Granted Patent B2

US 12,401,644 · App. 18/453,952 · Granted Aug 26, 2025

Inventor: Vincent E. Parla (North Hampton, NH)

Assignee: Cisco Technology, Inc.

H04L63/0876H04L61/4511H04L63/18

Abstract

Claims (93)

1. A method comprising:

detecting, by a processor of a first computing device, that a second computing device is operating in a per-flow authorization mode;

receiving, from the second computing device, a first request to communicate using a first network flow between the second computing device and a third computing device;

determining that the first network flow is authorized, wherein determining that the first network flow is authorized comprises determining at least one of: (i) that the first network flow is associated with a past authentication that is active, or (ii) that the third computing device is exempt from an authentication requirement;

based on determining that the first network flow is authorized, transmitting first data associated with the first request to the third computing device;

receiving, from the second computing device, a second request to communicate using a second network flow between the second computing device and a fourth computing device;

determining that the second network flow is unauthorized based on determining that the second network flow is independent of any active authentications and that the fourth computing device is subject to the authentication requirement; and

based on determining that the first network flow is unauthorized, blocking transmission of second data associated with the second request to the fourth computing device.

2. The method of claim 1 , wherein:

determining that the second network flow is independent of any active authentications comprises determining that the second request comprises a first domain name system (DNS) query, wherein the first DNS query comprises a hostname that is associated with the fourth computing device, and

blocking transmission of the second data comprises transmitting a first DNS response to the first computing device, wherein the first DNS response comprises a canonical name (CNAME) record associated with a first inauthentic hostname that is independent of the fourth computing device.

3. The method of claim 2 , further comprising:

receiving, from the second computing device, a second DNS query, wherein the second DNS query comprises the first inauthentic hostname;

determining that the second network flow is still unauthorized; and

based on determining that the second network flow is still unauthorized, transmitting a second DNS response to the second computing device, wherein the second DNS response comprises a second CNAME record associated with a second inauthentic hostname that is independent of the fourth computing device.

4. The method of claim 3 , further comprising:

receiving, from the second computing device, a third DNS query, wherein the third DNS query comprises the second inauthentic hostname;

determining that the second network flow is still unauthorized and that a threshold time has passed since a time associated with the first DNS query; and

based on determining that the second network flow is still unauthorized and that the threshold time has passed since the time associated with the first DNS query, redirecting the first computing device to a block page.

5. The method of claim 2 , further comprising:

receiving, from the second computing device, a second DNS query, wherein the second DNS query comprises the first inauthentic hostname;

determining that the second network flow is authorized; and

based on determining that the second network flow is authorized, determining that the second network flow is authorized, initiating resolution of the first DNS query.

6. The method of claim 1 , wherein:

determining that the second network flow is independent of any active authentications comprises determining that the second request comprises a Transmission Control Protocol (TCP) handshake request with the fourth computing device; and

blocking transmission of the second data comprises:

transmitting a handshake acknowledgement response to the first computing device, wherein the handshake acknowledgement response establishes a two-party TCP connection between the first computing device and the second computing device, and

preventing establishment of a three-party TCP connection between the first computing device, the second computing device, and the fourth computing device.

7. The method of claim 6 , wherein:

receiving, from the second computing device, third data associated with the second network flow;

determining that the second network flow is still unauthorized; and

based on determining that the second network flow is still unauthorized, preventing transmission of the third data to the fourth computing device.

8. The method of claim 7 , further comprising:

receiving, from the second computing device, fourth data associated with the second network flow;

determining that the second network flow is still unauthorized and that a threshold time has passed since a time associated with the TCP handshake request; and

based on determining that the second network flow is still unauthorized and that the threshold time has passed since the time associated with the TCP handshake request, redirecting the first computing device to a block page.

9. The method of claim 6 , further comprising:

receiving, from the second computing device, third data associated with the second network flow;

determining that the second network flow is authorized; and

based on determining that the second network flow is authorized:

establishing the three-party TCP connection, and

transmitting the third data to the fourth computing device using the three-party TCP connection.

10. The method of claim 1 , wherein:

the second request comprises a user datagram protocol (UDP) packet; and

blocking transmission of the second data comprises preventing transmission of the second data to the fourth computing device.

11. A system comprising:

one or more processors; and

one or more computer-readable media storing computer-executable instructions that, when executed by a processor of a first computing device, cause the processor to perform operations comprising:

detecting that a second computing device is operating in a per-flow authorization mode;

receiving, from the second computing device, a first request to communicate using a first network flow between the second computing device and a third computing device;

determining that the first network flow is authorized, wherein determining that the first network flow is authorized comprises determining at least one of: (i) that the first network flow is associated with a past authentication that is active, or (ii) that the third computing device is exempt from an authentication requirement;

based on determining that the first network flow is authorized, transmitting first data associated with the first request to the third computing device;

receiving, from the second computing device, a second request to communicate using a second network flow between the second computing device and a fourth computing device;

determining that the second network flow is unauthorized based on determining that the second network flow is independent of any active authentications and that the fourth computing device is subject to the authentication requirement; and

based on determining that the first network flow is unauthorized, blocking transmission of second data associated with the second request to the fourth computing device.

12. The system of claim 11 , wherein:

determining that the second network flow is independent of any active authentications comprises determining that the second request comprises a first domain name system (DNS) query, wherein the first DNS query comprises a hostname that is associated with the fourth computing device, and

blocking transmission of the second data comprises transmitting a first DNS response to the first computing device, wherein the first DNS response comprises a canonical name (CNAME) record associated with a first inauthentic hostname that is independent of the fourth computing device.

13. The system of claim 12 , the operations further comprising:

receiving, from the second computing device, a second DNS query, wherein the second DNS query comprises the first inauthentic hostname;

determining that the second network flow is still unauthorized; and

based on determining that the second network flow is still unauthorized, transmitting a second DNS response to the second computing device, wherein the second DNS response comprises a second CNAME record associated with a second inauthentic hostname that is independent of the fourth computing device.

14. The system of claim 13 , the operations further comprising:

receiving, from the second computing device, a third DNS query, wherein the third DNS query comprises the second inauthentic hostname;

determining that the second network flow is still unauthorized and that a threshold time has passed since a time associated with the first DNS query; and

based on determining that the second network flow is still unauthorized and that the threshold time has passed since the time associated with the first DNS query, redirecting the first computing device to a block page.

15. The system of claim 12 , the operations further comprising:

receiving, from the second computing device, a second DNS query, wherein the second DNS query comprises the first inauthentic hostname;

determining that the second network flow is authorized; and

based on determining that the second network flow is authorized, determining that the second network flow is authorized, initiating resolution of the first DNS query.

16. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by a processor of a first computing device, cause the processor to perform operations, comprising:

detecting that a second computing device is operating in a per-flow authorization mode;

receiving, from the second computing device, a first request to communicate using a first network flow between the second computing device and a third computing device;

determining that the first network flow is authorized, wherein determining that the first network flow is authorized comprises determining at least one of: (i) that the first network flow is associated with a past authentication that is active, or (ii) that the third computing device is exempt from an authentication requirement;

based on determining that the first network flow is authorized, transmitting first data associated with the first request to the third computing device;

receiving, from the second computing device, a second request to communicate using a second network flow between the second computing device and a fourth computing device;

determining that the second network flow is unauthorized based on determining that the second network flow is independent of any active authentications and that the fourth computing device is subject to the authentication requirement; and

based on determining that the first network flow is unauthorized, blocking transmission of second data associated with the second request to the fourth computing device.

17. The one or more non-transitory computer-readable media of claim 16 , wherein:

determining that the second network flow is independent of any active authentications comprises determining that the second request comprises a first domain name system (DNS) query, wherein the first DNS query comprises a hostname that is associated with the fourth computing device, and

blocking transmission of the second data comprises transmitting a first DNS response to the first computing device, wherein the first DNS response comprises a canonical name (CNAME) record associated with a first inauthentic hostname that is independent of the fourth computing device.

18. The one or more non-transitory computer-readable media of claim 17 , the operations further comprising:

receiving, from the second computing device, a second DNS query, wherein the second DNS query comprises the first inauthentic hostname;

determining that the second network flow is still unauthorized; and

based on determining that the second network flow is still unauthorized, transmitting a second DNS response to the second computing device, wherein the second DNS response comprises a second CNAME record associated with a second inauthentic hostname that is independent of the fourth computing device.

19. The one or more non-transitory computer-readable media of claim 18 , the operations further comprising:

receiving, from the second computing device, a third DNS query, wherein the third DNS query comprises the second inauthentic hostname;

determining that the second network flow is still unauthorized and that a threshold time has passed since a time associated with the first DNS query; and

based on determining that the second network flow is still unauthorized and that the threshold time has passed since the time associated with the first DNS query, redirecting the first computing device to a block page.

20. The one or more non-transitory computer-readable media of claim 17 , the operations further comprising:

receiving, from the second computing device, a second DNS query, wherein the second DNS query comprises the first inauthentic hostname;

determining that the second network flow is authorized; and

based on determining that the second network flow is authorized, determining that the second network flow is authorized, initiating resolution of the first DNS query.

Assignments (1)

Continuity (1)

References Cited (57)