Network security protection system and method based on DHCP and DNS services
By introducing the threat domain name information synchronization module and the threat terminal fingerprint profiling module into DHCP and DNS services, threat intelligence sharing and linkage between secure DNS and secure DHCP are achieved, which solves the limitations of independent DNS and DHCP protection in existing technologies and improves the linkage and active defense capabilities of network security protection.
Patent Information
- Application Number
- CN202510939136.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-08
- Publication Date
- 2025-10-10
AI Technical Summary
In existing technologies, DHCP's control of terminals cannot utilize the already very mature DNS threat intelligence library, and DNS's protection of threat domain names cannot make good use of DHCP's blocking and access capabilities, resulting in significant limitations in network security protection.
By introducing a threat domain name information synchronization module, a threat domain name linkage blocking module, and a threat terminal fingerprint profiling module into DHCP and DNS services, real-time sharing and linkage of threat intelligence between secure DNS and secure DHCP are achieved. Threat intelligence is used to block IP/MAC addresses of terminals, restrict address allocation, and link switches/routers for blocking. AI technology is used to analyze terminal fingerprint characteristics for proactive defense.
It realizes the linkage of DNS and DHCP security protection, improves the ability to identify and protect threat terminals, reduces the difficulty of bypassing protection, forms a full-chain security protection mechanism, reduces management costs and improves response efficiency.
Smart Images
Figure CN120768600A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network security technology, and in particular to a network security protection system and method based on DHCP and DNS services. Background Art
[0002] As fundamental internet services, the Domain Name System (DNS) and Dynamic Host Configuration Protocol (DHCP) are widely used in various network environments. In scenarios such as home networks, enterprise campus networks, data centers, and the Internet of Things (IoT), DNS plays a core role in domain name resolution. Like the "address translator" of the online world, it converts human-readable domain names into computer-readable IP addresses, ensuring users can accurately access various network resources. DHCP, on the other hand, acts as a network administrator, automatically assigning network parameters such as IP addresses, subnet masks, and gateways to network devices, greatly improving the efficiency of network deployment and device management.
[0003] However, as the internet landscape becomes increasingly complex, cyberattacks become more diverse, intelligent, and covert. Traditional DNS and DHCP systems are no longer able to meet the stringent requirements for network security management and control. Illegal software or malicious Trojans often use domain names as a vehicle to direct users to malicious websites, resulting in serious consequences such as data leaks and financial losses. The lack of effective security authentication mechanisms in DHCP is a significant issue. Unauthorized devices can obtain IP addresses through forged requests, infiltrate the network, and even launch internal attacks as vulnerable machines, preventing legitimate devices from accessing the network.
[0004] Based on the above security demands, DNS and DHCP have expanded their respective capabilities in terms of security, and to a certain extent, solved security issues in some scenarios. DNS has developed into secure DNS by combining third-party threat intelligence technology. By loading a threat intelligence library into the domain name server, it can perform real-time detection of domain names accessed by clients and identify whether they are threat domains. Once a malicious domain name resolution request is detected, secure DNS can automatically issue an alarm or block it, and use the information in the threat intelligence library to generate a threat profile that includes threat type, attack source, potential harm, etc., to help users better perceive threats. Block resolution requests based on preset policies to prevent users from accessing malicious websites; or tamper with the resolution results to direct users to safe IP addresses to avoid attacks.
[0005] DHCP then combines the capabilities of network scanning, access and blocking, and develops into a secure DHCP, which can timely discover abnormal terminals such as terminals not included in management and control and temporarily replaced terminals through periodic network scanning. The secure DHCP can limit illegal equipment to obtain IP addresses by controlling the allocation behavior of DHCP addresses; at the same time, combined with the IP / MAC blocking and passing instructions issued to routers and switches, it realizes linkage control and completes the access restriction and network blocking of abnormal terminals. For example, when the scan discovers that an unauthorized device attempts to access the network, the secure DHCP can refuse to allocate an IP address for it and send instructions to the router and switch to prohibit the network traffic of the device, thereby ensuring network security.
[0006] Although the secure DNS and the secure DHCP have achieved certain security protection effects in their respective fields, there are still significant limitations. When the client detects the blocking behavior of the domain name server for a specific domain name, it can easily bypass the security restrictions based on the secure DNS by manually configuring the client local domain name resolution file (such as the hosts file) or replacing the domain name server. The secure DHCP lacks a threat intelligence database similar to DNS and relies more on manual review and operation in the security management and control of network terminals. The security protection capabilities of DNS and DHCP are not well combined, DHCP cannot use the already mature DNS threat intelligence database for terminal management and control, and DNS cannot well utilize the blocking and access capabilities of DHCP for threat domain name protection. SUMMARY
[0007] To this end, the present application provides a network security protection system and method based on DHCP and DNS services to solve the problem that DHCP cannot use the already mature DNS threat intelligence database for terminal management and control, and DNS cannot well utilize the blocking and access capabilities of DHCP for threat domain name protection.
[0008] To achieve the above purpose, the present application provides the following technical solutions:
[0009] In a first aspect, a network security protection system based on DHCP and DNS services includes a secure DNS and a secure DHCP. The secure DNS includes a first threat domain name information synchronization module and a first threat domain name linkage blocking module. The secure DHCP includes a second threat domain name information synchronization module, a second threat domain name linkage blocking module, and a threat terminal fingerprint profiling module.
[0010] The first threat domain name information synchronization module is configured to synchronize the identified terminal threat domain name access information to the second threat domain name linkage blocking module and the threat terminal fingerprint profiling module.
[0011] The second threat domain linkage blocking module is used to automatically block the IP or MAC address of terminals accessing the threat domain according to the terminal threat domain access information synchronized by the first threat domain information synchronization module, and send a blocking command to the switch or router for the record values corresponding to the threat domains visited by all terminals, so that all terminals can no longer communicate with the threat server;
[0012] A threat terminal fingerprint profiling module is used to analyze the fingerprint characteristics of terminals accessing the threat domain name based on the terminal threat domain name access information synchronized by the first threat domain name information synchronization module, and to alert or block terminals with the same fingerprint characteristics;
[0013] The second threat domain name information synchronization module is used to synchronize the identified dangerous terminal information to the first threat domain name linkage blocking module;
[0014] The first threat domain name linkage blocking module is used to refuse to provide domain name resolution services to dangerous terminals according to the dangerous terminal information synchronized by the second threat domain name information synchronization module.
[0015] Preferably, the terminal threat domain name access information includes the terminal IP address or MAC address, the domain name and the domain name resolution record value.
[0016] Preferably, when the second threat domain linkage blocking module prevents all terminals from communicating with the threat server, even if the client modifies the local domain name resolution file, the communication cannot be completed.
[0017] Preferably, the threat terminal fingerprint profiling module adopts AI technology when analyzing the fingerprint features of the terminal accessing the threat domain name based on the terminal threat domain name access information synchronized by the first threat domain name information synchronization module.
[0018] Preferably, the threat terminal fingerprint profiling module analyzes the fingerprint features of the terminal accessing the threat domain name based on the terminal threat domain name access information synchronized by the first threat domain name information synchronization module. The terminal fingerprint features include option fingerprint, open port, protocol type and domain name access rules.
[0019] Preferably, the dangerous terminal information includes illegally accessed devices.
[0020] In a second aspect, a network security protection method based on DHCP and DNS services is provided, wherein the method is applied to secure DHCP in the network security protection system based on DHCP and DNS services, and comprises:
[0021] Receiving terminal threat domain name access information synchronized by the secure DNS through the first threat domain name information synchronization module;
[0022] Automatically block the IP or MAC address of terminals accessing the threat domain name based on the terminal threat domain name access information synchronized by the first threat domain name information synchronization module, and send a blocking command to the switch or router for the record values corresponding to the threat domain name accessed by all terminals, so that all terminals can no longer communicate with the threat server;
[0023] The terminal threat domain name access information synchronized by the first threat domain name information synchronization module is used to analyze the terminal fingerprint characteristics of the terminal accessing the threat domain name, and an alarm is issued or blocked for the terminal having the same fingerprint characteristics.
[0024] In a third aspect, a network security protection method based on DHCP and DNS services is provided, wherein the method is applied to a secure DNS in the network security protection system based on DHCP and DNS services, and comprises:
[0025] Receiving dangerous terminal information synchronized by the secure DHCP through the second threat domain name information synchronization module;
[0026] Refuse to provide domain name resolution service to the dangerous terminal according to the dangerous terminal information synchronized by the second threat domain name information synchronization module.
[0027] Compared with the prior art, this application has at least the following beneficial effects:
[0028] The present application provides a network security protection system based on DHCP and DNS services, including secure DNS and secure DHCP. The secure DNS includes a first threat domain name information synchronization module and a first threat domain name linkage blocking module. The secure DHCP includes a second threat domain name information synchronization module, a second threat domain name linkage blocking module, and a threat terminal fingerprint profiling module. The present application can achieve real-time sharing of threat intelligence between secure DNS and secure DHCP through the first threat domain name information synchronization module and the second threat domain name information synchronization module. The secure DHCP can block IP / MAC addresses of terminals, restrict address allocation, or link switches / routers to block communication with threat servers based on threat intelligence. The secure DNS can refuse to provide domain name resolution services to dangerous terminals based on dangerous terminal information, thereby achieving linkage between DNS and DHCP security blocking levels. The present application can also profile threat terminal fingerprints, thereby achieving active defense, improving the shortcomings and loopholes of the original secure DHCP and secure DNS in independently performing security protection. BRIEF DESCRIPTION OF THE DRAWINGS
[0029] To more intuitively illustrate the prior art and the present application, exemplary drawings are provided below. It should be understood that the specific shapes and structures shown in the drawings should not generally be considered as limiting conditions for implementing the present application; for example, based on the technical concepts disclosed in this application and the exemplary drawings, those skilled in the art are capable of easily making routine adjustments or further optimizations to the addition / reduction / attribution division, specific shapes, positional relationships, connection methods, dimensional ratios, etc. of certain units (components).
[0030] Figure 1 This is a structural diagram of a network security protection system based on DHCP and DNS services provided in Example 1 of the present application.
[0031] Description of reference numerals:
[0032] 1. Secure DNS; 101. First threat domain name information synchronization module; 102. First threat domain name linkage blocking module; 2. Secure DHCP; 201. Second threat domain name information synchronization module; 202. Second threat domain name linkage blocking module; 203. Threat terminal fingerprint profiling module. DETAILED DESCRIPTION
[0033] The present application will be further described below in detail through specific embodiments in conjunction with the accompanying drawings.
[0034] In the description of this application: unless otherwise specified, the meaning of "plurality" is two or more. The terms "first", "second", "third", etc. in this application are intended to distinguish the objects referred to and do not have any special meaning in terms of technical connotation (for example, they should not be understood as emphasizing the importance or order, etc.). Expressions such as "including", "comprising", "having", etc. also mean "not limited to" (certain units, components, materials, steps, etc.).
[0035] The terms such as "upper", "lower", "left", "right", "middle", etc. cited in this application are usually used to indicate the general relative position relationship for the convenience of intuitive understanding by referring to the drawings, and are not absolute limitations on the position relationship in the actual product.
[0036] Example 1
[0037] See also Figure 1 This embodiment provides a network security protection system based on DHCP and DNS services, including a secure DNS1 and a secure DHCP2, wherein the secure DNS1 includes a first threat domain name information synchronization module 101 and a first threat domain name linkage blocking module 102, and the secure DHCP2 includes a second threat domain name information synchronization module 201, a second threat domain name linkage blocking module 202 and a threat terminal fingerprint profiling module 203.
[0038] The first threat domain name information synchronization module 101 is used to synchronize the identified terminal threat domain name access information to the second threat domain name linkage blocking module 202 and the threat terminal fingerprint profiling module 203 of the secure DHCP2.
[0039] Specifically, based on threat intelligence, secure DNS1 can identify that a terminal has accessed certain threat domains. Information such as the terminal address and the resolution record values corresponding to the threat domains needs to be synchronized with secure DHCP2 to facilitate intelligence exchange. Therefore, this embodiment incorporates a first threat domain information synchronization module 101 into secure DNS1 to synchronize the threat domain access information identified by secure DNS1 with a second threat domain linkage blocking module 202 of secure DHCP2. This allows secure DHCP2 to utilize this information to supplement and improve its security actions related to access, blocking, and address allocation.
[0040] The second threat domain linkage blocking module 202 is used to automatically block the IP or MAC of the terminal accessing the threat domain according to the terminal threat domain access information synchronized by the first threat domain information synchronization module 101, and send a blocking command to the switch or router for the record value (threat server IP address) corresponding to the threat domain visited by all terminals, so that all terminals can no longer communicate with the threat server.
[0041] Specifically, this embodiment embeds a second threat domain name linkage blocking module 202 in the secure DHCP2. The secure DHCP2 can use the information synchronized to it by the secure DNS1 to automatically block the IP or MAC address of the terminal accessing the threat domain name, thereby preventing the terminal from further accessing other threat domain names. The secure DHCP2 can also use the information synchronized to it by the secure DNS1 to send a blocking command to the switch or router with the record values corresponding to the threat domain names visited by all terminals, so that all terminals (including newly connected terminals) can no longer communicate with these threat servers. Even if the client modifies the local domain name resolution file, communication cannot be completed.
[0042] Because the relevant information resolved by secure DNS1 includes the request source address and domain name resolution records, the request source address of secure DNS1 is the IP address of the terminal assigned by secure DHCP2. If a terminal is found to have accessed a threatening domain name or the frequency of accessing domain names (including non-threatening domain names) reaches the set threshold requirement or there is the possibility of other DNS security attacks (such as tunneling), the entire network of this terminal can be blocked to remove it from the network; if the record value (IP address) corresponding to the threatening domain name accessed by all terminals is a dangerous server, secure DHCP2 needs to issue an instruction to block all communications between all terminals and these servers. At this time, even if the terminal bypasses the security protection of secure DNS1, it cannot bypass the security protection of secure DHCP2; the regular query and access of domain name information assigned by the terminal by secure DHCP2 can also be used as a feature of the terminal fingerprint and included in terminal fingerprint management.
[0043] The threat terminal fingerprint profiling module 203 is used to analyze the fingerprint characteristics of terminals accessing the threat domain name based on the terminal threat domain name access information synchronized by the first threat domain name information synchronization module 101, and to alert or block terminals with the same fingerprint characteristics.
[0044] Specifically, a large portion of user access to threat domains is triggered unconsciously and passively. The initial intention is not to visit these threat websites, but rather as an indirect consequence of launching certain services or installing and using third-party software or plug-ins. AI and other technologies are used to analyze the common fingerprint characteristics of terminals accessing threat domains and create fingerprint profiles. Once the fingerprint characteristics are clearly defined, preemptive control and early warning can be implemented for access terminals with these fingerprint characteristics. Secure DHCP2 defines fingerprint characteristics by adding a domain name access indicator. Regular terminal access to certain domain names is also a key characteristic of terminals, and incorporating fingerprint characteristics facilitates access and blocking control.
[0045] In this embodiment, the threat terminal fingerprint profiling module 203 can use the information synchronized by secure DNS1 to analyze the terminal's fingerprint characteristics (option fingerprint, open ports and protocols, provided services, etc.) using AI or other technologies. It can then issue alerts or block terminals with the same fingerprint characteristics, thus expanding security threat protection from point to surface. In addition, secure DHCP2 can also expand its fingerprint categories. Terminals that regularly access certain domain names can also be used as fingerprint characteristics to better facilitate management and control.
[0046] The second threat domain name information synchronization module 201 is configured to synchronize the identified dangerous terminal information to the first threat domain name linkage blocking module 102 .
[0047] Specifically, this embodiment also implants a second threat domain name information synchronization module 201 in the secure DHCP2. The second threat domain name information synchronization module 201 can synchronize the dangerous terminal information identified by the secure DHCP2 to the first threat domain name linkage blocking module 102 of the secure DNS1, so that the secure DNS1 can refuse to provide domain name resolution services to these dangerous terminals, thereby achieving linkage at the DNS and DHCP security blocking levels.
[0048] The first threat domain name linkage blocking module 102 is configured to refuse to provide domain name resolution services to dangerous terminals according to the dangerous terminal information synchronized by the second threat domain name information synchronization module 201 .
[0049] Specifically, this embodiment embeds a first threat domain name linkage blocking module 102 in the secure DNS1. The purpose of embedding this module in the secure DNS1 is to utilize the DHCP dangerous terminal information synchronized by the "second threat domain name information synchronization module 201" to limit the provision of domain name resolution services to dangerous terminals at the resolution level.
[0050] Example:
[0051] Application scenario: The system provided in this embodiment is deployed in an enterprise campus network to protect against attacks in which malware induces terminal communications through domain names.
[0052] Specific process:
[0053] Step 1: Threat Identification:
[0054] The secure DNS detected that the terminal ATTACK_A (IP: 192.168.1.10) initiated a resolution request for the threat domain name "attack.zdns.cn". After matching the threat intelligence library, it was determined to be a malicious access and generated access information including the terminal address (192.168.1.10), domain name (attack.zdns.cn) and resolution record value (192.168.1.2).
[0055] Step 2: Intelligence synchronization:
[0056] The "first threat domain name information synchronization module" synchronizes the IP address (192.168.1.10) of the terminal ATTACK_A, the threat domain name "attack.zdns.cn" and its resolution IP address (192.168.1.2) to the secure DHCP.
[0057] Step 3: Linkage blocking:
[0058] Terminal-level blocking: Based on the configured rules, secure DHCP immediately blocks the IP / MAC binding for terminal ATTACK_A, prohibiting it from obtaining a new IP address. It also issues a command to the campus network switch to block all network traffic for the terminal. DHCP also synchronizes the terminal blocking information with the secure DNS server, which subsequently rejects domain name requests for this IP address.
[0059] Global blocking: Secure DHCP resolves the IP address (192.168.1.2) corresponding to the threat domain name and issues an ACL policy to the core router, prohibiting all terminals in the campus network (including newly connected devices) from communicating with this IP address, thus severing the malware's communication link.
[0060] Step 4: Fingerprint profiling and extended protection:
[0061] The "Threat Endpoint Fingerprint Profiling Module" analyzes the communication characteristics of the terminal ATTACK_A and identifies all terminals that frequently access suspicious domains, open unusual ports (such as TCP 8844), and use non-standard DHCP Option parameters. Based on these characteristics, it generates a fingerprint template and marks the terminal as a "high-risk terminal."
[0062] When the new terminal ATTACK_B (IP: 192.168.1.11) accesses the network, DHCP detects that its Option parameter matches the fingerprint of terminal ATTACK_A, immediately triggering an alert and restricting its network access rights, requiring manual review by the administrator to prevent the spread of similar threats.
[0063] Step 5: Effect verification:
[0064] The malicious access attempt by terminal ATTACK_A was blocked in real time, causing no security impact. After ATTACK_A switched its device to the previous IP address, the DNS server was no longer able to provide resolution services.
[0065] The global blocking policy effectively prevents other terminals from communicating with the threat server. Even if the terminal manually modifies the Hosts file to point to a different IP address, a connection cannot be established due to DHCP linkage blocking.
[0066] Through fingerprint matching, the potential risks of terminal ATTACK_B can be identified in advance, so that the threat can be dealt with before it spreads.
[0067] This embodiment provides a network security protection system based on DHCP and DNS services. It fully utilizes the existing general security capabilities of secure DNS1 and secure DHCP2, innovatively introducing a "threat domain name information synchronization module," a "threat terminal fingerprint profiling module," and a "threat domain name linkage blocking module" to combine the advantages of DNS and DHCP in identifying and protecting security threats. In particular, it fully leverages the DNS security threat intelligence library and DHCP's ability to access and block terminals, forming a full-chain security protection mechanism from multiple dimensions, including address allocation, domain name access, and network release policy configuration. This improves the shortcomings and vulnerabilities of the original independent security protection of secure DHCP and secure DNS. Specifically, it includes the following points:
[0068] 1. Threat intelligence exchange improves protection linkage and enables real-time sharing of threat intelligence between secure DNS and secure DHCP through the "Threat Domain Name Information Synchronization Module":
[0069] (1) The threat domain name access records (including terminal IP / MAC, domain name resolution record values, etc.) identified by secure DNS can be synchronized to DHCP, enabling DHCP to block the terminal's IP / MAC, restrict address allocation, or link switches / routers to block threat server communications based on threat intelligence, thus solving the problem of traditional DHCP lacking threat intelligence support.
[0070] (2) The dangerous terminal information identified by DHCP (such as illegal access devices) can be synchronized to DNS, so that DNS refuses to provide resolution services for dangerous terminals, forming a two-way blocking mechanism of "resolution layer + access layer" to make up for the protection loopholes of a single system.
[0071] 2. Fingerprint profiling expansion to achieve proactive defense. The "Threat Terminal Fingerprint Profiling Module" uses AI to analyze common characteristics of terminals accessing threat domain names (such as option fingerprints, open ports, protocol types, domain name access patterns, etc.) to build a multi-dimensional terminal fingerprint library:
[0072] (1) Trigger alarms or block new access terminals with the same fingerprint characteristics in advance, upgrade passive protection to active defense, and expand the scope of security protection (from "single point threat" to "similar terminal groups").
[0073] (2) Added "domain name access pattern" as a fingerprint feature to identify unconscious behaviors of indirectly accessing threat domain names through third-party software / plug-ins, thereby improving threat prediction capabilities.
[0074] (3) The unified management interface can centrally display the threat profile, blocking records and fingerprint characteristics of terminals with addresses assigned by DHCP, helping administrators quickly locate the source of risks and optimize security policies.
[0075] 3. Multi-level linkage blocking increases the difficulty of bypassing. The "Threat Domain Linkage Blocking Module" achieves dual blocking at the resolution layer and the network layer:
[0076] (1) At the DNS layer, the domain name resolution request of the dangerous terminal is directly rejected. Although DHCP has blocked the dangerous terminal at the network layer, if the MAC is blocked, the dangerous terminal can switch to another device with the same IP configuration to continue network access. If DNS is also blocked from the resolution side at this time, it can play a good protective role.
[0077] (2) At the DHCP layer, based on the synchronized threat domain IP address, all terminals are globally blocked from communicating with the threat server through switches / routers. Even if the terminal circumvents DNS resolution by modifying the local Hosts file or changing the DNS server, it will not be able to establish a network connection. In extreme scenarios, if the DNS resolution side detects that a terminal has a threat domain access vulnerability, the entire terminal can be blocked on the DHCP side.
[0078] 4. Full chain security protection to reduce management costs
[0079] (1) Integrate the DNS threat intelligence library and the terminal access / blocking capabilities of DHCP to form a full-process protection system of "address allocation → domain name resolution → traffic control".
[0080] (2) Reduce the operational costs of traditional secure DHCP that relies on manual review and improve response efficiency through automated intelligence synchronization and policy execution.
[0081] Example 2
[0082] This embodiment provides a network security protection method based on DHCP and DNS services. The method is applied to a secure DHCP in a network security protection system based on DHCP and DNS services, including:
[0083] Receiving terminal threat domain name access information synchronized by the secure DNS through the first threat domain name information synchronization module;
[0084] Automatically block the IP or MAC address of terminals accessing the threat domain name based on the terminal threat domain name access information synchronized by the first threat domain name information synchronization module, and send a blocking command to the switch or router for the record values corresponding to the threat domain name accessed by all terminals, so that all terminals can no longer communicate with the threat server;
[0085] The terminal threat domain name access information synchronized by the first threat domain name information synchronization module is used to analyze the terminal fingerprint characteristics of the terminal accessing the threat domain name, and an alarm is issued or blocked for the terminal having the same fingerprint characteristics.
[0086] For the specific implementation content of a network security protection method based on DHCP and DNS services, please refer to the specific definition of a network security protection system based on DHCP and DNS services above, which will not be repeated here.
[0087] Example 3
[0088] This embodiment provides a network security protection method based on DHCP and DNS services. The method is applied to a secure DNS in a network security protection system based on DHCP and DNS services, including:
[0089] Receiving dangerous terminal information synchronized by the secure DHCP through the second threat domain name information synchronization module;
[0090] Refuse to provide domain name resolution service to the dangerous terminal according to the dangerous terminal information synchronized by the second threat domain name information synchronization module.
[0091] For the specific implementation content of a network security protection method based on DHCP and DNS services, please refer to the specific definition of a network security protection system based on DHCP and DNS services above, which will not be repeated here.
[0092] The technical features of the above embodiments can be combined arbitrarily (as long as there is no contradiction in the combination of these technical features). In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described; these embodiments that are not explicitly written should also be considered to be within the scope of this specification.
Claims
1. A network security protection system based on DHCP and DNS services, including secure DNS and secure DHCP, characterized in that: Secure DNS includes a first threat domain name information synchronization module and a first threat domain name linkage blocking module. Secure DHCP includes a second threat domain name information synchronization module, a second threat domain name linkage blocking module, and a threat terminal fingerprint profiling module. A first threat domain name information synchronization module is used to synchronize the identified terminal threat domain name access information to the second threat domain name linkage blocking module and the threat terminal fingerprint profiling module; The second threat domain linkage blocking module is used to automatically block the IP or MAC address of terminals accessing the threat domain according to the terminal threat domain access information synchronized by the first threat domain information synchronization module, and send a blocking command to the switch or router for the record values corresponding to the threat domains visited by all terminals, so that all terminals can no longer communicate with the threat server; A threat terminal fingerprint profiling module is used to analyze the fingerprint characteristics of terminals accessing the threat domain name based on the terminal threat domain name access information synchronized by the first threat domain name information synchronization module, and to alert or block terminals with the same fingerprint characteristics; The second threat domain name information synchronization module is used to synchronize the identified dangerous terminal information to the first threat domain name linkage blocking module; The first threat domain name linkage blocking module is used to refuse to provide domain name resolution services to dangerous terminals according to the dangerous terminal information synchronized by the second threat domain name information synchronization module.
2. The network security protection system based on DHCP and DNS services according to claim 1, characterized in that: The terminal threat domain name access information includes the terminal IP address or MAC address, domain name, and domain name resolution record value.
3. The network security protection system based on DHCP and DNS services according to claim 1, characterized in that: The second threat domain name linkage blocking module prevents all terminals from communicating with the threat server. Even if the client modifies the local domain name resolution file, the communication cannot be completed.
4. The network security protection system based on DHCP and DNS services according to claim 1, characterized in that: The threat terminal fingerprint profiling module adopts AI technology when analyzing the fingerprint features of the terminal accessing the threat domain name based on the terminal threat domain name access information synchronized by the first threat domain name information synchronization module.
5. The network security protection system based on DHCP and DNS services according to claim 1, characterized in that: The threat terminal fingerprint profiling module analyzes the terminal fingerprint features of accessing the threat domain name based on the terminal threat domain name access information synchronized by the first threat domain name information synchronization module. The terminal fingerprint features include option fingerprints, open ports, protocol types and domain name access rules.
6. The network security protection system based on DHCP and DNS services according to claim 1, characterized in that: The dangerous terminal information includes illegally accessed devices.
7. A network security protection method based on DHCP and DNS services, characterized in that: The method is applied to secure DHCP in a network security protection system based on DHCP and DNS services according to any one of claims 1 to 6, comprising: Receiving terminal threat domain name access information synchronized by the secure DNS through the first threat domain name information synchronization module; Automatically block the IP or MAC address of terminals accessing the threat domain name based on the terminal threat domain name access information synchronized by the first threat domain name information synchronization module, and send a blocking command to the switch or router for the record values corresponding to the threat domain name accessed by all terminals, so that all terminals can no longer communicate with the threat server; The terminal threat domain name access information synchronized by the first threat domain name information synchronization module is used to analyze the terminal fingerprint characteristics of the terminal accessing the threat domain name, and an alarm is issued or blocked for the terminal having the same fingerprint characteristics.
8. A network security protection method based on DHCP and DNS services, characterized in that: The method is applied to the secure DNS in the network security protection system based on DHCP and DNS services according to any one of claims 1 to 6, comprising: Receiving dangerous terminal information synchronized by the secure DHCP through the second threat domain name information synchronization module; Refuse to provide domain name resolution service to the dangerous terminal according to the dangerous terminal information synchronized by the second threat domain name information synchronization module.