Recursive DNS Nameserver

• US 20140068051A1
• Filed: 11/08/2013
• Published: 03/06/2014
• Est. Priority Date: 06/14/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: OpenDNS Incorporated (Cisco Systems, Inc.)
• Inventors: Ulevitch, David
• Granted Patent: US 9,444,781 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/4552 Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses

Abstract

A recursive DNS server receives a request for domain name information associated with a domain name from a subscriber. In response to the request for domain name information, the recursive DNS nameserver determines a subscriber identifier and subscriber information associated with the subscriber identifier. The recursive DNS nameserver resolves the request for domain name information based on the subscriber information to generate a response to the request for domain name information. The recursive DNS nameserver then returns the response to the request for domain name information to the subscriber.

Claims

1-36. -36. (canceled)

37. A computer-implemented method of processing Domain Name System requests, the method comprising:

storing at a DNS nameserver domain name records for a plurality of domain names associated with a plurality of different owners;

storing preferences provided by a set of subscribers that indicate how to resolve requests that are associated with each subscriber for domain name information from the DNS nameserver, the preferences applying across the plurality of domain names;

receiving at the DNS nameserver from the set of subscribers a plurality of requests for domain name information;

for each request, determining the preferences provided by a corresponding subscriber;

resolving each request for domain name information based on the preferences of the corresponding subscriber associated with the request; and

generating a response to each request including domain name information based on resolving the request using the preferences of the corresponding subscriber.

38. The computer-implemented method of claim 37, wherein:

storing preferences by the set of subscribers includes storing a subscriber identifier and subscriber information including the preferences for each subscriber, the preferences for each subscriber including an indication of how to resolve requests for domain name information associated with one or more flags.

39. The computer-implemented method of claim 38, wherein:

the domain name records include a subset of domain name records having a first flag indicating an association with suspicious activity;

the preferences include a preference for resolving requests associated with the subset of domain name records having the first flag;

the plurality of requests include a first request associated with a first subscriber; and

the response to the first request includes substitute domain name information that is unaffiliated with the first domain name based on the preferences of the first subscriber for the first flag.

40. The computer-implemented method of claim 39, wherein generating the response to each request includes:

based on the preferences associated with the first subscriber, generating an indication in the response to the first request that the first domain name is associated with suspicious activity.

41. The computer-implemented method of claim 37, wherein:

the plurality of requests include a first request associated with a first subscriber; and

resolving the first request includes obtaining a substitute Uniform Resource Locator that satisfies a substitution criterion for the first domain name based on the preferences of the first subscriber.

42. The computer-implemented method of claim 41, wherein the substitution criterion specifies an association between a Uniform Resource Locator in the request for domain name information that appears to be misspelled and the substitute Uniform Resource Locator.

43. The computer-implemented method of claim 41, wherein the substitution criterion specifies an association between a Uniform Resource Locator in the request for domain name information and a referrer identifier in the substitute Uniform Resource Locator.

44. The computer-implemented method of claim 41, further comprising:

receiving geographic location information related to the first subscriber; and

resolving the request for domain name information based on the geographic location information related to the first subscriber.

45. A nameserver, comprising:

a communications interface configured to exchange data with a communications network;

a storage device maintaining domain name records for a plurality of domain names associated with a plurality of different owners, the one or more storage devices maintaining preferences provided by a plurality of subscribers that indicate how to resolve requests from each subscriber for domain name information from the nameserver, the preferences for each subscriber applying across the plurality of domain names; and

a processor coupled to the communications interface and the storage device, the processor is configured to receive requests from the plurality of subscribers for domain name information and to determine the preferences provided by a subscriber corresponding to the request, the processor resolves each request based on the preferences of the corresponding subscriber and generates a response to each request including domain name information based on resolving the request using the preferences of the corresponding subscriber.

46. The nameserver of claim 45, wherein:

the storage device maintains a subscriber identifier and subscriber information for each subscriber including the preferences for each subscriber, the preferences for each subscriber including an indication of how to resolve requests for domain name information associated with one or more flags.

47. The nameserver of claim 46, wherein:

the domain name records include a subset of domain name records having a first flag indicating an association with suspicious activity;

the preferences include a preference for resolving requests associated with the subset of domain name records having the first flag;

the plurality of requests include a first request associated with a first subscriber; and

the response to the first request includes substitute domain name information that is unaffiliated with the first domain name based on the preferences of the first subscriber for the first flag.

48. The nameserver of claim 45, wherein:

the plurality of requests include a first request associated with a first subscriber; and

resolving the first request includes obtaining a substitute Uniform Resource Locator that satisfies a substitution criterion for the first domain name based on the preferences of the first subscriber.

49. The nameserver of claim 48, wherein the substitution criterion specifies an association between a Uniform Resource Locator in the request for domain name information that appears to be misspelled and the substitute Uniform Resource Locator.

50. The nameserver of claim 48, wherein the substitution criterion specifies an association between a Uniform Resource Locator in the request for domain name information and a referrer identifier in the substitute Uniform Resource Locator.

51. A computer program product embodied on a tangible computer readable medium containing instructions executable by a computer, the executable instructions comprising:

code for receiving subscriber information from a subscriber of recursive domain name resolution services, the subscriber information including a set of preferences that indicate how to resolve requests associated with the subscriber for domain name information;

code for receiving a request for domain name information associated with a domain name;

code for determining a subscriber identifier and subscriber information in response to the request for domain name information;

code for resolving the request for domain name information based on the subscriber information to generate a response to the request for domain name information; and

code for returning the response to the request for domain name information.

52. The computer program product of claim 51, wherein:

the set of preferences for each subscriber include an indication of how to resolve requests for domain name information associated with one or more flags.

53. The computer program product of claim 52, wherein:

the domain name records include a subset of domain name records having a first flag indicating an association with suspicious activity;

the set of preferences include a preference for resolving requests associated with the subset of domain name records having the first flag;

the plurality of requests include a first request associated with a first subscriber; and

the response to the first request includes substitute domain name information that is unaffiliated with the first domain name based on the preferences of the first subscriber for the first flag.

54. The computer program product of claim 51, wherein:

the plurality of requests include a first request associated with a first subscriber; and

resolving the first request includes obtaining a substitute Uniform Resource Locator that satisfies a substitution criterion for the first domain name based on the preferences of the first subscriber.

55. The computer program product of claim 54, wherein the substitution criterion specifies an association between a Uniform Resource Locator in the request for domain name information that appears to be misspelled and the substitute Uniform Resource Locator.

56. The computer program product of claim 54, wherein the substitution criterion specifies an association between a Uniform Resource Locator in the request for domain name information and a referrer identifier in the substitute Uniform Resource Locator.