipment arranged for determining that SNI encryption is to be deactivated for subsequent traffic associated with the Domain Name;

transmit equipment arranged for forwarding the DNS query to an external DNS server, wherein the DNS query comprises the Domain Name and a request for deactivating SNI encryption;

wherein the receive equipment is further arranged for receiving from the external DNS server, a DNS answer, wherein the DNS answer comprises the converted IP address and wherein the DNS answer is free from encryption keys for encrypting SNI;

wherein the transmit equipment is further arranged for forwarding the DNS answer comprising the converted IP address to the UE, wherein the DNS answer is free from encryption keys such that the UE is not able to encrypt the SNI in the subsequent traffic.

12. The DNS server of claim 11 , wherein:

said transmit equipment is arranged for transmitting to a Policy and Charging function entity, a user consent request for querying whether the UE has provided a consent for deactivating the SNI encryption;

said receive equipment is arranged for receiving from the Policy and Charging function entity, a user consent response comprising an indication that the UE has provided the consent for deactivating the SNI encryption.

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (50)