User-based DNS server access control
View Patent ↗Methods, systems, and computer program products for managing access to a Domain Name Service (DNS) database. Embodiments of the present disclosure enable authorization of DNS request messages, such as queries and update requests according to user and network address information. The authorization functionality may be incorporated into existing DNS systems. The invention includes a method including receiving a DNS request message originated from a client by a user, the DNS request message comprising a request and identification information specific to the user; determining if the client is authorized to access a DNS database in dependence upon client address information and the user specific identification information contained in the DNS request message; and executing the request in response to determining the user is authorized. The method may further include extracting user specific identification information from a portion of the ID field of DNS messages.
1. A computer-implemented method for managing access to a Domain Name Service (DNS) database, the method comprising:
receiving a DNS request message originated from client software by a user operating a client computer, the client software comprising one or more software utilities running on the client computer, the DNS request message comprising a request and unencrypted identification information specific to the user;
determining if the user is authorized to access the DNS database in dependence upon client address information and the user specific identification information contained in the DNS request message, the determining if the user is authorized to access the DNS database further comprising performing a lookup of the domain name on an access control list, the access control list comprising a listing associating a plurality of domain names with at least one client address and user specific identification information pairing, each pairing representing a combination of a client address information and user specific identification information that is allowed to access to the associated domain name; and
executing the request in response to determining the user is authorized,
the user specific identification information comprises at least one of a user identifier and a privilege identifier.
2. The method of claim 1 wherein a portion of a header of the DNS request message comprises the user specific identification information, and determining if the user is authorized to access the DNS database in dependence upon the client address information and the user specific identification information comprises extracting the user specific identification information from the portion of the header.
3. The method of claim 2 wherein a portion of an identifier (ID) field of the header of the DNS request message comprises the user specific identification information, and determining if the user is authorized to access the DNS database in dependence upon the client address information and the user specific identification information comprises extracting the user specific identification information from the portion of the ID field.
4. The method of claim 1 wherein the request is an update request or a query.
5. The method of claim 3 , wherein the identifier (ID) field of the header of the DNS request message comprises a predetermined number of bits comprising a first number of consecutive bits storing an identifier that corresponds to the user specific identification information and that uniquely identifies the user, and a second number of consecutive bits storing a message identifier that uniquely identifies the DNS request message, the first number of bits and the second number of bits together equaling the predetermined number of bits.
6. A computer program product for managing access to a Domain Name Service (DNS) database, the computer program product comprising:
non-transitory a computer readable storage medium having computer readable program code embodied therewith, the computer usable program code comprising:
computer readable program code configured to receive a DNS request message originated from client software by a user operating a client computer, the client software comprising one or more software utilities running on the client computer, the DNS request message comprising a request and identification information specific to the user;
computer readable program code configured to determine if the user is authorized to access a DNS database in dependence upon client address information and the user specific identification information contained in the DNS request message, the computer readable program code configured to determine if the user is authorized to access the DNS database further comprising computer readable program code configured to perform a lookup of the domain name on an access control list, the access control list comprising a listing associating a plurality of domain names with at least one client address and user specific identification information pairing, each pairing representing a combination of a client address information and user specific identification information that is allowed access to the associated domain name; and
computer readable program code configured to execute the request in response to determining the user is authorized,
the user specific identification information comprises at least one of a user identifier and a privilege identifier.
7. The computer program product of claim 6 wherein a portion of a header of the DNS request message comprises the user specific identification information, and computer readable program code configured to determine if the user is authorized to access the DNS database in dependence upon the client address information and the user specific identification information comprises computer readable program code configured to extract the user specific identification information from the portion of the header.
8. The computer program product of claim 7 wherein a portion of an identifier (ID) field of the header of the DNS request message comprises the user specific identification information, and computer readable program code configured to determine if the user is authorized to access the DNS database in dependence upon the client address information and the user specific identification information comprises computer readable program code configured to extract the user specific identification information from the portion of the ID field.
9. The computer program product of claim 6 wherein the request is an update request or a query.
10. The computer program product of claim 8 , wherein the identifier (ID) field of the header of the DNS request message comprises a predetermined number of bits comprising a first number of consecutive bits storing an identifier that corresponds to the user specific identification information and that uniquely identifies the user, and a second number of consecutive bits storing a message identifier that uniquely identifies the DNS request message, the first number of bits and the second number of bits together equaling the predetermined number of bits.
11. A system for managing access to a Domain Name Service (DNS) database, the system comprising:
a processor; and
a computer memory operatively coupled to the processor, the computer memory having disposed within it:
computer readable program code configured to receive a DNS request message originated from client software by a user operating a client computer, the client software comprising one or more software utilities running on the client computer, the DNS request message comprising a request and identification information specific to the user;
computer readable program code configured to determine if the user is authorized to access a DNS database in dependence upon client address information and the user specific identification information contained in the DNS request message, the computer readable program code configured to determine if the user is authorized to access the DNS database further comprising computer readable program code configured to perform a lookup of the domain name on an access control list, the access control list comprising a listing associating a plurality of domain names with at least one client address and user specific identification information pairing, each pairing representing a combination of a client address information and user specific identification information that is allowed access to the associated domain name; and
computer readable program code configured to execute the request in response to determining the user is authorized,
the user specific identification information comprises at least one of a user identifier and a privilege identifier.
12. The system of claim 11 wherein a portion of a header of the DNS request message comprises the user specific identification information, and computer readable program code configured to determine if the user is authorized to access the DNS database in dependence upon the client address information and the user specific identification information comprises computer readable program code configured to extract the user specific identification information from the portion of the header.
13. The system of claim 12 wherein a portion of an identifier (ID) field of the header of the DNS request message comprises the user specific identification information, and computer readable program code configured to determine if the user is authorized to access the DNS database in dependence upon the client address information and the user specific identification information comprises computer readable program code configured to extract the user specific identification information from the portion of the ID field.
14. The system of claim 13 , wherein the identifier (ID) field of the header of the DNS request message comprises a predetermined number of bits comprising a first number of consecutive bits storing an identifier that corresponds to the user specific identification information and that uniquely identifies the user, and a second number of consecutive bits storing a message identifier that uniquely identifies the DNS request message, the first number of bits and the second number of bits together equaling the predetermined number of bits.
15. A computer-implemented method for identifying a user in a Domain Name Service (DNS) request message, the method comprising:
creating a DNS request message originated from client software by a user operating a client computer, the client software comprising one or more software utilities running on the client computer, the DNS request message comprising a DNS message section comprising unencrypted identification information specific to the user;
determining if the user is authorized to access a DNS database comprising performing a lookup of the domain name on an access control list, the access control list comprising a listing associating a plurality of domain names with at least one of a client address and a user specific identification information pairing, each pairing representing a combination of a client address information and user specific identification information that is allowed access to the associated domain name; and
sending the DNS request message to a DNS server,
the user specific identification information comprises at least one of a user identifier and a privilege identifier.
16. The method of claim 15 wherein creating the DNS request message originated from the client software by the user operating the client computer comprises:
inserting the user specific identification information into specific pre-defined bit positions of an identifier (ID) field of a header section of the DNS message;
generating a unique message identifier configured to fit into remaining bit positions of the identifier (ID) field that lack the user specific identification information; and
inserting the unique message identifier into the remaining bit positions of the identifier (ID) field.
17. A computer program product for identifying a user in a Domain Name Service (DNS) request message, the computer program product comprising:
non-transitory a computer readable storage medium having computer readable program code embodied therewith, the computer usable program code comprising:
computer readable program code configured to create a DNS request message originated from client software by a user operating a client computer, the client software comprising one or more software utilities running on the client computer, the DNS request message comprising a DNS message section comprising unencrypted identification information specific to the user;
computer readable program code for determining if the user is authorized to access a DNS database comprising performing a lookup of the domain name on an access control list, the access control list comprising a listing associating a plurality of domain names with at least one of a client address and a user specific identification information pairing, each pairing representing a combination of a client address information and user specific identification information that is allowed access to the associated domain name, and
computer readable program code configured to send the DNS request message to a DNS server,
the user specific identification information comprises at least one of a user identifier and a privilege identifier.