Domain name resolution method, system and device based on DNS proxy identity authentication and policy control

Abstract

The invention provides a domain name resolution method, system and device based on DNS proxy identity authentication and strategy control, and belongs to the technical field of computer network DNS resolution. The method comprises the following steps: receiving a DNS request of a client by a DNS agent, and extracting a query domain name and a client source IP (Internet Protocol); the DNS agent obtains a locally stored device ID, wherein the device ID is a 16-byte global unique identifier; constructing an EDNSOPT record containing a device ID and a timestamp; setting an option code as a private value 0xFF01; the data part comprises a 4-byte UNIX timestamp and a 16-byte equipment ID (Identity); adding the EDNSOPT record to an additional part of the DNS request message, and forwarding the EDNSOPT record to a DNS server; the DNS server executes a dynamic strategy decision; executing strategy matching on the verified request; and returning the DNS response message to the client through the DNS agent. According to the invention, the uniqueness authentication of the equipment is realized, the accuracy of equipment identification is obviously improved, and a solid foundation is provided for the implementation of a network security policy.

Description

Technical Field

[0001] The present invention relates to a domain name resolution method, system and device based on DNS proxy identity authentication and policy control, belonging to the technical field of computer network DNS resolution. Background Art

[0002] In the computer networking field, DNS (Domain Name System) resolution, as one of the fundamental internet services, undertakes the important task of converting human-readable domain names into machine-readable IP addresses. With the continuous development of enterprise businesses and the increasing complexity of network environments, traditional DNS resolution technology faces numerous challenges, particularly in terms of security, policy control, and compliance auditing. Existing technologies have the following limitations: Relying on IP addresses for identity and policy control Traditional DNS servers typically rely on the IP address of the DNS proxy issuing the DNS request as identification information and implement policy control based on this IP address. However, this approach has significant limitations. First, if the DNS server fails to adjust promptly when the IP address changes, identity recognition will fail, rendering the control policy ineffective. Second, in NAT (Network Address Translation) scenarios, multiple devices may share the same public IP address, making it impossible for the DNS server to distinguish specific device types and, therefore, unable to implement granular device-level policy control.

[0003] Limitations of EDNS Extensions While the ClientSubnet (ECS) option in EDNS (Extended DNS) can transmit user IP subnet information and provide geo-location-based DNS queries and responses, it also has several shortcomings. Firstly, the ECS option may leak user privacy information. Secondly, it only provides geolocation information and cannot identify the device, nor can it dynamically adjust response policies based on device type, location, or security status.

[0004] Security Question Traditional DNS resolution technology cannot perform device-level authentication on DNS proxies, which means other devices can also access the DNS server, potentially leading to corporate information leakage.

[0005] Compliance audit issues Existing DNS query logs usually do not contain the identification information of DNS proxy devices, which makes it impossible to associate the DNS query request with the specific source device, and thus impossible to conduct effective compliance audits and traceability.

[0006] Faced with these limitations of existing technologies, enterprises urgently need a system and method for policy control based on DNS proxy identity. This system and method should be able to overcome NAT limitations, implement device-level identity authentication, and dynamically adjust DNS resolution policies based on device identity to improve network security, optimize network performance, and meet compliance audit requirements. Summary of the Invention

[0007] The purpose of the present invention is to provide a domain name resolution method, system and device based on DNS proxy identity authentication and policy control. By extending the device identity identification code technology in EDNS, DNS proxy device identity authentication is realized, and policy control is performed on the response to DNS query requests based on the identity, thereby effectively solving the problems existing in the prior art.

[0008] To achieve the above-mentioned purpose, the present invention is implemented through the following technical solutions: A domain name resolution method based on DNS proxy identity authentication and policy control includes the following steps: The DNS proxy receives the client's DNS request and extracts the query domain name and client source IP address; The DNS proxy obtains the locally stored device ID, which is a 16-byte globally unique identifier. Construct an EDNSOPT record containing the device ID and timestamp: set the option code to the private value 0xFF01; the data part includes a 4-byte UNIX timestamp and a 16-byte device ID; Add the EDNSOPT record to the additional part of the DNS request message and forward it to the DNS server; The DNS server performs dynamic policy decisions: parsing EDNSOPT records, extracting device IDs and timestamps; verifying that the timestamp is within ±30 seconds of the server time; and verifying device ID validity and blacklist status. Perform policy matching on verified requests: associate device ID, query domain name, DNS query type, client IP and network context; match policy rule chains in priority order and generate response results; The DNS response message is returned to the client via the DNS proxy.

[0009] Preferably, the device ID is generated by: Static configuration: DNS proxy locally stores pre-assigned device IDs; or Dynamic generation: The DNS proxy registers with the DNS server when it is first started and receives the device ID through a two-way TLS encrypted channel.

[0010] Preferably, the device ID validity check includes: querying the device ID registration system for confirmation status; checking the device blacklist database, and returning a rejection response if the device ID exists.

[0011] Preferably, the matching strategy categories include: Access control policy: Return NXDOMAIN for blacklisted domain names or device contexts; Network optimization strategy: returns the optimal CDN node IP based on the device's geographic location and network context; Quality of Service strategy: allocate exclusive resolution resources to high-priority device IDs and allocate common domain name servers to low-priority device IDs; Security protection strategy: Return invalid addresses to malicious domain names based on the device security context; Business Strategy: Perform internal domain name resolution.

[0012] Preferably, policy matching is performed in order of priority: Device-specific policy: Use device ID as the primary key to match the exclusive policy rules. The matching order is access control policy, then business policy. Device group policy: Matches the group policy rule chain based on device group attributes. The policy chain processing logic is: access control policy is processed first, and business policy is processed last. Global policy: matches enterprise-level basic policy rules in the following order: security protection policy, compliance policy, business policy, network optimization policy, and quality of service policy; Default resolution: forwards to the default DNS server when no match is found.

[0013] Preferably, during the strategy matching process: When any level of policy matches successfully, subsequent rule matching is terminated; Device-specific policies take precedence over device group policies, and device group policies take precedence over global policies.

[0014] Preferably, the context includes network context and other contexts; Network context includes: client access area, network type, and device type; Other contexts include: device context, time context, and risk context; the device context is based on the device ID to associate device groups, security levels, and business attributes; the time context is used to determine whether the request occurs during peak business hours or maintenance windows; the risk context is used to check whether the device is on the security alert list.

[0015] A domain name resolution system based on DNS proxy identity authentication and policy control, comprising: The DNS proxy module is used to embed the device identity code into the EDNSOPT resource record after receiving the client's DNS query request, generate an extended DNS request message, and send the message to the DNS server; DNS server module, including: An identity authentication engine that parses the device identity code in the extended DNS request message to verify the legitimacy of the device; The policy decision engine generates dynamic response policies based on the contextual information associated with the device identity code and matches the preset policy library; Policy database, which stores access control policies, network optimization policies, quality of service policies, security protection policies, and business policies associated with device IDs; The response execution module executes the dynamic response strategy and returns the DNS response to the DNS proxy module.

[0016] Preferably, the device identity code includes: a 2-byte 0xF001 field, a 2-byte subsequent data total length field, a 1-byte protocol version field, a 1-byte reserved field, a 4-byte Unix timestamp field, and a 16-byte device ID field; The device ID field is generated by the DNS server through an ID generator using a distributed algorithm based on the timestamp, computer room ID, machine ID, and device serial number, and is a 16-byte hexadecimal string.

[0017] A domain name resolution device based on DNS proxy identity authentication and policy control comprises a processor and a memory storing program instructions. The processor is configured to execute the domain name resolution method based on DNS proxy identity authentication and policy control when running the program instructions.

[0018] The advantages of the present invention are: Enhancements to device-level authentication: By embedding a signed device identifier (including the device certificate ID and timestamp) in the EDNS field, device uniqueness authentication is achieved. This innovation solves the challenge of device traceability in NAT scenarios, significantly improves device identification accuracy, and provides a solid foundation for the implementation of network security policies.

[0019] Implementation of dynamic policy control: Compared to traditional static policies that rely on IP / domain name blacklists and whitelists, this technical solution supports dynamic matching of actions (such as accept, reject, and redirect) based on device identity and domain name patterns. Policy updates are rapid and applied directly to the DNS server, eliminating the need for network firewalls, significantly improving policy responsiveness and flexibility. Furthermore, the introduced circuit breaker mechanism monitors QPS and rejection rates in real time, automatically triggering temporary blackholes to effectively prevent security threats such as DDOS attacks.

[0020] Innovations in privacy protection and EDNS extension: Traditional EDNSClientSubnet technology transmits user IP subnets, which poses a risk of privacy leakage. This solution, based on a uniquely generated device ID, supports device verification that the device belongs to a legitimate group, preventing the leakage of private information such as user IP addresses and enhancing user privacy protection.

[0021] Innovation of identity-based DNS resolution mechanism: This technical solution proposes a new DNS resolution mechanism based on identity information, which realizes intelligent and secure DNS resolution through identity context, enabling the DNS server to dynamically return different DNS resolution results based on the identity attributes of the requester, greatly improving the intelligence and security level of DNS resolution. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0023] Figure 1 Schematic diagram of the process of the present invention.

[0024] Figure 2 FIG. 2 is a schematic diagram of the operation timing of the present invention.

[0025] Figure 3 This is a diagram of the policy decision engine workflow.

[0026] Figure 4 Diagram of the DNS server policy query workflow.

[0027] Figure 5 This is a schematic diagram of the policy matching process and priority. DETAILED DESCRIPTION

[0028] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0029] Example 1 like Figure 1 、 Figure 2 As shown, a domain name resolution method based on DNS proxy identity authentication and policy control includes the following steps: S1: The DNS proxy receives the client's DNS request and extracts the query domain name and client source IP address. S2: The DNS proxy obtains the locally stored device ID, which is a 16-byte globally unique identifier. S3: Construct an EDNSOPT record containing the device ID and timestamp: set the option code to the private value 0xFF01; the data part includes a 4-byte UNIX timestamp and a 16-byte device ID; S4: Add the EDNSOPT record to the additional part of the DNS request message and forward it to the DNS server; S5: The DNS server performs dynamic policy decisions: parsing the EDNSOPT record, extracting the device ID and timestamp; verifying that the timestamp is within ±30 seconds of the server time; and verifying the device ID validity and blacklist status. S6: Perform policy matching on the verified request: associate the device ID, query domain name, DNS query type, client IP and network context; match the policy rule chain in priority order and generate a response result; S7: Return the DNS response message to the client via the DNS proxy.

[0030] As a refinement of the above embodiment, the device ID is generated in the following manner: Static configuration: Configure the assigned device ID in the local storage of the DNS proxy.

[0031] Dynamic generation method: The DNS proxy registers with the DNS server when it is first started. After the DNS server system generates the device ID, it is transmitted to the DNS proxy through a two-way TLS encrypted channel.

[0032] As a refinement of the above embodiment, Figure 3 As shown, the DNS server executing dynamic policy decision in step S5 specifically includes: EDNS record resolution: The DNS server parses the DNS message, identifies the custom EDNS record with option code 0xFF01, and extracts the device ID and timestamp. Security verification process: (1) Time validity check: verify that the time difference between the timestamp and the server time is within ±30 seconds. If it is outside this time window, the DNS rejection response is immediate; (2) Device ID validity: Query the device ID management system to confirm the ID status and query the device blacklist database. If the device is marked as blacklisted, a rejection is returned. (3) For queries marked as requiring logging, the query is recorded in the server's current log file.

[0033] (4) If the query needs to be redirected, return the CNAME.

[0034] As a refinement of the above embodiment, Figure 4 As shown, executing policy matching on the request that passes verification in step S6 specifically includes: After the DNS query is filtered by the dynamic policy decision engine on the DNS server, if the result is accepted, the next step is to match the policy in the policy database: (1) DNS request resolution and device ID context association: Receive the verified device ID (16-byte unique identifier); (2) Extract the core elements of the DNS query: the fully qualified domain name (FQDN) requested for resolution, the DNS query type (such as A record, AAAA record, etc.), and the client's original IP address; (3) Obtain network context information: client access area (such as branch location), network type (such as office network, production network), client device type (such as PC, mobile device, IoT terminal); (4) Other context construction: Device context: associates device groups, security levels, and service attributes based on device IDs; Time context: Determine whether the request occurs during peak business hours or maintenance windows; Risk Context: Checks whether the device is on the security alert list.

[0035] like Figure 5 As shown, the policy matching process and priority: (1) Device-specific policy matching (highest priority) Query the device-specific policy library: Use the device ID as the primary key to retrieve the specific policy rules, match the domain name (supports exact matching and wildcard matching), check the policy effective time range, and match in the following order: first, access control policy, then business policy.

[0036] (2) Device group policy matching (secondary priority) Retrieve group policies based on device group attributes: match the business group (such as R&D group, Finance group) to which the device belongs, apply the group policy rule chain (execute sequentially until a match is found), and the policy chain processing logic: prioritize access control policies, then business policies.

[0037] (3) Global strategy matching (basic rules) Execute enterprise-level basic policies, and the matching order is as follows: Security protection strategies: such as blocking known malicious domain names Compliance strategy: Block illegal domain names according to regional regulations Business strategy: special resolution of enterprise internal domain names Network optimization strategy: Intelligent routing selects the optimal CDN node; identifies the client's physical location (city-level accuracy) and returns an IP address optimized for the corresponding region; Quality of Service policy: Identify high-priority devices (such as VIP users) and allocate dedicated resolution resource pools; (4) Default DNS resolution If there is no DNS resolution matching the policy, the default DNS server will be used to request DNS resolution. The matching strategy categories include: Access control policy: Return NXDOMAIN for blacklisted domain names or device contexts; Network optimization strategy: returns the optimal CDN node IP based on the device's geographic location and network context; Quality of Service strategy: allocate exclusive resolution resources to high-priority device IDs and allocate common domain name servers to low-priority device IDs; Security protection strategy: Return invalid addresses to malicious domain names based on the device security context; Business Strategy: Perform internal domain name resolution.

[0038] Preferably, policy matching is performed in order of priority: Device-specific policy: Use device ID as the primary key to match the exclusive policy rules. The matching order is access control policy, then business policy. Device group policy: Matches the group policy rule chain based on device group attributes. The policy chain processing logic is: access control policy is processed first, and business policy is processed last. Global policy: matches enterprise-level basic policy rules in the following order: security protection policy, compliance policy, business policy, network optimization policy, and quality of service policy; Default resolution: forwards to the default DNS server when no match is found.

[0039] Example 2 A domain name resolution system based on DNS proxy identity authentication and policy control, comprising: The DNS proxy module is used to embed the device identity code into the EDNSOPT resource record after receiving the client's DNS query request, generate an extended DNS request message, and send the message to the DNS server; DNS server module, including: An identity authentication engine that parses the device identity code in the extended DNS request message to verify the legitimacy of the device; The policy decision engine generates dynamic response policies based on the contextual information associated with the device identity code and matches the preset policy library; Policy database, which stores access control policies, network optimization policies, quality of service policies, security protection policies, and business policies associated with device IDs; The response execution module executes the dynamic response strategy and returns the DNS response to the DNS proxy module.

[0040] As a refinement of the above embodiment, the device identity code includes: a 2-byte 0xF001 field, a 2-byte subsequent data total length field, a 1-byte protocol version field, a 1-byte reserved field, a 4-byte Unix timestamp field, and a 16-byte device ID field; The DNS server uses an ID generator with a distributed algorithm to generate a globally unique device ID. The device ID format is a 16-byte hexadecimal string (for example, DID-7X2F-9A3B-C84D). The generated elements include but are not limited to the following information: timestamp, room ID, machine ID, device serial number, and other information.

[0041] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art will be able to modify the technical solutions described in the aforementioned embodiments or substitute equivalents for some of the technical features. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention.

Claims

1. A domain name resolution method based on DNS proxy identity authentication and policy control, characterized in that: The following steps are involved: The DNS proxy receives the client's DNS request and extracts the query domain name and client source IP address; The DNS proxy obtains the locally stored device ID, which is a 16-byte globally unique identifier. Construct an EDNSOPT record containing the device ID and timestamp: set the option code to the private value 0xFF01; the data part includes a 4-byte UNIX timestamp and a 16-byte device ID; Add the EDNSOPT record to the additional part of the DNS request message and forward it to the DNS server; The DNS server performs dynamic policy decisions: parsing EDNSOPT records, extracting device IDs and timestamps; verifying that the timestamp is within ±30 seconds of the server time; and verifying device ID validity and blacklist status. Perform policy matching on requests that pass verification: associate device ID, query domain name, DNS query type, client IP and context; Match the policy rule chain in priority order and generate a response result; The DNS response message is returned to the client via the DNS proxy.

2. The domain name resolution method based on DNS proxy identity authentication and policy control according to claim 1, characterized in that: The device ID is generated in the following ways: Static configuration: DNS proxy locally stores pre-assigned device IDs; or Dynamic generation: The DNS proxy registers with the DNS server when it is first started and receives the device ID through a two-way TLS encrypted channel.

3. The domain name resolution method based on DNS proxy identity authentication and policy control according to claim 1, characterized in that: The device ID validity check includes: querying the device ID registration system to confirm the status; checking the device blacklist database, and returning a rejection response if it exists.

4. The domain name resolution method based on DNS proxy identity authentication and policy control according to claim 1, characterized in that: The matching strategy categories include: Access control policy: Return NXDOMAIN for blacklisted domain names or device contexts; Network optimization strategy: returns the optimal CDN node IP based on the device's geographic location and network context; Quality of Service strategy: allocate exclusive resolution resources to high-priority device IDs and allocate common domain name servers to low-priority device IDs; Security protection strategy: Return invalid addresses to malicious domain names based on the device security context; Business Strategy: Perform internal domain name resolution.

5. The domain name resolution method based on DNS proxy identity authentication and policy control according to claim 4, characterized in that: Policy matching is performed in order of priority: Device-specific policy: Use device ID as the primary key to match the exclusive policy rules. The matching order is access control policy, then business policy. Device group policy: Matches the group policy rule chain based on device group attributes. The policy chain processing logic is: access control policy is processed first, and business policy is processed last. Global policy: matches enterprise-level basic policy rules in the following order: security protection policy, compliance policy, business policy, network optimization policy, and quality of service policy; Default resolution: forwards to the default DNS server when no match is found.

6. The domain name resolution method based on DNS proxy identity authentication and policy control according to claim 5, characterized in that: During the policy matching process: When any level of policy matches successfully, subsequent rule matching is terminated; Device-specific policies take precedence over device group policies, and device group policies take precedence over global policies.

7. The domain name resolution method based on DNS proxy identity authentication and policy control according to claim 1, characterized in that: The context includes network context and other contexts; Network context includes: client access area, network type, and device type; Other contexts include: device context, time context, and risk context; the device context is based on the device ID to associate device groups, security levels, and business attributes; the time context is used to determine whether the request occurs during peak business hours or maintenance windows; the risk context is used to check whether the device is on the security alert list.

8. A domain name resolution system based on DNS proxy identity authentication and policy control, characterized in that: The domain name resolution method based on DNS proxy identity authentication and policy control according to any one of claims 1 to 7 comprises: The DNS proxy module is used to embed the device identity code into the EDNSOPT resource record after receiving the client's DNS query request, generate an extended DNS request message, and send the message to the DNS server; DNS server module, including: An identity authentication engine that parses the device identity code in the extended DNS request message to verify the legitimacy of the device; The policy decision engine generates dynamic response policies based on the contextual information associated with the device identity code and matches the preset policy library; Policy database, which stores access control policies, network optimization policies, quality of service policies, security protection policies, and business policies associated with device IDs; The response execution module executes the dynamic response strategy and returns the DNS response to the DNS proxy module.

9. The domain name resolution system based on DNS proxy identity authentication and policy control according to claim 8, characterized in that: The device identity code includes: a 2-byte 0xF001 field, a 2-byte subsequent data total length field, a 1-byte protocol version field, a 1-byte reserved field, a 4-byte Unix timestamp field, and a 16-byte device ID field; The device ID field is generated by the DNS server through an ID generator using a distributed algorithm based on the timestamp, computer room ID, machine ID, and device serial number, and is a 16-byte hexadecimal string.

10. A domain name resolution device based on DNS proxy identity authentication and policy control, comprising a processor and a memory storing program instructions, characterized in that: The processor is configured to execute the domain name resolution method based on DNS proxy identity authentication and policy control as described in any one of claims 1 to 7 when running the program instructions.

Images