51 results about "Fully qualified domain name" patented technology

Techniques for wildcard based private application access are disclosed. In some embodiments, a system, a process, and / or a computer program product for wildcard based private application access includes receiving a request for access to an application over a secure access service edge (SASE) network for a user associated with an enterprise; determining if the request for access to the application matches a wildcard (e.g., the wildcard can be configured by an administrator of the enterprise for matching a fully qualified domain name (FQDN) for the application); and automatically configuring access information (e.g., IP address, protocol, and destination port) for the application that matches the wildcard.

The present disclosure relates to: a communication technique for a 5G communication system for supporting a higher data transmission rate higher a 4G system; and a system therefor. According to an embodiment of the present disclosure, a method for a first network node in a wireless communication system may be disclosed, the method comprising the steps of: receiving, from a second network node, a policy and charging control (PCC) rule and fully qualified domain name (FQDN)-based information that indicate any one of traffic detections via DNS message reporting or a DNS resolution; generating a DNS message processing rule on the basis of the FQDN-based information; transmitting the DNS message processing rule to a third network node; and receiving, from the third network node, an FQDN and an IP address for the FQDN, wherein the FQDN and the IP address are identified by the third network node via detection of a DNS response message on the basis of the DNS message processing rule.

The present invention relates to a cybersecurity system for preventing adversarial reconnaissance in cloud, hybrid, and multi-cloud environments by dynamically modifying user authentication identifiers, hostnames and fully qualified domain names. The system updates login usernames in real time using randomized, non-repeating values generated from a configurable dictionary. Updates occur at scheduled, random, coordinated, or event-triggered intervals to disrupt profiling and targeting attempts. When identifiers are changed, associated sessions and tokens are invalidated to prevent reuse. The system monitors expired credential usage to detect potential reconnaissance, generating alerts with intelligence such as IP addresses, timestamps, and affected resources. By eliminating predictable identity patterns, the system defends against reconnaissance-based attacks, unauthorized access attempts, and other credential-driven threats, thereby improving organizational security across cloud platforms.

Techniques for wildcard based private application access are disclosed. In some embodiments, a system, a process, and / or a computer program product for wildcard based private application access includes receiving a request for access to an application over a secure access service edge (SASE) network for a user associated with an enterprise; determining if the request for access to the application matches a wildcard (e.g., the wildcard can be configured by an administrator of the enterprise for matching a fully qualified domain name (FQDN) for the application); and automatically configuring access information (e.g., IP address, protocol, and destination port) for the application that matches the wildcard.

The present application discloses a method, system, and computer system for providing intelligent DNS load balancing using a combination of a dynamic DNAT pool and application providing in a connector-based solution for private application access. The method includes: (a) performing a DNS re-resolution for resolving an application Fully Qualified Domain Name (FQDN) to obtain a plurality of IP addresses for a plurality of application servers, (b) performing periodic application server probing, and (c) dynamically updating a destination network address translation (DNAT) to provide DNS load balancing for application traffic. The DNAT is updated based at least in part on one or more of the DNS re-resolution and the application server probing.

Methods, apparatus, systems, architectures and interfaces for a wireless transmit receive unit (WTRU) performing a client-side edge resolution function (cERF) are provided. A method may include any of: determining a fully qualified domain name (FQDN) associated with a domain name server (DNS) request of an application associated with the WTRU; if the FQDN is associated with a valid edge instance (EI) record, selecting an EI for resolving the FQDN to an IP address; if the FQDN is not associated with a valid EI record: (1) transmitting a DNS query to a DNS server, (2) receiving an IP address associated with a selected EI to which the FQDN is resolved, and (3) updating the EI record with the IP address and the FQDN; and generating a traffic steering rule to re-direct uplink traffic associated with the application to the selected EI.

Various techniques for detecting visual similarity between DNS fully qualified domain names (FQDNs) are disclosed. In some embodiments, a system, process, and / or computer program product for detecting visual similarity between DNS FQDNs includes receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query; performing extended sequence alignment for each of the set of FQDNs to identify potential malware FQDNs for one or more target FQDNs based on a visual similarity for each domain in the DNS data stream; and classifying the set of domains as malware FQDNs or benign FQDNs based on results of the extended sequence alignment.

Methods, apparatus, systems, architectures, and interfaces for a path computation element (PCE) performing run-time operations for providing isolated service chains in a name-based routing system of communications network, are provided. A method may include any of: receiving, from a client device, a first message requesting a forwarding identifier (FID) associated with a fully qualified domain name (FQDN) of a service function (SF), the first message including information indicating: (1) a first identifier (ID) associated with the FQDN of the SF, and (2) a second ID associated with the FQDN of the SF; on condition that the PCE has determined that the first ID is for a subscriber associated with a namespace known to the PCE, determining the FID associated with the FQDN of the SF according to namespace information; and transmitting information associated with the FID to the client device.

The embodiment of the invention discloses a communication method, device and system, relates to the technical field of communication, and helps to reduce the pressure of a session management function network element for processing a request for an edge application service. The method comprises: a session management function network element obtaining application information signed by a terminal device, the application information comprising at least one of the following items: a full domain name, an application identifier, or a data network access identifier; the session management function network element selects a target first network element according to the application information; wherein the first network element is used for selecting a local user plane function network element and / or an edge application service.

Embodiments include methods for a network data analytics function (NWDAF) configured to assist with application detection in a communication network. Such methods include receiving, from a consumer network function (cNF) of the communication network, an analytic request related to assisted application detection and based on the analytic request, sending to a first DNS resolver associated with the communication network an exposure request for events related to fully qualified domain name (FQDN)-to-address mapping for application servers associated with applications. Such methods also include receiving from the first DNS resolver a first FQDN associated with a first application, in accordance with the exposure request, and based on the first FQDN, determining one or more packet flow descriptions (PFDs) associated with the first application. Such methods also include sending to the cNF an analytic result comprising the one or more PFDs, in accordance with the analytic request.

A method, system and apparatus are disclosed. According to one or more embodiments, a verifier is provided. The verifier includes processing circuitry configured to obtain a hash algorithm and a fully qualified domain name, FQDN, associated with a virtual network function, VNF, image, determine an identifier for the VNF image based at least on the hash algorithm and the FQDN, perform domain name system security extensions, DNSSEC, resolution of the determined identifier for the VNF image at least in part by requesting at least one attribute of the VNF image using the determined identifier for the VNF image and validating a response associated with the request, and perform validation of the VNF image in response to successful DNSSEC resolution.

The disclosure relates to a 5G or 6G communication system for supporting a higher data transmission rate. A method and apparatus for updating credential information in a wireless communication system is provided. According to an embodiment of the disclosure, a method of a user equipment (UE) in wireless communication system includes: transmitting, to an access and mobility function (AMF) entity, a registration request message based on a credential of a credentials holder via 3rd generation partnership project (3GPP) interworking function (N3IWF) entity for an untrusted non-3GPP access, and receiving, from the AMF entity, a registration accept message including updated credential information or a credential information update indication. The updated credential information included in the registration message includes at least one of: credentials holder controlled prioritized list of preferred standalone non-public networks (SNPNs) with N3IWF fully qualified domain names (FQDNs) of the preferred SNPNs, credentials holder controlled prioritized list of group identifier (ID) for network selections (GINs) with N3IWF FQDNs of SNPNs which broadcast the GINs, or credentials holder controlled prioritized list of N3IWFs.

A method by a first security edge protection proxy (SEPP) for security edge protection of messages being communicated between first and second communications networks of a communications system. The method receives, from a first network function of the first communications network, a first message containing an address identifying a second network function which is located in the second communications network. The method receives, from a second SEPP operating to protect communications with the second communications network, a second message containing a fully qualified domain name, FQDN, reference for a combination of the second SEPP and the second network function. The method stores the FQDN reference for the combination of the second SEPP and second network function in a label-to-FQDN mapping data structure with a logical association to a substitute locally-unique label, and sends a third message containing the substitute locally-unique label to the first network function.

The application discloses a wireless communication method, a wireless communication platform, an electronic device and a computer readable storage medium, receiving first DNS configuration information associated with a first application network element sent by an edge computing server; the first DNS configuration information comprises at least one of a data network address, an application network element service identifier, a data network access identifier, a fully qualified domain name, a service filtering identifier and domain name system information; configuring the first DNS configuration information for a to-be-configured network element associated with the first application network element in a core network device, and sending DNS feedback information to the edge computing server; the DNS feedback information is used for indicating that the to-be-configured network element is successfully configured, or indicating that the to-be-configured network element fails to be configured. In this way, it is ensured that a terminal device can access services carried on the edge computing server through local DNS services.

Session management for a Fifth Generation (5G) roaming solution using PRotocol for N32 INterconnect Security (PRINS) with roaming intermediaries is described herein. A first network node establishes a transport layer security (TLS) connection with a second network node, wherein the TLS connection is established using hypertext transfer protocol secure (HTTPS) as a uniform resource identifier (URI). The first network node creates a security negotiation request message, including a fully qualified domain name (FQDN) of the second network node. The first network node protects information elements (IEs) in the security negotiation request message with a Javascript Object Notation (JSON) Web Signature (JWS) token, wherein the JWS token uses a digital signature and includes a public key certificate of the first network node. The first network node sends over TLS, to the second network node, an HTTPS request, including the security negotiation request message and the JWS token.

A controller can securely publish an application of a tenant by securely extending a network fabric into the networks of the tenant with virtual private networks and NAT. After a tenant deploys an application into one or more networks of the tenant, the tenant can indicate select applications to publish. The network controller assigns a network address from the routable address space of the network fabric to the application and a network address aggregate to each application connector that will front an instance of the application, which securely extends the network fabric into the tenant network. The network controller configures NAT rules in the network fabric and on the application connector to create a route for traffic of the application through the network fabric to the application instance using a fully qualified domain name assigned to the application without exposing a private network address of the application instance and preserving security of other resource on the tenant network.

Various aspects of the present disclosure relate to registration and authentication using multiple certificates. A network equipment (NE) may transmit a request for a vendor-signed certificate to a server device associated with a vendor of the NE and based on a security key and a fully qualified domain name (FQDN). The NE may receive the vendor-signed certificate from the server device associated with the vendor of the NE. The NE may transmit a request for an operator-signed certificate to a server device associated with an operator of the NE and based on the vendor-signed certificate. The NE may receive the operator-signed certificate from the server device associated with the operator of the NE. The NE may establish a secure connection between the NE and a core network (CN) based on the vendor-signed certificate and the operator-signed certificate.

Systems and methods for monitoring a file establishing a Secure Sockets Layer (SSL) Virtual Private Network (VPN) tunnel route. The method includes receiving a connection request from a client associated with a fully qualified domain name (FQDN) to use a SSLVPN tunnel service; referencing a data storage for data associated with the client; constructing a client configuration file based on the data associated with the client; resolving the FQDN associated with the client to at least one internet protocol (IP) address; storing the resolved IP address in the configuration file; and communicating the configuration file to the client to instruct the client regarding how to automatically configure an SSL VPN tunnel route for the at least one resolved IP address.

An identifier, for example, an identifier of a domain and / or a host of the domain (e.g., a fully qualified domain name (FQDN), etc.), such as a service management device (e.g., a server, a web server, a computing device, a web host device, a webpage, etc.), may be modified (e.g., hashed, encrypted, etc.) by a network device (e.g., a server, a domain name system (DNS) server, a DNS over hypertext transfer protocol secure (HTTPS) server / gateway (DoH server), DNS over Transport Layer Security (TLS) server / gateway (DoT server), a network management device, a computing device, etc.), sent to a user device (e.g., a client device, a smart device, a mobile device, a content output device, a computing device, a web browser, a search engine, etc.), and reused by the user device to request a service (e.g., a web service, a webpage, a file, content, a content item, etc.).

Systems, methods, apparatuses, and computer program products for implementing a physical service communication proxy domain A method may include interconnecting a first network element with one or more service communication proxy domains, each associated with one or several internet protocol addresses or fully qualified domain names used for the interconnection. The method may also include registering the first network element with a network repository function by sending a service operation to the network repository function. Further, the service operation may include profile information of the first network element. In addition, the profile information may include one or more service communication proxy domains, each associated with one or several internet protocol addresses or fully qualified domain names.

An authentication method, applied to a user equipment, includes: determining, from one or more first entities, a target entity with which communication is requested; and deriving an application key KAF based on a fully qualified domain name (FQDN) of the target entity, wherein a first proxy entity provides an authentication proxy function for the target entity.

A distributed unit (DU) includes a memory having non-transitory instructions stored therein and a processor coupled to the memory, and being configured to execute the instructions, thereby causing the DU to transmit a first power-on notification (PON) to an element management system (EMS), after transmitting the first PON, communicate with a first virtual centralized unit (vCU) using a stored first vCU fully qualified domain name (FQDN), and transmit a sequence of second PONs to the EMS in parallel with communicating with the vCU.

According to an example aspect of the present invention, there is provided an apparatus configured to function as a network function repository, and transmit to a network function consumer an access token authorizing access to a service provided by a network function producer, the access token comprising an at least one of: indication of a fully qualified domain name of the network function consumer, an indication of a domain from which access to the network function producer is allowed and an indication of a stand-alone non-public network from which access to the network function producer is allowed.

The invention provides a node selection method and device, electronic equipment and a storage medium. The method comprises the steps that in a 4G / 5G core network, the Type type of a network element domain name identification FQDN field is expanded, and the Type type is used for identifying node types including a control plane node and a user plane node, so that the interconnected node types can be conveniently confirmed during signaling interaction. The respective FQDN information of the control plane node and the user plane node is expanded, the FQDN information comprises the position, the type and the network element identifier of the node, the control plane node can select the user plane node through the preset matching rule based on the FQDN information, the association relationship between the user plane node and the position information of the user plane node does not need to be configured and adjusted at the control plane node, and the user plane node can select the user plane node through the preset matching rule. According to the invention, the computing resources of the control plane nodes can be saved, the workload required by the selection of the user plane nodes is greatly reduced, and the flexibility and accuracy of the selection of the user plane nodes are also improved.

Responsive to domain name server (DNS) flood conditions being detected, a fully qualified domain name (FQDN) of each DNS query is checked against a table of legitimate FQDNs, and DNS queries having FQDNs that are verified as legitimate queries to pass to the DNS server are allowed, and DNS queries having FQDNs not verified as legitimate queries from passing to the DNS server are blocked.

A method and system for improving the efficiency of locating a pool operator in a Plug and Charge ecosystem. The method includes receiving an identifier associated with a user, using a Domain Name System (DNS) as a reference engine for the received identifier, generating a fully qualified domain name using the received identifier, and directing the fully qualified domain name to an internet address of a corresponding pool operator. The system includes one or more processors, a DNS, a fully qualified domain name generator, and a directing module. A non-transitory computer-readable medium storing instructions for performing the method is also disclosed.

Signaling to identify a Stream Classification Service (SCS) flow using a Fully Qualified Domain Name (FQDN) / Uniform Resource Locator (URL) or an application Identifier (ID) may be provided. An Access Point (AP) may receive a SCS request from a station for a SCS flow. The SCS request may include a flow identifier for the SCS flow. The flow identifier may include a FDQN or an application ID for identifying the SCS flow. The AP may verify a network policy associated with the flow identifier for the SCS flow. The AP may process the SCS request for the SCS flow based on the network policy.

The present disclosure relates to a system (120) and a method (500) of handling Session Initiation Protocol (SIP) packets distribution in a network. The method includes the step of receiving one or more SIP packets addressed to at least one IP Multimedia Subsystem (IMS) node from a User Equipment (UE) (110). The method includes the step of retrieving a relevant fully qualified domain name (FQDN) associated with the at least one IMS node and one or more IP addresses. The method includes the step of determining a status of the at least one IMS node as one of, blacklisted and available, based on comparing a determined number of failures of the one or more IP addresses. The method includes the step of routing the received SIP packet to the at least one IMS node when the status of the at least one IMS node is determined as available or blacklisted.

Embodiments include a method for a Network Data Analysis Function (NWDAF) configured to assist application detection in a communications network. Such a method includes receiving, from a consumer network function (cNF) of the communication network, an analysis request related to assisted application detection, and sending, based on the analysis request, an open request to an event related to a fully defined domain name (FQDN)-to-address mapping to a first DNS parser associated with the communication network, the FQDN-to-address mapping is used for an application server associated with an application. Such a method also includes receiving a first FQDN associated with the first application from the first DNS parser in accordance with the open request, and determining one or more packet flow descriptions (PFDs) associated with the first application based on the first FQDN. Such a method also includes transmitting an analysis result including the one or more PFDs to the cNF in accordance with the analysis request.

A method and system for improving the efficiency of locating a pool operator in a Plug and Charge ecosystem. The method includes receiving an identifier associated with a user, using a Domain Name System (DNS) as a reference engine for the received identifier, generating a fully qualified domain name using the received identifier, and directing the fully qualified domain name to an internet address of a corresponding pool operator. The system includes one or more processors, a DNS, a fully qualified domain name generator, and a directing module. A non-transitory computer-readable medium storing instructions for performing the method is also disclosed.