Granted Patent B2

US 9,906,488 · App. 13/882,153 · Granted Feb 27, 2018

Inventor: Martin Kagan (Portland, OR)

Assignee: Cedexis, Inc.

H04L61/1511G06F17/30864H04L47/24H04L61/302H04L61/305H04L61/6009H04L67/30

Abstract

Claims (87)

1. A method for providing access to an Internet resource comprising:

maintaining a first nameserver that is registered to be an authoritative nameserver and that includes a cache of DNS resolutions to DNS queries;

receiving from a resource provider, a set of policy codes at the first nameserver, the policy codes indicating how the first nameserver responds to queries and conditions;

accepting at the first nameserver directions to blacklist DNS queries;

receiving at the first nameserver a first DNS query;

executing at the first nameserver a policy code to determine how to respond to the first DNS query;

determining, based on the policy code, that a parameter of the first DNS query is on the blacklist;

responding to the first DNS query by throwing a blacklist error message;

receiving at the first nameserver a second DNS query comprising a domain name, from a web client;

forming a cache key by augmenting the domain name with an identity of the web client; and

accessing the cache with the cache key to check for a valid cache resolution.

2. The method of claim 1 , wherein a hostname specified by the first DNS query indicates an infrastructure at which the Internet resource is to be accessed, wherein responding to the first DNS query further comprises generating a response that does not allow access to the infrastructure.

3. The method of claim 1 , wherein the policy code is a first policy code, wherein the valid cache resolution is a first valid cache resolution, and wherein the method further comprises:

receiving at the first nameserver a third DNS query from a second web client;

executing at the first nameserver a second policy code to determine how to respond to the third DNS query; and

based on the second policy code, checking for a second valid cached resolution, wherein the checking for a second valid cached resolution comprises evaluating a location of the second web client.

4. A method for providing access to an Internet resource comprising:

maintaining a first nameserver that is registered to be an authoritative nameserver and that includes a cache of DNS resolutions to DNS queries;

receiving from a resource provider, a set of policy codes at the first nameserver, the policy codes indicating how the first nameserver responds to queries and conditions;

accepting at the first nameserver directions to blacklist DNS queries;

receiving at the first nameserver a first DNS query;

executing at the first nameserver a first policy code to determine how to respond to the first DNS query;

determining, based on the first policy code, that a parameter of the first DNS query is on the blacklist; and

responding to the first DNS query by throwing a blacklist error message;

receiving at the first nameserver a second DNS query;

executing at the first nameserver a second policy code to determine how to respond to the second DNS query;

determining, based on the second policy code, that the second DNS query is malicious; and

responding to the second DNS query by generating a first DNS response, wherein generating the first DNS response comprises sending a third DNS query from the first nameserver to a second nameserver, receiving at the first nameserver from the second nameserver a second DNS response that includes a new DNS resolution, and including the new DNS resolution in the first DNS response.

5. The method of claim 1 , further comprising receiving a purge command and responsively removing one or more DNS cached resolutions from the cache.

6. The method of claim 1 , further comprising generating a report including one or more of the following parameters: data in the first DNS query, a time of receipt of the first DNS query, an origin of the first DNS query, or a measure of system performance.

7. The method of claim 1 , and further comprising receiving a third DNS query and generating a report including a measure of aggregation of the first and third DNS queries.

8. A system for providing access to an Internet resource, the system comprising:

a first nameserver, including a cache that holds DNS resolutions of DNS queries;

wherein the first nameserver further includes memory for holding policy code to make a policy-based determination of validity of one or more of the DNS queries and the cached resolutions;

wherein the first nameserver further includes processor resources to receive from a resource provider a set of policy codes indicating how the first nameserver responds to queries and conditions;

wherein the first nameserver further includes processor resources to receive directions to blacklist DNS queries; and

wherein the first nameserver further includes processor resources to receive a first DNS query directed to an authoritative DNS server, execute a first policy code, determine validity of the first DNS query, and responsively generate a response to the DNS query by returning an intentionally false response;

wherein the first nameserver further includes processor resources to:

receive at the first nameserver a second DNS query;

execute at the first nameserver a second policy code to determine how to respond to the second DNS query;

determine, based on the second policy code, that the second DNS query is malicious; and

respond to the second DNS query by generating a first DNS response, and

wherein the processor resources to generate the first DNS response include resources to:

send a third DNS query to a second nameserver,

receive from the second nameserver a second DNS response that includes a new DNS resolution, and

include the new DNS resolution in the first DNS response.

9. The system of claim 8 , wherein the first nameserver further includes a port used to receive the set of policy codes.

10. The system of claim 8 , wherein determination that the second DNS query is malicious comprises determining that a parameter of the second DNS query is on the blacklist.

11. The system of claim 8 , wherein the first nameserver further includes processor resources to:

based on the second policy code, check for a valid cached resolution, wherein checking for a valid cached resolution comprises evaluation of one or more of: a location of the web client or a measure of system performance.

12. The system of claim 8 , wherein the first nameserver further includes processor resources to generate a report including one or more of the following parameters: data in the DNS query, a time of receipt of the DNS query, a location of the web client, or a measure of system performance.

13. The system of claim 8 , wherein the first nameserver further includes processor resources to generate a report including a measure of aggregation of the first and second DNS queries.

14. A computer program product comprising a computer readable non-transitory storage medium, which includes a computer readable program that when executed on a processor causes the processor to:

maintain a cache that includes DNS resolutions of DNS queries;

receive a set of policy codes, the policy codes indicating how to respond to queries and conditions;

accept directions to blacklist DNS queries;

receive a first DNS query;

execute a first policy code to determine how to respond to the first DNS query;

determine, based on the first policy code, that a parameter of the first DNS query is on the blacklist;

respond to the first DNS query by throwing a blacklist error message;

receive at the first nameserver a second DNS query;

execute at the first nameserver a second policy code to determine how to respond to the second DNS query;

determine, based on the second policy code, that the second DNS query is malicious; and

respond to the second DNS query by generating a first DNS response, and wherein the computer readable program further causes the processor to generate the first DNS response by sending a third DNS query to a second nameserver, receiving from the second nameserver a second DNS response that includes a new DNS resolution, and including the new DNS resolution in the first DNS response.

15. The computer program product of claim 14 , wherein a hostname specified by the DNS query indicates an infrastructure at which an Internet resource is to be accessed, wherein responding to the DNS query further comprises generating a response that does not allow access to the infrastructure.

16. The computer program product of claim 14 , wherein the DNS query is a first DNS query, wherein the computer readable program further causes the processor to:

receive at the first nameserver a second DNS query;

execute at the first nameserver a second policy code to determine how to respond to the second DNS query;

determine, based on the policy code, that the second DNS query is malicious;

respond to the second DNS query by generating a first DNS response, and wherein the computer readable program further causes the processor to generate the first DNS response by sending a third DNS query to a second nameserver, receiving from the second nameserver a second DNS response that includes a new DNS resolution, and including the new DNS resolution in the first DNS response.

17. The method of claim 1 , wherein the policy code is a first policy code, further comprising:

receiving at the first nameserver a third DNS query; and

executing at the first nameserver a second policy code to determine how to respond to the third DNS query;

wherein determining how to respond to the third DNS query comprises delaying sending a DNS response in order to control a rate of throughput.

18. The method of claim 17 , wherein delaying sending the DNS response in order to control the rate of throughput comprises: the second policy code determining a delay time based on load parameters.

19. The method of claim 18 , wherein the load parameters include length of queued delayed responses.

20. The method of claim 19 , wherein the second policy code further comprises a set of actions to take when a queue exceeds a certain length.

21. The method of claim 1 , wherein the policy codes indicate how the first nameserver may modify or transform the contents of a DNS response received from a second nameserver.

22. The method of claim 1 , wherein the policy codes indicate one or more rates at which responses are returned.

23. The method of claim 1 , wherein the policy code is a first policy code, wherein the valid cached resolution is a first valid cached resolution, and wherein the method further comprises:

receiving at the first nameserver a third DNS query from a second web client;

executing at the first nameserver a second policy code to determine how to respond to the third DNS query; and

based on the second policy code, checking for a second valid cached resolution, wherein the checking for a second valid cached resolution comprises evaluating a measure of system performance.

24. The method of claim 4 , wherein the second DNS query includes a domain name and is received at the first nameserver from a requester, and wherein the third DNS query comprises the domain name and location information of the requester.

25. The method of claim 4 , wherein the second DNS response comprises a second Time-to-Live value, and wherein the method further comprises:

forming a cache entry based at least partly on the second DNS response and comprising a first Time-to-Live value that is distinct from the second Time-to-Live value; and

storing the cache entry in the cache.

Assignments (10)

Continuity (2)