DNS iterative query method and product

Abstract

The invention discloses a DNS (Domain Name Server) iterative query method and a DNS iterative query product, and aims to solve the problem that a user query behavior is easy to track and analyze due to the fact that user privacy protection is not fully considered when a DNS query is processed in the prior art. In the process of querying the superior authoritative server of the domain name upwards step by step through the DNS resolver, the QNAME sent each time is a reduced domain name of an original complete domain name, and the QTYPE is other query types different from the original query type; the QNAME sent to the final authoritative server is the original complete domain name, and the QTYPE is the original query type. According to the method, the user privacy protection is enhanced by reducing the data transmission quantity, and the number of times of transmitting complete information of the user to the outside is reduced by minimizing the query domain name and confusing the query types, so that the risk that the privacy of the user is exposed is effectively reduced.

Description

Technical Field

[0001] The present application relates to the field of computer network technology, and in particular to a DNS iterative query method. Background Art

[0002] With the rapid development of Internet technology, the Domain Name System (DNS), as a key component of Internet infrastructure, undertakes the important task of resolving domain names entered by users into corresponding IP addresses. However, in the existing DNS query processing mechanism, the issue of user privacy protection has become increasingly prominent and has become a technical issue that needs to be solved urgently.

[0003] When a user initiates a DNS query, the query request will go through multiple intermediate links, including the local DNS server, recursive DNS server, and possible third-party DNS resolution services. In this process, the user's query behavior (including the queried domain name, timestamp, and sensitive information such as the user's IP address) may be recorded and tracked. Once this information is obtained by a malicious third party, it may be used to analyze the user's network behavior, interest preferences, and even personal identity, thus posing a serious threat to the user's privacy.

[0004] In addition, with the continuous advancement of big data and artificial intelligence technology, the ability to deeply mine and analyze network traffic data has been increasingly enhanced, making it easier and more accurate to track and analyze user behavior through DNS query records. This not only threatens the personal privacy security of users, but may also cause broader social problems, such as online fraud and identity theft.

[0005] Therefore, how to effectively reduce the risk of user privacy leakage while ensuring the efficiency of DNS queries has become an important issue in the current field of Internet protocol privacy protection. Summary of the invention

[0006] The present application provides a method and product for iterative DNS query, aiming to solve the problem that the prior art fails to fully consider user privacy protection when processing DNS queries, resulting in user query behavior being easily tracked and analyzed.

[0007] In a first aspect, a DNS iterative query method is applied to a local DNS resolver, the method comprising:

[0008] In the process of the DNS resolver querying the superior authoritative server of the domain name step by step, the QNAME sent each time is the shortened domain name of the original full domain name, and the QTYPE is a query type different from the original query type; until the last query, the QNAME sent to the final authoritative server is the original full domain name, and the QTYPE is the original query type.

[0009] In the above solution, further optionally, the shortened domain name is a next-level domain name corresponding to the authoritative server.

[0010] In the above solution, optionally, the other query type different from the original query type adopts A, AAAA, CNAME, MX or NS.

[0011] In the above solution, optionally, the other query types different from the original query type are randomly generated each time.

[0012] In the above scheme, optionally, it specifically includes: the DNS resolver receives the original complete domain name and the original query type; the DNS resolver queries the upper-level authoritative server of the domain name step by step upward to obtain the NS record of the lower-level authoritative server; wherein, the QNAME sent each time is the next-level domain name of the corresponding authoritative server, and the QTYPE is a query type other than the original query type; according to the NS record of the authoritative server to which the original complete domain name belongs that is returned, a query request is sent to the authoritative server to which the original complete domain name belongs to obtain a final response result; the QNAME of the query request is the original complete domain name, and the QTYPE is the original query type.

[0013] In the above scheme, further optionally, based on the NS record of the authoritative server to which the original full domain name belongs that is returned, a query request is sent to the authoritative server to which the original full domain name belongs, a final response result is obtained, and it is determined whether there is an independent authorized sub-zone for the full domain name; when there is an independent authorized sub-zone, a query request is sent to the authoritative server of the independent authorized sub-zone, and the QNAME of the query request is the original full domain name, and the QTYPE is the original query type; when there is no independent authorized sub-zone, a query request is sent to the authoritative server of the superior domain name, and the QNAME of the query request is the original full domain name, and the QTYPE is the original query type.

[0014] In a second aspect, a client DNS resolver includes a memory, a processor, and a computer program stored in the memory, wherein the client DNS resolver executes the computer program to implement the steps of the above method.

[0015] In a third aspect, a computer program product comprises a computer program / instruction, wherein the computer program / instruction implements the steps of the above method when executed by a processor.

[0016] Compared with the prior art, this application has at least the following beneficial effects:

[0017] This application is based on further analysis and research of existing technical problems, and recognizes that reducing the amount of data transmission in network protocols is important for Internet protocol privacy protection. The less data sent out, the less likely privacy exposure is. By reducing the amount of data transmission, user privacy protection is enhanced, and by minimizing the confusion between query domain names and query types, the number of times the user's complete information is transmitted outward is reduced, thereby effectively reducing the risk of user privacy being exposed.

[0018] This application is also fully compatible with existing DNS systems and protocols, does not require large-scale changes to the infrastructure, and only performs optimization and obfuscation at the resolver level, making deployment relatively simple.

[0019] In addition to privacy protection, this application can also provide additional security, for example, by reducing the amount of data transmitted, the risk of data being intercepted and misused can be reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 An original query process result diagram provided for an embodiment of the present application.

[0021] Figure 2 A query process result diagram of a DNS iterative query method provided in an embodiment of the present application.

[0022] Figure 3 A diagram of the internal structure of a client DNS resolver in one embodiment. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0024] In the description of this application: unless otherwise specified, "plurality" means two or more. "Including", "comprising", "having" and other expressions also mean "not limited to" (certain units, components, materials, steps, etc.).

[0025] The traditional query process of DNS (Domain Name System) is an iterative process. The resolver (usually the user's local DNS resolver) sends the complete original query name (QNAME) and query type (QTYPE) to authoritative domain name servers at all levels starting from the root server until the final answer is returned. The following is a detailed description of this process:

[0026] 1. User-initiated query: The user enters a URL, such as www.example.com, in a browser or other client, and the resolver begins trying to resolve the domain name into an IP address.

[0027] 2. Query the root server: The resolver first sends a query request to the root server (Root Server), asking for the location of the authoritative domain name server for www.example.com. The root server returns the address of the top-level domain name (TLD) server, which is the NS record of com in this example.

[0028] 3. Query the top-level domain name server: The resolver then sends a query request to the top-level domain name server of com, asking the authoritative domain name server of example.com. The top-level domain name server returns the NS record of example.com.

[0029] 4. Query the authoritative domain name server: The resolver then sends a query request to the authoritative domain name server of example.com, asking for the IP address of www.example.com. The authoritative domain name server checks its database and returns the corresponding IP address if there is an A record for www.example.com.

[0030] 5. Return result: After receiving the response from the authoritative domain name server, the resolver returns the IP address to the user terminal, which can then use this IP address to access the target website.

[0031] 6. Cache results: During this process, each DNS server participating in the query can cache the query results to speed up the response to the same query in the future.

[0032] 7. Error handling: If the query fails at any stage, for example, the domain name does not exist or the record of the corresponding type of the domain name does not exist, the DNS server will return a negative response (the domain name does not exist or there is no corresponding type of data under the domain name), indicating that the corresponding record was not found.

[0033] Existing technologies fail to fully consider user privacy protection when processing DNS queries, resulting in user query behaviors being easily tracked and analyzed.

[0034] Reducing the amount of data transmission in network protocols is very important for Internet protocol privacy protection. The less data sent out, the less likely it is that privacy will be exposed. In the traditional DNS query process, the resolver will send the complete original query domain name (QNAME) and query type (QTYPE) to each layer of upper authoritative domain name server starting from the root server by default, which undoubtedly increases the risk of user privacy leakage. Because when the resolver sends a DNS query request, this request will pass through multiple network nodes, including the DNS servers provided by the ISP. These servers may record and analyze the user's query behavior characteristics, thereby infringing the user's privacy.

[0035] The resolver queries the superior authoritative server of the domain name step by step through iterative queries, with the purpose of obtaining the NS records of the subordinate authoritative servers, so as to locate the DNS server to which the domain name belongs and obtain the final response result. When querying the subordinate NS records:

[0036] a) No need for a complete domain name: When obtaining the authority record of a lower-level zone, the resolver does not need to send the complete original query domain name (QNAME). It only needs to send a domain name label one level higher than the zone that the upper-level authoritative server is responsible for.

[0037] b) Query type independence: When returning the subordinate zone's authoritative records, the superior authoritative servers do not care about the specific query type (QTYPE) because they are only responsible for returning the subordinate authoritative servers' NS records.

[0038] In one embodiment, a method for iterative DNS query is provided, which is applied to a local DNS resolver, and the method includes:

[0039] In the process of the DNS resolver querying the superior authoritative server of the domain name step by step, the QNAME sent each time is the shortened domain name of the original full domain name, and the QTYPE is a query type different from the original query type; until the last query, the QNAME sent to the final authoritative server is the original full domain name, and the QTYPE is the original query type.

[0040] In this embodiment, the purpose is to enhance user privacy protection by reducing the amount of data transmission. By minimizing the confusion between the query domain name and the query type, the number of times the user's complete information is transmitted to the outside is reduced, thereby effectively reducing the risk of user privacy being exposed. This application is fully compatible with the current DNS system and protocol, but only modifies the operation mode of the resolver, and performs a series of optimizations and obfuscation processing at the resolver level to reduce data transmission and potential privacy leakage.

[0041] In one embodiment, the domain name is shortened to a next-level domain name corresponding to the authoritative server.

[0042] In one embodiment, the other query types different from the original query type are A, AAAA, CNAME, MX or NS. In this embodiment, the other query types may also be any query types such as TXT, PTR or CAA, which are not specifically limited in this application.

[0043] In one embodiment, query types other than the original query type are randomly generated each time.

[0044] In one embodiment, during the iterative query process, other query types different from the original query type may use only the same query type, but the query type is randomly generated.

[0045] Taking the query QNAME = www.example.com, QTYPE = MX as an example, the optimized query process is as follows:

[0046] ① The resolver queries the root server for QNAME=com, QTYPE=A to obtain the NS record of .com.

[0047] ②The resolver uses the NS record of .com to query the DNS server of .com with QNAME=example.com, QTYPE=A to obtain the NS record of example.com.

[0048] ③The resolver uses the NS record of example.com to query the DNS server of example.com for QNAME=www.example.com, QTYPE=A to determine that www.example.com does not have an authorized subzone and the domain name exists in the example.com zone.

[0049] ④ If the NS record of www.example.com does not exist in the returned result, it means that there is no authorized sub-zone. At this time, the resolver uses the NS record of example.com to query the DNS server of example.com with QNAME=www.example.com, QTYPE=MX to obtain the final response result.

[0050] ⑤ If the returned result contains the NS record of www.example.com, it indicates that there is an authorized sub-zone. The resolver uses the NS record of www.example.com to query the DNS server of www.example.com with QNAME=www.example.com, QTYPE=MX, and obtains the final response result.

[0051] In one embodiment, other query types different from the original query type may be randomly generated during each iterative query process of the DNS resolver.

[0052] In one embodiment, taking the query QNAME=www.example.com, QTYPE=MX as an example, the optimized query process is as follows:

[0053] ① The resolver queries the root server for QNAME=com, QTYPE=A to obtain the NS record of .com.

[0054] ②The resolver uses the NS record of .com to query the DNS server of .com with QNAME=example.com, QTYPE=AAAA to obtain the NS record of example.com.

[0055] ③The resolver uses the NS record of example.com to query the DNS server of example.com with QNAME=www.example.com, QTYPE=TXT to determine that www.example.com does not have an authorized subzone and that the domain name exists in the example.com zone.

[0056] ④ If the NS record of www.example.com does not exist in the returned result, it means that there is no authorized sub-zone. At this time, the resolver uses the NS record of example.com to query the DNS server of example.com with QNAME=www.example.com, QTYPE=MX to obtain the final response result.

[0057] ⑤ If the returned result contains the NS record of www.example.com, it indicates that there is an authorized sub-zone. The resolver uses the NS record of www.example.com to query the DNS server of www.example.com with QNAME=www.example.com, QTYPE=MX, and obtains the final response result.

[0058] In one embodiment, it specifically includes:

[0059] The DNS resolver receives the original full domain name and the original query type;

[0060] The DNS resolver queries the upper-level authoritative server of the domain name step by step to obtain the NS record of the lower-level authoritative server; wherein, the QNAME sent each time is the lower-level domain name of the corresponding authoritative server, and the QTYPE is a query type different from the original query type;

[0061] According to the NS record of the authoritative server to which the original full domain name belongs, a query request is sent to the authoritative server to which the original full domain name belongs to obtain the final response result; the QNAME of the query request is the original full domain name, and the QTYPE is the original query type.

[0062] In one embodiment, according to the NS record of the authoritative server to which the original full domain name belongs, a query request is sent to the authoritative server to which the original full domain name belongs, a final response result is obtained, and it is determined whether the full domain name has an independent authorized sub-zone;

[0063] When there is an independent delegation sub-zone, a query request is sent to the authoritative server of the independent delegation sub-zone. The QNAME of the query request is the original full domain name, and the QTYPE is the original query type.

[0064] When there is no independent authorized sub-zone, a query request is sent to the authoritative server of the superior domain name. The QNAME of the query request is the original full domain name and the QTYPE is the original query type.

[0065] In one embodiment, taking the query QNAME=www.example.com, QTYPE=MX as an example, the optimized query process is as follows:

[0066] ① The resolver queries the root server for QNAME=com, QTYPE=A to obtain the NS record of .com.

[0067] ②The resolver uses the NS record of .com to query the DNS server of .com with QNAME=example.com, QTYPE=A to obtain the NS record of example.com.

[0068] ③The resolver uses the NS record of example.com to query the DNS server of example.com for QNAME=www.example.com, QTYPE=A, and determines whether there is an authorized subzone for www.example.com based on whether there is an NS record for www.example.com in the returned result.

[0069] ④ If the NS record of www.example.com does not exist in the returned result, it means that there is no authorized sub-zone. At this time, the resolver uses the NS record of example.com to query the DNS server of example.com with QNAME=www.example.com, QTYPE=MX to obtain the final response result.

[0070] ⑤ If the returned result contains the NS record of www.example.com, it indicates that there is an authorized sub-zone. The resolver uses the NS record of www.example.com to query the DNS server of www.example.com with QNAME=www.example.com, QTYPE=MX, and obtains the final response result.

[0071] In this embodiment, through: (1) Domain name query minimization: This technology ensures that only necessary information is sent during the DNS query process. For example, when querying a subdomain, the resolver does not send the entire domain name, but only sends the next-level domain name of the corresponding authoritative server, thereby reducing privacy risks by reducing the amount of data exchanged.

[0072] (2) Query type obfuscation: By randomizing the query type, even if an observer can see the external features of the query, he or she cannot determine the specific content of the query, making it more difficult for attackers to perform traffic analysis and identify user behavior patterns.

[0073] (3) Compatibility: The method provided in this application is fully compatible with existing DNS systems and protocols and does not require large-scale changes to the infrastructure. It only performs optimization and obfuscation at the resolver level, making deployment relatively simple.

[0074] (4) Enhanced security: In addition to privacy protection, the method provided in this application can also provide additional security. For example, by reducing the amount of data transmitted, the risk of data being intercepted and abused can be reduced.

[0075] This application Figure 1 and Figure 2 Provided are the original query process result diagram of iterative query using the prior art and the query process result diagram of the DNS iterative query method provided in the embodiment of the present application.

[0076] exist Figure 1 In the original query process, there are three queries in total, each of which is the full domain name www.example.com and the original query type MX. Figure 2 In the optimized query process of this application, a total of four queries were conducted. The queries sent to the superior authoritative server were all shortened domain names and obfuscated query type A, and the last query sent to the authoritative server to which the domain name belongs was the full domain name and the original query type MX.

[0077] In one embodiment, a client DNS resolver is provided, whose internal structure diagram can be as follows: Figure 3 As shown. The client DNS resolver includes a processor, a memory and a network interface connected through a system bus. The processor of the client DNS resolver is used to provide computing and control capabilities, and the network interface is used to communicate with an external terminal through a network connection. The client DNS resolver implements the above-mentioned DNS iterative query method by loading and running a computer program.

[0078] Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0079] In one embodiment, a computer program product is also provided, including a computer program / instruction, which implements the steps of the above-mentioned embodiment method when executed by a processor.

[0080] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

Claims

1. A DNS iterative query method, applied to a local DNS resolver, characterized in that: The method includes: In the process of the DNS resolver querying the superior authoritative server of the domain name step by step, the QNAME sent each time is the shortened domain name of the original full domain name, and the QTYPE is a query type different from the original query type; until the last query, the QNAME sent to the final authoritative server is the original full domain name, and the QTYPE is the original query type.

2. The method for iterative DNS query according to claim 1, characterized in that: The shortened domain name is the next-level domain name of the corresponding authoritative server.

3. The method for iterative DNS query according to claim 1, characterized in that: The other query types different from the original query type adopt A, AAAA, CNAME, MX or NS.

4. The method for iterative DNS query according to claim 1, characterized in that: The other query types different from the original query type are randomly generated each time.

5. The method for iterative DNS query according to claim 1, characterized in that: Specifically include: The DNS resolver receives the original full domain name and the original query type; The DNS resolver queries the upper-level authoritative server of the domain name step by step to obtain the NS record of the lower-level authoritative server; wherein, the QNAME sent each time is the lower-level domain name of the corresponding authoritative server, and the QTYPE is a query type different from the original query type; According to the NS record of the authoritative server to which the original full domain name belongs, a query request is sent to the authoritative server to which the original full domain name belongs to obtain the final response result; the QNAME of the query request is the original full domain name, and the QTYPE is the original query type.

6. The method for iterative DNS query according to claim 5, characterized in that: According to the NS record of the authoritative server of the original full domain name returned, a query request is sent to the authoritative server of the original full domain name to obtain the final response result, and determine whether the full domain name has an independent authorized sub-zone; When there is an independent authorized sub-zone, a query request is sent to the authoritative server of the independent authorized sub-zone, where QNAME of the query request is the original full domain name and QTYPE is the original query type; When there is no independent authorized sub-zone, a query request is sent to the authoritative server of the superior domain name. The QNAME of the query request is the original full domain name and the QTYPE is the original query type.

7. A client DNS resolver, comprising a memory, a processor, and a computer program stored in the memory, characterized in that: The client DNS resolver executes the computer program to implement the steps of the method of claim 1.

8. A computer program product comprising a computer program / instructions, characterized in that The computer program / instructions implement the steps of the method of claim 1 when executed by a processor.

Images