Selective proxying in domain name systems

Patent metadata

Field	Value
Publication number	US-9628437-B2
Application number	US-201514879897-A
Country	US
Kind code	B2
Filing date	Oct 9, 2015
Priority date	Oct 21, 2010
Publication date	Apr 18, 2017
Grant date	Apr 18, 2017

Abstract

Systems and methods for processing requests for domain name information in accordance with subscriber information are provided. A request for domain name information can be correlated with subscriber preferences to resolve the domain name information. Domain names may be flagged for blocking or proxying by one or more subscriber preferences. In response to a flagged domain name, a client device can be redirected to a web server that can function as proxy on behalf of the user for accessing the flagged domain. In one example, user preferences and/or network preferences can be used to determine whether a particular user can bypass a blocking preference and access the flagged domain using the proxy.

First claim

What is claimed is:

1. A method of domain name system (DNS) processing, comprising:
receiving, at a DNS server, a plurality of DNS requests associated with a first subscriber, the plurality of DNS requests being for a first domain;
based on at least one network record associated with the first subscriber, generating a response to each DNS request having domain name information for a second domain;
receiving at the second domain a set of requests for resources from the first domain;
for a first request of the set having a predetermined identifier for the first domain, generating a first response with one or more resources from the first domain; and
for a second request of the set without a predetermined identifier for the first domain, generating a second response with one or more resources from the second domain;
wherein a third request of the set is received prior to receiving the first request, the third request not having the predetermined identifier, the method further comprising:
accessing a first user record in response to the third request, the first user record being associated with the first subscriber;
generating the predetermined identifier for the first domain based on the first user record;
generating a third response including the predetermined identifier and a redirect with a destination locator corresponding to the first domain.

2. A method according to claim 1 , further comprising, after receiving the third request and before determining the first user record:
generating at the second domain a fourth response having a redirect with a destination locator corresponding to a third domain;
receiving a fourth request at the third domain after generating the fourth response, wherein the first user record is accessed at the third domain in response to the fourth request;
generating a fifth response at the third domain, the fifth response including a redirect with a unique universal resource locator generated by the third domain for the first domain; and
receiving a fifth request at the second domain including the unique universal resource locator generated by the third domain;
wherein the predetermined identifier for the first domain and the third response are generated at the second domain for the first domain in response to receiving the fifth request with the unique universal resource locator.

3. A method according to claim 2 , wherein:
the first request is received at the second domain after generating the third response with the identifier for the first domain.

4. A method according to claim 1 , wherein the one or more resources from the second domain include a redirect with a destination locator corresponding to a third domain, the method further comprising:
receiving a fourth request at the third domain after generating the second response;
accessing a second user record in response to the fourth request at the third domain, the second user record being associated with the first subscriber;
generating a fourth response having a redirect with a destination locator corresponding to the second domain based on the second user record.

5. A method according to claim 4 , further comprising:
receiving a fifth request at the second domain after generating the fourth response; and
generating a fifth response having one or more resources from the second domain.

6. A method according to claim 5 , wherein the one or more resources from the second domain indicate that a second user corresponding to the second user record is not permitted access to the first domain.

7. A method according to claim 1 , wherein said receiving at the second domain comprises receiving at a web server associated with the second domain.

8. A method of domain name system (DNS) processing, comprising:
determining at a DNS server subscriber information associated with a first DNS request corresponding to a first domain;
in response to the first DNS request and based on the subscriber information, generating a DNS response having domain name information for a second domain;
receiving at the second domain, a first resource request corresponding to the first domain, the first resource request having a first universal resource locator for the first domain;
if the first resource request includes a predetermined identifier previously generated by the second domain for the first domain, providing a request for one or more resources associated with the first resource request from the second domain to the first domain;
if the first resource request does not include the predetermined identifier for the first domain, generating a redirect response to a third domain;
receiving at the third domain a second resource request associated with the redirect response;
accessing a user identification based on the second resource request;
generating a redirect response to either the first domain or the second domain depending on a user corresponding to the user identification is permitted to access the first domain.

9. A method according to claim 8 , wherein generating the redirect response comprises:
generating the redirect response having a unique universal resource locator for the first domain if a user corresponding to the user identification is permitted access to the first domain; and
generating the redirect response to the second domain if the user corresponding to the user identification is not permitted access to the first domain.

10. A method according to claim 9 , further comprising:
receiving at the second domain a third resource request having the unique universal resource locator for the first domain; and
in response to the third resource request having the unique universal resource locator, generating the predetermined identifier and a redirect response having the first universal resource locator.

11. A method according to claim 9 , further comprising:
receiving at the second domain a third resource request having a universal resource locator corresponding to the second domain; and
in response to the third resource request having the universal resource locator corresponding to the second domain, generating at the second domain a response having one or more resources from the second domain indicating that the user corresponding to the user identification is not permitted access to the first domain.

12. A method according to claim 9 , further comprising:
determining at the DNS server a source internet protocol (IP) address associated with the first DNS request;
accessing by the DNS server one or more network records in the subscriber information based on the source IP address, the one or more network records including one or more settings indicating that domain name information for the first domain should not be supplied for DNS requests associated with the source IP address; and
accessing at the third domain one or more user records in the subscriber information based on the user identification, the one or more user records including one or more settings indicating whether or not the user corresponding to the user identification should have resource requests associated with the first domain fulfilled at the second domain.

13. A method according to claim 8 , further comprising:
receiving a response from the first domain containing the one or more resources indicated in the first resource request; and
generating a response to the first resource request having the one or more resources from the requested domain.

14. One or more non-transitory processor readable storage media having processor readable code embodied on the one or more non-transitory processor readable storage media, the processor readable code for prog

Assignees

• Cisco Tech Inc

Inventors

• Dempsky Matthew
• Ulevitch David
• Treuhaft Noah
• Damm Michael

Classifications

• H04L61/6013

  Electricity · mapped topic

• H04L61/1511 Primary

  Electricity · mapped topic

• H04L61/4511 Primary

  using domain name system [DNS] · CPC title

• H04L61/59 Primary

  using proxies for addressing · CPC title