Cloud-based user-level policy, reporting, and authentication over DNS

A cloud-based system for user-level policy, reporting, and authentication over Domain Name System (DNS), comprising:

• a cloud service-provided virtual machine (VM) operated on an internal network behind a Network Address Translation boundary;
• and
• a multi-tenant cloud-service operated on a cloud-based system communicatively coupled to the VM;
• wherein the VM is configured to:
• maintain a local user Internet Protocol (IP) database identifying users in the internal network;
• and
• act as a transparent proxy for all DNS requests from the users performing the steps of:
• for a user already identified in the local user IP database, forwarding a DNS request to the multi-tenant cloud-service with an identifier from the local user IP database of the user associated with the DNS request;
• and
• for the user not identified in the local user IP database, performing a series of redirects and hand offs between the cloud-based system, the enterprise, the user and an Identity Provider (IDP) to uniquely identify the user, wherein the series of redirects and hand offs is between i) the user and the enterprise, ii) the enterprise and the cloud-based system, iii) the cloud-based system within itself, iv) the user and the IDP directly, and v) the user to itself to install a cookie;
• subsequent to the performing the series of redirects and hand offs in the cloud-based system to identify the user, updating an identity of the user in the local user IP database;
• and
• forwarding a second DNS request to the cloud-based system with the identifier from the local user IP database of the user associated with the second DNS request;
• wherein the multi-tenant cloud-service is configured to perform, based on associated DNS requests and the local user IP database, user-level policy, reporting, and authentication by the cloud-based system responsive to uniquely identifying the users, and wherein the multi-tenant cloud-service is configured to determine if one of the associated DNS requests is within policy of the internal network for the user, and return a resolved address from the one of the associated DNS requests if it is within the policy.

A transparent proxy operating in a device within an enterprise network, comprising:

• a device in the enterprise network comprises a processor and memory storing instructions that, when executed, cause the processor to:
• maintain a local user Internet Protocol (IP) database identifying users in the enterprise network;
• receive a DNS request from a user;
• if the user is already identified in the local user IP database, forward the DNS request to a multi-tenant cloud-service with an identifier from the local user IP database of the user associated with the DNS request;
• if the user is not identified in the local user IP database, perform a series of redirects and hand offs between the cloud-based system, the enterprise, the user and an Identity Provider (IDP) to uniquely identify the user, wherein the series of redirects and hand offs is between i) the user and the enterprise, ii) the enterprise and the cloud-based system, iii) the cloud-based system within itself, iv) the user and the IDP directly, and v) the user to itself to install a cookie;
• subsequent to the performance of the series of redirects and hand offs in the cloud-based system to identify the user, update an identity of the user in the local user IP database;
• and
• forward a second DNS request to the cloud-based system with the identifier from the local user IP database of the user associated with the second DNS request;
• wherein the multi-tenant cloud-service is configured to perform, based on associated DNS requests and the local user IP database, user-level policy, reporting, and authentication by the cloud-based system responsive to uniquely identifying the user, and wherein the multi-tenant cloud-service is configured to determine if one of the associated DNS requests is within policy of the internal network for the user, and return a resolved address from the one of the associated DNS requests if it is within the policy.