Granted Patent B2

US 12,568,138 · App. 18/631,652 · Granted Mar 3, 2026

Inventors: Seven Starosta (Brooklyn, NY); Jeffrey M. Tejnecky (Chesterfield, VA); Brandon Krouse (Frisco, TX)

Assignee: Capital One Services, LLC

H04L67/1038H04L61/4511H04L63/10H04L63/1458

Abstract

Claims (85)

1 . A system configured to protect Domain Name System (DNS) servers from Denial of Service (DOS) attacks, the system comprising:

a computing device;

a first DNS server; and

a second DNS server;

wherein the computing device is configured to:

receive, via an Application Programming Interface (API) and during a first time period, a first DNS request;

based on determining that the first DNS request comprises a requested change to a first DNS record, based on authenticating one or more first authentication credentials in the first DNS request, and based on comparing a first quantity of DNS requests received during the first time period to a threshold associated with DNS attacks;

modify the first DNS request to replace the one or more first authentication credentials in the first DNS request with shared authentication credentials; and

route the modified first DNS request to the first DNS server;

receive, via the API and during a second time period different from the first time period, a second DNS request; and

based on determining that the second DNS request comprises a read request associated with the first DNS record, based on authenticating one or more second authentication credentials in the second DNS request, and based on comparing a second quantity of DNS requests received during the second time period to the threshold associated with DNS attacks;

modify the second DNS request to replace the one or more second authentication credentials in the second DNS request with the shared authentication credentials; and

route the modified second DNS request to the second DNS server;

receive, via the API and during a third time period different from the first time period and the second time period, a third DNS request comprising either or both the one or more first authentication credentials or the one or more second authentication credentials; and

based on comparing a third quantity of DNS requests received during the third time period to the threshold associated with DNS attacks, prevent transmission of the third DNS request to the first DNS server or the second DNS server;

wherein the first DNS server is configured to:

receive the modified first DNS request;

modify, based on authenticating the shared authentication credentials and based on the modified first DNS request, a DNS record; and

transmit the modified DNS record to the second DNS server; and

wherein the second DNS server is configured to:

store the modified DNS record;

receive the modified second DNS request; and

provide, in response to the modified second DNS request and based on authenticating the shared authentication credentials, the modified DNS record.

2 . The system of claim 1 , wherein the shared credentials comprise a token indicating successful authentication of one or more third authentication credentials.

3 . The system of claim 1 , wherein the first DNS server maintains a first copy of DNS records, wherein the second DNS server maintains a second copy of the DNS records, and wherein the first DNS server is configured to transmit the modified DNS record to the second DNS server as part of an update to the second copy of the DNS records.

4 . The system of claim 1 , wherein the computing device is configured to:

receive, via the API, a fourth DNS request; and

based on determining that the fourth DNS request is associated with a user on a blocklist, cause display, on a user device, of a notification indicating that the fourth DNS request is denied.

5 . The system of claim 1 , wherein the computing device is configured to prevent transmission of the third DNS request to the first DNS server or the second DNS server by:

causing display, on a user device, of a notification indicating that the third DNS request is denied.

6 . The system of claim 1 , wherein the second DNS request comprises authentication credentials, and wherein the computing device is configured to route the second DNS request to the second DNS server further based on validating the authentication credentials.

7 . The system of claim 1 , wherein the first DNS request comprises a request to create a Canonical Name (CNAME) record.

8 . A method configured to protect Domain Name System (DNS) servers from Denial of Service (DoS) attacks, the method comprising:

receiving, by a computing device, via an Application Programming Interface (API), and during a first time period a first DNS request;

based on determining that the first DNS request comprises a requested change to a first DNS record, based on authenticating one or more first authentication credentials in the first DNS request, and based on comparing a first quantity of DNS requests received during the first time period to a threshold associated with DNS attacks;

modifying the first DNS request to replace the one or more first authentication credentials in the first DNS request with shared authentication credentials; and

routing, by the computing device, the modified first DNS request to a first DNS server;

receiving, by the computing device, via the API, and during a second time period different from the first time period, a second DNS request;

based on determining that the second DNS request comprises a read request associated with the first DNS record, based on authenticating one or more second authentication credentials in the second DNS request, and based on comparing a second quantity of DNS requests received during the second time period to the threshold associated with DNS attacks;

modifying the second DNS request to replace the one or more second authentication credentials in the second DNS request with the shared authentication credentials; and

routing, by the computing device, the modified second DNS request to a second DNS server;

receiving, via the API and during a third time period different from the first time period and the second time period, a third DNS request comprising either or both the one or more first authentication credentials or the one or more second authentication credentials; and

based on comparing a third quantity of DNS requests received during the third time period to the threshold associated with DNS attacks, preventing transmission of the third DNS request to the first DNS server or the second DNS server;

receiving, by the first DNS server, the modified first DNS request;

modifying, by the first DNS server and based on authenticating the shared authentication credentials, a DNS record based on the first DNS request;

transmitting, by the first DNS server, the modified DNS record to the second DNS server;

storing, by the second DNS server, the modified DNS record;

receiving, by the second DNS server, the modified second DNS request; and

providing, by the second DNS server, in response to the modified second DNS request, and, based on authenticating the shared authentication credentials, the modified DNS record.

9 . The method of claim 8 , wherein the shared credentials comprise a token indicating successful authentication of one or more third authentication credentials.

10 . The method of claim 8 , wherein the first DNS server maintains a first copy of DNS records, wherein the second DNS server maintains a second copy of the DNS records, and wherein the first DNS server is configured to transmit the modified DNS record to the second DNS server as part of an update to the second copy of the DNS records.

11 . The method of claim 8 , further comprising:

receiving, by the computing device and via the API, a fourth DNS request; and

based on determining that the fourth DNS request is associated with a user on a blocklist, causing display, on a user device, of a notification indicating that the fourth DNS request is denied.

12 . The method of claim 8 , wherein the preventing transmission of the third DNS request to the first DNS server or the second DNS server comprises:

causing display, on a user device, of a notification indicating that the third DNS request is denied.

13 . The method of claim 8 , wherein the second DNS request comprises authentication credentials, and wherein the computing device is configured to route the second DNS request to the second DNS server further based on validating the authentication credentials.

14 . The method of claim 8 , wherein the first DNS request comprises a request to create a Canonical Name (CNAME) record.

15 . One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors, cause a computing device to:

receive, via an Application Programming Interface (API) and during a first time period, a first DNS request;

based on determining that the first DNS request comprises a requested change to a first DNS record, based on authenticating one or more first authentication credentials in the first DNS request, and based on comparing a first quantity of DNS requests received during the first time period to a threshold associated with DNS attacks;

modify the first DNS request to replace the one or more first authentication credentials in the first DNS request with shared authentication credentials; and

route the modified first DNS request to a first DNS server;

receive, via the API and during a second time period different from the first time period, a second DNS request; and

based on determining that the second DNS request comprises a read request associated with the first DNS record, based on authenticating one or more second authentication credentials in the second DNS request, and based on comparing a second quantity of DNS requests received during the second time period to the threshold associated with DNS attacks;

modify the second DNS request to replace the one or more second authentication credentials in the second DNS request with the shared authentication credentials; and

route the modified second DNS request to a second DNS server;

receive, via the API and during a third time period different from the first time period and the second time period, a third DNS request comprising either or both the one or more first authentication credentials or the one or more second authentication credentials; and

based on comparing a third quantity of DNS requests received during the third time period to the threshold associated with DNS attacks, prevent transmission of the third DNS request to the first DNS server or the second DNS server;

wherein the instructions, when executed by the one or more processors, further cause the first DNS server to:

receive the modified first DNS request;

modify, based on authenticating the shared authentication credentials, a DNS record based on the first DNS request; and

transmit the modified DNS record to the second DNS server; and

wherein the instructions, when executed by the one or more processors, further cause the second DNS server to:

store the modified DNS record;

receive the modified second DNS request; and

provide, in response to the modified second DNS request and based on authenticating the shared authentication credentials, the modified DNS record.

16 . The non-transitory computer-readable media of claim 15 , wherein the shared credentials comprise a token indicating successful authentication of one or more third authentication credentials.

17 . The non-transitory computer-readable media of claim 15 , wherein the first DNS server maintains a first copy of DNS records, wherein the second DNS server maintains a second copy of the DNS records, and wherein the instructions, when executed by the one or more processors, further cause the first DNS server to transmit the modified DNS record to the second DNS server as part of an update to the second copy of the DNS records.

18 . The non-transitory computer-readable media of claim 15 , wherein the instructions, when executed by the one or more processors, further cause the computing device to:

receive, via the API, a fourth DNS request; and

based on determining that the fourth DNS request is associated with a user on a blocklist, cause display, on a user device, of a notification indicating that the fourth DNS request is denied.

19 . The non-transitory computer-readable media of claim 15 , wherein the instructions, when executed by the one or more processors, further cause the computing device to prevent transmission of the third DNS request to the first DNS server or the second DNS server by causing the computing device to:

cause display, on a user device, of a notification indicating that the third DNS request is denied.

20 . The non-transitory computer-readable media of claim 15 , wherein the second DNS request comprises authentication credentials, and wherein the instructions, when executed by the one or more processors, further cause the computing device to route the second DNS request to the second DNS server further based on validating the authentication credentials.

Assignments (1)

Continuity (1)

References Cited (140)