Transparent proxy authentication via DNS processing

A DNS nameserver processes requests for domain name information based on subscriber identifiers, and optionally subscriber information. Based on a subscriber identifier, requests for a target domain name may generate a DNS response with domain name information for a proxy service. Techniques are provided to seamlessly and transparently authenticate a subscriber at the proxy service. The proxy service generates a redirect with a unique domain name including a tracking identifier in response to requests for a target domain name. The nameserver receives a request associated with the unique domain name. The nameserver responds with domain name information of the proxy service and generates a message to the proxy service mapping the tracking identifier to the subscriber identifier. The client then generates a request to the proxy service that includes the tracking identifier. The proxy service uses the mapping from the nameserver to authenticate the corresponding subscriber identifier.

BACKGROUND OF THE INVENTION

Field of the Invention

Embodiments in accordance with the present disclosure relate to computer networks, and particularly to processing domain name system (DNS) information.

Description of the Related Art

Network resources such as those available via the Internet are accessed according to Internet Protocol (IP) addresses. IP addresses are represented numerically, traditionally as a quartet of values having the form 111.111.111.111. From the early inception of network computing, familiar alphanumeric name-based addressing has been used to allow users to more easily locate and remember the addresses for resources. For example, domain names are assigned to computing servers and clients. The domain name system facilitates the translation between IP addresses and domain names by maintaining accessible records that associate one or more domain names with one or more IP addresses.

While early network implementations could utilize a single periodically distributed ASCII file to translate between domain names and IP addresses, modern networks such as the Internet rely on the domain name system (DNS) for the resolution of names and addresses.FIG. 1is a simplified block diagram illustrating traditional DNS processing. A client computing device102includes a resolver104for initiating DNS requests. The resolver may be a standalone component such as a software module of the client, or may be embedded within various applications such as web browsers, file transfer protocol programs, email applications, and the like that utilize Internet resources. When the client requests an Internet resource such as a web page or delivery of an email message, the resolver is charged with determining the IP address(es) of the requested resource so that the appropriate request can be issued to the appropriate address. The resolver is traditionally configured with the addresses of a group of ISP DNS Nameservers110that handle recursive DNS processing for the client device. As is often the case, the group of nameservers is provided by the Internet Service Provider (ISP) for the client device, although this isn't required. Nameservers110are recursive nameservers which resolve DNS requests using a recursive process that accesses various other nameservers in order to satisfy a given query.

Consider an example DNS request150from client102to nameserver112for the domain name information of “www.opendns.com”. The ISP DNS nameserver first checks a local cache to attempt to resolve the request. The ISP DNS nameserver maintains the local cache with domain name records that have already been resolved to improve performance in responding to subsequent DNS requests. If nameserver112is maintaining the requested domain name in the local cache, it will issue a DNS response152to the client with the domain name record including the IP address of “www.opendns.com”.

If the ISP DNS nameserver112does not have an entry for the requested domain name, it will launch recursive processing using authoritative DNS nameservers120and/or root DNS nameservers130. An authoritative nameserver maintains an authoritative or master list for a zone which is a group of computing devices. Recursive DNS nameservers obtain domain name information such as the IP address of a requested resource from authoritative nameservers. The root DNS nameservers are also authoritative DNS nameservers. They are called root DNS nameservers because they contain the authoritative domain name information for a set of top level domains (TLDs) in the so-called root zone. For example the root DNS nameservers contain the IP addresses for finding domain name information for lower level domains in the top level domains. The top level domains include the generic top-level domains (gTLD) of .com, .org, .net, etc.

Nameserver112first issues a DNS request154to root DNS nameservers130. The root DNS nameservers130can include multiple nameservers, one or more of which can be issued a request for the needed information. One of the nameservers132responds with a DNS response156including the IP address of one or more authoritative name servers for the “.com” domain. When ISP DNS nameserver112obtains the IP address for the “.com” domain, it issues another DNS request158to the specified one of the authoritative DNS nameservers120. The specified authoritative nameserver will issue a DNS response160with the IP address of one or more nameservers for the “opendns.com” domain. This process repeats between the ISP DNS nameserver and the authoritative name servers120until the ISP DNS nameserver receives the IP address for “www.opendns.com”. The client102application can then issue the resource request to the appropriate computer, such as an HTTP request to the server at the corresponding IP address.

FIG. 2is a simplified block diagram of a typical authoritative DNS nameserver120as shown inFIG. 1that can store domain name records. In this example, the authoritative DNS nameserver120is a computer system with a processor250coupled to a communications interface260and a memory or storage270via a system bus252. The communications interface160exchanges data with a communications network, such as the Internet, via line154. The processor250receives DNS requests from the Internet and resolves the DNS requests based on domain name records, such as a DNS record280stored in memory270. The DNS record280includes a domain name282, which is used as a key to lookup a corresponding IP address284, and includes a time-to-live (TTL) value286. The TTL value for the DNS record can be set by the administrator of the authoritative DNS nameserver. The TTL value is provided as part of the DNS response to DNS requests and is used by the receiving nameservers to control how long the DNS record should be maintained and treated as valid.

DETAILED DESCRIPTION

Systems and methods for processing domain name system requests in accordance with subscriber information are provided. A request for domain name information from a subscriber can be correlated with subscriber preferences using a subscriber identifier to resolve the domain name information at a domain name system (DNS) nameserver. Access to flagged domain names may be blocked or proxied in accordance with the subscriber preferences for example. In response to a request for a flagged domain name from a client device, the nameserver may provide domain name information for a proxy service. Communication between the proxy service and the DNS nameserver is facilitated to permit the proxy service to determine the subscriber identifier from the DNS nameserver. The subscriber can be authenticated at the proxy service seamlessly without input from the subscriber or client device based on the direct communication from the DNS nameserver.

The proxy service may generate tracking identifiers and unique domain names including the tracking identifiers to trigger the nameserver to transmit subscriber identifiers in one embodiment. For example, the proxy service can determine if a resource request for a target domain name includes a tracking identifier, as can be passed in a cookie for the target domain name. If the resource request does not include a tracking identifier, the proxy service generates a tracking identifier and a unique domain name including the tracking identifier. The proxy service sends a response to the client device that includes a redirect to the unique domain name and a cookie for the target domain name that includes the tracking identifier.

The nameserver receives a DNS request from the client device for the unique domain name. The nameserver correlates the tracking identifier from the unique domain name with the subscriber identifier for the DNS request. The nameserver sends the correlated subscriber identifier and tracking identifier to the proxy service. The nameserver sends domain name information for the proxy service in response to the DNS request.

The proxy service receives a resource request for the unique domain name in response to the issued redirect. The proxy service extracts the target domain name from the unique domain name and redirects the client device to the target domain name. The proxy service then receives a resource request for the target domain name. Significantly, the resource request passes the cookie with the tracking identifier. The proxy service extracts the tracking identifier and determines the corresponding subscriber identifier using the correlated information from the nameserver. The proxy service can then generate a response to the resource request based on the subscriber preferences associated with the subscriber identifier. In an alternate embodiment, the proxy service may extract the tracking identifier and the target domain name from the request for the unique domain name and directly respond to the client device without the described redirect.

FIG. 3is a block diagram of a system for processing domain name system (DNS) requests in accordance with an embodiment of the present disclosure. Subscriber networks310, web servers320and a recursive DNS cluster330are each in communication with one or more network(s)302. Although two subscriber networks with four client devices each are shown, any number of subscriber networks or client devices may be used.

Network(s)302and310can include any combination of local area networks, wide area networks (WAN), the Internet, and/or any other network. The recursive DNS clusters can vary by implementation and include any suitable computing system such as a server, group, grid, or distributed platform of computer systems configured to respond to requests for domain name information and/or to process network-related resource requests. While the cluster inFIG. 3is depicted with multiple recursive DNS nameservers, other embodiments may include a single computing system within a cluster such as a single server. The individual recursive nameservers in a cluster can be formed of hardware and/or software configured as described for domain name resolution and network processing. By way of non-limiting example, the various nameservers can include personal computers, servers, workstations, mainframes, etc.

Each of the recursive DNS nameservers in a cluster resolves requests for domain name information from other computing devices such as client devices312operated by individual users on a subscriber network310. The nameservers332in cluster330include or are in communication with a local cache340and a subscriber database350. The domain name information stored in the cache can be any type of information associated with a domain name. Some examples of domain name information are resource records, such as “A” records used for storing a 32-bit IP address associated with a domain name, “AAAA” records used for storing an IPv6 128-bit address associated with a domain name, and “CNAME” or canonical name records for a DNS alias. A request for domain name information can include a packet, cell, message, or signal used to ask for domain name information.

The cache340at each cluster facilitates more efficient responses to DNS requests by storing domain name information such as DNS records corresponding to previously received DNS requests. The cache may also store other domain name information, such as pre-fetched domain name information. If the cache contains the DNS record(s) needed to respond to a DNS request, the DNS nameserver can return the cached information without contacting other nameservers to fulfill the request.

When DNS requests from clients312or other computing devices cannot be fulfilled with cached domain name information, the recursive DNS cluster initiates recursive processing to determine the needed information. For example, a DNS nameserver332may first issue a DNS request to one of the root servers for generic top level domain information, followed by one or more DNS requests to various authoritative name servers to determine the requested domain name information.

A response can also include a packet, cell, message, or signal used for transmitting domain name information. A Uniform Resource Identifier (URI) identifies resources available through network hosts. Some examples of URIs include protocols such as http—HTTP resources, https—HTTP over SSL, ftp—File Transfer Protocol, mailto—E-mail address, ldap—Lightweight Directory Access Protocol lookups, file—resources available on the local computer or over a local file sharing network, news—Usenet newsgroups, gopher—the Gopher protocol, telnet—the TELNET protocol, and data—the Data: URL scheme for inserting small pieces of content in place. Typically, a URI such as a URL includes domain names that form a portion of the URL.

In response to a DNS request for domain name information associated with a domain name, a recursive DNS nameserver within a cluster can determine a subscriber identifier. A subscriber is generally an individual and/or entity that agrees to service conditions of an operator of a recursive DNS cluster330. Subscribers may range from entities operating large networks310, such as those provided by a wireless service providers or large corporations, to individuals having a home internet connection. It is noted that while subscriber networks310are depicted with multiple client devices312, that is not required. In one example, the subscriber may operate a single personal computer with an internet connection. Embodiments in accordance with the present disclosure may be applied in any type of environment.

A subscriber identifier discriminates the subscriber associated with the request for domain name information. Some examples of a subscriber identifiers are IP addresses, userID's, deviceID's, and secure tokens. If an IP address identifier is used, the recursive DNS nameserver can inspect the network packet containing the request to determine the source IP address of the packet. A username or secure token may be included in the request for domain information from which the recursive DNS nameserver determines the subscriber identifier and the subscriber information. Some subscribers may be associated with multiple users. Accordingly, a subscriber identifier may identify a subscriber and optionally a particular user associated with the subscriber where a subscriber includes multiple users. Reference to a subscriber identifier hereinafter includes an identifier of a subscriber as well as an identifier of a particular user associated with a subscriber.

In one example, a device or application on a subscriber's network is setup to modify DNS requests to include a subscriber identifier. For example, an extension of the DNS protocol can be used such as EDNS which allows more flags, label types and return codes to be defined. EDNS may allow the sender of a DNS message (e.g., client device312) to advertise its own extended capabilities to the message receiver (e.g., DNS nameserver332). This may be accomplished through the inclusion of an OPT pseudo-RR in the additional data section of a request or response. The OPT pseudo-RR may include one or more EDNS options. In one example, a client device312can supply a device ID to DNS nameserver332as a subscriber identifier. For example, a proprietary device ID key/value pair in an OPT resource record (RR) may be provided in the additional section of a DNS query. The RR can appear in the DNS query's additional section, causing DNS nameserver332to interpret the last eight octets of the section as a device ID. The device ID can act as an index into a database of subscriber information associated with DNS nameserver332. Other subscriber identifiers and techniques for determining the same can be used.

The recursive DNS nameserver resolves requests for domain name information based on subscriber information associated with the subscriber identifier to generate a response in one embodiment. The recursive DNS nameserver then returns the response to the client device, providing the resolved domain name information in accordance with the subscriber information. By way of example, the recursive DNS nameserver may obtain the network (e.g., IP) address in the domain name record of a requested domain name for a first subscriber. For a second subscriber, the recursive DNS nameserver instead may obtain a substitute network (e.g., IP) address that satisfies a substitution criterion for the requested domain name based on the subscriber information.

In some embodiments, a subscriber of a service provided by the DNS cluster may set one or more preferences or selections for how the options are to be enabled or otherwise applied when a DNS nameserver332resolves DNS queries associated with the subscriber. Preferences or settings for a subscriber may be stored as subscriber information at subscriber database350or in one or more storage devices accessible to the DNS cluster330. Upon identifying a subscriber, subscriber information associated with the subscriber identifier may be used to alter the IP address in a DNS response. For example, a subscriber may establish subscriber information that instructs the DNS nameserver to alter responses to DNS requests that are associated with adult web sites, potential phishing or pharming sites, or other sites deemed inappropriate by the subscriber or to which the subscriber wishes to block or filter access, etc. Web server334and nameserver332each have access to subscriber database350. InFIG. 3, the web server and nameserver utilize a single database but individual databases containing the same information may be used in other embodiments.

The subscriber information in database350may include network records352and/or user records354that are used to determine a particular IP address to resolve for a given domain name. The network and user records may each specify one or more DNS resolution options, filters, features or other techniques for determining what IP address to resolve for a given domain name. For example, in providing DNS services to the DNS client, the DNS servers may provide resolved domain name information or redirect the DNS client to another location based on subscriber information stored at the DNS servers that indicates how an end user wants the DNS servers to employ the DNS resolutions options or features. In various examples, the DNS cluster may provide various DNS resolution options or features, such as misspelling redirection, parental filters, domain blocking, or phishing protection through the DNS process.

Network records352specify preferences or selections for resolving domain name queries associated with a particular subscriber's network or networks310. The subscriber may specify resolution preferences that will apply to all traffic originating at their network310in one embodiment. DNS nameserver332can use a network identifier, such as an IP address from which the DNS query was issued, to determine a corresponding network record352. A subscriber may set permissions and preferences in network records to indicate that certain preferences can be bypassed by particular users of the subscriber's network. For example, an administrator for a corporate network310may set up network records352to allow certain users of network310to bypass particular preferences in the network records, such as those blocking access to certain domains. Alternatively or additionally, permissions and preferences for overriding network preferences may be included in user records354.

User records354include subscriber information for individual users or entities using the services of DNS cluster330. For example, a corporate subscriber may establish user records for multiple individuals within the organization to specify resolution preferences or selections that will apply to DNS requests issued by the user. DNS nameserver332can use a subscriber identifier such as a userid, token or other identifier to determine a corresponding network record352and/or user record354for a particular request.

User records and network records may be used together to determine a set of permissions or preferences for applying to any individual request for domain name information, or requests for actual resources as will be explained hereinafter. However, it is noted that implementations need not include network records and user records and may simply include subscriber records.

The domain name records in cache340may be associated with or store one or more flags. A flag can be any indicator, marking, or symbol associated with a domain name. For example a binary indicator stored in the domain name record can be used. A flag may be used to identify various types of information for a particular domain. For example, a flag may be used to mark a domain name as suspicious or untrustworthy, such as a site engaged in pharming or phishing activities. A flag may also indicate that a domain hosts illegal material, hate speech, pornography, material related to drugs or alcohol, or otherwise objectionable material that a subscriber does not wish to access or permit access to. Any number of flags can be used to create any number of categorizations for domain names. For example, flags denoting various levels of adult material may be used to classify domain names according to their age-appropriateness. Flags can also be set in domain name records to cause requests for a particular domain names to be proxied. This can allow a subscriber to have traffic for certain domain names proxied, for example for logging, auditing and the like, while traffic for other domains is not proxied. Category information and/or flags can be maintained in other manners. For example, flags or category information can be provided in a general database or in the subscriber database.

When a request for domain name information is received, the DNS nameserver332resolves the domain name query using the subscriber information and any flags in the domain name record. For example, a network record for a DNS request may set a preference that a particular category of domains or a particular domain is to be blocked from access by devices on the network. If a DNS request is for a domain having a flag matching such a preference in the network record, the DNS nameserver may generate a DNS response with a substitute IP address that directs the client device to an alternate domain. In one example, the DNS nameserver provides the client device with domain name information associated with proxy service336on web server334. In response to the client device's resource request, the proxy service can provide a block or landing page to the client device, for example, informing the subscriber that the requested domain is not accessible on their network. The block or landing page refers generally to any resource or information provided by the proxy service in response to a request for a target domain that is not an actual resource provided by the target domain. The proxy service may authenticate a subscriber and/or user associated with the subscriber before providing the landing page. For example, the landing page may be tailored based on the subscriber information. Furthermore, the proxy service may authenticate the subscriber and proxy resource requests from the subscriber for the target domain name.

The proxy service336transparently authenticates subscribers based on a subscriber identifier received from the DNS nameserver. In one example, the proxy service336seamlessly authenticates a subscriber using a series of redirects to create a mapping between a subscriber identifier received by the DNS nameserver to an authentication cookie for a target domain name. When the proxy service receives a request for a target domain and cannot identify a subscriber identifier associated with the request, it can issue a redirect to the client device that triggers the DNS nameserver to transmit the subscriber identifier to the proxy service in response to a corresponding DNS request. The series of redirects utilizes a tracking identifier and unique domain name to enable the proxy service to map the subscriber identifier to a particular resource request for the target domain name. In this manner, the DNS nameserver transmits the subscriber identifier from the DNS nameserver to the proxy service without requiring input from the subscriber or a user associated with the subscriber.

In one example, proxy service336receives a resource request associated with a target domain name338and examines the request for an authentication cookie for the target domain name. If the request does not include an authentication cookie, the proxy service generates a tracking identifier and a unique domain name for the request. The unique domain name includes the tracking identifier. The proxy service generates a redirect response including the unique domain name. The response includes a cookie for the target domain name that includes the tracking identifier.

The client312issues a DNS request to DNS nameserver332for domain name information for the unique domain name. The client312passes the subscriber identifier with the DNS request, for example as an EDNS header. The DNS nameserver recognizes the unique domain name and in response as corresponding to a proxy service authentication process and extracts the tracking identifier from the unique domain name. The DNS nameserver generates a message to the proxy service that correlates the tracking identifier with the subscriber identifier. The DNS nameserver returns domain name information for the proxy service to the client312in response to the DNS request.

The client312issues a resource request for the unique domain name to the proxy service. The proxy service extracts the target domain name from the unique domain name. The proxy service issues a redirect response to the client for the target domain name. The client312issues a resource request for the target domain name to the proxy service. The client312passes the authentication cookie generated for the target domain name by the proxy service to the proxy service with the request. The proxy service extracts the tracking identifier from the authentication cookie.

The proxy service336attempts to determine a subscriber identifier corresponding to the tracking identifier based on any messages it has received from the DNS nameserver. If the proxy service finds a message with a correlation between the tracking identifier and a subscriber identifier, it authenticates the subscriber identifier. The proxy service proxies the request for the target domain name in one example. The proxy service can issues one or more requests to the target domain338and return one or more resources to the client312using resource(s) received from the target domain338. In one example, the proxy service accesses subscriber information from database350corresponding to the subscriber identifier. The proxy service can apply the subscriber preferences to generate a reply to the resource request from the client312. For example, the subscriber information may indicate that the subscriber or user associated with the subscriber can or cannot access the target domain name. If the subscriber information indicates that the subscriber cannot access the target domain name, the proxy service may issue a redirect to the client312for a landing or block page for example. As earlier described, the proxy service may return a landing or block page without using the subscriber information in one embodiment.

FIG. 4is a diagram depicting traffic between a client device312, a recursive DNS Nameserver332, a proxy service336, and a web server320associated with a target domain name338in one example. The process begins when a subscriber or user associated with a subscriber (hereinafter just subscriber), issues a domain name system (DNS) request402to a recursive DNS name server332. A specific example is provided where request402is issued for the domain name information of a target domain name “example.eee.” It is noted that any examples used herein are intended to be fictitious and are provided only to better illustrate the disclosed technology with respect to specific examples.

In response to request402, name server332obtains domain name information for the target domain name. The name server may acquire a domain name record for the target domain name from cache340in one example. If a domain name record is not available for the requested domain name, the name server may recursively resolve the domain name information by issuing a request to one or more root, authoritative and/or other recursive domain name servers.

The nameserver also determines a subscriber ID associated with the DNS request. In one example, the nameserver determines a userid or token passed with the DNS request as earlier described. Using the subscriber ID, the nameserver obtains subscriber information, such as a network record and/or user record from database350, for a particular subscriber associated with the DNS request. The user and network records can be used to determine if the subscriber is permitted access to the target domain name when on the subscriber network310.

The target domain name may be associated with one or more flags corresponding to one or more preferences of the subscriber indicating that the domain name information should not be provided. For example, the network record associated with the IP address may indicate that no subscribers from that network may access the requested domain. Additionally or alternatively, the user record may indicate that the subscriber does not wish to be provided with domain name information associated with that particular domain.

Based on any flags and subscriber preferences, nameserver332issues a DNS response404to the client device312. In this example, it is assumed that the subscriber information indicates that the subscriber or user associated with the subscriber should not access the target domain name and therefore that the domain name information should not be provided. Accordingly, nameserver332does not provide the domain name information (e.g., “002.000.000.000”) for the requested domain name, but instead provides a DNS response404with domain name information (e.g., “00.000.000.000”) for proxy service336at web server334.

Proxy service336receives a resource request406(e.g., HTTP) from client312that is associated with the target domain name. For example, the request may include a URI including the target domain name228. InFIG. 4, the proxy service receives a request with the URI “http://www.example.eee.” The client device312issues the request to the proxy service based on the domain name information provided by nameserver332.

Proxy service336examines the request to determine if it includes an authentication cookie for the target domain name. For example, proxy service336may receive an authentication cookie or other predetermined identifier for the target domain including a tracking identifier used in identifying a subscriber ID corresponding to the request. If the proxy service336does not receive an authentication cookie for the target domain, it issues a redirect response408to the client device312.

The redirect response408is generated to initiate a process for identifying and authenticating the subscriber corresponding to request406at the proxy service336. Proxy service336generates a unique domain name to track request406. In one example, the unique domain name includes a unique tracking identifier generated by the proxy service336for the request406. Proxy service336also generates an authentication cookie for the target domain name. The proxy service includes the tracking identifier in the authentication cookie. The proxy service then issues a redirect response408that is associated with the unique domain name. Additionally, the response408sets the authentication cookie for the target domain name, including the tracking identifier.

FIG. 4illustrates two examples of redirect URI's that include the unique domain name. In the first example, the unique domain name includes a fixed domain name portion and one or more dynamically generated portions to generate the unique domain name. In this example, the fixed domain name portion is “fixed.eee.” The dynamically generated portions include the tracking identifier “TID” for the request and an identifier “IP” of the proxy service. The tracking identifier TID and identifier are appended to the fixed domain name as subdomain names in this example. Additionally, the unique domain name includes the target domain as an appended argument. For example, a trimmed version of the URI received with request406is appended as an argument inFIG. 4. The trimmed version is the original URI with the protocol “http” and domain name label “www” removed. The identifier “IP” of the proxy service is an IP address of the web server334hosting the proxy service. The identifier may be included in embodiments where the proxy service may reside on multiple machines so that the nameserver can properly generate a later message to the proxy service. The identifier of the proxy service is optional and may not be used in some implementations.

In the second example, the unique domain name is based on the target domain name rather than a fixed domain name. For example, the tracking identifier can be added as a subdomain of the target domain name to generate the unique domain name. Additionally, the identifier of the proxy can be appended as a subdomain of the target domain name. Other techniques of generating unique domain names that include a tracking identifier can be used.

The client312receives the redirect response408from proxy service336including a redirect URI associated with the unique domain name. The client312issues a DNS request410to the DNS nameserver332requesting domain name information for the unique domain name. The remainder ofFIG. 4continues with the first example of a unique domain name.

The DNS nameserver receives DNS request410and identifies the unique domain name as corresponding to an authentication transaction initiated by proxy service336. DNS nameserver332may be configured to initiate a subscriber identification and correlation process based on the unique domain name. For instance, the DNS nameserver may be configured to initiate the process based on a predetermined fixed domain being in a DNS request. The DNS nameserver may be configured to initiate the process based on a predetermined format of the domain name request. For example, the DNS nameserver may initiate the process in response to requests for domain names having a format of “TID.IP.target_domain_name.com.”

Nameserver332determines the subscriber identifier associated with DNS request410. Determining the subscriber identifier may be performed as described with respect to DNS query402. Nameserver332also determines the tracking identifier associated with DNS request410. For example, nameserver332can extract the tracking identifier from the subdomain of the target domain name or the fixed domain name in various implementations.

Nameserver332sends a message412to the proxy service336in response to DNS request410. Message412includes a correlation or mapping of the tracking identifier from the unique domain name to the subscriber identifier included in the DNS request. In one example, message412is a unicast message having a payload that includes the subscriber identifier and tracking identifier. In another example, the payload may include the subscriber information such as policy and preference information from database350. Although not shown, the proxy service336may issue a unicast message to the nameserver332to acknowledge receipt of message412in one example.

Nameserver332issues a DNS response414to the client device312including domain name information in response to the request410associated with the unique domain name. Nameserver332returns domain name information for the proxy service336causing the client device to return to the proxy service in response to the unique domain name. In one embodiment, the nameserver332may wait until it receives a message from the proxy service confirming receipt of the tracking identifier to subscriber identifier mapping. In another embodiment, the nameserver332can issue the DNS response without waiting for a reply from the proxy service. In one embodiment, the domain name information returned in response414is based on the IP address of the proxy service that was included in the unique domain name. For instance, nameserver may use the identification from the DNS request to return domain name information for the particular web server334from which the redirect originated and to which the DNS nameserver sent the tracking identifier to subscriber identifier mapping.

After receiving DNS reply414, client312issues a resource request416to proxy service336. The resource request includes the redirect URI “http://www.TID.IPA.fixed.eee/example.eee” provided by proxy service336for the unique domain name in response408. Proxy service336identifies the unique domain name submitted by the client312and extracts the target domain name “example.eee” from the unique domain name. Proxy service336issues a redirect response418to the client device312with a URI “including the target domain name.

Client312issues a resource request420to the proxy service with the URI from redirect418. Client312typically will have the domain name information for the target domain from reply404so an additional DNS request is not issued. However, client312may issue another request to DNS nameserver332and again receive a response with domain name information mapping to proxy service336. Client312passes the authentication cookie for the target domain to the proxy service336with the request420. Recall that proxy service passed the authentication cookie to the client device312in response408, setting the cookie for the target domain name.

Proxy service336authenticates the subscriber in response to request420in one embodiment. Authenticating the subscriber only may include determining a subscriber identifier for request420using the authentication cookie in one embodiment. Proxy service336extracts the tracking identifier placed into the cookie, accesses the information received from DNS nameserver332in message412, and determines the subscriber identifier corresponding to request420using the tracking identifier to subscriber identifier mapping.

In one embodiment, the proxy service336can authenticate the subscriber and determine how to respond to request420using subscriber information associated with the subscriber identifier. Proxy service336accesses database350using the subscriber identifier in response to request420. Proxy service336can determine any user records354and/or network records352that match the subscriber identifier. Proxy service336uses the subscriber information to determine how to respond to the request for the target domain name338. For example, proxy service336may determine what flags, etc. are associated with the target domain name and correlate those flags with any preferences or policies in the subscriber information. Proxy service336may use this information to determine if the subscriber associated with the subscriber ID is permitted access to the requested domain from the particular subscriber network310.

If the proxy service determines that the subscriber is permitted access to the target domain name338, it can proxy the client resource request. The proxy service336issues a resource request422for the target domain name338as received from the client312. The proxy service336may pass any cookies set by the target domain name338or the client312as may be received in request420. The proxy service336receives a response424from the target domain name338in reply to request422. Proxy service336issues a resource response426to request420, passing the response424received from the target domain name338.

If the proxy service determines that the subscriber is not permitted access to the target domain name, a block or landing page can be provided to the client device. For example, response426may be issued with a redirect to a block or landing page. In this case, request422is not issued.

In one option, the proxy service336may authenticate the subscriber in response to request416. Proxy service336may extract the tracking identifier from the unique domain name. It may then access the tracking identifier to subscriber identifier mapping provided by DNS nameserver336in message412to determine the subscriber identifier. The proxy service336may then access any user record and/or network records to determine how to respond to requests associated with the subscriber. Moreover, it is noted that while the example ofFIG. 4describes applying subscriber information to generate a response to the client's resource request, this is not required. For example, the proxy service may simply determine the subscriber identifier and begin proxying requests from the client312for the target domain name without accessing or analyzing subscriber information such as preferences and policies.

Arrow428represents the scenario where the client312includes an authentication cookie for the target domain name338. If the client312includes an authentication cookie, the proxy service336proceeds as shown to authenticate the subscriber and proxy the request, etc.

FIG. 5is a flowchart describing a method of processing domain name requests by a recursive DNS nameserver in accordance with one embodiment. At step502, the DNS nameserver332receives a request (e.g.,402) for domain name information from a client device312. At step504, the nameserver determines whether the requested domain name is a dynamically generated domain name (DGDN) from the proxy service. The nameserver can determine whether the domain name meets a predetermined format for domain names that will trigger a subscriber identification and authentication process. For example, the nameserver can determine whether the domain name includes a predetermine fixed domain name portion in an implementation using a fixed domain name for the identification and authentication redirect process. In another example, the nameserver can determine whether the domain name includes a format such as a tracking identifier, followed by a proxy IP address, followed by a target domain name. Other techniques may be used for detecting a predetermined format as part of a redirect process.

If the requested domain name is not a dynamically generated domain name from the proxy service, the proxy service determines a subscriber identifier associated with the DNS request at step506. In one example, the DNS nameserver parses the DNS request for the source IP address which is used as the subscriber identifier. In another example, a token or the subscriber ID itself may be passed with the DNS request such as by using an EDNS extension. At step508, the DNS nameserver uses the subscriber identifier to obtain subscriber information (e.g, network record352and/or user record354) corresponding to the subscriber identifier from database350. At step510, the DNS nameserver obtains the requested domain name information. Step510may include determining the domain name in the request and checking cache340for a domain name record corresponding to the target domain name. If the cache contains a domain name record for the target domain name and the record is not expired, the DNS nameserver obtains the cached domain name record. If the cache does not contain a domain name record for the target domain or if the domain name record is expired, the DNS nameserver attempts to retrieve the domain name information using one or more authoritative and/or root DNS nameservers.

After obtaining the domain name information, the DNS nameserver determines whether there are any flags associated with the requested domain and if so, correlates the flags with the preferences in the network record352at step512. Step512includes determining whether the domain name information for the requested domain includes any identifiers corresponding to preferences in the network record. For example, step512may include determining an age-rating for the domain and comparing that with an age-rating preference in the network record.

If any of the flags correlate to preferences in the network record, the DNS nameserver determines if any of the flags and corresponding network preferences indicate that the traffic to the domain should be filtered at step514. In one embodiment, step514includes determining whether the network records indicate that the requested domain should be blocked for requests from the subscriber's network. Step514may also include determining whether the records indicate that traffic for the requested domain should be proxied, but access still allowed.

If the domain name information contains a flag indicating that the requested domain should be proxied or blocked, the DNS nameserver issues a DNS response at step518with domain name information for the proxy service336at web server334. If the domain is not to be blocked or proxied, the DNS nameserver issues a DNS response at step516with domain name information for the requested domain.

Returning to step504, if DNS nameserver332determines that the requested domain name is a dynamically generated domain name from the proxy service, it determines a subscriber identifier associated with the DNS request at step520. In one embodiment, steps520and506can be performed as a single step before step504.

At step522, nameserver332determines the tracking identifier from the domain name. After determining the tracking identifier, the nameserver generates a message to the proxy service at step524. The message includes a mapping of the transaction identifier from the domain name to the subscriber identifier determined at step520. At step526, the nameserver generates a DNS response to the client device512, passing domain name information that maps to the proxy service.

FIG. 6is a flowchart describing processing by a proxy service336in accordance with an embodiment. At step652, the proxy service receives a resource request. Step652is often an HTTP request specifying a domain name and a network resource hosted at the target domain name using a URI, but any suitable protocol for requesting network resources may be used. The proxy service examines the requested domain name to determine if it is a dynamically generated domain name by the proxy service at step654. The proxy service may analyze the format of the domain name in the same manner as the nameserver earlier described.

If a dynamically generated domain name from the proxy service is not the requested domain name, the proxy service determines whether the request includes an authentication cookie for the target domain at step660. Step660includes checking for an authentication cookie set by the proxy service. If the request does not include an authentication cookie for the target domain, the proxy service generates a tracking identifier at step678. At step680, the proxy service dynamically generates a unique domain name for the request.

Step680may include appending the tracking identifier to the target domain name from the request in one embodiment. For example, the tracking identifier may be appended to the beginning of the URI from the request in one example. In this manner, the tracking identifier is added as a subdomain of the target domain name.

In another example, step680may include using a predetermined fixed domain name. The tracking identifier can be appended to the fixed domain name as a subdomain in one example as with the earlier example. To track the target domain name, the target domain name is appended as an argument to the fixed domain name in one example.

Although not shown, the IP address of the web server hosting the proxy service can be added as part of forming the unique domain name in one embodiment. For example. the IP address can be added as a subdomain of the fixed domain name or target domain name in various embodiments.

The proxy service generates an authentication cookie for the target domain name at step682. The authentication cookie includes the tracking identifier generated at step678and is set for the target domain. In this manner, the client device will pass the authentication cookie with subsequent requests for the target domain name. Because the nameserver maps requests for the target domain name to the proxy service, the authentication cookie with the tracking identifier will be passed to the proxy service during subsequent requests.

At step684, the proxy service generates a redirect response for the client312. The redirect response (e.g.,302redirect) includes a redirect URI specifying the unique domain name. The proxy service sends the redirect response to the client312which sets the authentication cookie at the client for the target domain. Recall that the unique domain name includes the tracking identifier and in some manner, the original target domain name. Accordingly, the proxy service generates a redirect response that causes the client312to issue a DNS request to the nameserver that will include the tracking identifier. Because the client312passes the subscriber identifier with DNS request, the nameserver is able to correlate or map the tracking identifier to the subscriber identifier as earlier described.

Returning to step660, if the request includes an authentication cookie for the target domain, the proxy service attempts to determine a subscriber identifier for the request at step662. The proxy service accesses the tracking identifier from the authentication cookie. Using the tracking identifier, the proxy service determines whether it has received a message from the DNS nameserver with a mapping of the tracking identifier to a subscriber identifier. In one example, the proxy service may store a list of tracking identifier to subscriber identifier mappings that is has received. If the proxy service does not find a subscriber identifier, it can return from662to step678in one example to attempt the redirection again to cause a mapping to be sent by the nameserver.

At step664, the proxy service optionally accesses subscriber information such as user records and/or network records corresponding to the subscriber identifier. At step666, the proxy service uses the subscriber information, if obtained, to determine how to respond to the resource request. As with the DNS nameserver, the proxy service may determine if the domain name record for the target domain contains any flags. The proxy service may correlate the subscriber preferences with the policies with any flags to determine whether the requested resource should be retrieved for the client device form the target domain.

If the proxy service determines that the subscriber or user associated with the subscriber should not access the target domain name, the proxy service generates a response to the request at step668. The proxy service can provide a block or landing page to the client device, for example, informing the subscriber that the requested domain is not accessible to them. The block or landing page refers generally to any resource or information provided by the proxy service in response to a request for a target domain that is not an actual resource provided by the target domain. The response may include a redirect URI to a block or landing page in one example.

If the proxy service determines that the subscriber or user can access the target domain, the proxy service issues a request at step670for the target domain name. The request at step670may be a resource request indicated by the URI of the request received at step652. The proxy service proxies the resource request by issuing its own request to the requested domain. At step672, the proxy service receives a response from the target domain with a resource indicated by the request URI. At step674, the proxy service generates a response to the resource request including the resource from the target domain. The proxy service may optionally log the traffic for auditing, etc. at step676. Step676can include logging and associating the traffic with a particular user of client device312or only with a subscriber network310.

Returning to step654, the proxy service proceeds at steps656when a dynamically generated domain name is requested. The proxy service extracts the target domain name from the request including the dynamically generated domain name. At step658, the proxy service generates a redirect response including the extracted target domain name. For example, the proxy service may generate an HTTP302redirect URI that includes the extracted target domain name. As earlier described, the redirect at step658will eventually result in a request being received at the proxy service which is for the target domain name and that includes an authentication cookie for the target domain name containing a tracking identifier.

In one example, the proxy service may extract the tracking identifier from the dynamically generated domain name in connection with steps656and658. The proxy service can determine the corresponding subscriber identifier and optionally subscriber information for the subscriber identifier. In this manner, the proxy service may directly proxy the request for the target domain name without redirect or can determine whether the subscriber should be permitted access in order to determine whether to redirect them to the target domain name.

FIG. 7is a high level block diagram of a computing system which can be used to implement any of the computing devices ofFIG. 3. The computing system ofFIG. 7includes processor80, memory82, mass storage device84, peripherals86, output devices88, input devices90, portable storage92, and display system94. For purposes of simplicity, the components shown inFIG. 7are depicted as being connected via a single bus96. However, the components may be connected through one or more data transport means. In one alternative, processor80and memory82may be connected via a local microprocessor bus, and the mass storage device84, peripheral device86, portable storage92and display system94may be connected via one or more input/output buses.

Processor80may contain a single microprocessor, or may contain a plurality of microprocessors for configuring the computer system as a multiprocessor system. Memory82stores instructions and data for programming processor80to implement the technology described herein. In one embodiment, memory82may include banks of dynamic random access memory, high speed cache memory, flash memory, other nonvolatile memory, and/or other storage elements. Mass storage device84, which may be implemented with a magnetic disc drive or optical disc drive, is a nonvolatile storage device for storing data and code. In one embodiment, mass storage device84stores the system software that programs processor80to implement the technology described herein. Portable storage device92operates in conjunction with a portable nonvolatile storage medium, such as a floppy disc, CD-RW, flash memory card/drive, etc., to input and output data and code to and from the computing system ofFIG. 7. In one embodiment, system software for implementing embodiments is stored on such a portable medium, and is input to the computer system via portable storage medium drive92.

Peripheral devices86may include any type of computer support device, such as an input/output interface, to add additional functionality to the computer system. For example, peripheral devices86may include one or more network interfaces for connecting the computer system to one or more networks, a modem, a router, a wireless communication device, etc. Input devices90provide a portion of a user interface, and may include a keyboard or pointing device (e.g. mouse, track ball, etc.). In order to display textual and graphical information, the computing system ofFIG. 7will (optionally) have an output display system94, which may include a video card and monitor. Output devices88can include speakers, printers, network interfaces, etc. Device100may also contain communications connection(s)112that allow the device to communicate with other devices via a wired or wireless network. Examples of communications connections include network cards for LAN connections, wireless networking cards, modems, etc. The communication connection(s) can include hardware and/or software that enables communication using such protocols as DNS, TCP/IP, UDP/IP, and HTTP/HTTPS, among others.

The components depicted in the computing system ofFIG. 7are those typically found in computing systems suitable for use with the technology described herein, and are intended to represent a broad category of such computer components that are well known in the art. Many different bus configurations, network platforms, operating systems can be used. The technology described herein is not limited to any particular computing system.

The technology described herein, including the proxy service, can be implemented using hardware, software, or a combination of both hardware and software. The software used is stored on one or more of the processor readable storage devices described above (e.g., memory82, mass storage84or portable storage92) to program one or more of the processors to perform the functions described herein. The processor readable storage devices can include computer readable media such as volatile and non-volatile media, removable and non-removable media. By way of example, and not limitation, computer readable media may comprise computer readable storage media and communication media. Computer readable storage media may be implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer readable storage media include RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by a computer. Communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as RF and other wireless media. Combinations of any of the above are also included within the scope of computer readable media.

In alternative embodiments, some or all of the software can be replaced by dedicated hardware including custom integrated circuits, gate arrays, FPGAs, PLDs, and special purpose computers. In one embodiment, software (stored on a storage device) implementing one or more embodiments is used to program one or more processors. The one or more processors can be in communication with one or more computer readable media/storage devices, peripherals and/or communication interfaces. In alternative embodiments, some or all of the software can be replaced by dedicated hardware including custom integrated circuits, gate arrays, FPGAs, PLDs, and special purpose computers.

FIG. 8is a block diagram depicting the structure of a domain name resource record that can be stored in the local cache at the recursive DNS clusters. Each resource record includes a name field902, a TTL field904, a class field906, a type field908, an RDLENGTH field910and an RDATA field912. As earlier described, the TTL field sets the maximum amount of time for maintaining the resource record before it should be treated as invalid and expired. In accordance with one embodiment, the RDATA field is used for various flags that may be set by the recursive nameservers to indicate some additional information about the domain in addition to the standard DNS specified information. A flag can be any indicator, marking or symbol associated with a domain name, such as a binary indicator in part of the RDATA field. The flags may have various functions, including but not limited to marking domain names as suspicious or untrustworthy, such as a web site associated with phishing activities. Flags may be used to indicate various types and levels of information. For information, social networking or pornographic web pages may be flagged so that the nameserver can provide alternate or additional information when a client issues a request.

FIG. 9is a block diagram depicting the structure of a DNS message response or request950. A DNS message includes a header field952, a question section954, an answer section956, an authority section958and an additional section960. The question section indicates the question for (or request) of the name server in a DNS request. The question field in a DNS response includes one or more resource records answering a question from a DNS request. The authority section includes one or more resource records pointing to an authority. The additional section is structured like a resource record and can include various types of information, such as the subscriber identifier as described above. In one example, the additional section includes an OPT RR containing zero or more key/value pair that might describe subscriber id information such as device id, etc.

A method of computer network processing has been described that includes receiving at a proxy service a first request associated with a target domain name and in response to the first request, generating a first identifier and a first domain name including the first identifier. The method includes providing a redirect response from the proxy service including the first domain name in response to the first request, receiving at the proxy service from a DNS nameserver a message including a subscriber identifier for the first identifier, receiving at the proxy service a second request associated with the target domain name where the second request includes the first identifier. The method includes determining in response to the second request the subscriber identifier corresponding to the first identifier based on the message from the DNS nameserver and generating a response to the second request based on the subscriber identifier.

A method of computer network processing has been described that includes receiving at a proxy service a message from a DNS nameserver mapping a first tracking identifier to a first subscriber identifier, receiving at the proxy service a first request having a resource identifier including a first domain name and a target domain name, and providing a redirect response for the first request where the redirect response including a resource identifier associated with the target domain name. The method includes receiving at the proxy service a second request having a resource identifier associated with the appended target domain name where the second request including a cookie for the target domain name with the first request identifier. The method includes determining that the first subscriber identifier from the cookie maps to the first tracking identifier based on the message from the DNS nameserver, and generating a response to the second request based on the subscriber identifier.

A system has been described that includes at least one web server including at least one processor and at least one DNS nameserver including at least one processor. The at least one processor of the at least one web server is programmed to receive from a client a first request associated with a target domain name, generate a first identifier and a first domain name including the first identifier, provide a redirect response including the first domain name in response to the first request, receive from a DNS nameserver a subscriber identifier corresponding to the first identifier, receive a second request associated with the target domain name, the second request including the first identifier, determine in response to the second request the subscriber identifier corresponding to the first identifier based on the message from the DNS nameserver, and generate a response to the second request based on the subscriber identifier. The at least one processor of the at least one DNS nameserver is programmed to receive a DNS request for domain name information for the first domain name as a result of the redirect response from the at least one web server that includes the subscriber identifier, determine the first identifier from the first domain name, generate a message to the at least one web server including a mapping of the first identifier to the subscriber identifier, and generate a DNS response to the request for domain name information with domain name information for the at least one web server.

The foregoing detailed description has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed. Many modifications and variations are possible in light of the above teachings. The described embodiments were chosen in order to best explain the principles of the invention and its practical application to thereby enable others skilled in the art to best utilize the invention in various embodiments and with various modifications as are suited to the particular use contemplated. It is intended that the scope of the invention be defined by the claims appended hereto.