Method, device, equipment, medium and program product for security enhancement of domain name resolution

Abstract

The present disclosure provides a security enhancement method, device, equipment, medium and program product for domain name resolution. The method comprises the following steps: querying a parent domain server to determine whether a first NS record list corresponding to a to-be-verified domain name exists; verifying the parent domain authorization validity of the to-be-verified domain name; querying a sub-domain server indicated by the first NS record to obtain a second NS record corresponding to the to-be-verified domain name; comparing the first NS record with the second NS record to determine whether the NS record of the to-be-verified domain name is trustworthy; constructing a local trustworthy NS database based on a strict data verification process to provide a technical basis for real-time domain name resolution; and returning a domain name resolution result to a user terminal in combination with the trustworthy NS record and the real-time NS record query result, which can maximize the accuracy of domain name resolution and effectively reduce domain name resolution abnormalities and network attacks caused by problems such as conflict authorization, invalid authorization and circular authorization.

Description

Technical Field

[0001] This disclosure relates to cybersecurity technologies, and in particular to a method, apparatus, device, medium, and program product for enhancing the security of domain name resolution. Background Technology

[0002] The security and reliability of the Domain Name System (DNS) directly impact the stable operation of the entire network. The current domain name authorization system suffers from abnormal authorization situations such as conflicting authorizations, invalid authorizations, and circular authorizations, which may lead to security risks such as domain name attacks, domain name hijacking, DNS hijacking, DNS resolution failures, and denial-of-service attacks.

[0003] Current domain name system security enhancement technologies, such as source port randomization, DNS security extensions (DNSSEC), DNS over TLS (DoT) protocol, and DNS over HTTPS (DoH) protocol, have played important roles in their respective fields. However, these technologies can only address one type of abnormal risk. They are difficult to comprehensively and effectively deal with the security risks caused by the aforementioned authorization issues. Furthermore, some solutions consume a lot of resources from recursive or authoritative DNS servers. Summary of the Invention

[0004] This disclosure provides a method, apparatus, device, medium, and program product for enhancing the security of domain name resolution, which can improve the accuracy of domain name resolution and effectively reduce domain name resolution anomalies and network attacks caused by problems such as conflicting authorizations, invalid authorizations, and circular authorizations.

[0005] One aspect of this disclosure provides a method for enhancing the security of domain name resolution, applied to a domain name resolution server, the method comprising:

[0006] In response to the database update trigger condition being met, obtain the domain name to be verified;

[0007] The authorization information is verified by sending an authorization information verification request to the parent domain server corresponding to the domain name to be verified, and verifying whether the parent domain server stores a list of first name server (NS) records corresponding to the domain name to be verified.

[0008] In response to receiving the first NS record list from the parent domain server, an NS record query request is sent to the child domain server recorded in the first NS record list;

[0009] in response to receiving the second NS record list fed back by the sub-domain server, comparing the first NS record list with the second NS record list, and storing the consistent NS records in the first NS record list and the second NS record list and the domain name to be verified in a trusted NS database;

[0010] in response to receiving a domain name resolution request sent by a user terminal, feeding back a domain name resolution result to the user terminal based on real-time NS record query results and the trusted NS database.

[0011] Optionally, the storing of the consistent NS records in the first NS record list and the second NS record list and the domain name to be verified in the trusted NS database comprises:

[0012] performing a trustworthiness verification on the consistent NS records, and storing the NS records passing the verification and the domain name to be verified in the trusted NS database;

[0013] The trustworthiness verification manner comprises at least one of the following:

[0014] in response to the domain name to be verified being provided with a DNSSEC mechanism, performing a DNSSEC verification on the consistent NS records;

[0015] verifying whether a parent domain in a sub-domain server domain name in the consistent NS records exists based on the sub-domain server domain name in the consistent NS records.

[0016] Optionally, the method further comprises:

[0017] for the inconsistent NS records in the first NS record list and the second NS record list, sending the NS record query request to a sub-domain server recorded in the inconsistent NS records;

[0018] in response to receiving a third NS record list fed back by the sub-domain server recorded in the inconsistent NS records, storing the inconsistent NS records, the domain name to be verified and an Internet Protocol Address (IP address) corresponding to the domain name to be verified in the trusted NS database;

[0019] in response to not receiving a response of the sub-domain server recorded in the inconsistent NS records, storing the inconsistent NS records and the domain name to be verified in an invalid NS list;

[0020] in response to not receiving the response of the parent domain server, storing the domain name to be verified in the invalid NS list;

[0021] store the consistent NS record that fails the credibility verification and the domain name to be verified to the invalid NS list.

[0022] Optionally, the trigger condition comprises at least one of the following: reaching a starting time of a preset update period, first receiving a domain name resolution request for a target domain name, and there being a newly added invalid domain name in the invalid NS list.

[0023] wherein,

[0024] When the trigger condition comprises reaching the starting time of the preset update period, the domain name to be verified comprises a domain name in the credible NS database and a domain name in the invalid NS list.

[0025] When the trigger condition comprises first receiving the domain name resolution request for the target domain name, the domain name to be verified comprises the target domain name.

[0026] When the trigger condition comprises there being the newly added invalid domain name in the invalid NS list, the domain name to be verified comprises the newly added invalid domain name.

[0027] Optionally, the method further comprises:

[0028] In response to receiving a domain name resolution request sent by a user terminal, performing NS record query through a parent domain server and a subdomain server corresponding to a domain name to be resolved in the domain name resolution request to obtain real-time NS record query results.

[0029] Performing domain name information retrieval based on the credible NS database to obtain credible NS record query results corresponding to the domain name to be resolved.

[0030] In response to the real-time NS record query results being consistent with the credible NS record query results, performing domain name resolution based on the real-time NS record query results and feeding back the domain name resolution results to the user terminal.

[0031] In response to the real-time NS record query results being inconsistent with the credible NS record query results, performing domain name resolution based on the credible NS record query results, feeding back the domain name resolution results to the user terminal, and determining that the trigger condition for database update is reached, and the domain name to be verified is the domain name to be resolved.

[0032] Optionally, the method further comprises:

[0033] updating the trusted NS database based on a record update policy, in response to receiving the NS record of the other domain name in the process of querying the NS record of the domain name to be verified, and the NS record of the other domain name being stored in the trusted NS database;

[0034] The record update policy comprises one of the following:

[0035] inhibiting cache update of the NS record of the other domain name in the trusted NS database, in response to the level of the received NS record of the other domain name being the same as or lower than the level of the NS record of the other domain name in the trusted NS database;

[0036] performing cache update of the NS record of the other domain name in the trusted NS database based on the received NS record of the other domain name, and not changing the cache validity period of the NS record of the other domain name in the trusted NS database, in response to the level of the received NS record of the other domain name being higher than the level of the NS record of the other domain name in the trusted NS database;

[0037] confirming that the trigger condition of database update is reached, and performing authorization information verification on the parent domain server corresponding to the other domain name; performing cache update of the NS record of the other domain name in the trusted NS database based on the received NS record of the other domain name, in the case that the first NS record, the second NS record and the received NS record of the other domain name are consistent.

[0038] Optionally, the method further comprises:

[0039] deleting the any NS record and the corresponding domain name from the trusted NS database, in response to the cache validity period of the any NS record in the trusted NS database being reached, and the domain name corresponding to the any NS record not being in a domain name resolution phase;

[0040] retaining the any NS record until the domain name resolution is completed, in response to the cache validity period of the any NS record in the trusted NS database being reached, and the domain name corresponding to the any NS record being in the domain name resolution phase.

[0041] Optionally, the method further comprises:

[0042] in response to receiving again the domain name resolution request for the domain name to be resolved during resolving the domain name to be resolved, suspending the response to the received again domain name resolution request;

[0043] in response to obtaining the resolution result of the domain name to be resolved, feeding back the domain name resolution result to each user terminal corresponding to the received domain name resolution request for the domain name to be resolved during resolving the domain name to be resolved.

[0044] Optionally, the method further comprises:

[0045] in response to detecting the circularly dependent domain name, performing negative cache processing on the circularly dependent domain name and corresponding NS record based on a negative cache validity period, the circularly dependent domain name being a domain name with a circular authorization problem;

[0046] the response to receiving the domain name resolution request sent by the user terminal, feeding back the domain name resolution result to the user terminal based on the real-time NS record query result and the trusted NS database, comprising:

[0047] in response to receiving the domain name resolution request, and the domain name to be resolved in the domain name resolution request not belonging to the domain name in the negative cache processing, feeding back the domain name resolution result to the user terminal based on the real-time NS record query result and the trusted NS database;

[0048] the method further comprises:

[0049] in response to receiving the domain name resolution request, and the domain name to be resolved in the domain name resolution request belonging to the domain name in the negative cache processing, feeding back domain name resolution error information to the user terminal.

[0050] Another aspect of the embodiments of the present disclosure provides a security enhancement device for domain name resolution, applied to a domain name resolution server, the device comprising:

[0051] an acquisition module, configured to acquire a domain name to be verified in response to reaching a trigger condition of database updating;

[0052] a first verification module, configured to perform authorization information checking on a parent domain server corresponding to the domain name to be verified, and verify whether a first NS record list corresponding to the domain name to be verified is stored in the parent domain server;

[0053] a second verification module, configured to send an NS record query request to a subdomain server recorded in the first NS record list in response to receiving the first NS record list fed back by the parent domain server;

[0054] The first storage module is configured to, in response to receiving the second NS record list fed back by the sub-domain server, compare the first NS record list with the second NS record list, store NS records inconsistent between the first NS record list and the second NS record list and the to-be-verified domain name in an invalid NS list, and store NS records consistent between the first NS record list and the second NS record list and the to-be-verified domain name in a trusted NS database.

[0055] The parsing module is configured to, in response to receiving a domain name resolution request sent by a user terminal, feed back a domain name resolution result to the user terminal based on real-time NS record query results and the trusted NS database.

[0056] In another aspect of the embodiments of the present disclosure, an electronic device is provided, comprising:

[0057] The memory is configured to store a computer program.

[0058] The processor is configured to execute the computer program stored in the memory, and when the computer program is executed, the method in the above aspect is implemented.

[0059] In another aspect of the embodiments of the present disclosure, a computer readable storage medium is provided, which stores a computer program, and when the computer program is executed by a processor, the method in the above aspect is implemented.

[0060] In another aspect of the embodiments of the present disclosure, a computer program is provided, which comprises computer program instructions, and when the computer program instructions are executed by a processor, the method in the above aspect is implemented.

[0061] Based on the embodiments of the present disclosure, whether the first NS record list corresponding to the to-be-verified domain name exists is queried from the parent domain server to verify the validity of the parent domain authorization of the to-be-verified domain name, and then the second NS record corresponding to the to-be-verified domain name is queried from the sub-domain server indicated by the first NS record, and by comparing the first NS record with the second NS record, whether the NS record of the to-be-verified domain name is trusted is determined. Based on the strict data verification process, a local trusted NS database is constructed to provide a technical basis for real-time domain name resolution, and the domain name resolution result is returned to the user terminal in combination with the trusted NS record and the real-time NS record query result, which can maximize the accuracy of domain name resolution and effectively reduce the abnormal domain name resolution and network attack phenomena such as domain name attack, resolution hijacking, denial of service attack, and the like caused by conflict authorization, invalid authorization, and cyclic authorization.

[0062] The technical solutions of the present disclosure are described in further detail below with reference to the drawings and embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0063] The accompanying drawings, which form part of this specification, illustrate embodiments of this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0064] This disclosure will become clearer with reference to the accompanying drawings and the following detailed description, wherein:

[0065] Figure 1 A schematic diagram illustrating conflicting licenses, invalid licenses, and circular licenses, provided as an exemplary embodiment of this disclosure;

[0066] Figure 2 A flowchart of one embodiment of the security enhancement method for domain name resolution disclosed herein;

[0067] Figure 3 A flowchart for updating a trusted NS database and an invalid NS list, provided as an exemplary embodiment of this disclosure;

[0068] Figure 4 A flowchart of another embodiment of the security enhancement method for domain name resolution disclosed herein;

[0069] Figure 5 A flowchart of a domain name resolution process provided as an exemplary embodiment of this disclosure;

[0070] Figure 6 This is a schematic diagram illustrating a security enhancement strategy architecture for domain name resolution, provided as an exemplary embodiment of this disclosure.

[0071] Figure 7 This is a schematic diagram of the structure of one embodiment of the security enhancement device for domain name resolution disclosed herein;

[0072] Figure 8 This is a schematic diagram of another embodiment of the security enhancement device for domain name resolution disclosed herein;

[0073] Figure 9 This is a schematic diagram of the structure of an application embodiment of the electronic device disclosed herein. Detailed Implementation

[0074] Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present disclosure.

[0075] Those skilled in the art will understand that the terms "first," "second," etc., in the embodiments of this disclosure are only used to distinguish different steps, devices, or modules, and do not represent any specific technical meaning, nor do they indicate a necessary logical order between them.

[0076] It should also be understood that, in the embodiments of the present disclosure, "multiple" can refer to two or more, and "at least one" can refer to one, two or more.

[0077] It should also be understood that, for any component, data or structure mentioned in the embodiments of the present disclosure, one or more can be generally understood without explicit limitation or in the context of the opposite implications given by the preceding and following texts.

[0078] In addition, the term "and / or" in the present disclosure is only a description of the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B can mean that A exists alone, A and B exist together, and B exists alone. In addition, the character " / " in the present disclosure generally represents that the front and rear associated objects are in an "or" relationship.

[0079] It should also be understood that the description of the embodiments of the present disclosure emphasizes the differences between the embodiments, and the same or similar parts can be referred to each other, and for the sake of brevity, they will not be repeated.

[0080] At the same time, it should be understood that, for the convenience of description, the size of each part shown in the drawings is not drawn according to the actual proportional relationship.

[0081] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present disclosure, its application or uses.

[0082] The techniques, methods, and devices known to those of ordinary skill in the relevant art can not be discussed in detail, but in appropriate cases, the techniques, methods, and devices should be considered as part of the specification.

[0083] It should be noted that: similar numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further discussed in the subsequent drawings.

[0084] As a core component of the Internet infrastructure, the security and reliability of the DNS system directly affect the stable operation of the entire network. The domain name authorization mechanism builds a hierarchical system with "parent domain - subdomain" as the basic structure. Usually, the parent domain and the subdomain are managed by different organizations, but they share the same information of the authoritative server, i.e. NS record. The RFC1034 standard requires that the NS records of the parent domain and the subdomain should be consistent, but in the actual situation, there are several abnormal domain name authorization relationships. These abnormal authorization relationships not only affect the stability of the domain name system, but also bring security risks.

[0085] The current domain name authorization system faces multiple challenges, mainly in three aspects: first, conflict authorization (such as Figure 1a, the NS record of the parent domain authorizes the subdomain server with domain name ef.abcd.cn, and the NS record of the subdomain authorizes the subdomain server with domain name gh.abcd.cn), refers to that, after the update of the subdomain authorization record, due to the high complexity of the parent domain zone file maintenance, the laziness of the subdomain operator, and the like, the NS records of the parent domain and the subdomain are inconsistent. The conflict authorization can induce a domain name attack (an attacker induces a domain name to remain in a resolving state for a long time by manipulating the cache record of a domain name server) or a resolving hijacking risk. Two is invalid authorization (for example Figure 1 b, the domain name gh.abcd.cn expires or does not exist), refers to that the authorization relationship of the domain name points to an invalid resource record. The invalid authorization can cause resolving abnormity, even domain name hijacking, and further induce risks such as email fraud and Secure Socket Layer (SSL) certificate forgery. Three is circular authorization (for example Figure 1 c, the domain name abcd.cn authorizes the server with domain name gh.abcd.cn, the domain name gh.abcd.cn authorizes the server with domain name ef.abcd.cn, and the domain name ef.abcd.cn authorizes the server with domain name abcd.cn), refers to that the domain name authorization dependency forms a loop, and there is a denial of service attack risk. The TsuNAME attack can be induced by using the circular authorization, the attack traffic can be continuously amplified, the resources of the opposite end server are exhausted, and thus the denial of service attack is caused.

[0086] The mainstream domain name security enhancement technologies currently adopted by the Internet security community, such as the randomization scheme in the domain name protocol interaction (for example, source port randomization and session identifier randomization), the encrypted domain name extension protocol and mechanism (for example, DNSSEC, DoT, and DoH), and the like, are not applicable to solving the security risks caused by the domain name authorization mechanism. Most of the schemes or suggestions for security enhancement of the domain name authorization mechanism can only solve one type of abnormal risk, and some of the solutions consume a large amount of performance of the recursive resolving server or the authoritative resolving server.

[0087] Therefore, the present disclosure provides a general and lightweight security enhancement method for domain name resolving, which aims to build a local trusted NS database, combine the real-time NS record query result of the domain name, and deploy and implement the method on the recursive resolving server under the premise of maintaining compatibility with the current DNS protocol and not needing to modify the DNS protocol and the basic settings. The method not only guarantees the principles of compatibility and low-cost deployment, but also can comprehensively and effectively cope with the security threats caused by various authorization problems, has a small impact on the domain name resolving performance, and effectively improves the security and reliability of the domain name authorization and resolving mechanism.

[0088] Figure 2A flowchart of a method for security enhancement of domain name resolution is provided for an exemplary embodiment of the present disclosure. The method for security enhancement of domain name resolution of the present embodiment can be implemented by a recursive resolution server in a domain name system. As shown in Figure 2 the method comprises the following steps:

[0089] Step 201, in response to reaching a trigger condition for database update, obtaining a domain name to be verified.

[0090] In a possible implementation, the recursive resolution server is pre-configured with a trigger condition for triggering database update. When the trigger condition is reached, the domain name to be verified is obtained and the following steps 202 to 204 are performed to update the trusted NS database. The trusted NS database is used to store domain names that are confirmed to be problem-free after verification, and corresponding NS records and Internet Protocol Addresses (IP addresses).

[0091] Illustratively, one or more trigger conditions can be set. Optionally, the trigger condition can be reaching a starting time of a preset database update period, and the domain name to be verified is a domain name in the trusted NS database and a domain name in the invalid NS list. The trigger condition can also be receiving a domain name resolution request sent by a user terminal for a domain name for the first time, and the domain name is the domain name to be verified.

[0092] Step 202, performing authorization information verification on a parent domain server corresponding to the domain name to be verified, and verifying whether the first NS record list corresponding to the domain name to be verified is stored in the parent domain server.

[0093] After obtaining the domain name to be verified, the validity of the authorization of the parent domain is first checked. Normally, when a domain name is authorized by a subdomain server of a parent domain server, the corresponding parent domain server should store the NS record list (i.e. the first NS record list) corresponding to the domain name, which includes the subdomain name, the IP address of at least one subdomain server, and other information. Therefore, an NS record query request is sent to the parent domain server corresponding to the domain name to be verified, and whether the first NS record list corresponding to the domain name to be verified is stored in the parent domain server is verified by checking whether the first NS record is fed back by the parent domain server. Optionally, the IP address of the parent domain server can be queried through the root domain server or the top-level domain server corresponding to the domain name to be verified, so as to perform authorization information verification on the parent domain server.

[0094] Step 203, in response to receiving the first NS record list fed back by the parent domain server, sending an NS record query request to the subdomain server recorded in the first NS record list.

[0095] If the first NS record list fed back by the parent domain server is received, it is proved that the parent domain authorization of the domain name exists, and then the NS record list (hereinafter referred to as the second NS record list) in the child domain server is acquired, and the authorization record in the child domain server is further queried. Optionally, the NS record query request can be sent to the child domain server through the IP address of the child domain server recorded in the first NS record list.

[0096] In step 204, in response to receiving the second NS record list fed back by the child domain server, the first NS record list and the second NS record list are compared, and the NS records consistent in the first NS record list and the second NS record list are stored in association with the domain name to be verified in the trusted NS database.

[0097] In response to receiving the second NS record list fed back by the child domain server, the first NS record list and the second NS record list are further compared. Normally, the first NS record list and the second NS record list should be consistent, and if the first NS record list and the second NS record list are inconsistent, there may be problems such as conflicting authorization, circular authorization, etc. Therefore, for the NS records consistent in the first NS record list and the second NS record list, the NS records can be stored in association with the corresponding domain name to be verified in the trusted NS database.

[0098] Optionally, an invalid NS list can also be set, which is used to store the domain name and its corresponding NS record that do not pass the verification, i.e. the domain name and its corresponding NS record that may have problems such as conflicting authorization, invalid authorization or circular authorization. The NS records inconsistent in the first NS record list and the second NS record list and the corresponding domain name to be verified can be stored in association in the invalid NS list.

[0099] Optionally, for the domain name to be verified in the trusted NS database, the domain name can be directly resolved based on the corresponding NS record to obtain the corresponding IP address and store it in association.

[0100] In step 205, in response to receiving the domain name resolution request sent by the user terminal, the domain name resolution result is fed back to the user terminal based on the real-time NS record query result and the trusted NS database.

[0101] In one possible implementation, upon receiving a domain name resolution request from a user terminal, a domain name resolution process is executed for the domain name to be resolved in the request. First, a real-time NS record query result is obtained. Then, combining the real-time NS record query result with a trusted NS database, a domain name resolution result is returned to the user terminal. For example, the real-time NS record query result includes the NS record of the domain name to be resolved. If the real-time NS record query result matches the NS record of the domain name to be resolved in the trusted NS database, the real-time NS record query result is returned to the user terminal. If the real-time NS record query result does not match the NS record of the domain name to be resolved in the trusted NS database, the IP address of the domain name to be resolved in the trusted NS database is returned to the user terminal, or a message indicating an error in the resolution result is returned to the user terminal.

[0102] Optionally, the real-time domain name resolution process may generally include: based on the root domain of the domain name to be resolved, sending a parent domain query request for the domain name to be resolved to the root domain server, obtaining the NS record returned by the root domain server; based on the IP address of the parent domain server recorded in the NS record returned by the root domain server, sending a subdomain query request for the domain name to be resolved to the parent domain server, obtaining the NS record returned by the parent domain server; based on the IP address of the subdomain server recorded in the NS record returned by the parent domain server, sending an IP address query request for the domain name to be resolved to the subdomain server, obtaining the NS record returned by the subdomain server and the IP address of the authoritative server; continuing to send an IP address query request for the domain name to be resolved to the authoritative server, until an IP address returned by an authoritative server is obtained.

[0103] Based on the embodiments of this disclosure, the validity of the parent domain authorization of the domain to be verified is verified by querying the parent domain server to see if there is a list of first NS records corresponding to the domain to be verified. Then, the second NS record corresponding to the domain to be verified is queried from the subdomain server indicated by the first NS record. By comparing the first NS record and the second NS record, it is determined whether the NS record of the domain to be verified is trustworthy. Based on a strict data verification process, a local trusted NS database is constructed, and domains and NS records that fail verification are stored in an invalid NS list, providing a technical foundation for real-time domain name resolution. By combining the trusted NS record and the real-time NS record query results, the domain name resolution results are returned to the user terminal, which can maximize the accuracy of domain name resolution and effectively reduce domain name attack, resolution hijacking, denial-of-service attack and other domain name resolution anomalies and network attacks caused by problems such as conflicting authorization, invalid authorization, and circular authorization.

[0104] In a possible implementation, after comparing the first NS record list and the second NS record list, the consistent NS records can be further verified to ensure the reliability of the NS records in the trusted NS database. The step 204 of "storing the consistent NS records in the first NS record list and the second NS record list and the domain name to be verified into the trusted NS database" can specifically include the following steps:

[0105] The consistent NS records are verified for trustworthiness, and the NS records that pass the verification and the domain name to be verified are stored into the trusted NS database.

[0106] The trustworthiness verification manner includes at least one of the following manners:

[0107] In response to the DNSSEC mechanism being set for the domain name to be verified, the DNSSEC verification is performed on the consistent NS records.

[0108] Based on the subdomain server domain name in the consistent NS records, it is verified whether the parent domain in the subdomain server domain name exists.

[0109] That is, for the consistent NS records in the first NS record list and the second NS record list, at least one of the signature verification and the validity verification can be performed. The signature verification refers to verifying the DNSSEC signature if the DNSSEC mechanism is set for the domain name to be verified, and the consistent NS records fail the trustworthiness verification if the verification fails. The validity verification refers to verifying the domain name of the subdomain server recorded in the consistent NS records, and judging whether the parent domain name in the domain name exists, and the consistent NS records fail the trustworthiness verification if the parent domain name does not exist. For example, the domain name query protocol (WHOIS) can be used to query whether the parent domain name of the subdomain server exists.

[0110] In a possible implementation, for the NS records and the domain name to be verified that do not meet the requirements of the trusted NS database, the invalid NS list can be added. The method for enhancing the security of domain name resolution provided by the embodiments of the present disclosure can further include the following steps.

[0111] For the inconsistent NS records in the first NS record list and the second NS record list, the NS record query request is sent to the subdomain server recorded in the inconsistent NS records.

[0112] In response to receiving the third NS record list fed back by the subdomain server recorded in the inconsistent NS records, the inconsistent NS records and the domain name to be verified and the IP address corresponding to the domain name to be verified are stored into the trusted NS database.

[0113] In response to not receiving the response of the subdomain server recorded in the inconsistent NS records, the inconsistent NS records and the domain name to be verified are stored into the invalid NS list.

[0114] In response to not receiving the response of the parent domain server, the domain name to be verified is stored in the invalid NS list;

[0115] The consistent NS record that fails the credibility verification and the domain name to be verified are stored in the invalid NS list.

[0116] If the response of the parent domain server is not received, the parent domain authorization of the domain name to be verified may not exist, so the domain name to be verified is added to the invalid NS list, so that the domain name that may have invalid authorization can be screened out. For the inconsistent NS records in the first NS record list and the second NS record list, there may be a case that the parent domain server does not update the NS record in time, so the child domain server recorded in the inconsistent NS record can be actively queried to obtain the latest and complete NS record list. For the child domain server that cannot obtain the response, the NS record corresponding to the child domain server and the domain name to be verified are stored in the invalid NS list. The inconsistent NS records in the first NS record list and the second NS record list refer to the NS record existing in the first NS record list but not existing in the second NS record list, or the NS record not existing in the first NS record list but existing in the second NS record list. Through the verification, the NS record that may have conflict authorization and circular authorization can be screened out.

[0117] In combination with the above embodiments, Figure 3 A flow chart for updating the trusted NS database and the invalid NS list is shown. As Figure 3 shown, after obtaining the domain name to be verified, the main process of data updating includes:

[0118] At step 301, the subdomain authorization record is obtained from the parent domain server. At step 302, it is determined whether the subdomain authorization exists. If yes, the step 303 is executed; if no, the step 312 is executed, and the domain name to be verified is stored in the invalid NS list. At step 303, the active query is initiated to the subdomain server. At step 304, it is determined whether the response of the subdomain server is obtained. If yes, the step 305 is executed; if no, the step 312 is executed, and the NS record corresponding to the subdomain server and the domain name to be verified are stored in the invalid NS list. At step 305, the difference set (i.e., the inconsistent NS record) of the first NS record list and the second NS record list is extracted, and the active query is sent to the subdomain server in the difference set NS list. At step 306, it is determined whether the response of the subdomain server is obtained. If yes, the step 307 is executed; if no, the step 312 is executed. At step 307, it is determined whether the DNSSEC verification is successful. If yes, the step 308 is executed; if no, the step 312 is executed. At step 308, it is determined whether the parent domain name of the subdomain server exists. If yes, the step 309 is executed; if no, the step 312 is executed. At step 309, it is determined whether the parent domain name of the subdomain server exists. If yes, the step 310 is executed, and the glue record (including IP address and other information) is extracted from the authority server corresponding to the NS record. At step 311, the trusted NS database is updated. At step 312, the invalid NS list is updated.

[0119] In a possible implementation, the trigger condition comprises at least one of the following: reaching the starting moment of a preset update period, first receiving a domain name resolution request for the target domain name, and the invalid NS list having a newly added invalid domain name.

[0120] wherein,

[0121] When the trigger condition comprises reaching the starting moment of a preset update period, the domain name to be verified comprises the domain name in the trusted NS database and the domain name in the invalid NS list. Illustratively, the preset update period is 24 hours, and then the iterative resolution server re-performs the NS information verification for the domain name in the trusted NS database and the domain name in the invalid NS list every 24 hours.

[0122] When the trigger condition comprises first receiving a domain name resolution request for the target domain name, the domain name to be verified comprises the target domain name. Optionally, when the domain name resolution request for the target domain name sent by the user terminal is received, if the target domain name is not stored in the trusted NS database and the invalid NS list, it is determined that the domain name resolution request for the target domain name is first received.

[0123] When the trigger condition comprises the existence of the newly added invalid domain name in the invalid NS list, the domain name to be verified comprises the newly added invalid domain name. The newly added invalid domain name refers to a domain name newly added in the invalid NS list after the last update compared with the invalid NS list after the last previous update.

[0124] In a possible implementation, the trusted NS database constructed by using the above process can be used to perform data verification on the resolution result, such as Figure 4 As shown in FIG. 5, the step 205 can specifically comprise the following steps.

[0125] At step 401, in response to receiving the domain name resolution request sent by the user terminal, NS record query is performed on the parent domain server and the subdomain server corresponding to the domain name to be resolved in the domain name resolution request, and real-time NS record query results are obtained.

[0126] Optionally, the real-time resolution process of the domain name can generally comprise the following steps: based on the root domain of the domain name to be resolved, a parent domain query request of the domain name to be resolved is sent to the root domain server, NS records fed back by the root domain server are obtained, based on the IP address of the parent domain server recorded in the NS records fed back by the root domain server, a subdomain query request of the domain name to be resolved is sent to the parent domain server, NS records fed back by the parent domain server are obtained, based on the IP address of the subdomain server recorded in the NS records fed back by the parent domain server, an IP address query request of the domain name to be resolved is sent to the subdomain server, NS records fed back by the subdomain server and the IP address of the authorization server are obtained, and the IP address query request of the domain name to be resolved is continuously sent to the authorization server until the IP address fed back by a certain authorization server is obtained. After the NS records fed back by the parent domain server and the subdomain server (i.e., the real-time NS record query results) are obtained, step 403 is performed.

[0127] At step 402, domain name information retrieval is performed based on the trusted NS database, and trusted NS record query results corresponding to the domain name to be resolved are obtained.

[0128] In the trusted NS database, information corresponding to the domain name to be resolved is retrieved, if the NS record corresponding to the domain name to be resolved is retrieved, the NS record is determined as the trusted NS record query result corresponding to the domain name to be resolved, and step 403 or step 404 is performed.

[0129] Optionally, if the trusted NS record query result corresponding to the domain name to be resolved is not retrieved based on the trusted NS database, domain name information retrieval is performed based on the invalid NS list, if the invalid NS record query result corresponding to the domain name to be resolved is obtained, and the real-time NS record query result is consistent with the trusted NS record query result corresponding to the domain name to be resolved in the invalid NS list, prompt information used to represent the domain name resolution anomaly is directly fed back to the user terminal, and the domain name resolution process is stopped.

[0130] Optionally, if the NS record corresponding to the domain name to be resolved is not retrieved through the trusted NS database and the invalid NS list, it is determined that the domain name resolution request of the domain name to be resolved is received for the first time, the real-time NS record query result is fed back to the user terminal, and it is determined that the trigger condition of database updating is reached, the domain name to be resolved is taken as a domain name to be verified, and steps 202 to 204 are executed.

[0131] In step 403, in response to the real-time NS record query result being consistent with the trusted NS record query result, the domain name is resolved based on the real-time NS record query result, and the domain name resolution result is fed back to the user terminal.

[0132] If the real-time NS record query result is consistent with the trusted NS record query result, the credibility of the real-time NS record query result is higher, and the domain name resolution process can be directly continued based on the real-time NS record query result to obtain the domain name resolution result.

[0133] In step 404, in response to the real-time NS record query result being inconsistent with the trusted NS record query result, the domain name is resolved based on the trusted NS record query result, the domain name resolution result is fed back to the user terminal, and it is determined that the trigger condition of database updating is reached, and the domain name to be verified is the domain name to be resolved.

[0134] If the real-time NS record query result is inconsistent with the trusted NS record query result, that is, the NS record of the domain name to be resolved changes, but at this time, the credibility of the NS record (that is, the real-time NS record query result) obtained in real time cannot be determined, therefore, for this domain name resolution request, the domain name is resolved based on the trusted NS record query result, the domain name resolution result is fed back to the user terminal, or the IP address associated with the domain name to be resolved and stored in the trusted NS database is directly fed back to the user terminal. At the same time, a parallel data verification process is triggered in the background, that is, it is determined that the trigger condition of database updating is reached, the domain name to be resolved is determined as the domain name to be verified, and steps 202 to 204 are executed.

[0135] Optionally, the method provided by the embodiments of the present disclosure can further include the following steps:

[0136] In response to the real-time NS record query result being inconsistent with the trusted NS record query result, the domain name information is retrieved based on the invalid NS list, if the invalid NS record query result corresponding to the domain name to be resolved is obtained, if the real-time NS record query result is consistent with the invalid NS record query corresponding to the domain name to be resolved in the invalid NS list, the prompt information for indicating that the domain name resolution is abnormal is fed back to the user terminal.

[0137] Illustratively, Figure 5A flow chart of a domain name resolution process is shown. The process mainly includes the following steps: step 501, receiving a domain name resolution request. Step 502, obtaining a real-time NS record query result. Step 503, obtaining a trusted NS record query result. Step 504, determining whether the two results are consistent; if yes, executing step 505, otherwise executing step 506 and step 507 in parallel. Step 505, maintaining domain name resolution logic, obtaining a domain name resolution result. Step 506, obtaining a domain name resolution result based on a trusted NS database. Step 507, starting a delay verification, determining whether a trigger condition of database updating is reached. Step 508, feeding back a domain name resolution result.

[0138] Based on the embodiments of the present disclosure, domain name resolution is performed based on trusted cache and delay verification. When receiving a domain name resolution request, real-time query is first performed, and the query result is compared with authorized data stored in the trusted library. If the two are consistent, the original resolution logic is maintained to ensure the stability and efficiency of the resolution process. When the real-time query result is inconsistent with the data in the trusted library, the data stored in the trusted resolution library is preferentially returned, and a delay verification task is started to trigger a parallel trusted resolution data re-verification logic in the background, obtain the latest authorized data for verification, and update the trusted NS database.

[0139] In a possible implementation, if NS records (or Glue records) sent by the authoritative segment and the additional segment are received when other information is queried, the information in the trusted NS database is overwritten according to the corresponding configuration strategy. The method provided by the embodiments of the present disclosure can further include the following steps:

[0140] In response to receiving NS records of other domain names in the process of querying NS records of the domain name to be verified, and the NS records of the other domain names are stored in the trusted NS database, the trusted NS database is updated based on a record overwriting strategy.

[0141] The record overwriting strategy includes one of the following:

[0142] A peer overwriting strategy: in response to the level of the received NS records of the other domain names being the same as or lower than the level of the NS records of the other domain names in the trusted NS database, the cache overwriting of the NS records of the other domain names in the trusted NS database is prohibited. That is, if the NS records of a certain domain name are received in the process of querying the NS records of the other domain names, and the level of the received NS records is the same as the level of the NS records of the domain name in the trusted NS database, the cache overwriting is prohibited directly, which can prevent attack behaviors such as domain name attacks. Optionally, the level of the NS records can be set by the parent domain server in advance.

[0143] Conditional coverage policy: in response to the level of the received NS record of the other domain name being the same as or higher than the level of the NS record of the other domain name in the trusted NS database, the NS record of the other domain name in the trusted NS database is cached and covered based on the received NS record of the other domain name, and the cache validity period of the NS record of the other domain name in the trusted NS database is not changed. That is, cache coverage is allowed when the same level or higher level NS record is received, but the cache validity period, i.e. the Time To Live (TTL) value, of the NS record is not updated to reduce the risk of malicious update. Correspondingly, the NS record of a low level is directly ignored.

[0144] Strict mode coverage policy: confirming that the trigger condition of database update is reached, the authorization information of the parent domain server corresponding to the other domain name is checked; in the case that the first NS record, the second NS record and the received NS record of the other domain name are consistent, the NS record of the other domain name in the trusted NS database is cached and covered based on the received NS record of the other domain name.

[0145] The recursive resolution server can be pre-configured with the at least one record coverage policy.

[0146] In a possible implementation, the data in the trusted NS database are all provided with corresponding cache validity periods, and when the cache validity period of a NS record is reached, the recursive resolution server will delete the NS record, and the method provided by the embodiment of the disclosure can further include the following steps:

[0147] In response to the cache validity period of any NS record in the trusted NS database being reached and the domain name corresponding to the NS record not being in the domain name resolution stage, the NS record and the corresponding domain name are deleted from the trusted NS database;

[0148] In response to the cache validity period of any NS record in the trusted NS database being reached and the domain name corresponding to the NS record being in the domain name resolution stage, the NS record is retained until the domain name resolution is completed.

[0149] In order to ensure the consistency and security of the cache operation, the recursive resolution server takes preventive measures when deleting the cached NS record. Specifically, it should be ensured that the records (such as NS records, Glue records) required for the current query process will not be deleted. This synchronization mechanism can prevent inconsistent data during the domain name resolution process, effectively prevent new domain name attacks, and thus improve the reliability of domain name resolution.

[0150] In a possible implementation, the recursive resolution server adopts a resolution security enhancement strategy to avoid repeated requests, and the method provided by the embodiment of the disclosure further includes the following steps.

[0151] In response to receiving again a domain name resolution request for the domain name to be resolved during the resolution of the domain name to be resolved, suspending the response to the received again domain name resolution request;

[0152] In response to obtaining the domain name resolution result of the domain name to be resolved, feeding back the domain name resolution result to each user terminal corresponding to the domain name resolution request for the domain name to be resolved received during the resolution of the domain name to be resolved.

[0153] In order to improve efficiency and reduce unnecessary network load, the recursive resolution server takes measures to avoid initiating repeated query operations when processing resolution requests for the same domain name, which can effectively prevent Distributed Denial of Service (DDOS) attacks using circular authorization. Specifically, when the recursive resolution server is processing a query for a certain domain name or record, if the same query request is received during this period, a new query will not be initiated immediately, but will wait until the first query is completed, and then directly use the result to respond to the subsequent request.

[0154] In a possible implementation, for the domain name with a circular authorization problem, a negative cache method can be used to avoid entering a dead loop of information query, and the method provided by the embodiment of the disclosure further includes the following steps:

[0155] In response to detecting the circular dependency domain name, performing negative cache processing on the circular dependency domain name and the corresponding NS record based on a negative cache validity period, the circular dependency domain name being a domain name with a circular authorization problem.

[0156] Correspondingly, the step 205 includes:

[0157] In response to receiving the domain name resolution request, and the domain name to be resolved in the domain name resolution request not belonging to the domain name in the negative cache processing, feeding back a domain name resolution result to the user terminal based on a real-time NS record query result and a trusted NS database.

[0158] The method provided by the embodiment of the disclosure further includes the following steps:

[0159] In response to receiving the domain name resolution request, and the domain name to be resolved in the domain name resolution request belonging to the domain name in the negative cache processing, feeding back domain name resolution error information to the user terminal.

[0160] Optionally, a pre-set cyclic dependency domain name detection method can be used to perform cyclic authorization detection on the domain name to be verified during the execution of the above steps 202 to 204. For example, the cyclic dependency domain name detection method can include a visual trust graph method, a traceback checking method, and a method using static code analysis tools such as Checkov and Terrascan. Negative cache processing is implemented on the detected cyclic dependency domain name, which can avoid entering a dead loop repeatedly in subsequent query processes, thereby improving domain name resolution efficiency and preventing potential denial of service attacks.

[0161] In combination with the above embodiments, Figure 6 A schematic diagram of a strategy architecture of a security enhancement method for domain name resolution is shown. As Figure 6 shown, by constructing a trusted NS database, when performing domain name resolution, the real-time NS record query result is verified in combination with the trusted NS records and trusted Glue records cached in the trusted NS database, and for the real-time NS record query result inconsistent with the trusted Glue records, delay verification is simultaneously started. Moreover, by setting additional authorization record processing, cache operation time synchronization, avoiding repeated requests, and negative cache mechanism, etc., all-round and multi-level domain name resolution security measures are implemented, which can comprehensively improve the security and reliability of domain name authorization and resolution mechanism.

[0162] Please refer to Figure 7 which shows a structural block diagram of a security enhancement device for domain name resolution provided by one exemplary embodiment of the present disclosure. The security enhancement device for domain name resolution is applied to a domain name resolution server, and the security enhancement device for domain name resolution provided by the embodiment includes:

[0163] The acquisition module 701 is configured to acquire a domain name to be verified in response to reaching a trigger condition of database update;

[0164] The first verification module 702 is configured to perform authorization information verification on a parent domain server corresponding to the domain name to be verified acquired by the acquisition module 701, and verify whether a first NS record list corresponding to the domain name to be verified is stored in the parent domain server;

[0165] The second verification module 703 is configured to send an NS record query request to a subdomain server recorded in the first NS record list in response to receiving the first NS record list fed back by the parent domain server;

[0166] The first storage module 704 is configured to compare the first NS record list with a second NS record list in response to receiving the second NS record list fed back by the subdomain server, and store the NS records consistent in the first NS record list and the second NS record list and the domain name to be verified in a trusted NS database;

[0167] The analysis module 705 is configured to, in response to receiving the domain name resolution request sent by the user terminal, feed back the domain name resolution result to the user terminal based on the real-time NS record query result and the trusted NS database.

[0168] Optionally, in a possible implementation, the first storage module 704 is further configured to:

[0169] The consistent NS record is subjected to the trustworthiness verification, and the NS record that passes the verification and the domain name to be verified are stored in the trusted NS database.

[0170] The trustworthiness verification manner includes at least one of the following manners:

[0171] In response to the DNSSEC mechanism being set for the domain name to be verified, the DNSSEC verification is performed on the consistent NS record.

[0172] Based on the subdomain server domain name in the consistent NS record, it is verified whether the parent domain in the subdomain server domain name exists.

[0173] Optionally, in a possible implementation, as shown in Figure 8 The security enhancement apparatus for domain name resolution provided by the embodiments of the present disclosure can further include:

[0174] The sending module 801 is configured to, for the inconsistent NS record in the first NS record list and the second NS record list, send an NS record query request to the subdomain server recorded in the inconsistent NS record.

[0175] The second storage module 802 is configured to, in response to receiving the third NS record list fed back by the subdomain server recorded in the inconsistent NS record, store the domain name to be verified and the IP address corresponding to the domain name to be verified in the trusted NS database.

[0176] The third storage module 803 is configured to, in response to not receiving the response of the subdomain server recorded in the inconsistent NS record, store the inconsistent NS record and the domain name to be verified in the invalid NS list.

[0177] The fourth storage module 804 is configured to, in response to not receiving the response of the parent domain server, store the domain name to be verified in the invalid NS list.

[0178] The fifth storage module 805 is configured to store the inconsistent NS record that does not pass the trustworthiness verification and the domain name to be verified in the invalid NS list.

[0179] Optionally, in a possible implementation, the trigger condition comprises at least one of the following: reaching a starting moment of a preset update period, first receiving a domain name resolution request for the target domain name, and existence of a newly added invalid domain name in the invalid NS list;

[0180] wherein,

[0181] When the trigger condition comprises reaching the starting moment of the preset update period, the domain name to be verified comprises a domain name in the trusted NS database and a domain name in the invalid NS list;

[0182] When the trigger condition comprises first receiving the domain name resolution request for the target domain name, the domain name to be verified comprises the target domain name;

[0183] When the trigger condition comprises existence of the newly added invalid domain name in the invalid NS list, the domain name to be verified comprises the newly added invalid domain name.

[0184] Optionally, in a possible implementation, the resolution module 705 is further configured to:

[0185] In response to receiving the domain name resolution request sent by the user terminal, performing NS record query on a parent domain server and a child domain server corresponding to the domain name to be resolved in the domain name resolution request to obtain a real-time NS record query result;

[0186] Performing domain name information retrieval based on the trusted NS database to obtain a trusted NS record query result corresponding to the domain name to be resolved;

[0187] In response to the real-time NS record query result being consistent with the trusted NS record query result, performing domain name resolution based on the real-time NS record query result and feeding back a domain name resolution result to the user terminal;

[0188] In response to the real-time NS record query result being inconsistent with the trusted NS record query result, performing domain name resolution based on the trusted NS record query result, feeding back the domain name resolution result to the user terminal, and determining that the trigger condition of database update is reached, and the domain name to be verified is the domain name to be resolved.

[0189] Optionally, in a possible implementation, the security enhancement apparatus for domain name resolution provided by the embodiment of the present disclosure can further comprise:

[0190] The cache coverage module is configured to, in response to receiving NS records of other domain names in the process of querying NS records of the domain name to be verified, and the trusted NS database storing the NS records of the other domain names, updating the trusted NS database based on a record coverage policy;

[0191] The record coverage policy comprises one of the following:

[0192] in response to the level of the received NS record of the other domain name being the same as or lower than the level of the NS record of the other domain name in the trusted NS database, prohibiting cache override of the NS record of the other domain name in the trusted NS database;

[0193] in response to the level of the received NS record of the other domain name being the same as or higher than the level of the NS record of the other domain name in the trusted NS database, performing cache override of the NS record of the other domain name in the trusted NS database based on the received NS record of the other domain name, and without changing the cache validity period of the NS record of the other domain name in the trusted NS database;

[0194] confirming that the trigger condition for database update is reached, and performing authorization information verification on the parent domain server corresponding to the other domain name; in a case where the first NS record and the second NS record of the other domain name are consistent with the received NS record of the other domain name, performing cache override of the NS record of the other domain name in the trusted NS database based on the received NS record of the other domain name.

[0195] Optionally, in a possible implementation, the security enhancement apparatus for domain name resolution provided by the embodiments of the present disclosure can further include:

[0196] a first clearing module configured to, in response to the cache validity period of any NS record in the trusted NS database being reached and the domain name corresponding to the any NS record not being in a domain name resolution phase, delete the any NS record and the corresponding domain name from the trusted NS database;

[0197] a second clearing module configured to, in response to the cache validity period of any NS record in the trusted NS database being reached and the domain name corresponding to the any NS record being in a domain name resolution phase, keep the any NS record until the domain name resolution is completed.

[0198] Optionally, in a possible implementation, the security enhancement apparatus for domain name resolution provided by the embodiments of the present disclosure can further include a repeated resolution module configured to:

[0199] in response to receiving again a domain name resolution request for the domain name to be resolved during resolution of the domain name to be resolved, suspending response to the received again domain name resolution request;

[0200] in response to obtaining a resolution result of the domain name to be resolved, feeding back the domain name resolution result to each user terminal corresponding to the received domain name resolution request for the domain name to be resolved during resolution of the domain name to be resolved.

[0201] Optionally, in a possible implementation, the security enhancement apparatus for domain name resolution provided by the embodiments of the present disclosure can further include a negative cache module, configured to:

[0202] in response to detecting the circularly dependent domain name, performing negative cache processing on the circularly dependent domain name and corresponding NS records based on a negative cache validity period, the circularly dependent domain name being a domain name with a circular authorization problem;

[0203] The resolving module 705 is further configured to:

[0204] in response to receiving the domain name resolution request and the domain name to be resolved in the domain name resolution request not being in the domain names in the negative cache processing, feeding back a domain name resolution result to the user terminal based on real-time NS record query results and a trusted NS database;

[0205] in response to receiving the domain name resolution request and the domain name to be resolved in the domain name resolution request being in the domain names in the negative cache processing, feeding back domain name resolution error information to the user terminal.

[0206] Each of the embodiments in the specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. The same, similar or corresponding parts of each embodiment can be mutually referred to. Since the method, device and equipment embodiments are basically corresponding, the relevant parts can be mutually referred to. The method, device and equipment of the embodiments of the present disclosure are also mutually corresponding in specific implementation and beneficial technical effects, and the relevant contents can be mutually referred to.

[0207] In addition, the embodiments of the present disclosure further provide an electronic device, comprising:

[0208] a memory configured to store a computer program;

[0209] a processor configured to execute the computer program stored in the memory, and when the computer program is executed, the security enhancement method for domain name resolution of any one of the embodiments of the present disclosure is implemented.

[0210] Figure 9 is a structural schematic diagram of an application embodiment of the electronic device of the present disclosure. Hereinafter, the electronic device according to the embodiments of the present disclosure will be described with reference to Figure 9 The electronic device can be any one or both of the first device and the second device, or a single device independent of them, which can communicate with the first device and the second device to receive the input signals collected therefrom.

[0211] As shown in Figure 9 The electronic device includes one or more processors and a memory.

[0212] A processor can be a central processing unit (CPU) or other form of processing unit with data processing and / or instruction execution capabilities, and can control other components in an electronic device to perform desired functions.

[0213] The memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and a processor may execute the program instructions to implement the domain name resolution security enhancement methods and / or other desired functions described in the various embodiments of this disclosure above.

[0214] In one example, the electronic device may also include input devices and output devices, which are interconnected via a bus system and / or other forms of connection mechanism (not shown).

[0215] In addition, the input device may include, for example, a keyboard, a mouse, etc.

[0216] This output device can output various information to the outside, including determined distance information, direction information, etc. The output device may include, for example, a display, a speaker, a printer, and a communication network and its connected remote output devices, etc.

[0217] Of course, for the sake of simplicity, Figure 9 Only some of the components of the electronic device relevant to this disclosure are shown, omitting components such as buses, input / output interfaces, etc. In addition, the electronic device may include any other suitable components depending on the specific application.

[0218] In addition to the methods and apparatus described above, embodiments of this disclosure may also be computer program products comprising computer program instructions that, when executed by a processor, cause the processor to perform the steps in the security enhancement methods for domain name resolution according to various embodiments of this disclosure as described in the foregoing portions of this specification.

[0219] The computer program product can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++, or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device or entirely on the remote computing device or server.

[0220] In addition, the embodiments of the present disclosure can also be a computer readable storage medium, which stores computer program instructions, and the computer program instructions make the processor execute the steps of the security enhancement method for domain name resolution according to various embodiments of the present disclosure described in the above part of the specification when the processor runs.

[0221] The computer readable storage medium can take the form of one or more combinations of any type of readable media. The readable media can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination thereof. More specific examples (a non-exhaustive list) of the readable storage medium include an electrical connection having one or more wires, a portable disc, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0222] Those of ordinary skill in the art can understand that all or part of the steps of the above-mentioned method embodiments can be completed by program instruction-related hardware, and the aforementioned program can be stored in a computer readable storage medium, and the program executes the steps of the above-mentioned method embodiments when executed; and the aforementioned storage medium includes ROM, RAM, magnetic disc or optical disc and various storage medium that can store program code.

[0223] The above describes the basic principles of the present disclosure in combination with specific embodiments, but it should be noted that the advantages, advantages, effects and the like mentioned in the present disclosure are only examples and are not limited, and these advantages, advantages, effects and the like cannot be considered as the various embodiments of the present disclosure must have. In addition, the above-mentioned specific details are only for the purpose of example and for the purpose of understanding, and the above-mentioned details do not limit the present disclosure to the above-mentioned specific details.

[0224] The various embodiments described in this specification are intended to be illustrative only and in no way limit the scope of the application. One skilled in the art will readily recognize from the disclosure herein, possible alternative techniques within the scope of the application. Accordingly, the examples are not to be regarded as limiting, but rather are to be understood to be illustrative of the possible aspects of the application. The various embodiments described in this specification are described in the context of a system. As such, the system embodiments are described in relatively greater detail than the method embodiments, with the understanding that the method embodiments are substantially analogous to the system embodiments.

[0225] The block diagrams of devices, apparatuses, equipment, systems referred to in this disclosure are merely illustrative examples and are not intended to require or imply that the connection, arrangement, configuration must be as shown in the block diagrams. These devices, apparatuses, equipment, systems can be connected, arranged, configured in any manner as will be appreciated by those skilled in the art. Words such as "include," "contain," "have," etc. are open-ended words that are to be interpreted to mean "including but not limited to," and are to be interpreted not to exclude items that do not match the description of the word. The words "or" and "and" as used herein are to be interpreted as the word "and / or," and are to be interpreted not to exclude items that do not match the description of the word. The word "such as" as used herein is to be interpreted as the phrase "such as but not limited to," and is to be interpreted not to exclude items that do not match the description of the word.

[0226] The methods and apparatuses of this disclosure can be implemented in a number of ways. For example, the methods and apparatuses of this disclosure can be implemented using software, hardware, firmware, or any combination of these methods and apparatuses. The order of any steps described above is merely exemplary and the steps of the methods of this disclosure need not be performed in the order described unless otherwise specified. Furthermore, in some embodiments, the methods of this disclosure can also be implemented as a program for use with a computer-based system, the program including a machine-readable medium having stored program instructions that, when executed by a machine, cause the machine to perform the methods of this disclosure. Thus, the disclosure also covers a record medium storing the program for performing the methods of this disclosure.

[0227] It is also important to note that the apparatuses, equipment and methods of this disclosure can be embodied in a number of different forms, including but not limited to a data processor, a computer system, a software routine, or a tangible computer-readable storage medium. As will be understood by those familiar with the art, the methods and apparatuses of this disclosure can be embodied in one or more computer-readable storage media having stored thereon, computer-executable instructions and / or data structures that, when executed by or otherwise usable to a computer system, cause the computer system to perform a method of the present disclosure. Examples of computer- readable storage media include, but are not limited to, magnetic disks, magnetic tapes, CD-ROMs, DVDs, Blu-ray discs™, memory cards, and semiconductor memory devices. Computer- executable instructions include, for example, both machine code as created by a compiler and files containing higher-level code that, when executed by a computer, add a computer-executable instruction to a computer such as a file created by a development environment or an interpreter executed by a computer.

[0228] The above description of disclosed aspects is to be construed as illustrative only and not as limiting of the scope of the disclosure. Those skilled in the art will readily recognize variations of the aspects discussed herein that are within the scope of the present disclosure. Accordingly, the disclosure is not intended to be limited to the aspects described herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0229] The foregoing description has been presented for the purposes of illustration and description. Furthermore, the description is not intended to limit the embodiments of the disclosure to the forms disclosed herein. Although the various example aspects and embodiments have been described herein with regard to particular aspects and embodiments, those skilled in the art will recognize that certain modifications, changes, substitutions, additions and sub-combinations can be made without departing from the spirit of the disclosure.

Claims

1. A method for enhancing the security of domain name resolution, characterized in that, Applied to a domain name resolution server, the method includes: In response to the database update trigger condition being met, obtain the domain name to be verified; The authorization information is verified by sending an authorization information verification to the parent domain server corresponding to the domain name to be verified, and verifying whether the parent domain server stores a list of first name server records corresponding to the domain name to be verified. In response to receiving the first name server record list from the parent domain server, a name server record query request is sent to the subdomain server recorded in the first name server record list. In response to receiving the second name server record list from the subdomain server, the first name server record list and the second name server record list are compared, and the name server records that match the first name server record list and the second name server record list, along with the domain name to be verified, are associated and stored in the trusted name server database. In response to receiving a domain name resolution request from a user terminal, the system feeds back the domain name resolution result to the user terminal based on the query results recorded by the real-time name server and the trusted name server database. The step of responding to a domain name resolution request sent by a user terminal, and feeding back the domain name resolution result to the user terminal based on the query results recorded by the real-time name server and the trusted name server database, includes: In response to receiving a domain name resolution request sent by a user terminal, the name server record is queried through the parent domain server and child domain server corresponding to the domain name to be resolved in the domain name resolution request, and the real-time name server record query result is obtained. Based on the trusted name server database, domain name information is retrieved to obtain the trusted name server record query results corresponding to the domain name to be resolved; In response to the consistency between the real-time name server record query result and the trusted name server record query result, domain name resolution is performed based on the real-time name server record query result and the domain name resolution result is fed back to the user terminal; In response to the inconsistency between the real-time name server record query result and the trusted name server record query result, domain name resolution is performed based on the trusted name server record query result, the domain name resolution result is fed back to the user terminal, and it is determined that the triggering condition for database update has been met, wherein the domain name to be verified is the domain name to be resolved.

2. The method according to claim 1, characterized in that, The step of associating and storing the name server records that match the first name server record list and the second name server record list, along with the domain name to be verified, in the trusted name server database includes: The consistency of the name server records is verified for trustworthiness, and the verified name server records and the domain name to be verified are associated and stored in the trusted name server database. The credibility verification method includes at least one of the following: In response to the fact that the domain name to be verified is equipped with the Domain Name System Security Extension (DNS) mechanism, DNS Security Extension verification is performed on the consistent name server record; Based on the subdomain server domain name in the consistent name server record, verify whether the parent domain exists in the subdomain server domain name.

3. The method according to claim 2, characterized in that, The method further includes: For name server records that are inconsistent between the first name server record list and the second name server record list, a name server record query request is sent to the subdomain server recorded in the inconsistent name server record; In response to receiving a third name server record list from the subdomain server recorded in the inconsistent name server record, the inconsistent name server record, the domain name to be verified, and the Internet Protocol address corresponding to the domain name to be verified are associated and stored in the trusted name server database. In response to not receiving a response from the subdomain server recorded in the inconsistent name server record, the inconsistent name server record and the domain name to be verified are associated and stored in the invalid name server list; In response to not receiving a response from the parent domain server, the domain name to be verified is stored in the list of invalid name servers; The consistent name server records that fail the trustworthiness verification, along with the domain name to be verified, are stored in the invalid name server list.

4. The method according to claim 3, characterized in that, The triggering conditions include at least one of the following: reaching the start time of the preset update cycle, receiving a domain name resolution request for the target domain name for the first time, or having a newly added invalid domain name in the invalid name server list; in, When the triggering condition includes reaching the start time of the preset update cycle, the domain name to be verified includes domain names in the trusted name server database and domain names in the invalid name server list; When the triggering condition includes receiving a domain name resolution request for the target domain name for the first time, the domain name to be verified includes the target domain name; When the triggering condition includes the existence of a newly added invalid domain name in the list of invalid name servers, the domain name to be verified includes the newly added invalid domain name.

5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: In response to receiving name server records of other domains during the process of querying the name server records of the domain to be verified, and the trusted name server database stores the name server records of the other domains, the trusted name server database is updated based on the record overwrite policy. The record overwrite strategy includes one of the following: In response to the fact that the level of the received name server record of the other domain name is the same as the level of the name server record of the other domain name in the trusted name server database, or the level of the received name server record of the other domain name is lower than the level of the name server record of the other domain name in the trusted name server database, caching overwriting of the name server record of the other domain name in the trusted name server database is prohibited. In response to the fact that the level of the received name server record of the other domain name is the same as the level of the name server record of the other domain name in the trusted name server database, or the level of the received name server record of the other domain name is higher than the level of the name server record of the other domain name in the trusted name server database, the name server record of the other domain name in the trusted name server database is cached and overwritten based on the received name server record of the other domain name, without changing the cache validity period of the name server record of the other domain name in the trusted name server data; Once the triggering condition for database update is confirmed, the authorization information of the parent domain server corresponding to the other domain name is verified. If the first name server record and the second name server record corresponding to the other domain name are consistent with the received name server record of the other domain name, the name server record of the other domain name in the trusted name server database is cached and overwritten based on the received name server record of the other domain name.

6. The method according to any one of claims 1 to 4, characterized in that, The method further includes: In response to the arrival of the cache expiration date of any name server record in the trusted name server database, and the domain name corresponding to any name server record is not in the domain name resolution stage, the any name server record and the corresponding domain name are deleted from the trusted name server database. In response to the arrival of the cache expiration date of any name server record in the trusted name server database, and the domain name corresponding to any name server record being in the domain name resolution stage, the any name server record is retained until the domain name resolution is completed.

7. The method according to any one of claims 1 to 4, characterized in that, The method further includes: In response to receiving another domain name resolution request for the domain name to be resolved during the resolution of the domain name to be resolved, the response to the second received domain name resolution request is suspended; In response to obtaining the resolution result of the domain name to be resolved, the domain name resolution result is fed back to each user terminal corresponding to the domain name resolution request for the domain name to be resolved received during the resolution of the domain name to be resolved.

8. The method according to any one of claims 1 to 4, characterized in that, The method further includes: In response to the detection of a circular dependency domain, negative caching is performed on the circular dependency domain and its corresponding name server record based on the negative cache validity period. The circular dependency domain is a domain with a circular authorization problem. In response to receiving a domain name resolution request from a user terminal, the method of sending back a domain name resolution result to the user terminal based on the query results recorded by the real-time name server and the trusted name server database includes: In response to receiving the domain name resolution request, and the domain name to be resolved in the domain name resolution request does not belong to the domain name in the negative cache processing, the domain name resolution result is fed back to the user terminal based on the query result of the real-time name server record and the trusted name server database; The method further includes: In response to receiving the domain name resolution request, and the domain name to be resolved in the domain name resolution request belongs to the domain name in the negative cache processing, the domain name resolution error information is fed back to the user terminal.

9. A security enhancement device for domain name resolution, characterized in that, The device, used in a domain name resolution server, includes: The acquisition module is used to acquire the domain name to be verified in response to the triggering condition of database update; The first verification module is used to verify the authorization information of the parent domain server corresponding to the domain name to be verified, and to verify whether the parent domain server stores the first name server record list corresponding to the domain name to be verified. The second verification module is used to send a name server record query request to the subdomain server recorded in the first name server record list in response to receiving the first name server record list from the parent domain server. The first storage module is configured to, in response to receiving the second name server record list fed back by the subdomain server, compare the first name server record list with the second name server record list, and associate and store the name server records that match the first name server record list and the second name server record list, along with the domain name to be verified, in the trusted name server database. The resolution module is used to respond to a domain name resolution request sent by a user terminal, and to send back the domain name resolution result to the user terminal based on the query results recorded by the real-time name server and the trusted name server database. The resolution module is further configured to: respond to receiving a domain name resolution request sent by a user terminal, perform a name server record query through the parent domain server and child domain server corresponding to the domain name to be resolved in the domain name resolution request, and obtain the real-time name server record query result; perform domain name information retrieval based on the trusted name server database, and obtain the trusted name server record query result corresponding to the domain name to be resolved; respond to the real-time name server record query result being consistent with the trusted name server record query result, perform domain name resolution based on the real-time name server record query result and feed back the domain name resolution result to the user terminal; respond to the real-time name server record query result being inconsistent with the trusted name server record query result, perform domain name resolution based on the trusted name server record query result, feed back the domain name resolution result to the user terminal, and determine that the triggering condition for database update has been met, wherein the domain name to be verified is the domain name to be resolved.

10. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing a computer program stored in the memory, wherein when the computer program is executed, it implements the method described in any one of claims 1-8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1-8.

12. A computer program product comprising computer program instructions, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1-8.

Images