Internet mediation

• US 10,263,958 B2
• Filed: 11/17/2015
• Issued: 04/16/2019
• Est. Priority Date: 03/18/2010
• Status: Active Grant

• Current Assignee: Akamai Technologies, Inc.
• Original Assignee: Nominum Incorporated (Akamai Technologies, Inc.)
• Inventors: Bremen, Brandon, Bremen, Erik, Wood, Jonathan P., Halley, Robert Thomas, Tovar, Tom C.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Sherkat, Arezoo
• Application Number:
  US14/943,908
• Publication Number:
  US 20160072847A1
• Time in Patent Office: 1,246 Days
• Field of Search: None
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A system for mediating Internet service includes a DNS server and a DNS policy engine associated with the DNS server. The DNS policy engine can be configured to apply one or more DNS policies selected by the DNS policy engine to DNS queries received by the DNS server from a client, analyze the DNS query based on predetermined criteria, and based on the analysis, and selectively redirect a data request associated with the client to a proxy server for further mediation. The system can further include a proxy server and a proxy policy engine associated with the proxy server. The proxy policy engine can be configured to apply one or more proxy policies selected by the proxy policy engine to at least one of data requests received by the proxy server from a client and data responses returned to the proxy server from an IP address.

Claims

1. A method for mediating Internet service, the method comprising:

A. at a DNS server;

receiving a Domain Name System (DNS) query associated with a client, the DNS query including a domain name to be resolved;

analyzing the DNS query based on predetermined criteria;

receiving a selection of a DNS policy from a policy engine;

applying the DNS policy to the DNS query;

based on the application of the DNS policy, redirecting a valid data request associated with the client to a proxy server for further mediation, said redirecting comprising;

responding to the DNS query with an IP address of the proxy server rather than with a defined IP address for the domain name;

B. at the proxy server;

receiving the valid data request from the client as a result of said redirection;

receiving a selection of proxy policy from a policy engine;

applying the proxy policy to the valid data request;

based on application of the proxy policy, performing any of;

(i) loading information from a different source than the one specified in the valid data request, and providing said information to the client in response to the valid data request, and

(ii) constructing a proxy data request in response to the valid data request, sending the proxy data request to an IP address corresponding to the domain name, receiving a data response to the proxy data request, and applying the proxy policy;

C. at the policy engine;

communicating with the DNS server to select the DNS policy to apply, wherein said selection of the DNS policy comprises selecting a policy entity from a collection of policy entities, the DNS policy and the proxy policy each being part of the selected policy entity;

communicating with the proxy server to select the proxy policy to apply, wherein said selection of the proxy policy comprises selecting the policy entity from the collection of policy entities, the DNS policy and the proxy policy each being part of the selected policy entity.

2. The method of claim 1, wherein applying the DNS policy includes one of the following actions:

tracking client behavior;

triggering an analytic action;

limiting a rate of the data traffic;

returning to the client a response to the DNS query, the response including an IP address of the proxy server;

returning to the client a response to the DNS query, the response including an error indication; and

returning no response to the client.

3. The method of claim 1, wherein the DNS policy is selected based at least on one of the following:

a subscriber associated with the client;

a domain name included in the DNS query;

a DNS answer;

an Extension Mechanisms for DNS (eDNS0) pseudo-resource record included in the DNS query; and

a time of the DNS query.

4. The method of claim 3, wherein the eDNS0 pseudo-resource record included in the DNS query includes a subnet address, the subnet address determining an identity of the client making the DNS request, the DNS policy being selected at least in part according to the identity of the client.

5. The method of claim 1, wherein the DNS policy is selected based on one or more of the following:

an IP address of a responding authoritative server, content of a resource record associated with the DNS answer, a result of the DNS query, a size of the DNS answer, and a type associated with DNS query.

6. The method of claim 1, wherein the proxy policy is selected based at least in part on one or more of the following:

a subscriber associated with the client;

a URL included in the valid data request;

the domain name received over HTTP or TLS protocol;

a time of the valid data request; and

a device type determined based on an inspection of the User-Agent header.

7. The method of claim 1, wherein applying the proxy policy includes one or more of the following actions:

tracking client behavior;

triggering an analytic action;

adding one or more fields included in a header and trailer of the valid data request;

modifying one or more fields included in a header and trailer of the valid data request;

replacing one or more fields included in a header and trailer of the valid data request;

removing one or more fields included in a header and trailer of the valid data request;

modifying a payload included in the valid data request;

replacing the payload included in the valid data request;

forwarding the valid data request to a destination Internet Protocol (IP) address;

returning a block page to the client;

creating a data response to the valid data request and returning it to the client;

returning an error response to the client; and

returning no response to the client.

8. The method of claim 1, wherein applying the proxy policy further includes one or more of the following actions:

adding one or more fields included in a header and trailer of the data response;

modifying one or more fields included in a header and trailer of the data response;

replacing one or more fields included in a header and trailer of the data response;

removing one or more fields included in a header and trailer of the data response;

modifying a payload included in the data response;

replacing the payload included in the data response;

returning the data response to the client;

returning a block page to the client;

returning a different data response to the client;

returning to the client a data response that causes the client to make additional requests to the proxy server;

returning an error response to the client; and

returning no response to the client.

9. The method of claim 8, comprising (i) loading information from a different source than the one specified in the valid data request, which comprises redirecting the valid data request based on a determination that a URL path in the valid data request refers to undesired content.

10. The method of claim 9, wherein the undesired content includes malware.

11. The method of claim 1, comprising (i) loading information from a different source than the one specified in the valid data request, which comprises the proxy server redirecting the valid data request.

12. A system for mediating Internet service, the system comprising:

A. a DNS server comprising at least one hardware processor and memory storing computer program instructions executed on the at least one hardware processor to cause the DNS server to;

receive a Domain Name System (DNS) query associated with a client, the DNS query including a domain name to be resolved;

analyze the DNS query based on predetermined criteria;

receive a selection of a DNS policy from a policy engine;

apply the DNS policy to the DNS query;

based on the application of the DNS policy, redirecting a valid data request associated with the client to a proxy server for further mediation, said redirection comprising;

responding to the DNS query with an IP address of the proxy server rather than with a defined IP address for the domain name;

B. the proxy server comprising at least one hardware processor and memory storing computer program instructions executed on the at least one hardware processor to cause the proxy server to;

receive the valid data request from the client as a result of said redirection;

receive a selection of proxy policy from a policy engine;

apply the proxy policy to the valid data request;

based on application of the proxy policy, perform any of;

(i) loading information from a different source than the one specified in the valid data request, and providing said information to the client in response to the valid data request, and

(ii) constructing a proxy data request in response to the valid data request, sending the proxy data request to an IP address corresponding to the domain name, receiving a data response to the proxy data request, and applying the proxy policy to the data response;

C. the policy engine comprising at least one hardware processor and memory storing computer program instructions executed on the at least one hardware processor to cause the policy engine to;

communicate with the DNS server to select the DNS policy to apply, wherein said selection of the DNS policy comprises selecting a policy entity from a collection of policy entities, the DNS policy and the proxy policy each being part of the selected policy entity;

communicate with the proxy server to select the proxy policy to apply, wherein said selection of the proxy policy comprises selecting the policy entity from the collection of policy entities, the DNS policy and the proxy policy each being part of the selected policy entity.

13. The system of claim 12, wherein the applying the DNS policy includes one or more of:

triggering an analytic action;

limiting a rate of the data traffic;

returning to the client a response to the DNS query, the response including an IP address of the proxy server;

returning to the client a response to the DNS query, the response including an error indication; and

returning no response to the client.

14. The system of claim 12, wherein applying the proxy policy includes at least one of the following:

triggering an analytic action;

tracking client behavior;

adding one or more fields included in a header and trailer of the valid data request;

modifying one or more fields included in a header and trailer of the valid data request;

replacing one or more fields included in a header and trailer of the valid data request;

removing one or more fields included in a header and trailer of the valid data request;

modifying a payload included in the valid data request;

replacing the payload included in the valid data request;

forwarding the valid data request to a destination IP address;

returning a block page to the client;

creating a data response to the valid data request and returning it to the client;

returning an error response to the client;

returning no response to the client;

modifying a payload included in a data response;

replacing the payload included in the data response;

returning the data response to the client;

returning a different data response to the client;

returning to the client a data response that causes the client to make additional requests to the proxy server; and

returning no response to the client.

15. One or more non-transitory computer-readable storage mediums having embodied thereon one or more programs, the one or more programs executed by one or more processors to perform a method for Internet mediation, the method comprising:

A. at a DNS server;

receiving a Domain Name System (DNS) query associated with a client, the DNS query including a domain name to be resolved;

analyzing the DNS query based on predetermined criteria;

receiving a selection of a DNS policy from a policy engine;

applying the DNS policy to the DNS query;

based on the application of the DNS policy, redirecting a valid data request associated with the client to a proxy server for further mediation, said redirecting comprising;

responding to the DNS query with an IP address of a proxy server rather than with a defined IP address for the domain name;

B. at the proxy server;

receiving the valid data request from the client as a result of said redirection;

receiving a selection of proxy policy from a policy engine;

applying the proxy policy to the valid data request;

based on application of the proxy policy, performing any of;

(i) loading information from a different source than the one specified in the valid data request, and providing said information to the client in response to the valid data request, and

(ii) constructing a proxy data request in response to the valid data request, sending the proxy data request to an IP address corresponding to the domain name, receiving a data response to the proxy data request, and applying the proxy policy to the data response;

C. at the policy engine;

communicating with the DNS server to select the DNS policy to apply, wherein said selection of the DNS policy comprises selecting a policy entity from a collection of policy entities, the DNS policy and the proxy policy each being part of the selected policy entity;

communicating with the proxy server to select the proxy policy to apply, wherein said selection of the proxy policy comprises selecting the policy entity from the collection of policy entities, the DNS policy and the proxy policy each being part of the selected policy entity.