USING DNS COMMUNICATIONS TO FILTER DOMAIN NAMES

• US 20120303808A1
• Filed: 05/24/2011
• Published: 11/29/2012
• Est. Priority Date: 05/24/2011
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Palo Alto Networks Incorporated
• Inventors: Xie, Huagang
• Granted Patent: US 9,467,421 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Using DNS communications to filter domain names is disclosed. A domain name is extracted from a received DNS request. The received DNS request is blocked in response to determining based on a policy that access to the domain name of the DNS request is not permitted. In some cases, such a DNS request is responded to with a spoofed DNS response.

Claims

1. A system, comprising:

a processor configured to;

receive a DNS (Domain Name System) request;

extract a domain name from the DNS request;

determine based on a policy that access to the domain name is not permitted; and

block the DNS request; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. A system as recited in claim 1, wherein the processor is further configured to compare the domain name extracted from the DNS request with a list or database of domain names.

3. A system as recited in claim 1, wherein the processor is further configured to determine a category or classification of the domain name.

4. A system as recited in claim 1, wherein to determine based on a policy that access to the is domain name is not permitted comprises to determine that the domain name is included in a block list.

5. A system as recited in claim 4, wherein the block list is part of an enterprise policy for restricting access to a set of domain names.

6. A system as recited in claim 4, wherein the block list is associated with a set of users.

7. A system as recited in claim 1, wherein to determine based on a policy that access to the domain name is not permitted comprises to determine that the domain name is included in a black list.

8. A system as recited in claim 7, wherein the black list includes a set of suspect or malicious domain names.

9. A system as recited in claim 1, wherein the processor is further configured to spoof a DNS response to the DNS request.

10. A system as recited in claim 9, wherein the spoofed DNS response comprises a non-existent or invalid IP (Internet Protocol) address.

11. A system as recited in claim 1, wherein the processor is further configured to respond to the DNS request with an error or access denied message.

12. A method, comprising:

receiving a DNS (Domain Name System) request;

extracting a domain name from the DNS request;

determining based on a policy that access to the domain name is not permitted; and

blocking the DNS request.

13. A method as recited in claim 12, further comprising comparing the domain name extracted from the DNS request with a list or database of domain names.

14. A method as recited in claim 12, further comprising determining a category or classification of the domain name.

15. A method as recited in claim 12, wherein determining based on a policy that access to the domain name is not permitted comprises determining that the domain name is included in a block list or a black list.

16. A method as recited in claim 15, wherein the black list includes a set of suspect or malicious domain names.

17. A method as recited in claim 12, further comprising spoofing a DNS response to the DNS request.

18. A method as recited in claim 17, wherein the spoofed DNS response comprises a non-existent or invalid IP (Internet Protocol) address.

19. A method as recited in claim 12, further comprising responding to the DNS request with an error or access denied message.

20. A computer program product embodied in a computer readable storage medium and comprising computer instructions for:

receiving a DNS (Domain Name System) request;

extracting a domain name from the DNS request;

determining based on a policy that access to the domain name is not permitted; and

blocking the DNS request.