User identity differentiated DNS resolution

• US 9,973,590 B2
• Filed: 11/27/2015
• Issued: 05/15/2018
• Est. Priority Date: 11/26/2011
• Status: Active Grant

• Current Assignee: Bing Wu
• Original Assignee: Bing Wu
• Inventors: Wu, Bing
• Primary Examiner(s): Lin, Kenny S
• Application Number:
  US14/953,022
• Publication Number:
  US 20170155645A1
• Time in Patent Office: 900 Days
• Field of Search: None
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching

Abstract

Systems and methods for DNS resolution based on user identities are provided herein. In the DNS name resolution process, a DNS resolver can construct and send DNS queries to different DNS name servers depending on the identities of the users requesting the name resolution. One embodiment may be a DNS forwarder configured in a home router, where DNS requests from a certain user group (e.g., kids) may be forwarded to OpenDNS Family Shield, while DNS requests from another user group (e.g., parents) may be forwarded to the ISP'"'"'s default DNS servers or Google Public DNS. In another embodiment, the DNS resolver may be integrated within an authenticating proxy server, wherein the DNS resolver may use different DNS name servers to perform DNS name resolution for different users authenticated by the proxy server.

Claims

1. A method for domain name system (DNS) resolution implemented in a computing device comprising:

at a domain name system (DNS) resolver, receiving, from a client, a request to resolve a domain name or multiple domain names into their corresponding IP address or IP addresses, and receiving, from the said client, authentication credentials that identify the user;

choosing, based on the user identity associated with the request, one or more recursive domain name servers from a plurality of recursive domain name system (DNS) servers available to the DNS resolver;

sending the DNS request to the chosen recursive domain name system server or servers for the purpose of resolving the requested domain name or names for the said client;

returning the response or responses from the chosen recursive domain name system server or servers back to the client.

2. the method of claim 1, wherein the user is authenticated by sending credentials directly to the domain name system (DNS) resolver.

3. the method of claim 1, wherein the user is authenticated by an application program.

4. the method of claim 1, wherein the user is authenticated by an operating system.

5. the method of claim 1, wherein the user is authenticated by a centralized authentication service.

6. the method of claim 1, wherein the user is authenticated by the identification of the client device.

7. the method of claim 1, wherein the user is authenticated by any other means of authentication service capable of identifying the user.

8. the method of claim 1, wherein responses from the chosen recursive domain name server or servers are stored in a local cache with specific allocations for each recursive domain name server or server group corresponding to specific user identity or user identities.

9. the method of claim 1, wherein the domain name system (DNS) resolver sends a response directly to the client based on data available in the local cache, or rules stored in storage media for the purpose of constructing an answer immediately by the DNS resolver, without consulting a recursive domain name server.

10. the method of claim 1, wherein the domain name system (DNS) resolver, based on user identity and rules configured for the DNS resolver, sends a DNS query for an alternate domain name in lieu of the original requested domain name to a recursive domain name server.

11. the method of claim 1, wherein the domain name system (DNS) resolver sends a domain name query to a DNS forwarder;

at the DNS forwarder, receiving the domain name query from the said domain name system (DNS) resolver;

at the DNS forwarder, sending the domain name query to the recursive domain name system (DNS) server chosen, based on user identity, by the domain name system (DNS) resolver to fulfill the domain name resolution request;

passing back the response or responses from the recursive domain name system (DNS) server to the client via the said DNS forwarder and the said DNS resolver.

12. the method of claim 11, wherein the DNS forwarder, instead of the DNS resolver, choses, based on the user identity associated with the request, the recursive DNS server to fulfill the domain name request.

13. the method of claim 11, wherein the user identity is verified by the DNS resolver in cooperation with the DNS forwarder.

14. the method of claim 11, wherein a plurality of DNS resolvers utilize the same DNS forwarder to communicate with a single or a plurality of recursive DNS name servers.

15. the method of claim 11, wherein responses from the chosen recursive domain name server servers are stored in a local cache in the DNS forwarder, with specific allocations for each recursive domain name server or server group corresponding to specific user identity or user identities.

16. the method of claim 11, wherein the DNS forwarder sends a response directly to the DNS resolver based on data available in the local cache of the DNS forwarder, or rules stored in storage media for the purpose of constructing an answer immediately by the DNS forwarder, without consulting a recursive domain name server.

17. the method of claim 11, wherein the DNS forwarder, based on user identity and rules configured for the DNS forwarder, sends a DNS query for an alternate domain name in lieu of the original requested domain name to a recursive domain name server.

18. A system for domain name system (DNS) resolution comprising:

a domain name system (DNS) resolver module to receive domain name system (DNS) resolution requests from a client;

an authentication module that authenticates users of clients sending domain name system (DNS) resolution requests to the domain name system (DNS) resolver;

a single or a plurality of recursive domain name system (DNS) servers that the domain name system (DNS) resolver is capable of communicating with; and

a configuration module comprising a set of configuration files or a database or other storage that enables one or more processors to chose, based on user identity and rules, the recursive domain name system (DNS) server or servers to use for domain name system (DNS) resolution requests from an authenticated user.

19. The system of claim 18, further comprising a user interface module for managing the configuration module that determines the recursive domain name system (DNS) server to use for domain name system (DNS) resolution requests from an authenticated user.

20. The system of claim 18, further comprising a domain name system (DNS) forwarder through which domain name system (DNS) queries are sent by the domain name system (DNS) resolver to the recursive domain name system (DNS) server.