DNS RESOLUTION, POLICIES, AND VIEWS FOR LARGE VOLUME SYSTEMS

• US 20120254996A1
• Filed: 03/31/2011
• Published: 10/04/2012
• Est. Priority Date: 03/31/2011
• Status: Active Grant

• Current Assignee: Akamai Technologies, Inc.
• Original Assignee: Nominum Incorporated (Akamai Technologies, Inc.)
• Inventors: Wilbourn, Robert S., Wood, Jonathan P., Halley, Robert Thomas
• Granted Patent: US 8,707,429 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/58 Caching of addresses or names
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Systems and methods for resolving domain name system (DNS) queries are provided herein. Methods may include receiving a DNS query from a DNS client via a DNS server, responsive to the DNS query, generating the DNS response utilizing the at least one policy associated with the view, providing the DNS response to the DNS client from which the DNS query was received, and storing the DNS response in a shared cache, the shared cache including previously generated DNS responses that are available to the DNS server, wherein previously generated DNS responses may be provided to DNS clients upon receiving a DNS query corresponding to at least one of the previously generated DNS responses.

Claims

1. A method for resolving domain name system (DNS) queries, the method comprising:

receiving a DNS query from a DNS client via a DNS server, the DNS query being assigned to a view to be utilized by the DNS server to generate a DNS response, the view being associated with one or more policies, the view including at least one policy;

responsive to the DNS query, generating the DNS response utilizing the at least one policy associated with the view;

providing the DNS response to the DNS client from which the DNS query was received; and

storing the DNS response in a shared cache, the shared cache including previously generated DNS responses that are available to the DNS server, wherein previously generated DNS responses may be provided to DNS clients upon receiving a DNS query corresponding to at least one of the previously generated DNS responses.

2. The method according to claim 1, further comprising binding at least one policy to at least one view, the at least one policy including one or more lists that each comprise one or more nodes, each of the one or more lists including at least one action, wherein if the DNS query corresponds to a node included in a list, the at least one action associated with the list is utilized to affect the way in which the DNS server generates the DNS response.

3. The method according to claim 2, wherein a view includes two or more policies and each policy includes a priority for ranking policies in an order of execution relative to one another such that when the view is utilized the two or more policies are utilized according to the order of execution.

4. The method according to claim 2, wherein the at least one action includes any of logging, blocking, filtering, modifying, editing, constraining, enabling, redirecting, promoting, demoting, substituting, obscuring, limiting, interrupting, restricting, or combinations thereof.

5. The method according to claim 1, further comprising associating one or more DNS clients with the view.

6. The method according to claim 1, wherein the DNS query includes an extension that includes at least one of end user identification information and device information indicative of DNS client from which the DNS query was received.

7. The method according to claim 6, wherein the device information includes information indicative of a media access control address, computing system configuration information, network identification, or combinations thereof.

8. The method according to claim 1, wherein the policies include information indicative of a customized DNS response generated by the DNS server.

9. The method according to claim 1, further comprising applying the at least one policy to the DNS query before the DNS response is generated by the DNS server.

10. The method according to claim 1, further comprising performing the DNS response of a query and receiving an answer in the context of a view.

11. The method according to claim 1, further comprising applying the at least one policy to the DNS query after the DNS response is generated by the DNS server but before the DNS response is provided to the DNS client.

12. The method according to claim 1, further comprising prioritizing the one or more policies that apply to the DNS query within the view.

13. The method according to claim 1, further comprising:

preventing providing the DNS response if the DNS response is determined to be excluded by the one or more policies;

determining whether the view that is to be utilized by the DNS server includes at least one action that is to be applied to the DNS response; and

applying the at least one action to subsequent DNS queries received from the DNS client.

14. The method according to claim 13, further comprising generating one or more additional policies that are to be associated with the view that is utilized by the DNS server for future DNS queries that match the view.

15. The method according to claim 1, further comprising providing a shared DNS response for substantially similar DNS queries, wherein at least a portion of the DNS queries are associated with views having different personalized sets of policies relative to one another.

16. The method according to claim 1, further comprising distributing the shared DNS response across two or more DNS servers.

17. The method according to claim 1, further comprising selecting one or more of the policies that are applied to the DNS query by evaluating query attributes obtained from the DNS query.

18. The method according to claim 17 wherein the query attributes include any of a name, a time of day at which the DNS query was received, a DNS query type, an initial generation of the DNS response, DNS flags corresponding to the DNS query, one or more extensions associated with the DNS query, previously generated DNS responses, or combinations thereof.

19. The method according to claim 1, wherein the DNS server processes a DNS name and stores the DNS response in one or more shared DNS caches.

20. The method according to claim 1, wherein the shared cache is associated with one or more views, wherein the one or more views are different from one another in at least one way.

21. The method according to claim 20, wherein the DNS shared cache is adapted to be flushed, modified, reused, reassigned while maintaining associations between the one or more views and the shared cache without requiring manipulation or reference to each view, which references that shared cache.

22. The method according to claim 20, further comprising selecting a DNS response from the shared cache for a current DNS query, the DNS response having been formulated while processing a DNS query that was resolved in the context of a different view.

23. The method according to claim 22, further comprising applying one or more policies to the DNS response selected from the shared cache, the one or more policies being bound to the view associated with the current DNS query.

24. The method according to claim 22, wherein an attribute of a DNS response which is stored in a shared cache is utilized to determine a validity of the attribute for the current DNS query.

25. The method according to claim 24, wherein the attribute includes any of a name, a time of day at which the DNS query was received, a DNS query type, an initial generation of the DNS response, DNS flags corresponding to the DNS query, one or more extensions associated with the DNS query, previously generated DNS responses, or combinations thereof.

26. The method according to claim 22, wherein auxiliary information (e.g. computed delegation information) of the selected DNS response which is stored in the shared cache is utilized to resolve the current DNS query.

27. The method according to claim 22, further comprising:

detecting security threats associated with DNS responses stored in the shared cache;

removing DNS responses determined to include a security threat.

28. The method according to claim 27, wherein detecting includes determining the presence of at least one of DNS cache poisoning and a denial of service attack.

29. A domain name system (DNS) server system adapted to resolve DNS queries, the system comprising:

at least one DNS server adapted to receive a DNS query from a DNS client via, the DNS query being assigned to a view, the view being associated with one or more policies, the view including at least one policy, the at least one DNS server including at least one DNS resolver adapted to;

generate a DNS response utilizing the view by applying the at least one policy to the DNS query, the at least one DNS resolver being communicatively coupled to the at least one DNS name server;

provide the DNS response to the DNS client from which the DNS query was received; and

store the DNS response in a shared cache, the shared cache including previously generated DNS responses that are available to the DNS server, wherein previously generated DNS responses may be provided to DNS clients upon receiving a DNS query corresponding to at least one of the previously generated DNS responses.

30. The DNS server system according to claim 29, wherein the at least one DNS name server is adapted to bind at least one policy to at least one view, the at least one policy including one or more lists that each comprise one or more nodes, each of the one or more lists including at least one action, wherein if the DNS query corresponds to a node included in a list, the at least one action associated with the list is applied to the DNS query to affect the way in which the DNS resolver generates the DNS response.

31. The DNS server system according to claim 30, wherein a view includes two or more policies and each policy includes a priority for ranking policies in an order of execution relative to one another such that when the view is utilized the two or more policies are utilized according to the order of execution.

32. The DNS server system according to claim 31, wherein the DNS server is adapted to associate one or more DNS clients with the view.

33. The DNS server system according to claim 29, wherein the DNS query includes an extension that includes at least one of end user identification information and device information indicative of DNS client from which the DNS query was received.

34. The DNS server system according to claim 33, wherein the device information includes information indicative of a media access control address, computing system configuration information, network identification, or combinations thereof.

35. The DNS server system according to claim 29, wherein the policies include information indicative of a customized DNS response generated by the DNS resolver.

36. The DNS server system according to claim 29, wherein the DNS name server is adapted to apply the at least one policy to the DNS query before the DNS response is generated by the DNS resolver.

37. The DNS server system according to claim 29, wherein the DNS resolver is adapted to perform the DNS response of a DNS query, in the context of the view.

38. The DNS server system according to claim 29, wherein the DNS name server is adapted to apply the at least one policy to the DNS query after the DNS response is generated by the DNS resolver but before the DNS response is provided to the DNS client.

39. The DNS server system according to claim 29, wherein the at least one action includes any of logging, blocking, filtering, modifying, editing, constraining, enabling, redirecting, promoting, demoting, substituting, obscuring, limiting, interrupting, restricting, or combinations thereof.

40. The DNS server system according to claim 29, wherein the DNS name server is adapted to prioritize the one or more policies that are applies to the DNS query within the view.

41. The DNS server system according to claim 29, wherein the DNS name server is adapted to:

prevent providing the DNS response if the DNS response is determined to be excluded by the one or more policies;

determine whether the view that is to be utilized by the DNS resolver includes at least one action that is to be applied to the DNS response; and

apply the at least one action to the DNS query and any subsequent DNS queries received from the DNS client that correspond to the DNS query.

42. The DNS server system according to claim 29, wherein the DNS name server is adapted to generate one or more additional policies that are to be associated with the view, the view being utilized by the DNS resolver for future queries that match this view.

43. The DNS server system according to claim 29, wherein the DNS name server is adapted to utilize a DNS response for substantially similar DNS queries, wherein at least a portion of the DNS queries are associated with views having different personalized sets of policies relative to one another.

44. The DNS server system according to claim 29, wherein the DNS resolver is adapted to distribute the shared DNS response across two or more DNS resolvers.

45. The DNS server system according to claim 29, wherein the DNS name server is adapted to select one or more of the policies that are applied to the DNS query by evaluating query attributes obtained from the DNS query.

46. The DNS server system according to claim 29, wherein query attributes include any of a name, a time of day at which the DNS query was received, a DNS query type, an initial generation of the DNS response, DNS flags corresponding to the DNS query, one or more extensions associated with the DNS query, previously generated DNS responses, or combinations thereof.

47. The DNS server system according to claim 29, wherein the DNS resolver processes a DNS name and stores the answer in one or more shared caches.

48. The DNS server system according to claim 29, wherein the shared cache is associated with one or more views.

49. The DNS server system according to claim 29, wherein the DNS resolver is adapted to at least one of flush, modify, reuse, reassign the shared cache while maintaining associations between the one or more views and the shared cache without requiring manipulation or reference to each view which references that shared cache.

50. A non-transitory computer readable storage medium having a computer program embodied thereon, the computer program executable by a processor in a computing system to perform a method for resolving domain name system (DNS) queries, the method comprising:

receiving a DNS query from a DNS client via a DNS server, the DNS query being assigned to a view to be utilized by the DNS server to generate a DNS response, the view being associated with one or more policies, the view including at least one policy;

responsive to the DNS query, generating the DNS response utilizing the at least one policy associated with the view;

providing the DNS response to the DNS client from which the DNS query was received; and

storing the DNS response in a shared cache, the shared cache including previously generated DNS responses that are available to the DNS server, wherein previously generated DNS responses may be provided to DNS clients upon receiving a DNS query corresponding to at least one of the previously generated DNS responses.