Patent ID: 12200136

DETAILED DESCRIPTION

FIG.1shows example domain name system (DNS) query methods100,109,119. The method100may comprise a DNS query method. The method100may comprise a method of sending DNS queries via cleartext. The method100may comprise a method of sending DNS queries without one or more layers of encryption, such as DNS-over-TLS (DoT) and/or DNS-over-HTTPS (DoH).

The method100may be performed by a system and/or computing device comprising an application101. The application101may be configured to run on a client device, such as a user device, a set-top box, cable modem, gateway, smart television, smart phone, laptop, desktop, tablet, wearable device, and/or other computing device. The application101may comprise a browser. The application101may be configured to generate a DNS query. The DNS query may comprise an indication of a domain name, such as a domain name associated with a website. The application101may be configured to send the DNS query. The application101may be configured to send the DNS query via cleartext.

The DNS query from the application101may be received by a stub resolver102. The stub resolver102may comprise an operating system of the client device. The stub resolver102may determine whether a result of the DNS query was returned previously and is stored in a local cache on the client device. If the result is already present in the cache, then the stub resolver102may return the result to the client device from the cache and does not need to send the DNS query to a DNS server. If the DNS information is not in the cache, then the stub resolver may send the DNS query on to a forwarder104. The stub resolver102may be configured to send the DNS query via cleartext.

The DNS query from the stub resolver may be received by a forwarder104. The forwarder104may comprise a premises firewall, such as a home firewall or an enterprise firewall. The forwarder104may comprise a router, such as at the premises.

The forwarder104may be configured to determine whether the requested domain name is appropriate for settings associated with the application101. Based on the forwarder104determining that the requested domain name is inappropriate, the forwarder104may be configured to not send the DNS request. Based on the forwarder104determining that the requested domain name is appropriate, the forwarder104may be configured to send the DNS request. The forwarder104may be configured to send the DNS request via cleartext.

The DNS request from the forwarder104may be received by a recursive resolver106. The recursive resolver106may comprise a DNS recursor associated with an Internet service provider (ISP) or cloud-computing environment. The recursive resolver106may comprise a DNS server.

The recursive resolver106may be configured to determine DNS information. For example, the recursive resolver106may be configured to determine an internet protocol (IP) address associated with a requested domain. The recursive resolver106may be configured to send the DNS query to the IP address associated with the requested domain. The recursive resolver106may be configured to send the DNS query to the determined IP address via cleartext.

The IP address may be associated with an authoritative server108. The authoritative server108may receive the DNS query from the recursive resolver106. The authoritative server108may be configured to determine a reply to the DNS query. The authoritative server108may be configured to send the reply to the recursive resolver106.

The recursive resolver106may be configured to send the reply from the authoritative server108to the forwarder104, the stub resolver102, and/or the

application101. The forwarder104may be configured to send the reply to the stub resolver102and/or the application101. The stub resolver102may be configured to send the reply to the application101. The application101may be configured to output an indication of the reply, such as to a user via a display of the client device.

A drawback of the DNS query method100is that the sending of the DNS query in cleartext may make the DNS query vulnerable such as to interceptors. Sending the DNS query in cleartext also exposes data associated with the client device in the DNS query to the authoritative server108. The authoritative server108may be associated with a third-party, such as a party that is not the user, the ISP, and/or the cloud computing environment. The third-party may exploit the data, such as by selling the data, saving the data to learn more about the user, and/or by targeting the user with advertisements.

The method109may comprise a method of sending DNS queries with one more layers of encryption, such as DoT. The method109may be performed by a system and/or computing device comprising a DoT application110. The DoT application110may be configured to run on a client device, such as a set-top box, cable modem, gateway, smart television, smart phone, laptop, desktop, tablet, wearable device, and/or other computing device. The DoT application110may comprise a browser. The DoT application110may be configured to generate a DNS query. The DNS query may comprise an indication of a domain name, such as a domain name associated with a website. The DoT application110may be configured to send the DNS query. The DoT application110may be configured to send the DNS query via cleartext.

The DNS query from the DoT application110may be received by a DoT stub resolver112. The DoT stub resolver112may comprise a part of? an operating system of the client device. The DoT stub resolver112may determine whether a result of the DNS query was returned previously and is stored in a local cache on the client device. If the result is already present in the cache, then the DoT stub resolver112simply returns the result to the client device from the cache and does not need to send the DNS query to a DNS server. If the DNS information is not in the cache, then the DoT stub resolver may send the DNS query. The DoT stub resolver112may be configured to send the DNS query via TLS.

The DNS query from the DoT stub resolver may be received by a DoT forwarder114. The DoT forwarder114may comprise a premises firewall, such as a home firewall or an enterprise firewall. The DoT forwarder114may comprise a router, such as at the premises.

The DoT forwarder114may be configured to determine whether the requested domain name is appropriate for settings associated with the DoT application110. Based on the DoT forwarder114determining that the requested domain name is inappropriate, the DoT forwarder114may be configured to not send the DNS request. Based on the DoT forwarder114determining that the requested domain name is appropriate, the DoT forwarder114may be configured to send the DNS request. The DoT forwarder114may be configured to send the DNS request via TLS.

The DNS request from the DoT forwarder114may be received by a DoT recursive resolver116. The DoT recursive resolver116may comprise a DNS recursor associated with an Internet service provider (ISP) or cloud-computing environment. The DoT recursive resolver116may comprise a DNS server.

The DoT recursive resolver116may be configured to determine DNS information. For example, the DoT recursive resolver116may be configured to determine an IP address associated with a requested domain. The DoT recursive resolver106may be configured to send the DNS query to the IP address associated with the requested domain. The DoT recursive resolver116may be configured to send the DNS query to the determined IP address via cleartext.

The IP address may be associated with a DoT authoritative server118. The DoT authoritative may be associated with a website. The DoT authoritative server118may receive the DNS query from the DoT recursive resolver116. The DoT authoritative server118may be configured to determine a reply to the DNS query. The DoT authoritative server118may be configured to send the reply to the DoT recursive resolver116.

The DoT recursive resolver116may be configured to send the reply from the DoT authoritative server118to the DoT forwarder114, the DoT stub resolver112, and/or the DoT application110. The DoT forwarder114may be configured to send the reply to the DoT stub resolver112and/or the DoT application110. The DoT stub resolver112may be configured to send the reply to the DoT application110. The DoT application110may be configured to output an indication of the reply, such as to a user via a display of the client device.

A drawback of the DoT DNS query method109is that the sending of the DNS query between one or more of the DoT stub resolver102, the DoT forwarder, and/or the DOT recursive resolver server may incur a computational load. The computational load may cause latency in the process of sending the DNS query and receiving a reply to the DNS query.

The DoH method of DNS query processing is shown at119. The method119may comprise a method of sending DNS queries with one more layers of encryption, such as DoH. The method119may be performed by a system and/or computing device comprising a DoH application120. The DoH application120may be configured to run on a client device, such as a set-top box, cable modem, gateway, smart television, smart phone, laptop, desktop, tablet, wearable device, and/or other computing device. The DoH application120may comprise a browser. The DoH application120may be configured to generate a DNS query. The DNS query may comprise an indication of a domain name, such as a domain name associated with a website. The DoH application120may be configured to send the DNS query. The DoH application120may be configured to send the DNS query using HTTPS.

The DNS query from the DoH application120may be sent to a DoH recursive resolver. The DNS query may not be sent to a DoH stub resolver and/or a DoH forwarder. Instead, the DNS query may be sent directly to the DoH recursive resolver. This may be the result of the DoH application being configured to send DNS queries directly to the DoH recursive resolver associated with the DoH application or a company associated with the DoH application, such as a browser host, like Google or Firefox.

Recently, web browsers such as Chrome and Firefox have pursued an implementation of DoH that sends all DNS queries to a central platform, bypassing an ISP's DNS. According to such an implementation, the DoH recursive resolver126may comprise a DNS recursor associated with an Internet service provider (ISP) or cloud-computing environment. The DoH recursive resolver126may comprise a DNS server. The DoH recursive resolver126may be configured to determine DNS information. For example, the DoH recursive resolver126may be configured to determine an IP address associated with a requested domain. The DoH recursive resolver126may be configured to send the DNS query to the IP address associated with the requested domain. The DoH recursive resolver126may be configured to send the DNS query to the determined IP address via cleartext.

The IP address may be associated with a DoH authoritative server128. The DoH authoritative may be associated with a website. The DoH authoritative server128may receive the DNS query from the DoH recursive resolver126. The DoH authoritative server128may be configured to determine a reply to the DNS query. The DoH authoritative server128may be configured to send the reply to the DoH recursive resolver126.

The DoH recursive resolver126may be configured to send the reply from the DoH authoritative server128to the DoH forwarder, the DoH stub resolver, and/or the DoH application120. The DoH recursive resolver126may be configured to send the reply using HTTPS.

A drawback of the DoH DNS query method119is that the sending of the DNS query from the DoH application120directly to the DoH recursive resolver126may prevent, impair, or impose costs on ISP's and/or service providers from providing customer features and/or business functions that depend on ISP DNS. For example, the DoH DNS query method119may not allow ISP's to provide breakage or impairment of provisioning walled garden, CDN localization, parental controls, malware detection and/or prevent, and troubleshooting, as examples.

FIG.2shows an example networking environment200. The networking environment200may be associated with a service provider. The networking environment200may comprise a service provider DNS server204. The DNS server204may comprise one or more of the recursive resolver servers106,116,126inFIG.1. The DNS server204may be configured to receive DNS queries, such as from one or more client devices. The DNS server204may be configured to initiate a secure communication session with the client devices, such as a communication session via TLS and/or HTTPs.

The networking environment200may comprise a home network201. The home network201may be associated with a premises. For example, the home network201may comprise a local area network at a house or a business. The home network201may comprise one or more client devices. The home network201may comprise a gateway202. The gateway202may be configured to communicate with other devices in the home network201and/or located at the premises, such as the client devices. The gateway202and/or the client devices may be configured to communicate with the DNS server204. The gateway202and/or the client devices may comprise, host, or otherwise implement the applications101,110,120and/or the stub resolvers102,112inFIG.1. The gateway202may be configured to send and/or receive messages. The gateway202may be configured to send and/or receive unencrypted messages, such as messages in cleartext. The gateway202may be configured to send and/or receive encrypted messages, such as messages sent via TLS and/or HTTPS. The messages may comprise query requests and/or replies to query requests.

The networking environment200may comprise a service provider network210. The service provider network210may comprise one or more computing devices associated with and/or controlled by the service provider. The service provider network210may comprise an ISP network and/or a cloud computing network. The service provider network210may be configured to communicate with the home network201. The service provider network210may be configured to communicate with the DNS server204. The service provider network210may comprise one or more of the forwarders104,114inFIG.1. The service provider network210may comprise features for users, such as malware detection212, service provider settings214(such as parental controls, etc.), service provider security216, walled garden self-provisioning218, and/or on-net content220. One or more devices of the service provider network210gateway202may be configured to send and/or receive messages from the gateway device202. One or more devices of the service provider network210gateway202may be configured to send and/or receive messages from the service provider network210. The messages may be unencrypted, such as cleartext. Unencrypted messages sent and/or received from the service provider network210may be vulnerable to interception, such as by a third party.

The networking environment200may comprise one or more directly-connected content delivery networks (CDNs)222. The directly-connected CDNs222may comprise one or more servers, such as web servers and/or servers configured to provide content. The directly-connected CDNs222may comprise one or more of the authoritative servers108,118,128inFIG.1. The directly-connected CDNs222may be configured to access Internet230.

The networking environment200may comprise an off-net content source232. The directly-connected CDNs222may be configured to communicate with the off-net content source232, such as via the Internet230. The off-net content source232may comprise a content provider. The off-net content source232may comprise a content provider other than an internet service provider. The off-net content source232may provide content created and/or aggregated by the off-net content source232, such as movies, TV shows, music, image, and more.

The networking environment200may comprise a service provider DNS server204. The service provider DNS server204may be located external to the premises associated with the home network201. The service provider DNS server204may comprise, for example, one or more of the recursive resolvers106,116,126inFIG.1. The DNS server204may be configured to send and/or receive encrypted messages from a device of the home network201, such as the gateway device202. Unencrypted messages sent via the networking environment300may be vulnerable, such as to third-party interceptors. Yet, message encryption and/or decryption in the networking environment may cause performance to suffer, such as by causing latency.

FIG.3shows an example networking environment300. The networking environment300may comprise the networking environment shown inFIG.2. The networking environment300may be associated with a service provider.

The networking environment300may comprise a central platform DNS server304. The central platform server304may comprise one or more of the recursive resolver servers106,116,126inFIG.1. The central platform DNS server304may be configured to receive DNS queries, such as from one or more client devices. The central platform DNS server304may be configured to initiate a secure communication session with the client devices, such as a communication session via TLS and/or HTTPs.

The networking environment300may comprise a home network301. The home network301may be associated with a premises. For example, the home network201may comprise a local area network at a house or a business. The home network301may comprise one or more client devices. The home network201may comprise a gateway302. The gateway302may be configured to communicate with other devices in the home network201and/or located at the premises. The gateway302and/or the client devices may be configured to communicate with the DNS server304. The gateway302and/or the client devices may comprise the applications101,110,120and/or the stub resolvers102,112inFIG.1.

The networking environment300may comprise a service provider network310. The service provider network310may comprise one or more computing devices associated with and/or controlled by the service provider. The service provider network310may comprise an ISP network and/or a cloud computing network. The service provider network310may be configured to communicate with the home network301. The service provider network310may be configured to communicate with the DNS server304. The service provider network310may comprise one or more of the forwarders104,114inFIG.1. The service provider network310may comprise features for users such as malware detection212, service provider settings314(such as parental controls, etc.), service provider security316, walled garden self-provisioning318, and/or on-net content320. One or more devices of the service provider network310may be configured to send and/or receive messages from the gateway device302. One or more devices of the service provider network310may be configured to send and/or receive messages from the gateway device302. The messages may be unencrypted, such as cleartext. The messages may be encrypted, such as via TLS and/or HTTPS.

The gateway302may be configured to send and/or receive messages. The message may comprise query requests. The messages may comprise replies to query requests. The messages may be encrypted or unencrypted. The gateway device302may be configured to send and/or receive messages via the Internet330. The gateway device302may be configured to receive messages, such as encrypted messages, from the central platform DNS server304via the Internet330. The gateway device302may be configured to receive messages from the central platform DNS server304instead of from the service provider network310, as inFIG.2. Receiving the messages from the central platform DNS server304instead of to the service provider network310may bypass features of the service provider network310. Bypassing of the features may compromise user protection.

FIG.4shows an example method400. The method400may be performed by a computing device, such as a computing device associated with a service provider network, such as the service provider networks210,310shown inFIGS.2and3. The method400may be performed by one or more of the DoT Recursive Resolver116or the DoH Recursive Resolver126inFIG.1. The method400may be performed by an encryption module of a device associated with a service provider network. At least a portion of the method400may be performed by an encryption module of a DNS server, such as a DNS server (e.g., DNS server host800inFIG.8). The method400may be performed by an encryption module comprising a smart network interface card (SmartNIC) (e.g., SmartNIC512inFIG.5). The SmartNIC and the service provider DNS server may be integrated. The service provider DNS server may comprise the SmartNIC. The SmartNIC and the service provider DNS server may be independent components, such as components connected via a communication bus.

At step410, an encrypted message may be received. The encrypted message may be received from a client device. The encrypted message may comprise a DNS request. The DNS request may comprise a domain name, such as a fully-qualified domain name. The DNS request may comprise at least one of a DoH or a DoT request.

At step420, a communication session may be established with the client device. The communication session may be established based on receiving the encrypted message in step410. The communication session may comprise a secure communication session, such as a Transport Layer Secure (TLS) session and/or a Hypertext Transfer Protocol Secure (HTTPS) session. The session may comprise a TLS session or an HTTP session based on whether the request comprises a DoT request or a DoH request.

At step430, the DNS request may be analyzed, processed or otherwise determined. The DNS request may be determined by decrypting the encrypted message and retrieving the DNS payload. The DNS request may be determined using a key, such as a private key associated with the device that received the DNS request. The DNS request may identify an IP address associated with the client device. The DNS request may identify a port associated with the client device. The port may comprise a series of numbers and/or integer. The port may comprise an unsigned series of numbers and/or integer. The port may be associated with a communication protocol, such as TLS and/or HTTPS. The port may be associated with the communication protocol associated with the secure communication session.

At step440, a security token, such as a cookie, may be determined. The security token may be determined, for example, by applying a hash function to the IP address and/or the port associated with the client device. The hash function may comprise a one-way hash function.

At step450, a message may be sent to a DNS server. The DNS server may comprise or function similarly to one or more of the recursive resolvers106,116,126inFIG.1, the service provider DNS server204inFIG.2, and/or the central platform DNS server304inFIG.3. The message may comprise an indication of the DNS request. The indication of the DNS request may comprise the DNS request extracted from the encrypted channel. The message may comprise the security token. Sending the message to the DNS server may comprise causing the message to be sent from the encryption module to another component of the DNS server.

At step460, a reply may be received from the DNS server. The reply may comprise the security token. The reply may comprise a payload. The payload may comprise a response to the DNS request, such as website data (e.g., an IP address, Mail Exchange Record (MX Record), Delegated Signer identity (DS record), etc.), metadata, image data, text data, audio data, and/or other content.

At step470, an indication of the payload of the reply (e.g., an indication of the DNS response to the DNS request) may be sent to the client device. The indication of the payload may be sent via the communication session. The indication of the payload may be sent to the client device based on the security token. For example, it may be determined that the security token in the reply is associated with the client and/or the communication session with the client. An indication of the security token may be stored in a lookup table and/or mapped to an identification of the communication session and/or the client device. A lookup may be performed using the security token and the table. Based on the lookup, the communication session and/or the client device may be determined. Based on the security token in the reply being associated with the communication session and/or the client, the indication of the payload may be sent to the client.

FIG.5shows an example system500. The system500may comprise a Regional Network, a Metro Network, or a Converged Regional Area Network (CRAN) DNS site510. The CRAN DNS site510may comprise a SmartNIC512. The SmartNIC512may comprise the encryption module described in reference toFIG.4. The CRAN DNS site510may comprise a service provider DNS server514. The SmartNIC512and the service provider DNS server514may be integrated. The service provider DNS server514may comprise the SmartNIC512. The SmartNIC512and the service provider DNS server514may be independent components, such as components connected via a communication bus. The DNS server514may comprise one or more of the recursive resolvers106,116,126inFIG.1, the service provider DNS server204inFIG.2, and/or the central platform DNS server304inFIG.3.

The system500may comprise customer-premises equipment (CPE)502. The CPE502may comprise one or more set-top boxes, cable modems, gateways, smart televisions, smart phones, laptops, desktops, tablets, wearable devices, and/or other computing devices. The CPE502may be configured to send and/or receive messages. The messages may comprise cleartext messages. The CPE502may comprise one or more of the applications101,110,120inFIG.1, the sub resolvers102,112inFIG.1, the home network201or the gateway202inFIG.2, or the home network301or the gateway302inFIG.3.

The system500may comprise a cable modem termination system (CMTS)504. The CMTS502may comprise one or more of the stub resolvers102,112or the forwarders104,114inFIG.1. The CPE502may be configured to send and/or receive messages from the CMTS503. The CMTS504may be configured to send and/or receive messages, such as cleartext messages. The CMTS504may be configured to send and/or receive messages via the Internet506.

The CPE502may be configured to send protected messages508. The CPE502may be configured to send the protected messages508to the CRAN DNS site510. The protected messages508may comprise DoT messages. The protected messages508may be encrypted, such as using TLS and/or HTTPS. The protected messages508may comprise TLS authentication.

The SmartNIC512may be configured to provide co-located TLS offload and/or protocol translation. The co-located TLS offload and protocol translation may enable and/or accelerate DoH and/or DoT processing associated with the service provider DNS server514. The service provider DNS server514may comprise an existing DNS server. Adding the SmartNIC512to the service provider DNS server514may add DoH and/or DoT support and/or capacity to the service provider DNS server514. The service provider DNS server514may comprise and/or be in communication with multiple SmartNICs512, allowing for scaling of DoH and/or DoT capacity independent of the service provider DNS server514. The CRAN DNS site510configuration may be configured to support extension mechanisms for DNS (EDNSO) client-subnet implementations by eliminating the need for source network address translation (NAT) proxies. The CRAN DNS site510configuration may provide a DNS caching location to further scale DNS performance.

FIG.6shows an example method600. The method may be performed by a system similar to the system inFIG.5. At step620, a client601may send a first message. The client601may comprise a client device. The first message may be sent via an Internet Protocol (IP), such as Internet Protocol version 4 (IPv4). The client601may send the first message to a DNS global server load balancing (GSLB) component602. The DNS GSLB component602component may comprise a computing device. The DNS GSLB component602may comprise a unit and/or component of a computing device. The first message may comprise a domain name, such as an initial resolution of a fully qualified domain name (FQDN) DoH. The first message may comprise cleartext.

At step622, the DNS GSLB component602may send a second message. The DNS GSLB component602may send the second message to the client601. The second message may comprise a map to a DoH service endpoint. The second message may be unencrypted, for example the second message may comprise cleartext.

At step624, the client601may send a third message. The client601may send the third message to DoH proxy functional components610. The DoH proxy functional components610may comprise components of a SmartNIC, such as the SmartNIC512inFIG.5. The DoH proxy functional components610may comprise a DoH TLS offload component612. The DoH TLS offload component612may comprise a TCP and/or TLS state. The DoH HTTP services component614may comprise a TCP and/or HTTP state. The client601may send the third message to the DoH TLS offload component612. The third message may comprise a handshake request, such as a DoH TLS handshake request. The third message may comprise TLS authentication information.

At step626, the DoH TLS offload component612may send a fourth message. The DoH TLS offload component612may send the fourth message to the client601. The fourth message may comprise a handshake acknowledgment, such as a DoH TLS handshake acknowledgment. The fourth message may comprise encrypted information. The fourth message may comprise TLS authentication information.

At step628, the client601may send a fifth message. The client601may send the fifth message to the DoH TLS offload component612. The fifth message may comprise a DoH HTTP and/or HTTPS (HTTP(S)) GET or POST request. The fifth message may comprise encrypted information. The fifth message may comprise TLS authentication information.

At step630, the DoH TLS offload component612may send a sixth message. The DoH TLS offload component612may send the sixth message to the DoH proxy function components610. The DoH proxy function components610may comprise a DoH HTTP services component614. The DoH TLS offload component612may send the sixth message to the DoH HTTP services component614. The sixth message may comprise a DoH HTTP GET or POST request. The sixth message may comprise cleartext. The DoH HTTP services component614may validate the request.

At step632, the DoH HTTP services component614may send a seventh message. The DoH HTTP services component may send the seventh message to the DoH TLS offload component612. The seventh message may comprise a DoH HTTP GET or POST acknowledgment. The seventh message may comprise cleartext.

At step634, the DoH TLS offload component612may send an eighth message. The DoH TLS offload component612may send the eighth message to the client601. The eighth message may comprise a DoH HTTP(S) GET or POST acknowledgment. The eighth message may comprise encrypted information. The eighth message may comprise TLS authentication information.

At step636, the DoH HTTP services component614may send a ninth message. The DoH HTTP services component614may send the ninth message to the DoH proxy function components610. The DoH proxy function components610may comprise an HTTP to DNS protocol translation component616. The HTTP to DNS protocol translation component616may comprise a TCP and/or HTTP state. The HTTP to DNS protocol translation component616may comprise a DNS request on timeout. The DoH HTTP services component614may send the ninth message to the HTTP to DNS protocol translation component616. The ninth message may comprise a DoH HTTP GET or POST request. The ninth message may comprise cleartext.

At step638, the HTTP to DNS protocol translation component616may send a tenth message. The HTTP to DNS protocol translation component616may send the tenth message to the DoH HTTP services component614. The tenth message may comprise a DoH HTTP GET or POST acknowledgment. The tenth message may comprise cleartext.

At step640, the HTTP to DNS protocol translation component616may send an eleventh message to the DoH proxy function components610. The DoH proxy function components610may comprise a DNAT/SNAT component618. The DNAT/SNAT component618may comprise a UDP session state. The HTTP to DNS protocol translation component616may send the eleventh message to the DNAT/SNAT component618. The eleventh message may comprise a DNS request. The eleventh message may comprise a DNS request on UDP port53. The eleventh message may comprise cleartext.

At step642, a DNAT/SNAT component618of the DoH proxy function components610may send a twelfth message. The DNAT/SNAT component618may send the twelfth message to the DNS resolver604. The twelfth message may comprise a DNS request. The DNS request may comprise a DNS request on UDP port53. The twelfth message may comprise cleartext.

At step644, the DNS resolver604may send a thirteenth message. The DNS resolver604may send the thirteenth message to the DNAT/SNAT component618. The thirteenth message may comprise a DNS response. The DNS response may comprise a DNS response on UDP port53. The thirteenth message may comprise cleartext.

At step646, the DNAT/SNAT component618may send a fourteenth message. The DNAT/SNAT component618may send the fourteenth message to the HTTP to DNS protocol translation component616. The fourteenth message may comprise a DNS response. The DNS response may comprise a DNS response on UDP port53. The fourteenth message may comprise cleartext.

At step648, the HTTP to DNS protocol translation component616may send a fifteenth message. The HTTP to DNS protocol translation component616may send the fifteenth message to the DoH HTTP services component614. The fifteenth message may comprise a DoH HTTP response. The fifteenth message may comprise cleartext.

At step650, the DoH HTTP services component614may send a sixteenth message. The DoH HTTP services component614may send the sixteenth message to the DoH TLS offload component612. The sixteenth message may comprise a DoH HTTP response. The sixteenth message may comprise cleartext.

At step652, the DoH TLS offload component612may send a seventeenth message. The DoH TLS offload component612may send the seventeenth message to the client601. The seventeenth message may comprise a DoH HTTP(S) response. The seventeenth message may comprise encrypted information. The seventeenth message may comprise TLS authentication.

FIG.7shows an example method700. At step720, a client701may send a first message. The first message may be sent via an Internet Protocol (IP), such as Internet Protocol version 6 (IPv6). The client701may send the first message to a DNS GSLB component702. The first message may comprise an initial resolution of a FQDN DoH. The first message may comprise cleartext.

At step722, the DNS GSLB component702may send a second message. The DNS GSLB component702may send the second message to the client701. The second message may comprise a map to a DoH service endpoint. The second message may comprise cleartext.

At step724, the client701may send a third message. The client701may send the third message to DoH proxy functional components710. The DoH proxy functional components710may comprise components of a SmartNIC, such as the SmartNIC512inFIG.5. The DoH proxy functional components710may comprise a DoH TLS offload component712. The DoH TLS offload component712may comprise a TCP and/or TLS state. The third message may comprise a DoH TLS handshake request. The third message may comprise encrypted information. The third message may comprise TLS authentication.

At step726, the DoH TLS offload component712may send a fourth message. The DoH TLS offload component712may send the fourth message to the client701. The fourth message may comprise a DoH TLS handshake acknowledgment. The fourth message may comprise encrypted information. The fourth message may comprise TLS authentication.

At step728, the client701may send a fifth message. The client701may send the fifth message to the DoH TLS offload component712. The fifth message may comprise a DoH HTTP(S) GET or POST request. The fifth message may comprise encrypted information. The fifth message may comprise TLS authentication.

At step730, the DoH TLS offload component712may send a sixth message. The DoH TLS offload component712may send the sixth message to a DoH HTTP services component714of the DoH proxy functional components710. The DoH HTTP services component714may comprise a TCP and/or HTTP state. The sixth message may comprise a DoH HTTP GET or POST request. The sixth message may comprise cleartext. The DoH HTTP services component714may validate the request.

At step732, the DoH HTTP services component714may send a seventh message. The DoH HTTP services component714may send the seventh message to the DoH TLS offload component712. The seventh message may comprise a DoH HTTP GET or POST acknowledgment. The seventh message may comprise cleartext.

At step734, the DoH TLS offload component712may send an eighth message. The DoH TLS offload component712may send the eighth message to the client701. The eighth message may comprise a DoH HTTP(S) GET or POST acknowledgment. The eighth message may comprise encrypted information. The eighth message may comprise TLS authentication.

At step736, the DoH HTTP services component714may send a ninth message. The DoH HTTP services component714may send the ninth message to a HTTP to DNS protocol translation component716. The HTTP to DNS protocol translation component716may comprise a TCP and/or HTTP state. The HTTP to DNS protocol translation component716may comprise a DNS request on timeout. The ninth message may comprise a DoH HTTP GET or POST request. The ninth message may comprise cleartext.

At step738, the HTTP to DNS protocol translation component716may send a tenth message to the DoH HTTP services component714. The tenth message may comprise a DoH HTTP GET or POST acknowledgment. The tenth message may comprise cleartext.

At step740, the HTTP to DNS protocol translation component716may send an eleventh message. The HTTP to DNS protocol translation component716may send the eleventh message to the DNS resolver704. The eleventh message may comprise a DNS request. The eleventh message may comprise a DNS request on UDP port53. The eleventh message may comprise cleartext.

At step742, the DNS resolver704may send a twelfth message. The DNS resolver704may send a twelfth message to the HTTP to DNS protocol translation component716. The twelfth message may comprise a DNS response. The twelfth message may comprise a DNS response on UDP port53. The twelfth message may comprise cleartext.

At step744, the HTTP to DNS protocol translation component716may send a thirteenth message. The HTTP to DNS protocol translation component716may send the thirteenth message to the DoH HTTP services component714. The thirteenth message may comprise a DoH HTTP response. The thirteenth message may comprise cleartext.

At step746, the DoH HTTP services component714may send a fourteenth message. The DoH HTTP services component714may send the fourteenth message to the DoH TLS offload component712. The fourteenth message may comprise a DoH HTTP response. The fourteenth message may comprise cleartext.

At step748, the DoH TLS offload component712may send a fifteenth message. The DoH TLS offload component712may send the fifteenth message to the client701. The fifteenth message may comprise a DoH HTTP(S) response. The fifteenth message may comprise encrypted information. The fifteenth message may comprise TLS authentication.

FIG.8shows an example SmartNic820. The SmartNic820may comprise the SmartNIC512inFIG.5. The SmartNic820may comprise the encryption module described in reference toFIG.4. The SmartNic820may comprise a component of a DNS server host800. The DNS server host800may comprise an Ethernet networking interface806. The DNS server host800may comprise a server CPU810. The DNS server host800may be configured to communicate with one or more CPEs, such as a first CPE802and a second CPE804. The DNS server host800may be configured to communicate with the CPE's802,804via an Ethernet networking interface806. The CPEs802,804may comprise one or more set-top boxes, cable modems, gateways, smart televisions, smart phones, laptops, desktops, tablets, wearable devices, and/or other computing devices. The Ethernet networking interface806may be configured to convert network messages into signals suitable for the DNS server host800. The Ethernet networking interface806may be configured to convert signals generated by the DNS server host800into messages suitable for a networking protocol. The server CPU810may comprise an operating system (OS)812. The OS812may comprise a Linux OS. The OS812may comprise instructions for executing (e.g., running, etc.) a DNS resolver user space application814.

The SmartNIC820may comprise a TLS encryption offload component822. The SmartNIC820may comprise a SmartNIC programmable datapath component824. The SmartNIC820may comprise a SmartNIC CPU830. The TLS encryption offload component822may be configured to decrypt messages from the CPEs802,804. The TLS encryption offload component822may be configured to encrypt message to the CPEs802,804without using other computational resources of the DNS server host800. The SmartNIC programmable datapath component824may comprise a traffic steering component826. The SmartNIC CPU830may comprise an OS832. The OS832may comprise a Linux OS. The OS832may comprise instructions for executing an HTTP-DNS translator834. The traffic steering component826may be configured to direct messages to an appropriate CPU within the DNS server host800. The traffic steering component826may be configured to direct encrypted messages to the SmartNIC CPU830. The traffic steering component826may be configured to direct cleartext messages to the server CPU810.

The first CPE802and the Ethernet networking interface806may be configured to communicate via a first protected datapath840. The first protected datapath840may comprise one or more networking components. Messages sent via the first protected datapath840may comprise DoH messages and/or DoT messages. Messages sent from the first CPE802to the Ethernet networking interface806via the first protected datapath840may comprise a DoH HTTP request. Messages sent from the Ethernet networking interface806to the first CPE802via the first protected datapath840may comprise a DoH HTTP response. Messages sent via the first protected datapath840may comprise encrypted messages. Messages sent via the first protected datapath840may comprise TLS authentication.

The Ethernet networking interface806and the SmartNIC programmable datapath component824may be configured to communicate via a second protected datapath842. The second protected datapath842may comprise one or more communication buses. Messages sent via the second protected datapath842may comprise DoH messages. Messages sent from the Ethernet networking interface806to the SmartNIC programmable datapath component824via the second protected datapath842may comprise a DoH HTTP request. Messages sent from the SmartNIC programmable datapath component824to the Ethernet networking interface806via the second protected datapath842may comprise a DoH HTTP response. Messages sent via the second protected datapath842may comprise encrypted messages. Messages sent via the second protected datapath842may comprise TLS authentication.

The SmartNIC programmable datapath component824and the SmartNIC CPU830may communicate via a third protected datapath844. The third protected datapath844may comprise one or more communication buses. Messages sent via the third protected datapath844may comprise DoH messages. Messages sent from the SmartNIC programmable datapath component824to the SmartNIC CPU830via the third protected datapath844may comprise a DoH HTTP request. Messages sent from the SmartNIC CPU830to the SmartNIC programmable datapath component824via the third protected datapath844may comprise a DoH HTTP response. Messages sent via the third protected datapath844may comprise encrypted messages. Messages sent via the third protected datapath844may comprise TLS authentication.

The SmartNIC CPU830and the TLS encryption offload component822may communicate via a fourth protected datapath846. The fourth protected datapath846may comprise one or more communication buses. Messages sent via the fourth protected datapath846may comprise encrypted messages. Messages sent via the fourth protected datapath846may comprise TLS authentication. Messages sent to the TLS encryption offload component822from the SmartNIC CPU830via the fourth protected datapath846may comprise encrypted data in need of decryption. Messages sent to the SmartNIC CPU830from the TLS encryption offload component822via the fourth protected datapath846may comprise encrypted data, wherein the data was encrypted in response to a request from the SmartNIC CPU830.

The SmartNIC CPU830and the TLS encryption offload component822may communicate via a first unprotected datapath848. The first unprotected datapath848may comprise one or more communication buses. The first unprotected datapath848and the fourth protected datapath846may share physical and/or logical components. Messages sent via the first unprotected datapath848may comprise cleartext messages. Messages sent to the TLS encryption offload component822from the SmartNIC CPU830via the first unprotected datapath848may comprise data in need of encryption. Messages sent to the SmartNIC CPU830from the TLS encryption offload component822via the first unprotected datapath848may comprise decrypted data.

The SmartNIC CPU830and the server CPU810may communicate via a second unprotected datapath850. The second unprotected datapath850may comprise one or more communication buses. Messages sent via the second unprotected datapath850may comprise cleartext messages. Messages sent from the SmartNIC CPU830to the server CPU810via the second unprotected datapath850may comprise a cleartext DNS request. Messages sent from the server CPU810to the SmartNIC CPU830via the second unprotected datapath850may comprise a cleartext DNS response.

The second CPE804and the Ethernet networking interface806may communicate via a first cleartext datapath860. The first cleartext datapath860may comprise one or more networking components. Messages sent via the first cleartext datapath860may comprise cleartext DNS messages. Messages sent from the second CPE804to the Ethernet networking interface806via the first cleartext datapath860may comprise a cleartext DNS request. Messages sent from the Ethernet networking interface806to the second CPE804via the first cleartext datapath860may comprise a cleartext DNS response.

The Ethernet networking interface806and the SmartNIC programmable datapath component824may communicate via a second cleartext datapath862. The second cleartext datapath862may comprise one or more communication buses. Messages sent via the second cleartext datapath862may comprise cleartext DNS messages. Messages sent from the Ethernet networking interface806to the SmartNIC programmable datapath component824via the second cleartext datapath862may comprise a cleartext DNS request. Messages sent from the SmartNIC programmable datapath component824to the Ethernet networking interface806via second cleartext datapath862may comprise a cleartext DNS response.

The SmartNIC programmable datapath component824and the server CPU810may communicate via a third cleartext datapath864. The third cleartext datapath864may comprise one or more communication buses. Messages sent via the third cleartext datapath864may comprise cleartext DNS messages. Messages sent from the SmartNIC programmable datapath component824to the server CPU810via the third cleartext datapath864may comprise a cleartext DNS request. Messages sent from the server CPU810to the SmartNIC programmable datapath component824via the third cleartext datapath864may comprise a cleartext DNS response.

FIG.9shows an example computing environment900. The systems, methods, and apparatuses described herein may be implemented on a computing device such as a computing device901. Any of the components of a SmartNIC, such as SmartNIC512inFIG.5, or a DNS server, such as service provider DNS server514inFIG.5or DNS server host800inFIG.8, may comprise a computing device as shown inFIG.9. Similarly, the methods, systems, and apparatuses disclosed may utilize one or more computing device to perform one or more functions in one or more locations. The computing environment is not intended to suggest any limitation as to the scope of use or functionality of computing environment architecture. Neither should the computing environment900be interpreted as having any dependency or requirement relating to any one or combination of components shown in the computing environment900.

The systems, methods, and apparatuses described herein may be operational with numerous other general purpose or special purpose computing system environments or configurations. Computing systems, environments, and/or configurations that may be suitable for use with the systems, methods, and apparatuses comprise, but are not limited to, personal computers, server computers, laptop devices, and multiprocessor systems. Set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that comprise any of the above systems or devices, and the like may be used to implement the methods, systems, and apparatuses.

The systems, methods, and apparatuses may be implemented, in whole or in part, by software components. The disclosed methods, systems, and apparatuses may be described in the general context of computer-executable instructions, such as program modules, being executed by one or more computers or other devices. Program modules comprise computer code, routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The methods, systems, and apparatuses may be practiced in grid-based and distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.

The methods, systems, and apparatuses may be implemented via a general-purpose computing device in the form of a computing device901. The components of the computing device901may comprise, but are not limited to, one or more processors903, a system memory912, and a system bus913that couples various system components including the processor903to the system memory912. With multiple processors503, the system may utilize parallel computing.

The system bus913represents one or more of several possible types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. Such architectures may comprise an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, an Accelerated Graphics Port (AGP) bus, and a Peripheral Component Interconnects (PCI), a PCI-Express bus, a Personal Computer Memory Card Industry Association (PCMCIA), Universal Serial Bus (USB) and the like. The bus913, and all buses specified in this description may be implemented via a wired or wireless network connection and each of the subsystems, including the processor903, a mass storage device904, an operating system905, DNS encryption software906, DNS encryption data907, a network adapter908, system memory912, an Input/Output Interface910, a display adapter909, a display device911, and a human machine interface902, may be contained within one or more remote computing devices914a,b,cat physically separate locations, connected through buses of this form, in effect implementing a fully distributed system.

The computing device901typically comprises a variety of computer readable media. Readable media may be any available media that is accessible by the computing device901and comprises both volatile and non-volatile media, removable and non-removable media. The system memory912comprises computer readable media in the form of volatile memory, such as random access memory (RAM), and/or non-volatile memory, such as read only memory (ROM). The system memory912typically contains data such as DNS encryption data907and/or program modules such as operating system905and DNS encryption software906that are immediately accessible to and/or are presently operated on by the processor903.

The computing device901may comprise other removable/non-removable, volatile/non-volatile computer storage media.FIG.9shows a mass storage device504which may provide non-volatile storage of computer code, computer readable instructions, data structures, program modules, and other data for the computing device901. A mass storage device904may be a hard disk, a removable magnetic disk, a removable optical disk, magnetic cassettes or other magnetic storage devices, flash memory cards, CD-ROM, digital versatile disks (DVD) or other optical storage, random access memories (RAM), read only memories (ROM), electrically erasable programmable read-only memory (EEPROM), and the like.

Any number of program modules may be stored on the mass storage device904, including an operating system905and DNS encryption software906. Each of the operating system905and DNS encryption software906(or some combination thereof) may comprise elements of the programming and the DNS encryption software906. DNS encryption data907may be stored on the mass storage device904. DNS encryption data907may be stored in any of one or more databases known in the art. Such databases may comprise, DB2®, Microsoft® Access, Microsoft® SQL Server, Oracle®, mySQL, PostgreSQL, and the like. The databases may be centralized or distributed across multiple systems.

The user may enter commands and information into the computing device901via an input device (not shown). Input devices may comprise, but are not limited to, a keyboard, pointing device (e.g., a “mouse”), a microphone, a joystick, tactile input devices such as gloves, and other body coverings, and the like. These and other input devices may be connected to the processor903via a human machine interface902that is coupled to the system bus913, but may be connected by other interface and bus structures, such as a parallel port, game port, an IEEE 694 Port (also known as a Firewire port), a serial port, or a universal serial bus (USB).

A display device911may be connected to the system bus913via an interface, such as a display adapter909. It is contemplated that the computing device901may have more than one display adapter909and the computing device901may have more than one display device911. A display device may be a monitor, an LCD (Liquid Crystal Display), or a projector. Output peripheral devices may comprise components such as speakers (not shown) and a printer (not shown) which may be connected to the computing device901via Input/Output Interface910. Any step and/or result of the methods may be output in any form to an output device. Such output may be any form of visual representation, including, but not limited to, textual, graphical, animation, audio, tactile, and the like. The display911and computing device901may be part of one device, or separate devices.

The computing device901may operate in a networked environment using logical connections to one or more remote computing devices914a,b,c. A remote computing device may be a personal computer, portable computer, smartphone, a server, a router, a network computer, a peer device or other common network node, and so on. Logical connections between the computing device901and a remote computing device914a,b,cmay be made via a network915, such as a local area network (LAN) and a general wide area network (WAN). Such network connections may be through a network adapter908. A network adapter908may be implemented in both wired and wireless environments. Such networking environments are conventional and commonplace in dwellings, offices, enterprise-wide computer networks, intranets, and the Internet.

Application programs and other executable program components such as the operating system905are shown herein as discrete blocks, although it is recognized that such programs and components reside at various times in different storage components of the computing device901, and are executed by the data processor(s) of the computer. An implementation of DNS encryption software906may be stored on or sent across some form of computer readable media. Any of the disclosed methods may be performed by computer readable instructions embodied on computer readable media. Computer readable media may be any available media that may be accessed by a computer. Computer readable media may comprise “computer storage media” and “communications media.” “Computer storage media” comprise volatile and non-volatile, removable and non-removable media implemented in any methods or technology for storage of information such as computer readable instructions, data structures, program modules, or other data. Computer storage media may comprise, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which may be used to store the desired information and which may be accessed by a computing device.