Secure request authentication for a threat protection service

A computer program product in a non-transitory computer-readable medium, the computer program product comprising program code configured to execute in a hardware processor in a mobile device managed by an enterprise, the program code comprising:

• code configured to instantiate a DNS proxy in the mobile device;
• code configured to determine whether the mobile device is executing off an enterprise network;
• and
• code responsive to a determination that the mobile device is executing off the enterprise network to issue a DNS query from the DNS proxy to a resolver, the resolver having been configured as a recursive Domain Name System (DNS) service on behalf of the enterprise, the DNS query having been extended to encode an authorization token, the authentication token including a unique device identifier associated with the mobile device, the unique device identifier having been encrypted and digitally-signed with a key to generate the authorization token;
• and
• code receiving a response to the DNS query, the response having been generated at the resolver upon a determination at the resolver that the authorization code is allowed for the enterprise, the determination having been carried out by the resolver without access to a unique device identifier encoded in the authentication token, together with application by the resolver of a policy associated with the enterprise.

A system, comprising:

• a log service;
• a recursive resolver providing a recursive Domain Name System (DNS) service on behalf of an enterprise;
• a mobile device client application configured to instantiate a DNS proxy on a mobile device, the client application including code to determine whether the mobile device is operating off-net with respect to a protected enterprise network, code responsive to a determination that the mobile device is executing off-net to issue a DNS query from the DNS proxy to the recursive resolver, the DNS query having been extended to encode an authorization token, the authentication token including a unique device identifier associated with the mobile device, the unique device identifier having been encrypted and digitally-signed with a key to generate the authorization token;
• wherein the recursive resolver is further configured to receive the DNS query and, without access to a unique device identifier encoded in the authorization token, to determine whether the authorization token is allowed for the enterprise, wherein the determination is based at least in part on a policy for the enterprise;
• the recursive resolver further configured upon a determination that the authorization token is allowed, to return to the mobile device client application a response to the DNS query, wherein the response to the DNS query is based on applying the policy to the DNS query;
• the recursive resolver further configured to forward the authorization token to the log service, the log service being configured to recover and use the unique device identifier.