INTERNET MEDIATION

• US 20160072847A1
• Filed: 11/17/2015
• Published: 03/10/2016
• Est. Priority Date: 03/18/2010
• Status: Active Application

• Current Assignee: Akamai Technologies, Inc.
• Original Assignee: Nominum Incorporated (Akamai Technologies, Inc.)
• Inventors: Halley, Robert Thomas, Tovar, Tom C., Bremen, Brandon, Bremen, Erik, Wood, Jonathan P.
• Granted Patent: US 10,263,958 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A system for mediating Internet service includes a DNS server and a DNS policy engine associated with the DNS server. The DNS policy engine can be configured to apply one or more DNS policies selected by the DNS policy engine to DNS queries received by the DNS server from a client, analyze the DNS query based on predetermined criteria, and based on the analysis, and selectively redirect a data request associated with the client to a proxy server for further mediation. The system can further include a proxy server and a proxy policy engine associated with the proxy server. The proxy policy engine can be configured to apply one or more proxy policies selected by the proxy policy engine to at least one of data requests received by the proxy server from a client and data responses returned to the proxy server from an IP address.

Claims

1. A method for mediating Internet service, the method comprising:

receiving a Domain Name System (DNS) query associated with a client, the DNS query including a domain name to be resolved;

analyzing the DNS query based on predetermined criteria; and

based on the analysis, selectively redirecting a data request associated with the client to a proxy server for further mediation.

2. The method of claim 1, further comprising applying at least one DNS policy to the DNS query.

3. The method of claim 2, wherein the at least one DNS policy is selected by a DNS policy engine associated with the DNS server.

4. The method of claim 2, wherein applying the DNS policy includes one of the following actions:

tracking client behavior;

triggering an analytic action;

limiting a rate of the data traffic;

returning to the client a response to the DNS query, the response including an IP address of one of;

an Internet service represented by the domain name included in the DNS query;

another Internet service;

the proxy server; and

a block page;

returning to the client a response to the DNS query, the response including an error indication; and

returning no response to the client.

5. The method of claim 2, wherein the DNS policy is selected based at least on one of the following:

a subscriber associated with the client;

a domain name included in the DNS query;

a DNS answer;

an Extension Mechanisms for DNS (eDNS0) pseudo-resource record included in the DNS query; and

a time of with the DNS query.

6. The method of claim 5, wherein the eDNS0 pseudo-resource record included in the DNS query includes a subnet address, the subnet address determining an identity of the client making the DNS request, the DNS policy being selected at least in part according to the identity of the client.

7. The method of claim 5, wherein the DNS policy is selected based on one or more of the following:

an IP address of a responding authoritative server, content of a resource record associated with the DNS answer, a result of the DNS query, a size of the DNS answer, and a type associated with DNS query.

8. The method of claim 1, further comprising applying, by the proxy server, at least one proxy policy to the data request.

9. The method of claim 8, wherein the DNS policy and the proxy policy are parts of the same policy entity.

10. The method of claim 8, wherein the at least one proxy policy is selected by a proxy policy engine associated with the proxy server.

11. The method of claim 7, wherein the at least one proxy policy is selected based at least in part on the following:

a subscriber associated with the client;

a URL included in the data request;

the domain name received over HTTP or TLS protocol;

a time of the data request; and

a device type determined based on an inspection of the User-Agent header.

12. The method of claim 7, wherein applying the proxy policy includes one or more of the following actions:

tracking client behavior;

triggering an analytic action;

adding one or more fields included in a header and trailer of the data request;

modifying one or more fields included in a header and trailer of the data request;

replacing one or more fields included in a header and trailer of the data request;

removing one or more fields included in a header and trailer of the data request;

modifying a payload included in the data request;

replacing the payload included in the data request;

forwarding the data request to a destination Internet Protocol (IP) address;

returning a block page to the client;

creating a data response to the data request and returning it to the client;

returning an error response to the client; and

returning no response to the client.

13. The method of claim 7, wherein applying the proxy policy further includes one or more of the following actions:

adding one or more fields included in a header and trailer of the data response;

modifying one or more fields included in a header and trailer of the data response;

replacing one or more fields included in a header and trailer of the data response;

removing one or more fields included in a header and trailer of the data response;

modifying a payload included in the data response;

replacing the payload included in the data response;

returning the data response to the client;

returning a block page to the client;

returning a different data response to the client;

returning to the client a data response that causes the client to make additional requests to the proxy server;

returning an error response to the client; and

returning no response to the client.

14. The method of claim 13, further comprising redirecting the data request based on a determination that the URL path refers to undesired content.

15. The method of claim 14, wherein the undesired content includes malware.

16. The method of claim 1, wherein the proxy server redirects the data request to a different IP address than the one included in the data request received from the client.

17. A system for mediating Internet service, the system comprising:

a DNS server;

a DNS policy engine associated with the DNS server, the DNS policy engine being configured to;

apply one or more DNS policies selected by the DNS policy engine to DNS queries received by the DNS server from a client;

analyze the DNS query based on predetermined criteria;

based on the analysis, selectively redirect a data request associated with the client to a proxy server for further mediation;

a proxy server;

a proxy policy engine associated with the proxy server, the proxy policy engine being configured to apply one or more proxy policies selected by the proxy policy engine to at least one of data requests received by the proxy server from a client and data responses returned to the proxy server from an IP address.

18. The system of claim 17, wherein applying a DNS policy includes one or more of:

triggering an analytic action;

limiting a rate of the data traffic;

returning to the client a response to the DNS query, the response including an IP address of one of an Internet service represented by the domain name included in the DNS query, another Internet service, the proxy server, and a block page;

returning to the client a response to the DNS query, the response including an error indication; and

returning no response to the client

19. The system of claim 17, wherein applying a proxy policy includes at least one of the following:

triggering an analytic action;

tracking client behavior, adding one or more fields included in a header and trailer of the data request, modifying one or more fields included in a header and trailer of the data request, replacing one or more fields included in a header and trailer of the data request, removing one or more fields included in a header and trailer of the data request, modifying a payload included in the data request;

replacing the payload included in the data request, forwarding the data request to a destination IP address, returning a block page to the client, creating a data response to the data request and returning it to the client;

returning a block page to the client, returning an error response to the client, returning no response to the client, modifying a payload included in a data response, replacing the payload included in the data response, returning the data response to the client, returning a block page to the client, returning a different data response to the client, returning to the client a data response that causes the client to make additional requests to the proxy server, returning an error response to the client, and returning no response to the client.

20. A computer-readable storage medium having embodied thereon a program, the program executable by a processor to perform a method for Internet mediation, the method comprising:

receiving a Domain Name System (DNS) query associated with a client, the DNS query including a domain name to be resolved;

analyzing the DNS query based on predetermined criteria; and

based on the analysis, selectively redirecting a data request associated with the client to a proxy server for further mediation.