PROTOCOL-INDEPENDENT, MOBILE, WEB FILTER SYSTEM PROVISIONING DNS TRIAGE, URI SCANNER, AND QUERY PROXY SERVICES

• US 20100318681A1
• Filed: 06/12/2009
• Published: 12/16/2010
• Est. Priority Date: 06/12/2009
• Status: Abandoned Application

• Current Assignee: Barracuda Networks Incorporated
• Original Assignee: Barracuda Networks Incorporated
• Inventors: Shi, Fleming
• Application Number:
  US12/484,046
• Publication Number:
  US 20100318681A1
• Time in Patent Office: Days
• US Class Current: 709/245
• CPC Class Codes: G06F 15/16 Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs coordinating program control therefor G06F9/52; in regulating and control system G05B
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A system comprising three services: query string proxy, URI path scanner, and domain name system triage. A query string proxy sends a request on behalf of a client and analyzes the response from a remote server. A URI path scanner performs keyword matching on the entire path of a uniform resource identifier. A domain name system triage service receives a UDP request prior to establishing any protocol session between a client and a server and returns one IP address selected from the following: a block IP address, a trusted IP address, and a redirection to enhanced filter service IP address.

Claims

1. A system to provide a selective personalized Web filtering service by selective proxy using a domain name system comprising:

a network, the network coupling

a client machine apparatus,

a Web filtering domain name system server apparatus,

a Web server apparatus having a first Internet protocol address and a domain name.

2. The system of claim 1 wherein the Web filtering domain name system server apparatus comprises

a white list database comprising at least one first Internet protocol address and a domain name, and

means for receiving a domain name request from the client machine apparatus.

3. The system of claim 2 wherein the Web filtering domain name system server apparatus comprises

a processor adapted by a software program to

search the white list for the domain name and, if found,

return the first Internet protocol address of the Web server apparatus to the client machine apparatus.

4. The system of claim 3 further comprising

a web filtering extended proxy apparatus having a second Internet protocol address and wherein the Web filtering domain name system server apparatus comprises

a processor adapted by a software program

to search a white list for the domain name and if not found,

to return the second Internet protocol address of the Web filtering extended proxy apparatus,

whereby the client machine is directed to send the actual full URI of an HTTP request to the Web filtering extended proxy apparatus.

5. The system of claim 1 further comprising a Web filtering response portal server having a third Internet protocol address comprising

means for receiving an HTTP request from a client machine apparatus and

means for serving a block page.

6. The system of claim 5 wherein the Web filtering domain name system server apparatus further comprises

a blacklist database comprising at least one domain name and further comprising

a processor adapted by a software program

to search the blacklist database for the domain name and if found

to return the third Internet protocol address of the Web filtering response portal server

whereby the client machine is directed to send actual full URI of an HTTP request to the Web filtering response portal server.

7. The system of claim 1 wherein the client machine is adapted at network connection to send domain name system requests to the Web filtering domain name system server apparatus.

8. The system of claim 1 wherein the client machine is adapted at user logon to send DNS requests t

a certain personalized Web filtering domain name system server apparatus.

9. The system of claim 1 wherein the network comprises one of

a mesh network,

a cellular network, and

a wireless network.

10. The system of claim 1 wherein the network is a wide area network.

11. An apparatus to provide a selective personalized Web filtering service by extended proxy comprising:

a plurality of network interfaces,

means for receiving a full URI of an HTTP request,

means for examining the full URI for a deeply buried URI within the full URI,

means for determining if traffic to or from the buried URI is not allowed, and

means for blocking the traffic if it is not allowed.

12. The apparatus of claim 11 further comprising

a blacklist database and

a processor adapted

to examine a URI for buried URI on the blacklist and

to block it if found.

13. The apparatus of claim 11 further comprising

a proxy server apparatus adapted by a software program

to request a response from a Web server on behalf of a client and

to examine the response for objectionable content and

to return a block page if objectionable content is found.

14. The apparatus of claim 11 further comprising

a blacklist database of domain names and

means for returning a third Internet protocol address on the condition that a client machine submits a DNS request containing a domain name found on the blacklist.

15. The apparatus of claim 11 further comprising

a response server,

having a third Internet protocol address and

comprising means for serving a block page.

16. The apparatus of claim 11 further comprising

authentication means of a client machine as a subscriber of a service.

17. The apparatus of claim 11 further comprising

authentication means of a user as a subscriber of a service.

18. The apparatus of claim 11 further comprising

means for fulfillment of a Web page request to the requesting client machine if no objectionable content is found and if the full URI does not contain a URI found in the blacklist.

19. A method for operating a system, the system comprising three services:

query string proxy, URI path scanner, and domain name system triage, wherein each service views the processor adapted by a program product and coupled to each other via a network;

the method comprising;

within a query string proxy apparatus

sending a request on behalf of a client and analyzing a response from a remote server;

within a URI path scanner apparatus

receiving an entire path of a uniform resource identifier, and

performing keyword matching on labels within the uniform resource identifier;

within a domain name system triage service apparatus

receiving a UDP request prior to establishing any protocol session between a client and a server and returning one IP address selected from the following;

a block IP address, a trusted IP address, and a redirection to enhanced filter service IP address.

20. The method of claim 19 further comprising the following steps:

within a domain name system service apparatus,

searching a database of domain names to determine if a block IP address or a trusted IP address corresponds t

a domain name system, wherein a block IP address is one of a loopback address and an address of message server serving an html message;

within a URI path scanner apparatus,

returning a block IP address if a label within the uniform resource identifier is matched with any member of a list of keywords consistent with undesirable content;

within a query string proxy apparatus,

receiving from a server in response t

any URI which triggers a script or program or database retrieval,

analyzing the response for images or text with undesirable content, and

returning a message or block IP address to the client.