WEBSITE FILTERING USING BIFURCATED DOMAIN NAME SYSTEM

• US 20180007054A1
• Filed: 06/30/2016
• Published: 01/04/2018
• Est. Priority Date: 06/30/2016
• Status: Active Grant

• Current Assignee: Calix Incorporated
• Original Assignee: Calix Incorporated
• Inventors: Els, Henning, Ferre, Miguel A. Alonso
• Granted Patent: US 10,469,499 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

Systems and techniques for website filtering using bifurcated domain name system are described herein. A domain name system (DNS) request may be received. An internet address for a DNS service of an internet service provider (ISP) and an internet address for a DNS service provider external to the ISP may be determined. The ISP may provide external network services to the services gateway. The DNS service provider may maintain a website filtering list. The DNS request may be forwarded to the internet address for the DNS service of the ISP and the internet address of the DNS service provider external to the ISP. A first response and a second response to the DNS request may be received from the respective DNS services. A DNS request response may be transmitted to a client computing device connected to an internal network of the services gateway upon receipt of the first and second responses.

Claims

1. A services gateway for website filtering using bifurcated domain name system (DNS), the services gateway comprising:

one or more processors; and

at least one memory including instructions that, when executed by the one or more processors, cause the one or more processors to perform operations to;

receive a DNS request, the DNS request including a hostname corresponding to a website;

determine a first internet address for a DNS service of an internet service provider (ISP), the ISP providing external network services to the services gateway;

determine a second internet address for a DNS service provider external to the ISP, the DNS service provider maintaining a website filtering list;

forward the DNS request to both the first internet address for the DNS service of the ISP and the second internet address of the DNS service provider external to the ISP;

receive a first response to the DNS request from the DNS service of the ISP;

receive a second response to the DNS request from the DNS service provider external to the ISP; and

transmit, upon receipt of both the first response and the second response, a DNS request response to a client computing device, the client computing device connected to an internal network provided by the services gateway.

2. The services gateway of claim 1, wherein the instructions to transmit the DNS request response to the client computing device include instructions to forward the response to the DNS request received from the DNS service of the ISP.

3. The services gateway of claim 1, wherein the second response to the DNS request includes a message that the website has been blocked by the DNS service provider external to the ISP.

4. The services gateway of claim 1, wherein the instructions further cause the one or more processors to perform operations to:

determine an identifier of a sender of the DNS request;

forward the identifier of the sender to the DNS service provider external to the ISP along with the DNS request; and

wherein the second response received from the DNS service external to the ISP includes the identifier of the sender, and wherein the client computing device corresponds to the identifier of the sender.

5. The services gateway of claim 4, wherein the identifier is an internal internet protocol (IP) address of the sender of the DNS request, the IP address being issued by the services gateway.

6. The services gateway of claim 1, wherein the DNS request is received from a computing device connected to an internal network provided by the services gateway.

7. At least one machine readable medium including instructions for website filtering using bifurcated domain name system (DNS) that, when executed by a machine, cause the machine to perform operations to:

receive a DNS request, the DNS request including a hostname corresponding to a website;

determine a first internet address for a DNS service of an internet service provider (ISP), the ISP providing external network services to the services gateway;

determine a second internet address for a DNS service provider external to the ISP, the DNS service provider maintaining a website filtering list;

forward the DNS request to both the first internet address for the DNS service of the ISP and the second internet address of the DNS service provider external to the ISP;

receive a first response to the DNS request from the DNS service of the ISP;

receive a second response to the DNS request from the DNS service provider external to the ISP; and

transmit, upon receipt of both the first response and the second response, a DNS request response to a client computing device, the client computing device connected to an internal network provided by the services gateway.

8. The at least one machine readable medium of claim 7, wherein the instructions to transmit the DNS request response to the client computing device include instructions to forward the response to the DNS request received from the DNS service of the ISP.

9. The at least one machine readable medium of claim 7, wherein the second response to the DNS request includes a message that the website has been blocked by the DNS service provider external to the ISP.

10. The at least one machine readable medium of claim 7, wherein the instructions further cause the one or more processors to perform operations to:

determine an identifier of a sender of the DNS request;

forward the identifier of the sender to the DNS service provider external to the ISP along with the DNS request; and

wherein the second response received from the DNS service external to the ISP includes the identifier of the sender, and wherein the client computing device corresponds to the identifier of the sender.

11. The at least one machine readable medium of claim 10, wherein the identifier is an internal internet protocol (IP) address of the sender of the DNS request, the IP address being issued by the services gateway.

12. The at least one machine readable medium of claim 7, wherein the DNS request is received from a computing device connected to an internal network provided by the services gateway.

13. A method for website filtering using bifurcated domain name system (DNS), the method comprising:

receiving, by a services gateway, a DNS request, the DNS request including a hostname corresponding to a website;

determining a first internet address for a DNS service of an internet service provider (ISP), the ISP providing external network services to the services gateway;

determining a second internet address for a DNS service provider external to the ISP, the DNS service provider maintaining a website filtering list;

forwarding the DNS request to both the first internet address for the DNS service of the ISP and the second internet address of the DNS service provider external to the ISP;

receiving a first response to the DNS request from the DNS service of the ISP;

receiving a second response to the DNS request from the DNS service provider external to the ISP; and

transmitting, upon receiving both the first response and the second response, a DNS request response to a client computing device, the client computing device connected to an internal network provided by the services gateway.

14. The method of claim 13, wherein transmitting the DNS request response to the client computing device includes forwarding the response to the DNS request received from the DNS service of the ISP.

15. The method of claim 13, wherein receiving the second response to the DNS request includes receiving a message that the website has been blocked by the DNS service provider external to the ISP.

16. The method of claim 13, further comprising:

determining an identifier of a sender of the DNS request;

forwarding the identifier of the sender to the DNS service provider external to the ISP along with the DNS request; and

wherein receiving the second response from the DNS service external to the ISP includes receiving the identifier of the sender, and wherein the client computing device corresponds to the identifier of the sender.

17. The method of claim 16, wherein determining the identifier of the sender includes determining an internal internet protocol (IP) address of the sender of the DNS request, the IP address being issued by the services gateway.

18. The method of claim 13, wherein receiving the DNS request includes receiving the DNS request from a computing device connected to an internal network provided by the services gateway.

19. A domain name system (DNS) service for website filtering using bifurcated DNS, the DNS service comprising:

one or more processors; and

at least one memory including instructions that, when executed by the one or more processors, cause the one or more processors to perform operations to;

receive a DNS request forwarded by a services gateway;

extract from the DNS request a hostname corresponding to a website;

resolve the hostname to an internet address;

compare the internet address to a website filtering list; and

transmit a response to the DNS request to the services gateway based on the comparison.

20. The DNS service of claim 19, wherein the website filtering list includes one or more internet addresses.

21. The DNS service of claim 19, wherein the instructions further cause the one or more processors to perform operations to:

receive an identifier for a computing device that sent the DNS request to the services gateway,

wherein the website filtering list is selected using the identifier.

22. The DNS service of claim 19, wherein the instructions further cause the one or more processors to perform operations to:

receive a website category from a user;

determine a set of internet addresses using the website category; and

create the website filtering list using the generated website filtering.