Systems and methods of controlling internet access using encrypted DNS
Described systems and methods enable protecting client devices (e.g., personal computers and IoT devices) implementing encrypted DNS protocols against harmful or inappropriate Internet content. A DNS proxy intercepts an attempt to establish an encrypted communication session between a client device and a DNS server. Without decrypting any communications, some embodiments of the DNS proxy determine an identifier of the respective session and an identifier of the client device, and send a query tracer connecting the session identifier with the client identifier to a security server. In some embodiments, the security server obtains the domain name included in an encrypted DNS query from the DNS server and instructs the DNS server to allow or block access of the client device to the respective Internet domain according to a device- and/or user-specific access policy.
1. A computer system comprising at least one hardware processor configured to:
receive from a DNS proxy a query tracer characterizing an encrypted communication session between a client device and a DNS server, wherein:
the DNS proxy is connected to the client device over a local network,
the encrypted communication session comprises a cleartext part and an encrypted part, wherein the encrypted part comprises the client device transmitting an encrypted DNS query to the DNS server,
the query tracer associates a session identifier with a client identifier, wherein the client identifier identifies the client device, and wherein the session identifier identifies the encrypted communication session and is determined according to a content of the cleartext part;
receive from the DNS server a query notification comprising a domain name included in the encrypted DNS query, the query notification further associating the domain name with the session identifier;
determine an access indicator according to the query tracer and query notification, the access indicator indicating whether an access policy selected according to the client identifier allows the client device to access an Internet domain having the domain name; and
communicate the access indicator for enforcing the access policy.
2. The computer system of claim 1 , wherein the cleartext part comprises a handshake including a ClientHello message sent by the client device to the DNS server and a ServerHello message sent by the DNS server to the client device, and wherein the session identifier is determined according to a content of the ClientHello message or according to a content of the ServerHello message.
3. The computer system of claim 2 , wherein the session identifier is determined according to a ClientRandom value sent by the client device to the DNS server during the handshake.
4. The computer system of claim 1 , wherein the at least one hardware processor is configured to communicate the access indicator to the DNS server.
5. The computer system of claim 1 , wherein the at least one hardware processor is configured to communicate the access indicator to a traffic filter configured to:
intercept an attempt by the client device to access the Internet domain; and
in response, when the access indicator indicates that the client device is not allowed to access the Internet domain, prevent the client device from accessing the Internet domain.
6. The computer system of claim 1 , wherein the query tracer includes the session identifier and the client identifier.
7. The computer system of claim 1 , wherein the query notification includes the domain name and the session identifier.
8. The computer system of claim 7 , wherein the query notification further includes a query identifier identifying the encrypted DNS query and an IP address produced by resolving the encrypted DNS query.
9. A method comprising employing at least one hardware processor of a computer system to:
receive from a DNS proxy a query tracer characterizing an encrypted communication session between a client device and a DNS server, wherein:
the DNS proxy is connected to the client device over a local network,
the encrypted communication session comprises a cleartext part and an encrypted part, wherein the encrypted part comprises the client device transmitting an encrypted DNS query to the DNS server,
the query tracer associates a session identifier with a client identifier, wherein the client identifier identifies the client device, and wherein the session identifier identifies the encrypted communication session and is determined according to a content of the cleartext part;
receive from the DNS server a query notification comprising a domain name included in the encrypted DNS query, the query notification further associating the domain name with the session identifier;
determine an access indicator according to the query tracer and query notification, the access indicator indicating whether an access policy selected according to the client identifier allows the client device to access an Internet domain having the domain name; and
communicate the access indicator for enforcing the access policy.
10. The method of claim 9 , wherein the cleartext part comprises a handshake including a ClientHello message sent by the client device to the DNS server and a ServerHello message sent by the DNS server to the client device, and wherein the session identifier is determined according to a content of the ClientHello message or according to a content of the ServerHello message.
11. The method of claim 10 , wherein the session identifier is determined according to a ClientRandom value sent by the client device to the DNS server during the handshake.
12. The method of claim 9 , wherein the at least one hardware processor is configured to communicate the access indicator to the DNS server.
13. The method of claim 9 , wherein the at least one hardware processor is configured to communicate the access indicator to a traffic filter configured to:
intercept an attempt by the client device to access the Internet domain; and
in response, when the access indicator indicates that the client device is not allowed to access the Internet domain, prevent the client device from accessing the Internet domain.
14. The method of claim 9 , wherein the query tracer includes the session identifier and the client identifier.
15. The method of claim 9 , wherein the query notification includes the domain name and the session identifier.
16. The method of claim 15 , wherein the query notification further includes a query identifier identifying the encrypted DNS query and an IP address produced by resolving the encrypted DNS query.
17. A non-transitory computer-readable medium storing instructions which, when executed by at least one hardware processor of a computer system, cause the computer system to:
receive from a DNS proxy a query tracer characterizing an encrypted communication session between a client device and a DNS server, wherein:
the DNS proxy is connected to the client device over a local network,
the encrypted communication session comprises a cleartext part and an encrypted part, wherein the encrypted part comprises the client device transmitting an encrypted DNS query to the DNS server,
the query tracer associates a session identifier with a client identifier, wherein the client identifier identifies the client device, and wherein the session identifier identifies the encrypted communication session and is determined according to a content of the cleartext part;
receive from the DNS server a query notification comprising a domain name included in the encrypted DNS query, the query notification further associating the domain name with the session identifier;
determine an access indicator according to the query tracer and query notification, the access indicator indicating whether an access policy selected according to the client identifier allows the client device to access an Internet domain having the domain name; and
communicate the access indicator for enforcing the access policy.