US 12,218,981 B2
Secure request authentication for a threat protection service
Brandon O. Williams, Revere, MA (US)
Assigned to Akamai Technologies, Inc., Cambridge, MA (US)
Filed by Akamai Technologies, Inc., Cambridge, MA (US)
Filed on Jan. 10, 2023, as Appl. No. 18/095,024.
Application 18/095,024 is a continuation of application No. 16/267,587, filed on Feb. 5, 2019, granted, now 11,552,997, issued on Jan. 10, 2023.
Claims priority of provisional application 62/626,852, filed on Feb. 6, 2018.
Prior Publication US 2023/0164191 A1, May 25, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); H04L 9/08 (2006.01); H04L 9/32 (2006.01); H04L 61/4511 (2022.01); H04W 12/37 (2021.01)
CPC H04L 63/20 (2013.01) [H04L 9/0891 (2013.01); H04L 9/3234 (2013.01); H04L 9/3247 (2013.01); H04L 61/4511 (2022.05); H04L 63/0281 (2013.01); H04W 12/37 (2021.01)] 10 Claims
OG exemplary drawing
 
1. A method to enable a client device associated with an enterprise network to obtain access to an enterprise resource, comprising:
configuring a recursive Domain Name System (DNS) service, the recursive DNS service including a resolver associated with the enterprise;
configuring the client device to act as a local proxy for off enterprise network DNS requests;
receiving at the resolver a DNS query from the client device, the client device having determined it is operating off of the enterprise network, the DNS query having been extended using an edns (0) extension to encode an authorization token, the authorization token including a unique device identifier associated with the client device and an identifier associated with the enterprise, the unique device identifier having been encrypted and digitally-signed with a key to generate the authorization token, the identifier associated with the enterprise being unencrypted;
determining at the resolver, but without access to the unique device identifier encoded in the authorization token, whether the authorization token is allowed for the enterprise, wherein a determination is based at least in part on the identifier associated with the enterprise and a threat protection policy; and
upon a determination that the authorization token is allowed, returning a response to the DNS query, wherein the response to the DNS query is based on applying the threat protection policy to the DNS query.