Managing client-oriented domain name service over Hypertext Transfer Protocol Secure

1. A method performed by a network computing device for managing Domain Name Service (DNS) over Hypertext Transfer Protocol Secure (DoH), comprising:

receiving from a client computing device a DoH request comprising a public certificate associated with a client identifier and DoH request content;

generating a fingerprint of the public certificate;

obtaining a client-specific DoH policy based on an association between the fingerprint of the public certificate and the client-specific DoH policy;

routing the DoH request content to a DNS resolver, wherein the DoH request does not contain any identifying information regarding the client computing device;

receiving a DNS response from the DNS resolver; and

applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request based upon the DNS response.

2. The method of claim 1 , further comprising:

receiving from the client computing device policy parameters; and

configuring the client-specific DoH policy based on the received policy parameters;

wherein obtaining the client-specific DoH policy based on the association between the fingerprint of the public certificate and the client-specific DoH policy comprises obtaining the client-specific DoH policy that is configured based on the received policy parameters.

3. The method of claim 2 , wherein configuring the client-specific DoH policy based on the received policy parameters comprises:

generating the association between the fingerprint of the public certificate and the client-specific DoH policy; and

storing in a data structure the association between the fingerprint of the public certificate and the client-specific DoH policy.

4. The method of claim 1 , wherein applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request comprises:

applying the client-specific DoH policy to the DoH request to perform a DNS-based advertisement management operation; and

formulating the response to the DoH request using an output of the DNS-based advertisement management operation.

5. The method of claim 1 , wherein applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request comprises:

applying the client-specific DoH policy to the DoH request to perform a DNS-based parental control operation; and

formulating the response to the DoH request using an output of the DNS-based parental control operation.

6. The method of claim 1 , wherein applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request comprises:

applying the client-specific DoH policy to the DoH request to perform a DNS-based content filtering operation; and

formulating the response to the DoH request using an output of the DNS-based content filtering operation.

7. A network computing device, comprising:

a processor coupled to the memory and configured with processor-executable instructions to perform operations comprising:

receiving from a client computing device a Domain Name Service (DNS) over Hypertext Transfer Protocol Secure (DoH) request comprising a public certificate associated with a client identifier and DoH request content;

generating a fingerprint of the public certificate;

obtaining a client-specific DoH policy based on an association between the fingerprint of the public certificate and the client-specific DoH policy;

routing the DoH request content to a DNS resolver, wherein the DoH request does not contain any identifying information regarding the client computing device;

receiving a DNS response from the DNS resolver; and

applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request based upon the DNS response.

8. The network computing device of claim 7 , wherein the processor is configured with processor-executable instructions to perform operations further comprising:

receiving from the client computing device policy parameters; and

configuring the client-specific DoH policy based on the received policy parameters;

wherein obtaining the client-specific DoH policy based on the association between the fingerprint of the public certificate and the client-specific DoH policy comprises obtaining the client-specific DoH policy that is configured based on the received policy parameters.

9. The network computing device of claim 8 , wherein the processor is configured with processor-executable instructions to perform operations such that configuring the client-specific DoH policy based on the received policy parameters comprises:

generating the association between the fingerprint of the public certificate and the client-specific DoH policy; and

storing in a data structure the association between the fingerprint of the public certificate and the client-specific DoH policy.

10. The network computing device of claim 7 , wherein the processor is configured with processor-executable instructions to perform operations such that applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request comprises:

applying the client-specific DoH policy to the DoH request to perform a DNS-based advertisement management operation; and

formulating the response to the DoH request using an output of the DNS-based advertisement management operation.

11. The network computing device of claim 7 , wherein the processor is configured with processor-executable instructions to perform operations such that applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request comprises:

applying the client-specific DoH policy to the DoH request to perform a DNS-based parental control operation; and

formulating the response to the DoH request using an output of the DNS-based parental control operation.

12. The network computing device of claim 7 , wherein the processor is configured with processor-executable instructions to perform operations such that applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request comprises:

applying the client-specific DoH policy to the DoH request to perform a DNS-based content filtering operation; and

formulating the response to the DoH request using an output of the DNS-based content filtering operation.

13. A non-transitory processor-readable medium having stored thereon processor-executable instruction configured to cause a processor of a network computing device to perform operations comprising:

receiving from a client computing device a Domain Name Service (DNS) over Hypertext Transfer Protocol Secure (DoH) request comprising a public certificate associated with a client identifier and DoH request content;

generating a fingerprint of the public certificate;

obtaining a client-specific DoH policy based on an association between the fingerprint of the public certificate and the client-specific DoH policy;

routing the DoH request content to a DNS resolver, wherein the DoH request does not contain any identifying information regarding the client computing device;

receiving a DNS response from the DNS resolver; and

applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request based upon the DNS response.

14. The non-transitory processor-readable medium of claim 13 , wherein the stored processor-executable instructions are configured to cause a processor of a network computing device to perform operations further comprising:

receiving from the client computing device policy parameters; and

configuring the client-specific DoH policy based on the received policy parameters;

wherein obtaining the client-specific DoH policy based on the association between the fingerprint of the public certificate and the client-specific DoH policy comprises obtaining the client-specific DoH policy that is configured based on the received policy parameters.

15. The method of claim 14 , wherein the stored processor-executable instructions are configured to cause a processor of a network computing device to perform operations such that configuring the client-specific DoH policy based on the received policy parameters comprises:

generating the association between the fingerprint of the public certificate and the client-specific DoH policy; and

storing in a data structure the association between the fingerprint of the public certificate and the client-specific DoH policy.

16. The non-transitory processor-readable medium of claim 13 , wherein the stored processor-executable instructions are configured to cause a processor of a network computing device to perform operations such that applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request comprises:

applying the client-specific DoH policy to the DoH request to perform a DNS-based advertisement management operation; and

formulating the response to the DoH request using an output of the DNS-based advertisement management operation.

17. The non-transitory processor-readable medium of claim 13 , wherein the stored processor-executable instructions are configured to cause a processor of a network computing device to perform operations such that applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request comprises:

applying the client-specific DoH policy to the DoH request to perform a DNS-based parental control operation; and

formulating the response to the DoH request using an output of the DNS-based parental control operation.

18. The non-transitory processor-readable medium of claim 13 , wherein the stored processor-executable instructions are configured to cause a processor of a network computing device to perform operations such that applying the client-specific DoH policy to the DoH request to formulate a response to the DoH request comprises:

applying the client-specific DoH policy to the DoH request to perform a DNS-based content filtering operation; and

formulating the response to the DoH request using an output of the DNS-based content filtering operation.