Per-request control of DNS behavior

• US 8,713,188 B2
• Filed: 12/15/2008
• Issued: 04/29/2014
• Est. Priority Date: 12/13/2007
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: OpenDNS Incorporated (Cisco Systems, Inc.)
• Inventors: Treuhaft, Noah
• Primary Examiner(s): SALL, EL HADJI MALICK
• Application Number:
  US12/335,432
• Publication Number:
  US 20090157889A1
• Time in Patent Office: 1,961 Days
• Field of Search: 709/203, 709/219, 709/223, 709/230, 709/239, 709/245, 709/45, 709/246, 709/2, 709/229, 709/200, 709/224
• US Class Current: 709/229
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

In various embodiments, a user or subscriber of a domain name system (DNS) service that provides various DNS resolution options or features, such as misspelling redirection, parental filters, domain blocking, or phishing protection through the DNS process, can influence how requests for domain name (DNS) information are handled on a per-request basis. The user or subscriber may configure the DNS client software of their personal computer or configure their broadband router to provide control information to a DNS server with DNS resolution options that enables the DNS server to resolve DNS queries with the DNS resolution options on a per-request basis. As a result, the user can mitigate exposure to pop-ups, pop-unders, banner ads, fraudulent offers, malware, viruses, or the like, from websites using the domain name system.

Claims

1. A method for resolving domain name system (DNS) queries, the method comprising:

configuring a second computer system to service DNS queries using a plurality of options for resolving domain names into IP addresses;

receiving a DNS query from a first computer system at the second computer system, the DNS query including control information provided by the first computer system that enables the second computer system to identify whether to use one or more of the plurality of options when resolving the DNS query;

parsing a domain name and the control information from the DNS query with the second computer system;

determining an IP address with the second computer system using the one or more options for resolving DNS queries based on the domain name and the control information; and

generating a DNS response for the DNS query with the second computer system using the determined IP address;

wherein receiving the DNS query from the first computer system comprises receiving the DNS query with the control information encoding one or more settings provided by a subscriber that enable or disable the one or more options, the one or more settings being controllable by the subscriber to provide per-query control for said determining the IP address when resolving the DNS query.

2. The method of claim 1 wherein receiving the DNS query from the first computer system comprises receiving the DNS query with the control information further encoding information identifying the subscriber.

3. The method of claim 1 wherein determining the IP address with the second computer system using the one or more options based on the domain name and the control information comprises:

resolving the IP address based on the domain name and the one or more settings of the at least one option.

4. The method of claim 3 wherein the one or more settings include a setting for at least one of a malformed domain name option, a proxy option, a security option, a phishing option, a parental filter option, a lingerie option, a mature option, nudity option, a pornography option, or a sexuality option.

5. The method of claim 1 further comprising sending the DNS response to the first computer system from the second computer system;

and

wherein an application uses the IP address specified in the DNS response that is different than an IP address associated with the domain name.

6. A system for resolving domain name system (DNS) queries, the system comprising:

a communications interface configured to receive DNS queries via a communications network;

one or more storage devices maintaining a plurality of options for resolving DNS queries; and

a processor configured to;

receive subscriber information from a first subscriber of domain name resolution services, the subscriber information including one or more user-controllable settings that enable or disable one or more of the plurality of options;

store the subscriber information in the one or more storage devices;

receive a DNS query via the communications interface from a network device after storing the subscriber information, the DNS query including control information provided by the network device that encodes an index specifying a location of the subscriber information for the first subscriber;

parse a domain name and the control information from the DNS query;

determine an IP address based on the domain name and the one or more user-controllable settings for the one or more options; and

generate a DNS response for the DNS query using the determined IP address.

7. The system of claim 6 wherein the processor is further configured to receive the DNS query with the control information encoding one or more additional settings associated with the one or more options.

8. The system of claim 6 wherein the processor is configured to receive the DNS query with the control information encoding information identifying the first subscriber.

9. The system of claim 6 wherein the processor is further configured to:

identify an additional setting in the control information for the one or more options; and

resolve the IP address based on the domain name and the additional setting for the one or more options to determine the IP address.

10. The system of claim 6 wherein the processor is further configured to:

identify the one or more user-controllable settings using the control information; and

resolve an IP address based on the domain name and the one or more user-controllable settings for the one or more options to determine the IP address.

11. The system of claim 6 wherein the processor is further configured to send the DNS response to the network device;

and

wherein an application uses the IP address specified in the DNS response that is different than an IP address associated with the domain name.

12. A network device comprising:

a communications interface;

one or more storage devices; and

a processor configured to receive from a first subscriber one or more user-controllable settings having a correspondence to one or more options at a domain name server for resolving DNS queries, the processor further configured to store the one or more user-controllable settings in the one or more storage devices and thereafter, to receive a request from an application to resolve a domain name into an Internet Protocol (IP) address, to generate a DNS query based on the request, to modify the DNS query to encode the one or more user-controllable settings from the first subscriber, to send the modified DNS query to the domain name server, to receive a DNS response for the modified DNS query, and to forward an IP address associated with the DNS response to the application.

13. The network device of claim 12 wherein the application communicates with a computer system at the IP address which is different from an IP address associated with the domain name requested by the application.

14. A tangible computer-readable storage memory configured to store a computer-executable program for resolving domain name system (DNS) queries, the computer-readable storage memory comprising:

code for receiving subscriber information from a first subscriber and a second subscriber of recursive domain name resolution services, the subscriber information including a first set of one or more user-controllable settings provided by the first subscriber for resolving domain names into IP addresses using one or more options at a second computer system and a second set of one or more user-controllable settings provided by the second subscriber for resolving domain names into IP addresses using the one or more options at the second computer system;

code for storing the subscriber information;

code for receiving a first DNS query from a first computer system, the first DNS query including first control information that enables the second computer system to identify a location of the first set of one or more user-controllable settings, the first computer system being associated with a first IP address;

code for parsing a first domain name and the first control information from the first DNS query;

code for determining a second IP address using at least one of the one or more options for resolving DNS queries based on the first domain name and the first set of one or more user-controllable settings;

code for generating a first DNS response for the first DNS query using the second IP address;

code for receiving a second DNS query from the first computer system, the second DNS query including second control information that enables the second computer system to identify a location of the second set of one or more user-controllable settings;

code for parsing the first domain name and the second control information from the second DNS query;

code for determining a third IP address using at least one of the one or more options for resolving DNS queries based on the first domain name and the second set of one or more user-controllable settings; and

code for generating a second DNS response for the second DNS query using the third IP address.

15. The computer-readable storage memory of claim 14 wherein the code for receiving the first DNS query further comprises code for receiving the first DNS query with the first control information encoding additional settings associated with the one or more options.

16. The computer-readable storage memory of claim 14 wherein the code for receiving the first DNS query comprises code for receiving the first DNS query with the control information encoding information identifying the first subscriber.

17. The computer-readable storage memory of claim 14 wherein the code for determining the second IP address using the at least one of the one or more options based on the domain name and the first set of user-controllable settings further comprises:

code for identifying an additional setting in the control information for the at least one of the one or more options; and

code for resolving the IP address based on the domain name and the additional setting of the at least one option.

18. The computer-readable storage memory of claim 14 wherein the code for determining the second IP address with the second computer system using the at least one of the one or more options based on the domain name and the first set of user-controllable settings comprises:

code for identifying the first set of one or more user-controllable settings using the first control information; and

code for resolving an IP address based on the domain name and the first set of one or more user-controllable settings for the one or more options.

19. The computer-readable storage memory of claim 14 further comprising code for sending the first DNS response to the first computer system from the second computer system;

and

wherein an application uses the second IP address specified in the DNS response that is different than a fourth IP address associated with the domain name.