Efficient provisioning of internet circuit and secure domain name system
The present application describes systems and methods for automatically provisioning a domain name system (DNS) firewall service for an Internet circuit. In examples, customer premises equipment and a DNS firewall system are automatically configured to work with the Internet circuit without requiring technical knowledge or intervention by a customer.
1. A method, comprising:
receiving, from a provider configuration system of a network and at a domain name system (DNS) firewall system, a request to instantiate the DNS firewall system for an Internet circuit, wherein the request comprises customer information and an assigned Internet protocol (IP) address space for the Internet circuit;
automatically extracting the customer information and the assigned IP address space from the request;
automatically storing tenant data for the customer at the DNS firewall system, wherein the tenant data comprises at least the assigned IP address space;
receiving, by the DNS firewall system, a first DNS request from the assigned IP address space;
processing, by the DNS firewall system, the first DNS request, wherein the processing comprises:
determining that the first DNS request includes a first domain that is in a first category;
determining whether the first category is permitted for the customer;
when the first category is permitted for the customer, causing the first DNS request to be resolved to a first IP address associated with the first domain; and
when the first category is not permitted for the customer, causing the first DNS request to be rejected;
receiving, by the DNS firewall system, a second DNS request from the assigned IP address space;
determining, by the DNS firewall system, that the customer is not currently subscribed to the DNS firewall system for the Internet circuit; and
forwarding, by the DNS firewall system, the second DNS request to a separate DNS system.
2. The method of claim 1 , further comprising reporting, by the DNS firewall system, filtering information to a threat intelligence system.
3. The method of claim 2 , wherein the filtering information comprises information regarding any domains that the customer has included on at least one of an access-allowed list or an access-denied list.
4. The method of claim 2 , further comprising receiving, from the threat intelligence system, a list of known malicious domains, wherein the first category comprises the list of known malicious domains and wherein the DNS firewall system automatically prohibits the first category from being permitted for the customer.
5. The method of claim 1 , wherein the separate DNS system is associated with a second IP address, the method further comprising, when the customer is not currently subscribed to the DNS firewall system for the Internet circuit, sending a notification to the customer to instruct the customer to change an IP address at customer premises equipment to the second IP address.
6. The method of claim 1 , further comprising, when the customer is not currently subscribed to the DNS firewall system for the Internet circuit, forwarding the second DNS request to a separate DNS system only if the second DNS request is received during a predefined period since the customer was last subscribed to the DNS firewall system and, otherwise, discarding the second DNS request.