Recursive DNS nameserver

• US 9,444,781 B2
• Filed: 11/08/2013
• Issued: 09/13/2016
• Est. Priority Date: 06/14/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Ulevitch, David
• Primary Examiner(s): Donabed, Ninos
• Application Number:
  US14/075,868
• Publication Number:
  US 20140068051A1
• Time in Patent Office: 1,040 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses

Abstract

A recursive DNS server receives a request for domain name information associated with a domain name from a subscriber. In response to the request for domain name information, the recursive DNS nameserver determines a subscriber identifier and subscriber information associated with the subscriber identifier. The recursive DNS nameserver resolves the request for domain name information based on the subscriber information to generate a response to the request for domain name information. The recursive DNS nameserver then returns the response to the request for domain name information to the subscriber.

Claims

1. A computer-implemented method of processing Domain Name System requests, the method comprising:

storing at a DNS nameserver domain name records for a plurality of domain names associated with a plurality of different owners;

storing preferences provided by a subscriber that indicate how to resolve requests that are associated with the subscriber for domain name information from the DNS nameserver, the preferences applying across the plurality of domain names and including a substitution criterion for domain name records associated with a first flag;

receiving at the DNS nameserver from the subscriber a request for domain name information for a first domain name associated with a first domain name record;

receiving geographic location information related to the subscriber;

in response to the request, determining the preferences provided by the subscriber and the first domain name record;

in response to the first domain name record including the first flag, resolving the request for domain name information by obtaining substitute domain name information that satisfies the substitution criterion, wherein resolving the request for domain name information is based on the geographic location information related to the subscriber; and

generating a response to the request including the substitute domain name information in place of domain name information from the first domain name record.

2. The computer-implemented method of claim 1, the method further comprising:

storing preferences for each of a plurality of subscribers, the preferences for each subscriber including an indication of how to resolve requests for domain name information associated with one or more flags.

3. The computer-implemented method of claim 2, wherein:

the first flag indicates an association with suspicious activity; and

the substitute domain name information is unaffiliated with the first domain name.

4. The computer-implemented method of claim 3, wherein generating the response to the request includes:

based on the preferences associated with a first subscriber of the plurality of subscribers, generating an indication in the response to the request that the first domain name is associated with suspicious activity.

5. The computer-implemented method of claim 1, wherein:

resolving the request includes obtaining a substitute Uniform Resource Locator that satisfies the substitution criterion.

6. The computer-implemented method of claim 5, wherein the substitution criterion specifies an association between a Uniform Resource Locator in the request for domain name information that appears to be misspelled and the substitute Uniform Resource Locator.

7. The computer-implemented method of claim 5, wherein the substitution criterion specifies an association between a Uniform Resource Locator in the request for domain name information and a referrer identifier in the substitute Uniform Resource Locator.

8. A nameserver, comprising:

a communications interface configured to exchange data with a communications network;

a storage device maintaining domain name records for a plurality of domain names associated with a plurality of different owners, the one or more storage devices maintaining preferences provided by a subscriber that indicate how to resolve requests from the subscriber for domain name information from the nameserver, the preferences applying across the plurality of domain names and including a substitution criterion for domain name records associated with a first flag; and

a processor coupled to the communications interface and the storage device, the processor is configured to receive a request from the subscriber for domain name information of a first domain name associated with the first flag and geographic location information related to the subscriber, and to determine the preferences provided by the subscriber in response to the request, the processor is configured to resolve the request by obtaining substitute domain name information that satisfies the substitution criterion and based on the geographic location information related to the subscriber and to generate a response to the request including the substitute domain name information in place of domain name information for the first domain name.

9. The nameserver of claim 8, wherein:

the subscriber is a first subscriber; and

the storage device maintains a subscriber identifier and subscriber information for a plurality of subscribers including the first subscriber, the subscriber information including preferences for each subscriber, the preferences for each subscriber including an indication of how to resolve requests for domain name information associated with one or more flags.

10. The nameserver of claim 9, wherein:

the first flag indicates an association with suspicious activity; and

the substitute domain name information is unaffiliated with the first domain name.

11. The nameserver of claim 8, wherein:

resolving the request includes obtaining a substitute Uniform Resource Locator that satisfies the substitution criterion.

12. The nameserver of claim 11, wherein the substitution criterion specifies an association between a Uniform Resource Locator in the request for domain name information that appears to be misspelled and the substitute Uniform Resource Locator.

13. The nameserver of claim 11, wherein the substitution criterion specifies an association between a Uniform Resource Locator in the request for domain name information and a referrer identifier in the substitute Uniform Resource Locator.

14. A computer program product embodied on a tangible non-transitory computer readable medium containing instructions executable by a computer, the executable instructions comprising:

code for storing domain name records for a plurality of domain names, the plurality of domain name records including a first domain name record for a first domain name, the first domain name record being associated with a first flag;

code for storing preferences provided by a subscriber that indicate how to resolve requests that are associated with the subscriber for domain name information from the DNS nameserver, the preferences applying across the plurality of domain names and including a substitution criterion for domain name records associated with the first flag;

code for receiving a request for domain name information associated with the first domain name and for receiving geographic location information related to the subscriber;

code for determining the preferences provided by the subscriber and the first domain name record based on the request;

code for resolving the request for domain name information based on the subscriber information and the first flag by obtaining substitute domain name information that satisfies the substitution criterion, wherein resolving the request for domain name information is based on the geographic location information related to the subscriber, to generate a response to the request for domain name information, the response including substitute domain name information that satisfies the substitution criterion in place of domain name information associated with the first domain name; and

code for returning the response to the request for domain name information.

15. The computer program product of claim 14, further comprising:

code for receiving subscriber information from a plurality of subscribers, the subscriber information for each subscriber including an indication of how to resolve requests for domain name information associated with one or more flags.

16. The computer program product of claim 15, wherein:

the first flag indicates an association with suspicious activity; and

the substitute domain name information is unaffiliated with the first domain name.

17. The computer program product of claim 14, wherein:

resolving the request includes obtaining a substitute Uniform Resource Locator that satisfies the substitution criterion.

18. The computer program product of claim 17, wherein the substitution criterion specifies an association between a Uniform Resource Locator in the request for domain name information that appears to be misspelled and the substitute Uniform Resource Locator.

19. The computer program product of claim 17, wherein the substitution criterion specifies an association between a Uniform Resource Locator in the request for domain name information and a referrer identifier in the substitute Uniform Resource Locator.