IP Library › Granted Patent US 10,361,920
Granted Patent B2
US 10,361,920 · App. 15/087,493 · Granted Jul 23, 2019

Domain name system based VPN management

Inventors: Tomas L. Byrnes (San Marcos, CA); Francis Turner (Carlsbad, CA)
Assignee: ThreatSTOP, Inc.
H04L41/12H04L61/1511H04L61/2592H04L63/0272H04L63/0428H04L63/08
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,361,920
App. No.
15/087,493
Filed
Mar 31, 2016
Granted
Jul 23, 2019
Kind
B2
Art Unit
2457
USPC
709/223
Abstract

VPN data for building and maintaining VPNs through a public network is gathered. The VPN data is maintained, at a DNS server, as part of a DNS table. A portion of the VPN data is provided as part of a DNS view of the DNS table to a client device. A VPN mode indicating a manner to establish a VPN node for the client device through the public network is determined using the portion of the VPN data. When the client device is coupled to the public network the VPN node is established and maintained according to the VPN mode using the portion of the VPN data.

Claims (50)

1. A method comprising:

determining, by observing network behavior of networking devices within a private network, characteristics of the private network corresponding to a virtual private network (VPN) node, the characteristics of the private network including a policy of the private network and identification of equipment to communicate with in establishing the VPN node, the characteristics of the private network being determined when a user device at which the VPN node is being established is at a local network location;

generating VPN data based on the characteristics of the private network, wherein the VPN data is gathered, by a domain name system (DNS) server, for building and maintaining the VPN node of the private network through a public network, the VPN data including at least one of the policy of the private network for establishing the VPN node and the identification of the equipment to communicate with in establishing the VPN node;

maintaining, by the DNS server, the VPN data, at the DNS server, as part of a DNS table;

providing a portion of the VPN data as part of a DNS view of the DNS table from the DNS server to a client device coupled to the public network;

determining, by the client device coupled to the public network, a VPN mode indicating a manner to establish the VPN node of the private network for the client device through the public network using the portion of the VPN data;

establishing, by the client device coupled to the public network, the VPN node of the private network according to the VPN mode using the portion of the VPN data;

maintaining, by the client device coupled to the public network, the VPN node of the private network according to the VPN mode using the portion of the VPN data.

2. The method of claim 1 , wherein the VPN mode specifies to establish and maintain the VPN node through encryption and encapsulation of data in VPN packets.

3. The method of claim 1 , wherein the VPN mode specifies to establish and maintain the VPN node using dedicated equipment within the public network.

4. The method of claim 1 , wherein the VPN mode specifies to establish and maintain the VPN node through a combination of encryption and encapsulation of data in VPN packets and use of dedicated equipment within the public network.

5. The method of claim 1 , further comprising:

determining characteristics of the private network corresponding to the VPN node, wherein the characteristics of the private network include the policy of the private network and the identification of the equipment to communicate with in establishing the VPN node;

generating the VPN data based on the characteristics of the private network.

6. The method of claim 1 , further comprising:

providing a unique cipher from the client device to the DNS server;

determining the portion of the VPN data to provide as part of the DNS view based on the unique cipher.

7. The method of claim 6 , wherein the cipher is unique to a user of the client device.

8. The method of claim 1 , wherein the VPN data is gathered automatically by crawling lists of data related to network operation of network devices of the private network.

9. The method of claim 1 , wherein the VPN data is associated with a domain name, for use in providing the portion of the VPN data as part of the DNS view of the DNS table to the client device in response to a DNS query.

10. A system comprising:

a domain name system (DNS) server for processing, the DNS server including memory and one or more processors, configured to:

determine, by observing network behavior of networking devices within a private network, characteristics of the private network corresponding to a virtual private network (VPN) node, the characteristics of the private network including a policy of the private network and identification of equipment to communicate with in establishing the VPN node, the characteristics of the private network being determined when a user device at which the VPN node is being established is at a local network location;

generate VPN data based on the characteristics of the private network, wherein the VPN data is gathered for building and maintaining the VPN node of the private network through a public network, the VPN data including at least one of the policy of the private network for establishing the VPN node and the identification of the equipment to communicate with in establishing the VPN node;

maintain the VPN data, at the DNS server, as part of a DNS table;

provide a portion of the VPN data as part of a DNS view of the DNS table to a client device;

a VPN mode determination engine at the client device coupled to the public network, the VPN mode determination engine being configured to determine a VPN mode indicating a manner to establish the VPN node of the private network for the client device through the public network using the portion of the VPN data;

a data routing engine at the client device coupled to the public network, the data routing engine being configured to:

establish the VPN node of the private network according to the VPN mode using the portion of the VPN data;

maintain the VPN node of the private network according to the VPN mode using the portion of the VPN data when the client device is coupled to the public network.

11. The system of claim 10 , wherein the VPN mode specifies to establish and maintain the VPN node through encryption and encapsulation of data in VPN packets.

12. The system of claim 10 , wherein the VPN mode specifies to establish and maintain the VPN node using dedicated equipment within the public network.

13. The system of claim 10 , wherein the VPN mode specifies to establish and maintain the VPN node through a combination of encryption and encapsulation of data in VPN packets and use of dedicated equipment within the public network.

14. The system of claim 10 , wherein the DNS server is further configured to:

determine characteristics of the private network corresponding to the VPN node, wherein the characteristics of the private network include the policy of the private network and the identification of the equipment to communicate with in establishing the VPN node;

generate the VPN data based on the characteristics of the private network.

15. The system of claim 10 , wherein the DNS server is further configured to:

determine, by observing network behavior of networking devices within the private network, characteristics of the private network corresponding to the VPN node, wherein the characteristics of the private network include the policy of the private network and the identification of the equipment to communicate with in establishing the VPN node;

generate the VPN data based on the characteristics of the private network.

16. The system of claim 10 , further comprising a VPN data determination engine provided at the client device and configured to provide a unique cipher to the DNS server from the client device, wherein the DNS server is further configured to determine the portion of the VPN data to provide as part of the DNS view based on the unique cipher.

17. The system of claim 10 , wherein the DNS server is further configured to gather the VPN data automatically by crawling lists of data related to network operation of network devices of the private network.

18. The system of claim 10 , wherein the VPN data is associated with a domain name, for use in providing the portion of the VPN data as part of the DNS view of the DNS table to the client device in response to a DNS query.

19. A computer program product comprising instructions which, when the program is executed by a computer, cause the computer to carry out a method comprising:

determining, by observing network behavior of networking devices within a private network, characteristics of the private network corresponding to a virtual private network (VPN) node, the characteristics of the private network including a policy of the private network and identification of equipment to communicate with in establishing the VPN node, the characteristics of the private network being determined when a user device at which the VPN node is being established is at a local network location;

generating VPN data based on the characteristics of the private network, wherein the VPN data is gathered, by a domain name system (DNS) server, for building and maintaining the VPN node of the private network through a public network, the VPN data including at least one of the policy of the private network for establishing the VPN node and the identification of the equipment to communicate with in establishing the VPN node;

maintaining, by the DNS server, the VPN data, at the DNS server, as part of a DNS table;

providing a portion of the VPN data as part of a DNS view of the DNS table from the DNS server to a client device coupled to the public network;

determining, by the client device coupled to the public network, a VPN mode indicating a manner to establish the VPN node of the private network for the client device through the public network using the portion of the VPN data;

establishing, by the client device coupled to the public network, the VPN node of the private network according to the VPN mode using the portion of the VPN data;

maintaining, by the client device coupled to the public network, the VPN node of the private network according to the VPN mode using the portion of the VPN data.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded May 17, 2016
From: BYRNES, TOMAS L.; TURNER, FRANCIS
To: THREATSTOP, INC.
Reel/Frame 038617/0988 →
Continuity (2)
Provisional Application 62141778 · Apr 1, 2015
Related Publication 20160294631A1 · Oct 6, 2016
Cited By (1)
US 12,712,912