Domain name security protection methods, devices, computer equipment and storage media

Abstract

This application discloses a domain name security protection method, apparatus, computer device, and storage medium. The method includes: intercepting a domain name query request sent by a recursive server to a root server, parsing the domain name query request information to determine the target top-level domain (TLD) that the recursive server needs to query; matching the target TLD with multiple preset TLDs to obtain a matching result; when the matching result indicates a successful match, determining the target TLD configuration parameters corresponding to the target TLD based on the mapping relationship between the preset TLDs and preset TLD configuration parameters; generating domain name response information corresponding to the target TLD based on the target TLD configuration parameters and the domain name query request information, and sending the domain name response information to the recursive server. Thus, by intercepting the domain name query request information sent to the root server, processing and generating the domain name response information and returning it, the root server is protected to achieve protection of the TLD.

Description

Technical Field

[0001] This application relates to the field of network security technology, specifically to a method, apparatus, computer device, and storage medium for domain name security protection. Background Technology

[0002] With the rapid development of internet technology, the Domain Name System (DNS), as a core component of the internet, undertakes the crucial task of resolving domain names into IP addresses. Root servers are the core infrastructure of the DNS, responsible for the authoritative resolution of global top-level domains (such as .com, .cn, .org, etc.).

[0003] However, the root servers in the Domain Name System (including 13 logical roots and thousands of physical root instances) also face increasingly severe security threats. On the one hand, malicious attackers may launch hijacking attacks to tamper with or delete top-level domain information in the root server zone records, causing subdomains under the corresponding top-level domains to fail to resolve correctly, resulting in serious consequences. On the other hand, malicious attackers may launch a large number of top-level domain query requests against the root servers to carry out network attacks, thereby affecting the stability and reliability of the Domain Name System services.

[0004] In related technologies, traditional root server network attack defense methods rely on stacking the physical resources of root servers and combining load balancing to resist large-scale network attacks. However, this is not easy to operate and manage and has low security protection efficiency. Summary of the Invention

[0005] This application provides a domain name security protection method, apparatus, computer equipment, and storage medium, which can protect root servers to protect top-level domain names.

[0006] To achieve the above objectives, one embodiment of this application provides a domain name security protection method, the method comprising:

[0007] The domain name query request information sent by the recursive server to the root server is intercepted, and the domain name query request information is parsed to determine the target top-level domain name that the recursive server needs to query.

[0008] The target top-level domain is matched with multiple preset top-level domains to obtain the matching results;

[0009] When the matching result indicates a successful match, the target top-level domain configuration parameters corresponding to the target top-level domain are determined according to the mapping relationship between the preset top-level domain and the preset top-level domain configuration parameters.

[0010] Generate domain response information corresponding to the target top-level domain based on the target top-level domain configuration parameters and the domain query request information, and send the domain response information to the recursive server.

[0011] To achieve the above objectives, one embodiment of this application provides a domain name security protection device, the device comprising:

[0012] The interception module is used to intercept the domain name query request information sent by the recursive server to the root server, and to parse the domain name query request information to determine the target top-level domain name that the recursive server needs to query.

[0013] The matching module is used to match the target top-level domain with multiple preset top-level domains to obtain matching results;

[0014] The determination module is used to determine the target top-level domain configuration parameters corresponding to the target top-level domain based on the mapping relationship between the preset top-level domain and the preset top-level domain configuration parameters when the matching result indicates a successful match.

[0015] The generation module is used to generate domain name response information corresponding to the target top-level domain based on the target top-level domain configuration parameters and the domain name query request information, and send the domain name response information to the recursive server.

[0016] In some implementations, the determining module is used for:

[0017] Determine the data transmission protocol type corresponding to the domain name query request information;

[0018] The target top-level domain configuration parameters corresponding to the target top-level domain are determined based on the mapping relationship between the preset top-level domain and the preset top-level domain configuration parameters, as well as the data transmission protocol type.

[0019] In some implementations, the generation module is used for:

[0020] The target data structure is determined based on the target top-level domain configuration parameters;

[0021] Obtain the transaction identifier, media access control address, source Internet Protocol address, destination Internet Protocol address, source port number, and destination port number from the domain name query request information;

[0022] The transaction identifier, media access control address, source Internet Protocol address, destination Internet Protocol address, source port number, and destination port number are respectively set in the fields corresponding to the target data structure to obtain the domain name response information corresponding to the target top-level domain.

[0023] In some implementations, the generation module is used for:

[0024] The transaction identifier, media access control address, source Internet Protocol address, destination Internet Protocol address, source port number, and destination port number are respectively set in the fields corresponding to the target data structure to obtain the initial domain name response information;

[0025] The initial domain name response information is verified to generate a verification value, and the domain name response information corresponding to the target top-level domain is generated based on the verification value and the initial domain name response information.

[0026] In some implementations, the domain name security protection device further includes a configuration module for:

[0027] Before matching the target top-level domain with multiple preset top-level domains to obtain a matching result, multiple preset top-level domains and the preset top-level domain configuration parameters of each preset top-level domain are obtained.

[0028] Generate and save the mapping relationship between each preset top-level domain and the preset top-level domain configuration parameters.

[0029] In some implementations, the configuration module is used for:

[0030] Before matching the target top-level domain with multiple preset top-level domains to obtain the matching result, the target preset top-level domain with updated preset top-level domain configuration parameters is determined from among the multiple preset top-level domains.

[0031] Obtain the new version of the preset top-level domain configuration parameters corresponding to the target preset top-level domain, and update the preset top-level domain configuration parameters corresponding to the target preset top-level domain using the new version of the preset top-level domain configuration parameters.

[0032] In some implementations, the configuration module is used for:

[0033] The target Internet Protocol address corresponding to the recursive server is determined based on the domain name query request information.

[0034] The total number of times the recursive server sends request information to the root server within a preset time period and the sending frequency per unit time are determined based on the target Internet Protocol address.

[0035] When the total number of times and the sending frequency do not meet the preset security conditions, an abnormal response information is generated based on the domain name query request information, and the abnormal response information is sent to the recursive server;

[0036] When the total number of times and the sending frequency meet the preset security conditions, the step of matching the target top-level domain with multiple preset top-level domains is executed to obtain the matching results.

[0037] In some implementations, the domain name security protection device further includes a forwarding module for:

[0038] After matching the target top-level domain with multiple preset top-level domains to obtain matching results, when the matching result indicates that the matching has failed, the domain name query request information is forwarded to the root server;

[0039] The system receives the domain name response information returned by the root server based on the domain name query request information and forwards the domain name response information to the recursive server.

[0040] In some implementations, the forwarding module is used for:

[0041] Get the number of query requests processed within a preset time period;

[0042] When the number exceeds the preset number, the domain name query request information is forwarded to the root server;

[0043] The system receives the domain name response information returned by the root server based on the domain name query request information and forwards the domain name response information to the recursive server.

[0044] To achieve the above objectives, one aspect of this application provides a computer-readable storage medium storing multiple instructions adapted for loading by a processor to execute the domain name security protection method provided in this application.

[0045] To achieve the above objectives, one aspect of this application provides a computer device, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor. When the processor executes the computer program, it implements the domain name security protection method provided in this application.

[0046] In this embodiment, the domain name query request information sent by the recursive server to the root server is intercepted and parsed to determine the target top-level domain that the recursive server needs to query; the target top-level domain is matched with multiple preset top-level domains to obtain a matching result; when the matching result indicates a successful match, the target top-level domain configuration parameters corresponding to the target top-level domain are determined according to the mapping relationship between the preset top-level domains and the preset top-level domain configuration parameters; the domain name response information corresponding to the target top-level domain is generated according to the target top-level domain configuration parameters and the domain name query request information, and the domain name response information is sent to the recursive server.

[0047] This approach intercepts domain name query requests sent from the recursive server to the root server, parses them to determine the target top-level domain (TLD) the recursive server needs to query, and then matches the target TLD with several pre-stored TLDs. If a match is found, the target TLD configuration parameters are determined based on the mapping between the pre-stored TLDs and their configuration parameters. A domain name response is then generated based on the target TLD configuration parameters and the domain name query request, and sent to the recursive server. This avoids the recursive server directly sending domain name query requests to the root server, thus preventing network attacks on the root server and achieving network security protection for the root server and TLDs. It also reduces the amount of domain name query requests processed by the root server, alleviating its load.

[0048] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the description, claims and drawings. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 This is a schematic diagram of the system framework corresponding to the domain name security protection method provided in the embodiments of this application;

[0051] Figure 2 This is a schematic diagram illustrating a scenario of the domain name security protection method provided in this application embodiment;

[0052] Figure 3 This is a flowchart illustrating the domain name security protection method provided in the embodiments of this application;

[0053] Figure 4 This is a schematic diagram of the data structure provided in the embodiments of this application;

[0054] Figure 5 This is another flowchart illustrating the domain name security protection method provided in this application embodiment;

[0055] Figure 6This is a schematic diagram of the domain name security protection device provided in the embodiments of this application;

[0056] Figure 7 This is a schematic diagram of the structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0057] To enable those skilled in the art to better understand the solutions of this application, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0058] It should be noted that in all specific embodiments of this application, when processing is required based on domain name query request information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require access to sensitive user personal information, separate user permission or consent is obtained through pop-ups or redirects to confirmation pages. Only after obtaining the user's separate permission or consent is the necessary user-related data required for the proper functioning of these embodiments obtained.

[0059] It should be noted that while some processes described in the specification, claims, and accompanying drawings contain multiple steps that appear in a specific order, it should be clearly understood that these steps may not be performed in the order they appear herein, or may be performed in parallel. The step numbers are merely used to distinguish different steps and do not represent any particular order of execution. Furthermore, descriptions such as "first," "second," or "objective" in this document are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0060] This application provides a domain name security protection method, apparatus, computer device, and storage medium. Specifically, this application will describe the domain name security protection device from the perspective of the domain name security protection device, which can be integrated into a computer device, such as a server or a terminal. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal can be a programmable device, smartphone, tablet computer, laptop computer, desktop computer, smart speaker, smartwatch, smart home appliance, vehicle terminal, intelligent voice interaction device, aircraft, etc., but is not limited to these.

[0061] Before providing a further detailed description of the embodiments of this application, the nouns and terms used in the embodiments of this application are explained, and the nouns and terms used in the embodiments of this application shall be interpreted as follows:

[0062] Recursive Server: A recursive server is a key component in the Domain Name System (DNS) architecture. It is primarily responsible for handling users' domain name resolution requests and completing the resolution process through recursive queries. It acts as a "bridge" between users and other DNS servers (such as root servers, top-level domain servers, and authoritative servers). It initiates queries to other servers on behalf of the user until it obtains the final IP address or a resolution failure result, and then returns the result to the user.

[0063] Root Servers: Root servers are the "cornerstone" of the Domain Name System (DNS) architecture. They are responsible for storing and managing the address information of top-level domain (TLD) servers and are an indispensable first-level node in the DNS resolution process. When a recursive server cannot obtain the domain name resolution result directly through local caching or authoritative servers, it must first query the root server, which will guide the next step of the query (such as providing the address of the corresponding top-level domain server). Currently, there are 13 groups of root servers globally (logically identified by the letters A to M), managed by different organizations and distributed across multiple data centers worldwide using Anycast technology to ensure high availability and resistance to attacks.

[0064] A Field-Programmable Gate Array (FPGA) is an integrated circuit chip that can be programmed and configured using a Hardware Description Language (HDL), belonging to semi-custom hardware. Users can program it to implement specific digital logic functions according to their needs. It consists of a large number of programmable logic units, programmable interconnect resources, and input / output units. Through programming, these resources can be flexibly configured and connected to implement various digital circuit functions such as counters, adders, and communication protocol processing modules. It has wide applications in electronic design, for example, in communication equipment for high-speed data processing and protocol conversion.

[0065] User Datagram Protocol (UDP) is a connectionless, unreliable transport layer protocol and a core member of the TCP / IP protocol stack. Unlike connection-oriented TCP, UDP does not require establishing a connection before communication; it directly encapsulates data into datagrams and sends them. It is suitable for scenarios with high real-time requirements and where a small amount of packet loss is acceptable.

[0066] The Transmission Control Protocol (TCP) is one of the core protocols in the Internet Protocol Suite (TCP / IP). It belongs to the transport layer and is responsible for providing reliable, connection-oriented byte stream transmission services across a network. It is widely used in scenarios requiring highly reliable data transmission, such as web browsing (HTTP / HTTPS), file transfer (FTP), and email (SMTP / POP3).

[0067] The above is an explanation of the relevant professional terms involved in this application. Other related terms will be described in detail later.

[0068] First, let me explain the technical problems that exist in the relevant technologies:

[0069] With the rapid development of internet technology, the Domain Name System (DNS), as a core component of the internet, undertakes the crucial task of resolving domain names into IP addresses. Root servers are the core infrastructure of the DNS, responsible for the authoritative resolution of global top-level domains (such as .com, .cn, .org, etc.).

[0070] However, the root servers in the Domain Name System (including 13 logical roots and thousands of physical root instances) also face increasingly severe security threats. On the one hand, malicious attackers may launch hijacking attacks to tamper with or delete top-level domain information in the root server zone records, causing subdomains under the corresponding top-level domains to fail to resolve correctly, resulting in serious consequences. On the other hand, malicious attackers may launch a large number of top-level domain query requests against the root servers to carry out network attacks, thereby affecting the stability and reliability of the Domain Name System services.

[0071] In related technologies, traditional root server network attack defense methods rely on stacking the physical resources of root servers and combining load balancing to resist large-scale network attacks. However, this is not easy to operate and manage and has low security protection efficiency.

[0072] To address the aforementioned problems, this application proposes a domain name security protection method, apparatus, computer device, and storage medium. The method involves intercepting domain name query requests sent by a recursive server to the root server, parsing them to determine the target top-level domain (TLD) the recursive server needs to query, and then matching the target TLD with multiple locally stored preset TLDs. If a match is successful, the target TLD configuration parameters are determined based on the mapping relationship between the preset TLDs and their configuration parameters. A domain name response is generated based on the target TLD configuration parameters and the domain name query request, and this response is sent to the recursive server. This avoids the recursive server directly sending the domain name query request to the root server, thus preventing network attacks on the root server and achieving network security protection for the root server and TLDs. It also reduces the processing load of domain name query requests on the root server, alleviating its workload.

[0073] Please see Figure 1 , Figure 1 This is a schematic diagram of the system framework corresponding to the domain name security protection method provided in this application embodiment. The domain name security protection method provided in this application embodiment can be applied to this system framework.

[0074] Please refer to the details. Figure 1 , Figure 1 This is a system architecture diagram of the domain name security protection method provided in this application embodiment. It includes a terminal 140, an Internet 130, a gateway 120, a server 110, etc.

[0075] Terminal 140 or server 110 can be a device that performs domain name security protection methods.

[0076] Terminal 140 includes, but is not limited to, mobile phones, computers, smart voice interaction devices, smart home appliances, vehicle terminals, and aircraft. Embodiments of this application can be applied to various scenarios, including but not limited to network security and network defense. Furthermore, it can be a single device or a collection of multiple devices. For example, multiple desktop computers connected to each other via a local area network, sharing a single monitor, etc., can work collaboratively to form a single terminal 140. Terminal 140 can communicate with the Internet 130 via wired or wireless means to exchange data.

[0077] Server 110 refers to a computer system that can provide certain services to terminal 140. Compared to ordinary terminal 140, server 110 has higher requirements in terms of stability, security, and performance. Server 110 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0078] Gateway 120, also known as an internetwork connector or protocol converter, is a computer system or device that acts as a translator, enabling network interconnection at the transport layer. It bridges the gap between two systems using different communication protocols, data formats, languages, or even completely different architectures. Gateways can also provide filtering and security functions. Messages sent from terminal 140 to server 110 are forwarded to the corresponding server 110 via gateway 120. Messages sent from server 110 to terminal 140 are also forwarded to the corresponding terminal 140 via gateway 120.

[0079] The domain name security protection method in this application can be applied to various scenarios, such as network security. No limitation is imposed on the scenarios in which the domain name security protection method in this application can be applied.

[0080] Please see Figure 2 , Figure 2 This is a schematic diagram of a scenario for the domain name security protection method provided in the embodiments of this application.

[0081] In the context of domain name security protection, the system generally includes the configuration end, programmable devices, recursive servers, and root servers.

[0082] The configuration end can be understood as the host device of the programmable device. The configuration end can configure the preset top-level domain configuration parameters corresponding to different top-level domains, and then send the preset top-level domain configuration parameters to the programmable device.

[0083] Specifically, users configure preset top-level domain (TLD) configuration parameters for the TLDs that require security protection through the configuration terminal's web page. These preset TLD configuration parameters include the correct authority information corresponding to the TLD (such as NS and A records). The configuration terminal's backend software then sends these preset TLD configuration parameters to the programmable device. Simultaneously, the configuration terminal can also check the security protection status of the TLD by reading registers in the programmable device.

[0084] Programmable devices can be devices based on field-programmable gate arrays (FPGAs), and programmable devices can perform the following steps:

[0085] Intercept the domain name query request information sent by the recursive server to the root server, and parse the domain name query request information to determine the target top-level domain name that the recursive server needs to query.

[0086] The target top-level domain is matched with multiple preset top-level domains to obtain the matching results;

[0087] When the matching result indicates a successful match, the target top-level domain configuration parameters corresponding to the target top-level domain are determined based on the mapping relationship between the preset top-level domain and the preset top-level domain configuration parameters.

[0088] Generate the domain response information corresponding to the target top-level domain based on the target top-level domain configuration parameters and domain query request information, and send the domain response information to the recursive server.

[0089] In traditional solutions, the recursive server typically sends the domain name query request directly to the root server to obtain authoritative information related to the top-level domain. However, this application, by setting preset top-level domain configuration parameters for each top-level domain requiring security protection within a programmable device, once the target top-level domain in the domain name query request is determined, if the target top-level domain is one that needs protection, the programmable device can respond to the domain name query request by generating domain name response information (such as authoritative information about the target top-level domain) and sending it to the recursive server. This reduces the risk of the root server being directly exposed to the network and thus vulnerable to cyberattacks, achieving root server security protection and consequently, top-level domain security protection.

[0090] For a more detailed understanding of the domain name security protection methods implemented in this application, please refer to [link / reference needed]. Figure 3 , Figure 3 This is a flowchart illustrating the domain name security protection method provided in this application embodiment. The domain name security protection method may include the following steps:

[0091] Step 210: Intercept the domain name query request information sent by the recursive server to the root server, and parse the domain name query request information to determine the target top-level domain name that the recursive server needs to query.

[0092] Step 220: Match the target top-level domain with multiple preset top-level domains to obtain the matching results;

[0093] Step 230: When the matching result indicates a successful match, determine the target top-level domain configuration parameters corresponding to the target top-level domain based on the mapping relationship between the preset top-level domain and the preset top-level domain configuration parameters.

[0094] Step 240: Generate the domain name response information corresponding to the target top-level domain based on the target top-level domain configuration parameters and domain name query request information, and send the domain name response information to the recursive server.

[0095] Steps 210 to 240 will be described in detail below. This application will implement the domain name security protection method from the perspective of a programmable device.

[0096] In step 210, the domain name query request information sent by the recursive server to the root server is intercepted, and the domain name query request information is parsed to determine the target top-level domain name that the recursive server needs to query.

[0097] When processing corresponding network tasks, the recursive server generates domain name query request information. For example, when accessing a webpage, it generates domain name query request information to obtain relevant information about the top-level domain, thereby completing the subsequent webpage access.

[0098] It can intercept domain name query requests sent by recursive servers to root servers, and then parse these requests to determine the target top-level domain (TLD) the recursive server needs to query. For example, a programmable device receives a domain name query request from a recursive server to the root server via a network interface. This query request can be understood as a message. The programmable device will parse the header fields of the query request and extract information such as the source Media Access Control Address (MAC), source Internet Protocol Address (IP), destination Internet Protocol Address, source port number, destination port number, transaction ID, and the target TLD.

[0099] In some implementations, before matching the target top-level domain with multiple preset top-level domains to obtain the matching result, the following steps are also included:

[0100] (1.1) Obtain multiple preset top-level domains and the preset top-level domain configuration parameters for each preset top-level domain;

[0101] (1.2) Generate and save the mapping relationship between each preset top-level domain and the preset top-level domain configuration parameters.

[0102] The configuration interface allows users to set preset top-level domain (TLD) configuration parameters for each TLD. For example, users can access the domain configuration parameter management interface through the configuration interface and then add TLD configuration parameters for each TLD. These parameters include the domain sequence number, the query domain (e.g., the 'aaa' TLD), and the query type (e.g., NS record, A record, AAAA record). Additionally, the protocol used for the response data can be configured (e.g., UDP or TCP).

[0103] Users can also use this page to clear the historical preset top-level domain (TOPD) configuration parameters and then save the new TOPD configuration parameters. While clearing the historical TOPD configuration parameters, the programmable device can simultaneously clear the historical TOPD configuration parameters for the preset top-level domain.

[0104] After the user saves the preset top-level domain configuration parameters on this page, the page will send a save configuration command to the configuration terminal. The configuration terminal will then package the preset top-level domain configuration parameters and send them to the programmable device, so that the new preset top-level domain configuration parameters are written into the programmable device and take effect.

[0105] Users can also write zone files to the configuration backend software through this page for future retrieval. The zone file contains accurate and authoritative information about the top-level domain (NS and A records), which is crucial for top-level domain matching and automatic response.

[0106] Users can also initiate search requests through this page. This page will send search instructions to the configuration backend software. The configuration backend will search the top-level domain zone file, retrieve the corresponding response parameters of the top-level domain based on the top-level domain in the user's search request, and then store the search results in the database table and refresh the page data.

[0107] The programmable device can receive multiple preset top-level domains and preset top-level domain configuration parameters sent by the configuration terminal, and then generate and save the mapping relationship between each preset top-level domain and the preset top-level domain configuration parameters locally.

[0108] As shown above, the configuration parameters for the preset top-level domain can be generated according to actual needs. This ensures that the configuration parameters are usable, thereby achieving effective protection for the preset top-level domain.

[0109] In some implementations, before matching the target top-level domain with multiple preset top-level domains to obtain the matching result, the following steps are also included:

[0110] (2.1) Identify the target preset top-level domain whose preset top-level domain configuration parameters have been updated among multiple preset top-level domains;

[0111] (2.2) Obtain the new version of the preset top-level domain configuration parameters corresponding to the target preset top-level domain, and update the preset top-level domain configuration parameters corresponding to the target preset top-level domain using the new version of the preset top-level domain configuration parameters.

[0112] The programmable device can query the configuration terminal for the first version number of the configuration parameters of each preset top-level domain, then determine the second version number of the configuration parameters of each preset top-level domain stored locally, and then compare the first version number and the second version number of the configuration parameters of each preset top-level domain to determine the target preset top-level domain whose configuration parameters have been updated.

[0113] Then, the new version of the preset top-level domain configuration parameters corresponding to the target preset top-level domain are obtained from the configuration end, and the preset top-level domain configuration parameters corresponding to the target preset top-level domain are updated using the new version of the preset top-level domain configuration parameters. For example, the old version of the preset top-level domain configuration parameters corresponding to the target preset top-level domain are deleted, and then the new version of the preset top-level domain configuration parameters corresponding to the target preset top-level domain are saved.

[0114] The advantage of doing this is that it ensures that the preset top-level domain name configuration parameters stored locally on the programmable device are always up-to-date, thereby achieving more effective protection for the preset top-level domain name.

[0115] In some implementations, before matching the target top-level domain with multiple preset top-level domains to obtain the matching result, the following steps are also included:

[0116] (3.1) Determine the target Internet Protocol address corresponding to the recursive server based on the domain name query request information;

[0117] (3.2) Determine the total number of times the recursive server sends request information to the root server within a preset time period, and the sending frequency per unit time, based on the target Internet Protocol address;

[0118] (3.3) When the total number of times and the sending frequency do not meet the preset security conditions, generate abnormal response information based on the domain name query request information and send the abnormal response information to the recursive server.

[0119] (3.4) When the total number of times and the sending frequency meet the preset security conditions, execute the step of matching the target top-level domain with multiple preset top-level domains to obtain the matching results.

[0120] The process involves determining the target Internet Protocol (IP) address corresponding to the recursive server based on the domain name query request information. This target IP address can be understood as the identifier of the recursive server. Then, based on the target IP address, the total number of requests the recursive server will send to the root server within a preset time period, as well as the sending frequency per unit time, is determined. For example, the preset time period is 1 minute, and the unit time is 1 second.

[0121] Then, it is determined whether the total number of requests and the sending frequency meet the preset security conditions. For example, the preset security conditions are that the total number of requests is less than a preset total number of requests threshold, and the sending frequency is less than a preset sending frequency threshold. If the total number of requests and the sending frequency of the recursive server do not meet these preset security conditions, it indicates that the domain name query request information sent by the recursive server may be a malicious request. In this case, the recursive server may be an insecure and potentially malicious device.

[0122] When the total number of requests and the sending frequency do not meet the preset security conditions, an abnormal response message is generated based on the domain name query request information and sent to the recursive server. For example, the abnormal response message may contain the text "Too many requests, please try again later".

[0123] When the total number of times and the sending frequency meet the preset security conditions, such as the total number of times being less than the preset total number of times threshold and the sending frequency being less than the preset sending frequency threshold, the step of matching the target top-level domain with multiple preset top-level domains is executed to obtain the matching results.

[0124] The advantage of doing this is that it can block some malicious requests, prevent the root server from being subjected to malicious network attacks, and thus protect the root server and top-level domain.

[0125] In some implementations, before matching the target top-level domain with multiple preset top-level domains to obtain the matching result, the following steps are also included:

[0126] (4.1) Obtain the number of query request information processed within a preset time period;

[0127] (4.2) When the number exceeds the preset number, forward the domain name query request information to the root server;

[0128] (4.3) Receive the domain name response information returned by the root server based on the domain name query request information, and forward the domain name response information to the recursive server.

[0129] This includes the ability to retrieve the number of query requests processed within a preset time period, such as a preset time period of 1 minute and a preset number of ten million query requests processed within that time period. When the number exceeds the preset number, the domain name query request is forwarded to the root server. For example, if the preset number is nine million, it is assumed that the programmable device cannot process the excessive number of query requests. To ensure that the query requests from the recursive server can be processed normally, the domain name query request is forwarded to the root server. The root server then receives the domain name response information returned by the domain name query request and forwards the domain name response information to the recursive server.

[0130] The advantage of doing this is that when the programmable device is busy, the query requests for the top-level domain name can be processed normally.

[0131] In step 220, the target top-level domain is matched with multiple preset top-level domains to obtain the matching results.

[0132] The programmable device locally stores multiple preset top-level domains and their corresponding configuration parameters. These top-level domains can form a top-level domain table entry, and the target domain name is then matched against this top-level domain table entry to obtain the matching result.

[0133] If a top-level domain that matches the target top-level domain is found in the top-level domain table, the match is successful. If no top-level domain that matches the target top-level domain is found in the top-level domain table, the match is unsuccessful.

[0134] In some implementations, after matching the target top-level domain with multiple preset top-level domains to obtain the matching results, the method further includes:

[0135] (1.1) When the matching result indicates that the match has failed, the domain name query request information is forwarded to the root server;

[0136] (1.2) Receive the domain name response information returned by the root server based on the domain name query request information, and forward the domain name response information to the recursive server.

[0137] If the matching result indicates a failure, it means the target top-level domain is not a pre-defined top-level domain that needs protection. In this case, the domain query request can be forwarded to the root server. After receiving the domain query request, the root server can process it to generate a domain response, which is then sent to the programmable device. The programmable device then forwards the domain response to the recursive server. The domain response includes authoritative information about the target top-level domain.

[0138] Step 230: When the matching result indicates a successful match, determine the target top-level domain configuration parameters corresponding to the target top-level domain based on the mapping relationship between the preset top-level domain and the preset top-level domain configuration parameters.

[0139] When the matching result indicates a successful match, it means that the target top-level domain (TLD) is a preset TLD that requires security protection. At this point, the target TLD configuration parameters can be determined based on the mapping relationship between the preset TLD and the preset TLD configuration parameters. The target TLD configuration parameters can be understood as the processing parameters for handling domain query requests corresponding to the target TLD, enabling responses to domain query requests.

[0140] In some implementations, the target top-level domain configuration parameters corresponding to the target top-level domain are determined based on the mapping relationship between the preset top-level domain and the preset top-level domain configuration parameters, including:

[0141] (1.1) Determine the data transmission protocol type corresponding to the domain name query request information;

[0142] (1.2) Determine the target top-level domain configuration parameters corresponding to the target top-level domain based on the mapping relationship between the preset top-level domain and the preset top-level domain configuration parameters, as well as the data transmission protocol type.

[0143] The data transmission protocol type corresponding to the domain name query request information is generally TCP or UDP. The data structures corresponding to these two types of data transmission protocols are different. Therefore, it is necessary to set a preset top-level domain configuration parameter for each. In other words, for a preset top-level domain, it is necessary to consider the preset top-level domain configuration parameter corresponding to TCP and also set the preset top-level domain configuration parameter corresponding to UDP.

[0144] First, determine the preset top-level domain (TLD) configuration parameters corresponding to the target TLD based on the mapping relationship between preset TLDs and preset TLD configuration parameters. Then, select the target TLD configuration parameters from the preset TLD configuration parameters based on the data transmission protocol type. For example, if the data transmission protocol type is TCP, then the preset TLD configuration parameters corresponding to TCP can be selected as the target TLD configuration parameters.

[0145] The advantage of doing this is that it allows for the processing of domain name query requests based on different data transmission protocol types, ensuring the accuracy of the domain name response information generated subsequently based on the target top-level domain configuration parameters.

[0146] In step 240, domain name response information corresponding to the target top-level domain is generated based on the target top-level domain configuration parameters and domain name query request information, and the domain name response information is sent to the recursive server.

[0147] This involves extracting relevant data from the domain name query request information, and then generating the domain name response information corresponding to the target top-level domain through the target top-level domain configuration parameters. This domain name response information contains relevant information about the top-level domain that the recursive server needs to query, such as NS records, A records, AAAA records, etc.

[0148] In some implementations, domain name response information corresponding to the target top-level domain is generated based on the target top-level domain configuration parameters and domain name query request information, including:

[0149] (1.1) Determine the target data structure based on the target top-level domain configuration parameters;

[0150] (1.2) Obtain the transaction identifier, media access control address, source Internet Protocol address, destination Internet Protocol address, source port number, and destination port number from the domain name query request information;

[0151] (1.3) Set the transaction identifier, media access control address, source Internet Protocol address, destination Internet Protocol address, source port number and destination port number into the fields corresponding to the target data structure to obtain the domain name response information corresponding to the target top-level domain.

[0152] The data transmission protocol corresponding to a domain name query request is often either TCP or UDP. Therefore, the domain name query request information typically corresponds to two different data structures. The data structure of the domain name response information returned by the programmable device to the recursive server should be consistent with the data structure corresponding to the domain name request information. For example, if the domain name query request information corresponds to the TCP protocol, then the domain name response information should also be TCP; if the domain name query request information corresponds to the UDP protocol, then the domain name response information should also be UDP.

[0153] The target data structure can be determined based on the configuration parameters of the target top-level domain. Please refer to [link / reference] for details. Figure 4 , Figure 4 This is a schematic diagram of the data structure provided in an embodiment of this application. Wherein, if the data structure corresponding to the target data structure is the data structure corresponding to the UDP protocol, please refer to... Figure 4The diagram above shows the data structure of the UDP packet, which includes the destination MAC address, source IP address, destination IP address, IP checksum, source port, destination port, UDP checksum, and transaction ID. The MAC header includes the destination MAC address, the IP header includes the source IP address, destination IP address, and IP checksum, the UDP header includes the source port, destination port, and UDP checksum, and the DNS information includes the transaction ID.

[0154] If the target data structure corresponds to the same data structure used in the TCP protocol, please refer to [link / reference]. Figure 4 The diagram above shows the TCP packet, which contains the data structure corresponding to the TCP protocol. This includes the destination MAC address, source IP address, destination IP address, IP checksum, source port, destination port, sequence number, acknowledgment number, TCP checksum, and transaction ID. The MAC header includes the destination MAC address, the IP header includes the source IP address, destination IP address, and IP checksum, and the TCP header includes the source port, destination port, sequence number, acknowledgment number, and TCP checksum. The DNS information includes the transaction ID.

[0155] After determining the target data structure, the transaction identifier, media access control address, source internet protocol address, destination internet protocol address, source port number, and destination port number are obtained from the domain name query request information. Then, these parameters are set into the corresponding fields in the target data structure to obtain the domain name response information for the target top-level domain.

[0156] For example, if the target data structure is a UDP protocol data structure, the source MAC address from the domain name query request information is set in the destination MAC address field of the target data structure. The source MAC address field of the target data structure is specified by the corresponding target domain name configuration parameters. The destination IP address from the domain name query request information is set in the source IP address field of the target data structure, the destination port from the domain name query request information is set in the source port field of the target data structure, and the source port from the domain name query request information is set in the destination port field of the target data structure. Then, the UDP checksum and IP checksum are calculated to generate the corresponding domain name response information.

[0157] For example, if the target data structure is a TCP protocol-related data structure, the source MAC address from the domain name query request information is set in the destination MAC address field of the target data structure. The source MAC address field of the target data structure is specified by the corresponding target domain name configuration parameters. The destination IP address from the domain name query request information is set in the source IP address field of the target data structure. The destination port from the domain name query request information is set in the source port field of the target data structure. The sequence number from the domain name query request information is set in the acknowledgment number field of the target data structure. The acknowledgment number from the domain name query request information is set in the sequence number field of the target data structure. The specific replacement process is as follows: the sequence number and acknowledgement number from the domain name query request information are extracted, and the sequence number is replaced in the acknowledgement number field of the target data structure; simultaneously, the sequence number plus the DNS length of the original packet (used to calculate the acknowledgement number of the return packet) is replaced in the sequence number field of the response packet. Then, the TCP checksum and IP checksum are calculated to generate the corresponding domain name response information.

[0158] As can be seen from the above, in this application, domain name response information can be flexibly generated based on the domain name request information.

[0159] In some implementations, the transaction identifier, media access control address, source Internet Protocol address, destination Internet Protocol address, source port number, and destination port number are respectively set in the corresponding fields of the target data structure to obtain the domain name response information corresponding to the target top-level domain, including:

[0160] (1.3.1) Set the transaction identifier, media access control address, source Internet Protocol address, destination Internet Protocol address, source port number and destination port number into the corresponding fields of the target data structure to obtain the initial domain name response information;

[0161] (1.3.2) Perform information verification on the initial domain name response information to generate a verification value, and generate the domain name response information corresponding to the target top-level domain based on the verification value and the initial domain name response information.

[0162] Specifically, the transaction identifier, media access control address, source Internet Protocol address, destination Internet Protocol address, source port number, and destination port number can be set in the corresponding fields of the target data structure to obtain the initial domain name response information, as described above.

[0163] Then, the initial domain response information is validated to generate a checksum, such as an MD5 checksum. Based on the checksum and the initial domain response information, the domain response information corresponding to the target top-level domain is generated. The advantage of this approach is that it allows the recursive server to perform integrity checks on the domain response information based on the checksum, ensuring that the received domain response information is complete.

[0164] In this embodiment, the domain name query request information sent by the recursive server to the root server is intercepted and parsed to determine the target top-level domain that the recursive server needs to query; the target top-level domain is matched with multiple preset top-level domains to obtain a matching result; when the matching result indicates a successful match, the target top-level domain configuration parameters corresponding to the target top-level domain are determined according to the mapping relationship between the preset top-level domains and the preset top-level domain configuration parameters; the domain name response information corresponding to the target top-level domain is generated according to the target top-level domain configuration parameters and the domain name query request information, and the domain name response information is sent to the recursive server.

[0165] This approach intercepts domain name query requests sent from the recursive server to the root server, parses them to determine the target top-level domain (TLD) the recursive server needs to query, and then matches the target TLD with several pre-stored TLDs. If a match is found, the target TLD configuration parameters are determined based on the mapping between the pre-stored TLDs and their configuration parameters. A domain name response is then generated based on the target TLD configuration parameters and the domain name query request, and sent to the recursive server. This avoids the recursive server directly sending domain name query requests to the root server, thus preventing network attacks on the root server and achieving network security protection for the root server and TLDs. It also reduces the amount of domain name query requests processed by the root server, alleviating its load.

[0166] Please see Figure 5 , Figure 5 This is another flowchart illustrating the domain name security protection method provided in this application embodiment, which may include the following steps:

[0167] Step 301: Intercept the domain name query request information sent by the recursive server to the root server, and parse the domain name query request information to determine the target top-level domain name that the recursive server needs to query.

[0168] Step 302: Determine the target Internet Protocol address corresponding to the recursive server based on the domain name query request information;

[0169] Step 303: Determine the total number of times the recursive server sends request information to the root server within a preset time period, and the sending frequency per unit time, based on the target Internet Protocol address;

[0170] Step 304: When the total number of times and the sending frequency meet the preset security conditions, match the target top-level domain with multiple preset top-level domains to obtain the matching results;

[0171] Step 305: When the matching result indicates that the match has failed, forward the domain name query request information to the root server;

[0172] Step 306: Receive the domain name response information returned by the root server based on the domain name query request information, and forward the domain name response information to the recursive server;

[0173] Step 307: When the matching result indicates a successful match, determine the data transmission protocol type corresponding to the domain name query request information;

[0174] Step 308: Determine the target top-level domain configuration parameters corresponding to the target top-level domain based on the mapping relationship between the preset top-level domain and the preset top-level domain configuration parameters, as well as the data transmission protocol type;

[0175] Step 309: Determine the target data structure based on the target top-level domain configuration parameters;

[0176] Step 310: Obtain the transaction identifier, media access control address, source Internet Protocol address, destination Internet Protocol address, source port number, and destination port number from the domain name query request information;

[0177] Step 311: Set the transaction identifier, media access control address, source Internet Protocol address, destination Internet Protocol address, source port number, and destination port number into the corresponding fields of the target data structure to obtain the domain name response information corresponding to the target top-level domain.

[0178] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the detailed description of the domain name security protection method above, which will not be repeated here.

[0179] Please see Figure 6 , Figure 6 This is a schematic diagram of the domain name security protection device provided in this application embodiment. This domain name security protection device can execute the above-described domain name security protection method.

[0180] In this application embodiment, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0181] Domain name security protection device 400, the device includes:

[0182] The interception module 410 is used to intercept the domain name query request information sent by the recursive server to the root server, and to parse the domain name query request information to determine the target top-level domain name that the recursive server needs to query.

[0183] The matching module 420 is used to match the target top-level domain with multiple preset top-level domains to obtain the matching results;

[0184] The determination module 430 is used to determine the target top-level domain configuration parameters corresponding to the target top-level domain based on the mapping relationship between the preset top-level domain and the preset top-level domain configuration parameters when the matching result indicates a successful match.

[0185] The generation module 440 is used to generate the domain name response information corresponding to the target top-level domain based on the target top-level domain configuration parameters and domain name query request information, and send the domain name response information to the recursive server.

[0186] In some implementations, the determining module 430 is used for:

[0187] Determine the data transmission protocol type corresponding to the domain name query request information;

[0188] The target top-level domain configuration parameters are determined based on the mapping relationship between the preset top-level domain and the preset top-level domain configuration parameters, as well as the data transmission protocol type.

[0189] In some implementations, the generation module 440 is used for:

[0190] The target data structure is determined based on the configuration parameters of the target top-level domain.

[0191] Obtain the transaction identifier, media access control address, source Internet Protocol address, destination Internet Protocol address, source port number, and destination port number from the domain name query request information;

[0192] By setting the transaction identifier, media access control address, source Internet Protocol address, destination Internet Protocol address, source port number, and destination port number into the corresponding fields of the target data structure, the domain name response information corresponding to the target top-level domain is obtained.

[0193] In some implementations, the generation module 440 is used for:

[0194] Set the transaction identifier, media access control address, source Internet Protocol address, destination Internet Protocol address, source port number and destination port number into the corresponding fields of the target data structure to obtain the initial domain name response information;

[0195] The initial domain name response information is verified to generate a verification value, and the domain name response information corresponding to the target top-level domain is generated based on the verification value and the initial domain name response information.

[0196] In some implementations, the domain name security protection device 400 further includes a configuration module for:

[0197] Before matching the target top-level domain with multiple preset top-level domains and obtaining the matching result, obtain multiple preset top-level domains and the preset top-level domain configuration parameters for each preset top-level domain;

[0198] Generate and save the mapping relationship between each preset top-level domain and its configuration parameters.

[0199] In some implementations, the configuration module is used for:

[0200] Before matching the target top-level domain with multiple preset top-level domains and obtaining the matching results, the target preset top-level domain with updated preset top-level domain configuration parameters is identified among the multiple preset top-level domains.

[0201] Obtain the new version of the preset top-level domain configuration parameters corresponding to the target preset top-level domain, and update the preset top-level domain configuration parameters corresponding to the target preset top-level domain using the new version of the preset top-level domain configuration parameters.

[0202] In some implementations, the configuration module is used for:

[0203] The target Internet Protocol address corresponding to the recursive server is determined based on the domain name query request information;

[0204] The total number of times the recursive server sends request information to the root server within a preset time period and the sending frequency per unit time are determined based on the target Internet Protocol address.

[0205] When the total number of times and the sending frequency do not meet the preset security conditions, an abnormal response information is generated based on the domain name query request information and sent to the recursive server.

[0206] When the total number of times and the sending frequency meet the preset security conditions, the step of matching the target top-level domain with multiple preset top-level domains is executed to obtain the matching results.

[0207] In some implementations, the domain name security protection device 400 further includes a forwarding module for:

[0208] After matching the target top-level domain with multiple preset top-level domains and obtaining the matching results, when the matching result indicates that the match failed, the domain query request information is forwarded to the root server.

[0209] Receive the domain name response information returned by the root server based on the domain name query request information, and forward the domain name response information to the recursive server.

[0210] In some implementations, the forwarding module is used for:

[0211] Get the number of query requests processed within a preset time period;

[0212] When the number exceeds the preset number, the domain name query request information will be forwarded to the root server;

[0213] Receive the domain name response information returned by the root server based on the domain name query request information, and forward the domain name response information to the recursive server.

[0214] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the detailed description of the domain name security protection method above, which will not be repeated here.

[0215] In this embodiment, the interception module 410 intercepts the domain name query request information sent by the recursive server to the root server and parses the domain name query request information to determine the target top-level domain that the recursive server needs to query; the matching module 420 matches the target top-level domain with multiple preset top-level domains to obtain the matching result; when the matching result indicates a successful match, the determination module 430 determines the target top-level domain configuration parameters corresponding to the target top-level domain according to the mapping relationship between the preset top-level domains and the preset top-level domain configuration parameters; the generation module 440 generates the domain name response information corresponding to the target top-level domain according to the target top-level domain configuration parameters and the domain name query request information, and sends the domain name response information to the recursive server.

[0216] This approach intercepts domain name query requests sent from the recursive server to the root server, parses them to determine the target top-level domain (TLD) the recursive server needs to query, and then matches the target TLD with several pre-stored TLDs. If a match is found, the target TLD configuration parameters are determined based on the mapping between the pre-stored TLDs and their configuration parameters. A domain name response is then generated based on the target TLD configuration parameters and the domain name query request, and sent to the recursive server. This avoids the recursive server directly sending domain name query requests to the root server, thus preventing network attacks on the root server and achieving network security protection for the root server and TLDs. It also reduces the amount of domain name query requests processed by the root server, alleviating its load.

[0217] This application also provides a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned domain name security protection method. This computer device can be a server, a programmable device, or similar equipment.

[0218] Please see Figure 7 , Figure 7 The hardware structure of a computer device according to another embodiment is illustrated. The computer device includes:

[0219] The processor 501 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0220] The memory 502 can be implemented as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 502 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 502 and is called and executed by the processor 501 to implement the domain name security protection method of the embodiments of this application.

[0221] The input / output interface 503 is used to implement information input and output;

[0222] The communication interface 504 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0223] Bus 505 transmits information between various components of the device (e.g., processor 501, memory 502, input / output interface 503, and communication interface 504);

[0224] The processor 501, memory 502, input / output interface 503, and communication interface 504 are connected to each other within the device via bus 505.

[0225] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned domain name security protection method.

[0226] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0227] The domain name security protection method, apparatus, computer equipment, and storage medium provided in this application intercept domain name query request information sent by a recursive server to a root server, parse the domain name query request information to determine the target top-level domain that the recursive server needs to query; match the target top-level domain with multiple preset top-level domains to obtain a matching result; when the matching result indicates a successful match, determine the target top-level domain configuration parameters corresponding to the target top-level domain according to the mapping relationship between the preset top-level domains and the preset top-level domain configuration parameters; generate domain name response information corresponding to the target top-level domain according to the target top-level domain configuration parameters and the domain name query request information, and send the domain name response information to the recursive server.

[0228] This approach intercepts domain name query requests sent from the recursive server to the root server, parses them to determine the target top-level domain (TLD) the recursive server needs to query, and then matches the target TLD with several pre-stored TLDs. If a match is found, the target TLD configuration parameters are determined based on the mapping between the pre-stored TLDs and their configuration parameters. A domain name response is then generated based on the target TLD configuration parameters and the domain name query request, and sent to the recursive server. This avoids the recursive server directly sending domain name query requests to the root server, thus preventing network attacks on the root server and achieving network security protection for the root server and TLDs. It also reduces the amount of domain name query requests processed by the root server, alleviating its load.

[0229] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0230] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0231] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0232] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0233] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0234] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0235] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0236] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0237] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0238] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0239] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A method for protecting domain name security, characterized in that, The method includes: The domain name query request information sent by the recursive server to the root server is intercepted, and the domain name query request information is parsed to determine the target top-level domain name that the recursive server needs to query. The target top-level domain is matched with multiple preset top-level domains to obtain the matching results; When the matching result indicates a successful match, the target top-level domain configuration parameters corresponding to the target top-level domain are determined according to the mapping relationship between the preset top-level domain and the preset top-level domain configuration parameters. The preset top-level domain configuration parameters include the authoritative information corresponding to the top-level domain and the adapted data transmission protocol type. The target data structure is determined based on the data transmission protocol type included in the target top-level domain configuration parameters; Obtain the transaction identifier, media access control address, source Internet Protocol address, destination Internet Protocol address, source port number, and destination port number from the domain name query request information; The transaction identifier, media access control address, source Internet Protocol address, destination Internet Protocol address, source port number, and destination port number are respectively set in the fields corresponding to the target data structure to obtain the initial domain name response information; The initial domain name response information is verified to generate a verification value. Based on the verification value and the initial domain name response information, the domain name response information corresponding to the target top-level domain is generated and sent to the recursive server.

2. The domain name security protection method according to claim 1, characterized in that, The step of determining the target top-level domain configuration parameters corresponding to the target top-level domain based on the mapping relationship between the preset top-level domain and the preset top-level domain configuration parameters includes: Determine the data transmission protocol type corresponding to the domain name query request information; The target top-level domain configuration parameters corresponding to the target top-level domain are determined based on the mapping relationship between the preset top-level domain and the preset top-level domain configuration parameters, as well as the data transmission protocol type.

3. The domain name security protection method according to claim 1, characterized in that, Before matching the target top-level domain with multiple preset top-level domains to obtain the matching result, the method further includes: Retrieve multiple preset top-level domains and the preset top-level domain configuration parameters for each preset top-level domain; Generate and save the mapping relationship between each preset top-level domain and the preset top-level domain configuration parameters.

4. The domain name security protection method according to claim 1, characterized in that, After matching the target top-level domain with multiple preset top-level domains to obtain the matching results, the method further includes: When the matching result indicates a match failure, the domain name query request information is forwarded to the root server; The system receives the domain name response information returned by the root server based on the domain name query request information and forwards the domain name response information to the recursive server.

5. The domain name security protection method according to claim 1, characterized in that, Before matching the target top-level domain with multiple preset top-level domains to obtain the matching result, the method further includes: The target Internet Protocol address corresponding to the recursive server is determined based on the domain name query request information. The total number of times the recursive server sends request information to the root server within a preset time period and the sending frequency per unit time are determined based on the target Internet Protocol address. When the total number of times and the sending frequency do not meet the preset security conditions, an abnormal response information is generated based on the domain name query request information, and the abnormal response information is sent to the recursive server; When the total number of times and the sending frequency meet the preset security conditions, the step of matching the target top-level domain with multiple preset top-level domains is executed to obtain the matching results.

6. The domain name security protection method according to any one of claims 1 to 5, characterized in that, Before matching the target top-level domain with multiple preset top-level domains to obtain the matching result, the method further includes: Identify the target preset top-level domain (TOPD) whose preset top-level domain configuration parameters have been updated from among multiple preset top-level domains; Obtain the new version of the preset top-level domain configuration parameters corresponding to the target preset top-level domain, and update the preset top-level domain configuration parameters corresponding to the target preset top-level domain using the new version of the preset top-level domain configuration parameters.

7. The domain name security protection method according to any one of claims 1 to 5, characterized in that, Before matching the target top-level domain with multiple preset top-level domains to obtain the matching result, the method further includes: Get the number of query requests processed within a preset time period; When the number exceeds the preset number, the domain name query request information is forwarded to the root server; The system receives the domain name response information returned by the root server based on the domain name query request information and forwards the domain name response information to the recursive server.

8. A domain name security protection device, characterized in that, The device includes: The interception module is used to intercept the domain name query request information sent by the recursive server to the root server, and to parse the domain name query request information to determine the target top-level domain name that the recursive server needs to query. The matching module is used to match the target top-level domain with multiple preset top-level domains to obtain matching results; The determination module is used to determine the target top-level domain configuration parameters corresponding to the target top-level domain according to the mapping relationship between the preset top-level domain and the preset top-level domain configuration parameters when the matching result indicates a successful match. The preset top-level domain configuration parameters include the authoritative information corresponding to the top-level domain and the adapted data transmission protocol type. Generate modules, used for The target data structure is determined based on the data transmission protocol type included in the target top-level domain configuration parameters; Obtain the transaction identifier, media access control address, source Internet Protocol address, destination Internet Protocol address, source port number, and destination port number from the domain name query request information; The transaction identifier, media access control address, source Internet Protocol address, destination Internet Protocol address, source port number, and destination port number are respectively set in the fields corresponding to the target data structure to obtain the initial domain name response information; The initial domain name response information is verified to generate a verification value. Based on the verification value and the initial domain name response information, the domain name response information corresponding to the target top-level domain is generated and sent to the recursive server.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a plurality of instructions adapted for loading by a processor to execute the domain name security protection method according to any one of claims 1 to 7.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that, When the processor executes the computer program, it implements the domain name security protection method according to any one of claims 1 to 7.

Images