Patent ID: 11949651
Assignee: VMWARE LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 16:
17. A non-transitory machine readable medium storing a program that when executed by at least one processor of a host computer performs domain name service (DNS) operations on a host computer, the program comprising sets of instructions for:
creating a secure enclave on a DNS workload machine executing on the host computer;
creating a DNS table in the secure enclave in order to keep the DNS table isolated from processes operating outside of the enclave;
using the DNS table to perform DNS operations;
operating a security agent in the secure enclave, the security agent using the DNS table to ensure that the DNS operations of the DNS server are not using corrupted DNS records;
during a learning phase, a set of instructions for (i) having the security agent build a security agent (SA) DNS cache in the DNS table, said DNS cache storing DNS resolution mappings based on DNS resolution responses from the workload machine that the security agent intercepts, and (ii) having the security agent send the SA DNS cache to a policy manager that collects SA DNS caches from other host computers that implement other DNS workload machines, creates a whitelist DNS cache from all of the caches that the policy manager receives and distributes the whitelist DNS cache back to the security agent of the host computer for the security agent to use.