CA2318669A1 - Method for identifying the geographical location of an ip address on the internet - Google Patents

Method for identifying the geographical location of an ip address on the internet Download PDF

Info

Publication number
CA2318669A1
CA2318669A1 CA002318669A CA2318669A CA2318669A1 CA 2318669 A1 CA2318669 A1 CA 2318669A1 CA 002318669 A CA002318669 A CA 002318669A CA 2318669 A CA2318669 A CA 2318669A CA 2318669 A1 CA2318669 A1 CA 2318669A1
Authority
CA
Canada
Prior art keywords
address
country
internet
information
database
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
CA002318669A
Other languages
French (fr)
Inventor
William A. Lloyd
Sean Macguire
Robert Andre Croteau
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
BORDER CONTROL Inc
Original Assignee
BORDER CONTROL Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by BORDER CONTROL Inc filed Critical BORDER CONTROL Inc
Priority to CA002318669A priority Critical patent/CA2318669A1/en
Publication of CA2318669A1 publication Critical patent/CA2318669A1/en
Abandoned legal-status Critical Current

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/30Definitions, standards or architectural aspects of layered protocol stacks
    • H04L69/32Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
    • H04L69/322Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions
    • H04L69/329Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions in the application layer [OSI layer 7]
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00Network arrangements, protocols or services for addressing or naming
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00Network arrangements, protocols or services for addressing or naming
    • H04L61/45Network directories; Name-to-address mapping
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network arrangements or protocols for supporting network services or applications
    • H04L67/50Network services
    • H04L67/51Discovery or management thereof, e.g. service location protocol [SLP] or web services
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network arrangements or protocols for supporting network services or applications
    • H04L67/50Network services
    • H04L67/52Network services specially adapted for the location of the user terminal

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

A method and system for the identification of the geographical location of an IP address on the Internet is described herein.
The method and system include traversing the entire top-level address space and collect all the allocations, which we save in an intermediate format; looking up the registration information of each allocation and store that information in an intermediate format; processing said registration information to determine country of origin: - Country Name, Country Code if used, City names; - Heuristic Address indicators - ZIP codes, ZIP+4, Canadian Postal code format, UK Postcodes, Telephone number cross reference, area codes, etc... we score each entry and if the score is high enough, then it is accepted; otherwise the offending entries are manually inspected; and associating the corresponding network with the country.

Description

TITLE OF THE INVENTION
Method for identifying the geographical location of an IP
address on the Internet.
FIELD OF THE INVENTION
The present invention relates to the Internet. More specifically, the present invention is concerned with a method for identifying the geographical location of an IP address on the Internet.
BACKGROUND OF THE INVENTION
Current efforts to determine the geographical location of a computer on the Internet are based upon reverse domain name system ("DNS") lookups. The IN-ADDR DNS lookup will return the unique forward DNS name from the Internet name servers. The forward DNS name is used to do a "whois" lookup in the DNS registration database.
The "whois" lookup will provide a text record of the official address of the owner of the particular DNS name. The text record has few formal fields but is relatively easily parsed to provide the country name of the registering organization. This assumes that country data is included in the returned text. Incomplete address information is common in the whois DNS tables.
This type of lookup has many problems including the speed of the lookup, its scaleability, and its accuracy. Up until last year all Internet name registrations were handled by a single organization (Internet Solutions, currently owned by Verisign Inc). When the APRA
mandate on administration of the Internet expired, DNS registrations were opened up to many more companies. Currently there are almost 40 different companies capable of DNS registrations.
With the proliferation of competing DNS registrars there is no consistency among registrars with respect to "whois" lookups. Each registry company may or may not provide registration data available by "whois" lookup.
In an interactive environment like web sites or streaming video on the Internet there is considerable time lost to the several lookups required to determine the geographical location of an incoming transaction request.
To resolve the location of any IP (Internet Protocol) address requires at least two external queries to the Internet. One reverse lookup and then a "whois". This quickly becomes a problem when a web site has to handle many requests.
OBJECTS OF THE INVENTION
An object of the present invention is therefore to provide an improved method for identifying of the geographical location of an IP
address on the Internet.
Other objects, advantages and features of the present invention will become more apparent upon reading of the following non restrictive description of preferred embodiments thereof, given by way of example only with reference to the accompanying drawings.
DESCRIPTION OF THE PREFERRED EMBODIMENT
The present invention was developed specifically to build a database to identify the geographical location of an IP address on the Internet. This is done by determining the smallest network the IP address is part of and returning the country of origin of that network. The present invention is designed to be better and faster to map IP address to country of origin then any other method currently available.
The present invention offers a significant advantage in providing a database where only one call is required and no parsing of data to return a country of origin.
The present approach to the problem is based on recognition that all IP addresses are part of networks. Historically, IP
space has been handled out in Class A, B or C allocations. Due to the inefficiencies of the class system and the significant growth of the Internet, space is now allocated on a classless system.
When an organization, such as an ASP connects to the Internet they make an application to their ISP (Internet Service Provider) for IP space. If an organization needs 150 IP address's, the upstream ISP
will likely allocate a Class C (255 IP's). In the classless world they will receive a /24 delegation.
When the IP space is allocated from the ISP to the ASP
the ISP will file a SWIP. The SWIP is a electronic form that the ISP sends to ARIN (American Registry of Internet Numbers), RIPE (Reseau IP
europeen) or APNIC to perform the official administrative transfer of IP
space from one organization to another.
Since IP space is a "limited" resource with about 4 billion possible addresses, an agency called ICANN was put in charge of the IP
space. With 4 billion addresses to manage, ICANN delegates IP allocation responsibility to 3 Regional Internet Registries (RIR) ARIN, RIPE NIC and APNIC.
ARIN (www.arin.net) handles North America delegations and is the lead agency. ARIN also handles most of all the unknown of unusual allocations. European and African applications are mostly handled by RIPE (www.ripe.net), and Asian registrations by APNIC
(www.apnic.net).

The total address space available was allocated along Class A boundaries that can be found at http://www.isi.edu/in-notes/iana/assignments/ipv4-address-space 5 The present invention includes a database of information built from the information sources described above. This database can be queried in several ways including http requests and a custom unix daemon. The database provides much quicker access to geographical information in a extremely quick and easily integrated fashion. The preferred response to a database inquiry is a ISO 3166 2 letter country codes.
The system of the present invention comprises three distinct parts. There is a "suck" engine that is used to populate the database. There is the database itself with information on all the subnets of interest. Finally there is the API (Application Program Interface) mechanism that is used by applications to query the system.
The "suck" engine of the present invention is the primary method used to populate the database.
The database population starts with a basic division of the all the Class A address space allocations into responsible RR's and others. For example the IANA (Internet Assigned Number Authority) assignments tell us that the 206 Class A has ARIN as the responsible registry. All 206 inquiries will be directed to ARIN instead of RIPE or APNIC.
It is not unusual for there to be some cross over between the registries. For example, an inquiry of RIPE might produce the same or different information than AKIN on the same inquiry. When there is a difference of information the IANA Class A allocation provides the indication of he correct RR.
If IANA points to ARIN and the data does not exist in the ARIN registry, the system of the present invention will perform a lookup in RIPE and APNIC.
The database population exploits a feature of the ARIN
database lookup that allows us to view the first 250 sub-network allocations that comprise any network. The allows us to determine and populate the database with networks that cross the traditional Class boundaries. For example, we can determine and map a Class C space of 255 IP's that does not start at .0 and end at .255. This also has the added benefit of speeding up the querying of the ARIN database tables greatly.
We can determine all of an organizations contiguous IP space in one lookup rather that several smaller lookups.
The present invention keeps track of all network ownership through the use of Internic handles. The Internic handle to organization address is maintained as a separate database. This allows for much faster query of the information. Only when a network ownership changes to an unknown organization does the system of the present invention requires another lookup to the ARIN database.
The present invention also supports the use of exclusion lists. With the proliferation of anonymous proxy services we have a list of IP's and DNS names that are completely blocked because the DNS data is incomplete or misleading. A client of these proxy services, for example, would not be identified as a resident of any country because the client is identified as a client of a service established to protect privacy.
The exclusion information also applies to large Class A
and Class B corporate allocations that were made in the early years of the Internet. Some large companies were given complete a complete Class A for use in their corporate networks. There large corporate networks can easily span the entire organization including all of their physical locations around the world. The present invention blocks there addresses and does not make try to integrate this IP space into the database as any information is misleading and will often reflect the address and country of origin of the corporate headquarters.
The present invention also uses a the forward DNS
name to determine geographic data if it exists. For example, country domains as opposed to the more generic TLD like .com, .net and .org. An IP address with a reverse DNS name that identifies a country code like .ca for Canada is a good indicator of country of origin when it exists.
There is also a DNS RR record for geographic location based on latitude and longitude coordinates. Such data is only present in a small number of DNS entries. However when such data exists it can be taken as the most authoritative information available. It is relatively easy to use some basic tools to map longitude and latitude information to a physical country.
When the system of the present invention is specifically used in a web page and the API call to the database is made by the client themselves or information is passed to the system in the API call, the language of the browser provides some basic country information. For example a client with browser language set to Russian and coming from an IP address otherwise identified as Spanish would be suspect.
The present invention uses a "traceroute" feature to verify the location of IP address after they have been used. The total address space of the Internet is sufficiently large that a complete trace of routing information cannot be performed in reasonable time.
Traceroute data provides the most comprehensive and accurate indication of the physical location of a computer. After an IP
address is looked up in the system of the present invention by a client, the system adds the IP address into a queue of address space to researched with a traceroute.
While there is a total of 4 billion IP's available on the Internet the actual number of IP address used by web surfers and other client type computers is relatively small. Exact numbers are unknown and impossible to determine with any accuracy.

When the traceroute function is run on an IP address, the traceroute provides a complete list of routers involved in routing traffic to the end user IP. The system of the present invention uses this by starting with the first router between the IP address of interest and the Internet and doing a database lookup on that IP address. The system then does a lookup on the IP address of the router before and so on.
What we end up with is a chain of country codes. If the country codes are flipping around then the data in the database is highly suspect and the offending IP and network is marked for manual analysis.
Routers before the IP address in question that are part of the same network have no weight to the determination of the country of origin If the first router from a network outside that of the IP in question is also from the same country then it is extremely likely that the database determination is valid.
After considerable effort we have discovered that to try to apply techniques to map the Internet to boundaries smaller than a country level the data available from the Internet IP registrations is simply not reliable.
Although the present invention has been described hereinabove by way of preferred embodiments thereof, it can be modified, without departing from the spirit and nature of the subject invention as defined in the appended claims.

Claims (7)

WHAT IS CLAIMED IS:
1. A method for the identification of the geographical location of an IP address on the Internet as described herein.
2. A method for the identification of the geographical location of an IP address on the Internet, said method comprising:
traversing the entire top-level address space and collect all the allocations, which we save in an intermediate format;
looking up the registration information of each allocation and store that information in an intermediate format;
processing said registration information to determine country of origin:
- Country Name, Country Code if used, City names, - Heuristic Address indicators - ZIP codes, ZIP+4, Canadian Postal code format, UK Postcodes, Telephone number cross reference, area codes, etc... we score each entry and if the score is high enough, then it is accepted; otherwise the offending entries are manually inspected; and associating the corresponding network with the country.
3. A method for storing a global IP/Country information in such a way as to make updating rapid, and accesses reliable:
- since getting a list of all allocations is relatively quick (claim 2), we can do this frequently, and check the results against our list of allocations; Added/Deleted/Changed registrations can be updated as per the steps above.
4. A method as recited in claim 2, wherein the exclusion of anonymised allocations is possible by the maintenance of an exclusion list of networks which are supra-national (i.e. Ford/HP/etc), and networks which provide 'privacy' and 'anonymization' services; these are considered 'pirate' entries, and XX is returned as the country code.
5. A method as recited in claim 2, wherein the compression of the database allows adjacent networks to be grouped together provided they are all in the same country; in other words, if we determine that the class B address 204.101 is allocated only to Canadians, we don't need to store the thousands of suballocations; this results in a greatly compressed database and is likewise orders of magnitude faster to search.
6. A method as recited in claim 2, suited for making this information available for use by others; comprising:
- a connection to an internet daemon is made, the IP
address is passed to the program and a 2 character country code is returned; and - a local copy of the database is available which may be queried directly.
7. A system for the identification of the geographical location of an IP address on the Internet as described herein.
CA002318669A 2000-09-11 2000-09-11 Method for identifying the geographical location of an ip address on the internet Abandoned CA2318669A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CA002318669A CA2318669A1 (en) 2000-09-11 2000-09-11 Method for identifying the geographical location of an ip address on the internet

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CA002318669A CA2318669A1 (en) 2000-09-11 2000-09-11 Method for identifying the geographical location of an ip address on the internet

Publications (1)

Publication Number Publication Date
CA2318669A1 true CA2318669A1 (en) 2002-03-11

Family

ID=4167106

Family Applications (1)

Application Number Title Priority Date Filing Date
CA002318669A Abandoned CA2318669A1 (en) 2000-09-11 2000-09-11 Method for identifying the geographical location of an ip address on the internet

Country Status (1)

Country Link
CA (1) CA2318669A1 (en)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2408114A (en) * 2003-11-13 2005-05-18 Whereonearth Ltd Determining a geographical location from IP address information
US7752210B2 (en) 2003-11-13 2010-07-06 Yahoo! Inc. Method of determining geographical location from IP address information
CN103327133A (en) * 2013-05-31 2013-09-25 青岛海信传媒网络技术有限公司 Method and device for updating geographic position information
CN113360586A (en) * 2021-06-03 2021-09-07 深圳前海微众银行股份有限公司 Address aggregation degree query method, device and equipment and computer readable storage medium

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2408114A (en) * 2003-11-13 2005-05-18 Whereonearth Ltd Determining a geographical location from IP address information
US7752210B2 (en) 2003-11-13 2010-07-06 Yahoo! Inc. Method of determining geographical location from IP address information
CN103327133A (en) * 2013-05-31 2013-09-25 青岛海信传媒网络技术有限公司 Method and device for updating geographic position information
CN103327133B (en) * 2013-05-31 2016-04-27 青岛海信传媒网络技术有限公司 A kind of geographical location information update method and device
CN113360586A (en) * 2021-06-03 2021-09-07 深圳前海微众银行股份有限公司 Address aggregation degree query method, device and equipment and computer readable storage medium
CN113360586B (en) * 2021-06-03 2024-05-03 深圳前海微众银行股份有限公司 Address aggregation degree query method, device, equipment and computer readable storage medium

Similar Documents

Publication Publication Date Title
US7752210B2 (en) Method of determining geographical location from IP address information
US7769826B2 (en) Systems and methods of providing DNS services using separate answer and referral caches
US8090796B2 (en) Position identification method and system
JP7045104B2 (en) How to process data, devices and computer programs, and zone files for hierarchical Domain Name System
AU2010263076B2 (en) Characterizing unregistered domain names
US6745248B1 (en) Method and apparatus for analyzing domain name registrations
US20060218303A1 (en) Creation of a database storing domain names and business operational areas
US20040220903A1 (en) Method and system to correlate trademark data to internet domain name data
AU2013206327B2 (en) Systems and methods for automatically providing whois service to top level domains
CA2565077A1 (en) System and methods for domain name acquisition and management
Halvorson et al. The BIZ top-level domain: ten years later
CA2318669A1 (en) Method for identifying the geographical location of an ip address on the internet
KR100342107B1 (en) Methods for deciding Internet address groups distinguished by assigned organizations or locations and for resolving the geographical information for each address group, which are intended to set up Internet address supplementary system and its applications
US20020073209A1 (en) Method for redirecting a network communication
US8117439B2 (en) Issuing secure certificate using domain zone control validation
US9183368B2 (en) Validating control of domain zone
EP1784947A1 (en) Systems and methods of registering and utilizing domain names
KR100464583B1 (en) System for mapping keyword name to url and method thereof
WO2019207771A1 (en) System for user attribute estimation based on ip address
KR20050099943A (en) System for accessing web page and method thereof
KR100464582B1 (en) System for acc esing web page using native language key-word names and method thereof
Ichise et al. Design and implementation of NS record history database for detecting DNS-based botnet communication
KR100732975B1 (en) System for accessing web page and method thereof
WO2001029710A2 (en) Derivative domain names
GB2408114A (en) Determining a geographical location from IP address information

Legal Events

Date Code Title Description
FZDE Discontinued