Domain policy specification and enforcement

• US 9,344,454 B1
• Filed: 06/27/2014
• Issued: 05/17/2016
• Est. Priority Date: 04/11/2012
• Status: Expired due to Fees

• Current Assignee: Artemis Internet Inc.
• Original Assignee: Artemis Internet Inc.
• Inventors: Stamos, Alexander Charles
• Primary Examiner(s): Lagor, Alexander
• Application Number:
  US14/318,394
• Time in Patent Office: 690 Days
• Field of Search: 726/1
• US Class Current: 1/1
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Determining that a domain is a candidate for processing by a domain policy enforcement system is disclosed herein. A DNS request is received. A domain included in the request is sent to a domain policy enforcement system. Also disclosed herein are a specification of domain policies and enforcement of domain policies, usable by the domain policy enforcement system.

Claims

1. A system, comprising:

an interface configured to;

receive a DNS request;

a processor configured to;

determine that a first domain included in the received DNS request is an NXDOMAIN, and following the determination that the first domain is an NXDOMAIN, increase a count value associated with the first domain; and

in response to determining that the count value associated with the first domain has exceeded a threshold, provide the first domain to a domain policy enforcement system, wherein the domain policy enforcement system is configured to determine whether a resource reachable via an input domain name is in compliance with one or more policies associated with at least a portion of the input domain name; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1 wherein the processor is further configured to alert a domain technical contact in conjunction with providing the first domain to the domain policy enforcement system.

3. The system of claim 1 wherein the domain policy enforcement system is configured to determine whether the resource is in compliance with a policy associated with a top level domain.

4. The system of claim 3 wherein the policy associated with the top level domain comprises a set of minimum requirements applicable to all second level domains of the top level domain.

5. The system of claim 1 wherein the domain policy enforcement system is configured to determine whether the resource is in compliance with a policy associated with a second level domain.

6. The system of claim 1 wherein the request is received in response to a DNS query.

7. The system of claim 1 wherein the request is received as log data collected from a nameserver.

8. The system of claim 1 wherein the interface is configured to receive the request and wherein the processor is configured to provide the first domain to the domain policy enforcement system in conjunction with a batch process.

9. The system of claim 1 wherein determining whether the resource is in compliance with one or more policies includes scanning the resource for a presence of a malicious element.

10. A method, comprising:

receiving a DNS request;

determining that a first domain included in the received DNS request is an NXDOMAIN, and following the determination that the first domain is an NXDOMAIN, increasing a count value associated with the first domain; and

in response to determining that the count value associated with the first domain has exceeded a threshold, providing the first domain to a domain policy enforcement system, wherein the domain policy enforcement system is configured to determine whether a resource reachable via an input domain name is in compliance with one or more policies associated with at least a portion of the input domain name.

11. The method of claim 10 further comprising alerting a domain technical contact in conjunction with providing the first domain to the domain policy enforcement system.

12. The method of claim 10 wherein the domain policy enforcement system is configured to determine whether the resource is in compliance with a policy associated with a top level domain.

13. The method of claim 10 wherein the domain policy enforcement system is configured to determine whether the resource is in compliance with a policy associated with a second level domain.

14. The method of claim 10 wherein the request is received in response to a DNS query.

15. The method of claim 10 wherein the request is received as log data collected from a nameserver.

16. The method of claim 10 wherein determining whether the resource is in compliance with one or more policies includes scanning the resource for a presence of a malicious element.

17. The method of claim 12 wherein the policy associated with the top level domain comprises a set of minimum requirements applicable to all second level domains of the top level domain.

18. The method of claim 10 wherein the request is received and the first domain is provided to the domain policy enforcement system in conjunction with a batch process.