Systems and methods for filtering internet access
View Patent ↗A computer-implemented method for filtering Internet access may include: 1) identifying a domain-name-system request from a client system, 2) identifying a filtering policy for the client system, 3) bundling the filtering policy with the domain-name-system request, and then 4) forwarding the bundled domain-name-system request to a domain-name-system server. Various other methods and systems are also disclosed.
1. A computer-implemented method for filtering Internet access, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
intercepting a domain-name-system request from a client system;
identifying a filtering policy for the client system, the filtering policy comprising filtering rules for filtering access to domains;
bundling the filtering policy with the domain-name-system request by modifying the domain-name-system request to add the filtering policy to the domain-name-system request;
forwarding the bundled domain-name-system request to a domain-name-system server, wherein the domain-name-system server is programmed to:
identify the filtering policy that is bundled with the domain-name-system request;
identify a domain that the domain-name-system request requests to resolve to an IP address;
determine that the filtering policy applies to the domain;
filter access to the domain based on the filtering rules included in the filtering policy.
2. The computer-implemented method of claim 1 , wherein modifying the domain-name-system request comprises at least one of:
appending the filtering policy to the domain-name-system request;
prefixing the filtering policy to the domain-name-system request.
3. The computer-implemented method of claim 1 , wherein modifying the domain-name-system request comprises adding the filtering policy to a field of the domain-name-system request.
4. The computer-implemented method of claim 3 , wherein adding the filtering policy to the field of the domain-name-system request comprises:
adding a delimiter to an end of a hostname in the domain-name-system request;
adding data after the delimiter identifying the filtering policy.
5. The computer-implemented method of claim 4 , wherein each bit in a bit string of the data added after the delimiter represents a different category of the filtering policy.
6. A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
intercept a domain-name-system request from a client system;
identify a filtering policy for the client system, the filtering policy comprising filtering rules for filtering access to domains;
bundle the filtering policy with the domain-name-system request by modifying the domain-name-system request to add the filtering policy to the domain-name-system request;
forward the bundled domain-name-system request to a domain-name-system server, wherein the domain-name-system server is programmed to:
identify the filtering policy that is bundled with the domain-name-system request;
identify a domain that the domain-name-system request requests to resolve to an IP address;
determine that the filtering policy applies to the domain;
filter access to the domain based on the filtering rules included in the filtering policy.
7. A system for filtering Internet access, the system comprising:
an identification module programmed to:
intercept a domain-name-system request from a client system;
identify a filtering policy for the client system, the filtering policy comprising filtering rules for filtering access to domains;
a bundling module programmed to bundle the filtering policy with the domain-name-system request by modifying the domain-name-system request to add the filtering policy to the domain-name-system request;
a forwarding module programmed to forward the bundled domain-name-system request to a domain-name-system server, wherein the domain-name-system server comprises:
a receiving module programmed to:
identify the filtering policy that is bundled with the domain-name-system request;
identify a domain that the domain-name-system request requests to resolve to an IP address;
a determination module programmed to determine that the filtering policy applies to the domain;
a filtering module programmed to filter access to the domain based on the filtering rules included in the filtering policy;
at least one processor configured to execute the identification module, the bundling module, the forwarding module, the receiving module, the determination module, and the filtering module.
8. The system of claim 7 , wherein the bundling module modifies the domain-name-system request by at least one of:
appending the filtering policy to the domain-name-system request;
prefixing the filtering policy to the domain-name-system request.
9. The system of claim 7 , wherein the bundling module modifies the domain-name-system request by adding the filtering policy to a field of the domain-name-system request.
10. The system of claim 9 , wherein the bundling module adds the filtering policy to the field of the domain-name-system request by:
adding a delimiter to an end of a hostname in the domain-name-system request;
adding data after the delimiter identifying the filtering policy.
11. The system of claim 10 , wherein each bit in a bit string of the data added after the delimiter represents a different category of the filtering policy.
12. The system of claim 7 , wherein the identification module intercepts the domain-name-system request using a filter driver on the client system.
13. The system of claim 7 , wherein the identification module intercepts the domain-name-system request by intercepting requests to an address of a domain-name-system server.
14. The system of claim 7 , wherein the identification module intercepts the domain-name-system request using an intercepting appliance.
15. The system of claim 14 , wherein the intercepting appliance comprises a router.
16. The computer-implemented method of claim 1 , wherein intercepting the domain-name-system request comprises using a filter driver on the client system to intercept the domain-name-system request.
17. The computer-implemented method of claim 1 , wherein intercepting the domain-name-system request comprises intercepting requests to an address of a domain-name-system server.
18. The computer-implemented method of claim 1 , wherein intercepting the domain-name-system request comprises using an intercepting appliance to intercept the domain-name-system request.
19. The computer-implemented method of claim 18 , wherein the intercepting appliance comprises a router.
20. The computer-implemented method of claim 1 , wherein the filtering policy comprises a policy to filter Internet resources categorized as untrusted by a computing security vendor.