Request routing processing

• US 9,930,131 B2
• Filed: 02/23/2015
• Issued: 03/27/2018
• Est. Priority Date: 11/22/2010
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: MacCarthaigh, Colm, Richardson, David R., Redman, Benjamin W. S.
• Primary Examiner(s): Katsikis, Kostas
• Application Number:
  US14/629,433
• Publication Number:
  US 20150172407A1
• Time in Patent Office: 1,128 Days
• Field of Search: 709226, 709222
• CPC Class Codes: H04L 2463/142 Denial of service attacks against network infrastructure
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 45/72 Routing based on the source address
• CPC Class Codes: H04L 61/3025 Domain name generation or assignment
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/1036 Load balancing of requests to servers for services different from user content provisioning, e.g. load balancing across domain name servers
• CPC Class Codes: H04L 67/566 Grouping or aggregating service requests, e.g. for unified processing

Abstract

Generally described, the present disclosure is directed to managing request routing functionality corresponding to resource requests for one or more resources associated with a content provider. The processing of the DNS requests by the service provider can include the selective filtering of DNS queries associated with a DNS query-based attack. A service provider can assign DNS servers corresponding to a distributed set of network addresses, or portions of network addresses, such that DNS queries exceeding a threshold, such as in DNS query-based attacks, can be filtered in a manner that can mitigate performance impact on for the content provider or service provider.

Claims

1. A computer-implemented method for managing DNS queries comprising:

determining, at a service provider, whether DNS queries associated with an identifiable domain exceed a threshold number of DNS queries that can be processed by a service provider;

determining, at the service provider, whether to filter the one or more DNS queries based on the threshold number of DNS queries; and

causing, at the service provider, the filtering of at least one of the one or more DNS queries based on the threshold number of DNS queries, wherein the filtering of the at least one or more DNS queries comprises filtering at least one of the one or more DNS queries based on assigned network addresses for a DNS server authoritative for the identified domain, and wherein causing the filtering of at least one of the one or more DNS queries based on the threshold number of DNS queries comprises causing the filtering of at least one or more DNS queries received at the service provider and directed to one or more assigned network address subdivisions or zones available to the service provider based on access control lists.

2. The computer-implemented method as recited in claim 1, wherein causing the filtering of at least one of the one or more DNS queries includes causing at least one of the one or more DNS queries to be answered by an alternative set of DNS servers.

3. The computer-implemented method as recited in claim 1, wherein causing the filtering of at least one of the one or more DNS queries includes transmitting a request to filter one or more DNS queries for domains in which service provider DNS servers are authoritative.

4. The computer-implemented method as recited in claim 1, wherein determining whether to filter the one or more DNS queries includes determining whether to filter based on a percentage of DNS queries allowed to be processed.

5. The computer-implemented method as recited in claim 1 further comprising obtaining, at the service provider, at least a portion of the one or more DNS queries associated with the identifiable domain.

6. The computer-implemented method as recited in claim 1 further comprising:

determining, at the service provider, whether DNS queries associated with a different identifiable domain exceed a threshold number of DNS queries that can be processed by a service provider; and

determining, by the service provider, not to filter the one or more DNS queries associated with a different identifiable domain, wherein the determination corresponds to a percentage of DNS queries allowed to be processed.

7. The computer-implemented method as recited in claim 2, wherein causing at least one of the one or more DNS queries to be answered by an alternative set of DNS servers includes forwarding the at least one of the one or more DNS queries to the alternative set of DNS servers.

8. A system for DNS query processing comprising:

a DNS query processor, at a service provider, coupled to memory and operative to;

obtain registration information for registering one or more content providers with the service provider, the registration corresponding to hosting at least a portion of request routing functionality associated with one or more resources provided by the content provider;

determine whether DNS queries associated with an identifiable domain exceed a threshold number of DNS queries that can be processed by the service provider;

determine whether to filter the one or more DNS queries based on the threshold number of DNS queries; and

cause the filtering of at least one of the one or more DNS queries based on the threshold number of DNS queries, wherein the filtering of the at least one or more DNS queries comprises filtering at least one of the one or more DNS queries based on assigned network addresses for a DNS server authoritative for the identified domain, and wherein causing the filtering of at least one of the one or more DNS queries based on the threshold number of DNS queries comprises causing the filtering of at least one or more DNS queries received at the service provider and directed to one or more assigned network address subdivisions or zones available to the service provider based on access control lists.

9. The system as recited in claim 8, wherein the range of available service provider network addresses corresponds to a plurality of network address zone such that each network address zone is defined according to a division of available network addresses for service provider DNS server components.

10. The system as recited in claim 8, wherein the DNS query processor is further operative to:

obtain one or more additional DNS queries, the additional DNS queries corresponding to the identifiable domain, wherein the DNS server component corresponds to a different assigned network from a range of available service provider network addresses;

associate the one or more DNS queries with the identified set of DNS queries exceeding a threshold number of DNS queries that can be processed by a service provider; and

determine not to filter the one or more DNS queries.

11. The system as recited in claim 8, wherein the DNS query processor selectively filters the DNS queries causing at least one of the one or more DNS queries to be answered by an alternative set of DNS servers.

12. The system as recited in claim 11, wherein the DNS query processor causes at least one of the one or more DNS queries to be answered by an alternative set of DNS servers by forwarding the at least one of the one or more DNS queries to the alternative set of DNS servers.

13. The system as recited in claim 8, wherein the DNS query processor determines whether to filter the one or more DNS queries based on the associated set of DNS queries based on a percentage of DNS queries allowed to be processed.

14. A non-transitory, computer-readable storage medium having one or more computer-executable components for managing DNS queries, the one or more computer-executable components comprising computer-executable instructions to:

determine, at a service provider, whether DNS queries associated with an identifiable domain exceed a threshold number of DNS queries that can be processed by a service provider;

determine, at the service provider, whether to filter the one or more DNS queries based on the threshold number of DNS queries; and

cause, at the service provider, the filtering of at least one of the one or more DNS queries based on the threshold number of DNS queries, wherein the filtering of the at least one or more DNS queries comprises filtering at least one of the one or more DNS queries based on assigned network addresses for a DNS server authoritative for the identified domain, and wherein causing the filtering of at least one of the one or more DNS queries based on the threshold number of DNS queries comprises causing the filtering of at least one or more DNS queries received at the service provider and directed to one or more assigned network address subdivisions or zones available to the service provider based on access control lists.

15. The computer-readable storage medium as recited in claim 14, wherein determining whether to filter the one or more DNS queries includes determining whether to filter based on a percentage of DNS queries allowed to be processed.

16. The computer-readable storage medium as recited in claim 14, wherein causing the filtering of at least one of the one or more DNS queries includes causing at least one of the one or more DNS queries to be answered by an alternative set of DNS servers.

17. The computer-readable storage medium as recited in claim 16, wherein causing at least one of the one or more DNS queries to be answered by an alternative set of DNS servers includes forwarding the at least one of the one or more DNS queries to the alternative set of DNS servers.

18. The computer-readable storage medium as recited in claim 14, wherein causing the filtering of at least one of the one or more DNS queries includes transmitting a request to filter one or more DNS queries for domains in which service provider DNS servers are authoritative.