DNS (Domain Name Server) security protection method, device and equipment

Abstract

The invention discloses a DNS security protection method, device and equipment, and the method comprises the steps: intercepting a DNS query request sent by terminal equipment, and determining a network access entity corresponding to the DNS query request and an identity label of the network access entity based on the identity configuration information of a DNS agent module; packaging the identity label into the DNS query request; and forwarding the packaged DNS query request to a DNS server, so that the DNS server executes security judgment and response processing on the DNS query request according to a security protection strategy associated with the identity identifier. According to the method, the security protection strategy is bound with the stable identity identification instead of the variable IP address, so that the problems of strategy failure caused by IP change, strategy mismatching caused by IP redistribution and strategy mutual interference among different users in a shared IP scene are solved, and the pertinence and effectiveness of the security protection strategy are improved.

Description

Technical Field

[0001] This application belongs to the field of computer security technology, and in particular relates to a DNS security protection method, device and equipment. Background Technology

[0002] In computer communication networks, there is a mapping relationship between domain names (DN) and Internet Protocol (IP) addresses. When a user accesses a website, they usually only need to use the website's domain name to access it, without needing the IP address used for underlying computer communication. The service system that translates the domain name entered by the user into an IP address is called the Domain Name System (DNS). The host that provides this translation service to users based on received DNS query requests is called a DNS server. DNS servers are also an important line of defense against malicious domain name attacks.

[0003] Current DNS security solutions generally bind IP addresses to security policies; however, this approach has limitations in practical applications. On one hand, in scenarios where multiple users share the same public IP address (such as enterprise NAT scenarios or home shared networks), all users' DNS query requests present the same source IP address, forcing multiple users to share the same security policy and making it impossible to implement differentiated domain name blocking measures. On the other hand, when IP addresses change dynamically due to network switching, redialing, or other reasons, security policies cannot follow the user, resulting in security interruptions or mismatches. Summary of the Invention

[0004] To address the aforementioned issues, this application provides a DNS security protection method, apparatus, and device through integration.

[0005] Firstly, this application provides a DNS security protection method applied to a DNS proxy module deployed on a terminal device, comprising:

[0006] The DNS query request sent by the terminal device is intercepted, and the network access entity corresponding to the DNS query request and the identity identifier of the network access entity are determined based on the identity configuration information of the DNS proxy module.

[0007] The identity identifier is encapsulated into the DNS query request;

[0008] The encapsulated DNS query request is forwarded to the DNS server, so that the DNS server performs security judgment and response processing on the DNS query request according to the security protection policy associated with the identity.

[0009] In one possible implementation, the identity configuration information includes a static identity label pre-set in the DNS proxy module, or a user account logged in on the DNS proxy module;

[0010] The step of determining the network access entity corresponding to the DNS query request and the identity identifier of the network access entity based on the identity configuration information of the DNS proxy module includes:

[0011] If the static identity tag is obtained, the network access entity is confirmed as the terminal device, and the identity identifier of the terminal device is determined as the static identity tag;

[0012] If the user account is obtained, the network access entity is confirmed as the user account, and the identity identifier corresponding to the user account is determined based on the preset correspondence between user accounts and identity identifiers.

[0013] In one possible implementation, encapsulating the identity identifier into the DNS query request includes:

[0014] Based on the preset identifier writing configuration information, determine the target field type used to write the identity identifier and the validity period of the identity identifier;

[0015] If the identity identifier is determined to be valid based on the validity period, then the identity identifier is written into the extended field of the DNS query request that conforms to the target field type.

[0016] Secondly, this application provides a DNS security protection method applied to a security management platform, including:

[0017] Receive user security protection requests for network access entities;

[0018] Based on the security protection requirements, an identity identifier is assigned to the network access entity, a security protection policy is generated for the network access entity, and an association relationship is established between the security protection policy and the identity identifier.

[0019] The security protection policy and the association relationship are sent to the DNS server so that the DNS server receives the DNS query request from the DNS proxy module, resolves the identity identifier from the DNS query request, and performs security judgment and response processing on the DNS query request based on the security protection policy associated with the identity identifier.

[0020] In one possible implementation, generating a security protection policy for the network access entity based on the security protection requirements includes:

[0021] Based on the aforementioned security protection requirements, at least one type of domain name blocking rule, access control action, and policy activation condition are determined; the domain name blocking rule is used to determine whether to block the DNS query request based on the domain name access range of the network access entity; the access control action is used to indicate the response processing operation to be performed on the DNS query request based on the determination result of the domain name blocking rule; the policy activation condition is used to indicate the conditions under which the domain name blocking rule takes effect.

[0022] Based on the domain name blocking rules, the access control actions, and the policy activation conditions, a security protection policy for the network access entity is obtained.

[0023] In one possible implementation, the method further includes:

[0024] The DNS proxy module is issued identifier writing configuration information, which is used to indicate the target field type for encapsulating the identity identifier and the validity period of the identity identifier, so that when the DNS proxy module determines that the identity identifier is valid based on the validity period, it writes the identity identifier into the extended field of the DNS query request that conforms to the target field type.

[0025] The DNS server sends the identifier write configuration information to the DNS server so that the DNS server resolves the identity identifier in the DNS query request according to the target field type, and when it determines that the identity identifier is valid based on the validity period, it performs security judgment and response processing on the DNS query request according to the security protection policy associated with the identity identifier.

[0026] Thirdly, this application provides a DNS security protection method applied to a DNS server, including:

[0027] Receive DNS query requests from the DNS proxy module;

[0028] The identity identifier is parsed from the DNS query request; the identity identifier is used to identify the network access entity corresponding to the DNS query request;

[0029] Based on the association between the security protection policy received from the security management platform and the identity identifier, the security protection policy corresponding to the identity identifier is determined; the security protection policy is generated by the security management platform based on the user's security protection requirements for the network access entity;

[0030] The security protection strategy is used to perform security assessment and response processing on the DNS query request.

[0031] In one possible implementation, the security protection strategy includes domain name blocking rules, access control actions, and policy activation conditions; the domain name blocking rules are used to determine whether to block the DNS query request based on the domain name access range of the network access entity; the access control actions are used to indicate the response processing operation to be performed on the DNS query request based on the determination result of the domain name blocking rules; and the policy activation conditions are used to indicate the conditions under which the domain name blocking rules take effect.

[0032] The process of performing security assessment and response processing on the DNS query request based on the security protection strategy includes:

[0033] When the domain name blocking rule is determined to be effective based on the policy's effective conditions, the domain name to be accessed corresponding to the DNS query request is determined.

[0034] Based on the domain name blocking rules, it is determined whether the domain name to be accessed is within the domain name access range of the network access entity;

[0035] The corresponding access control action will be executed based on the determination result.

[0036] Fourthly, this application provides a DNS security protection system, including:

[0037] A DNS proxy module deployed on a terminal device is used to perform the DNS security protection method as described in any of the first aspects;

[0038] A security management platform for implementing DNS security protection methods as described in any of the second aspects;

[0039] A DNS server for performing DNS security protection methods as described in any of the third aspects.

[0040] Fifthly, embodiments of this application provide an apparatus including at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform a DNS security protection method as described in any of the first aspects of this application, or to perform a DNS security protection method as described in any of the second aspects of this application, or to perform a DNS security protection method as described in any of the third aspects of this application.

[0041] In a sixth aspect, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, enables a terminal device to perform a DNS security protection method as described in any of the first aspects of this application, or a DNS security protection method as described in any of the second aspects of this application, or a DNS security protection method as described in any of the third aspects of this application.

[0042] The technical solutions provided by the embodiments of this application bring at least the following beneficial effects:

[0043] This application provides a DNS security protection method, apparatus, and device. By deploying a DNS proxy module on a terminal device to intercept DNS query requests issued by the terminal device, and determining the network access entity and its identity identifier in the DNS query request based on the identity configuration information of the DNS proxy module, the identity identifier is encapsulated into the DNS query request and forwarded to the DNS server. This enables the DNS server to perform security judgment and response processing on the request based on the security protection policy associated with the identity identifier. Thus, the security protection policy is bound to a stable identity identifier rather than a volatile IP address, solving the problems of policy failure caused by IP changes, policy mismatch caused by IP reassignment, and policy interference between different users in a shared IP scenario, thereby improving the pertinence and effectiveness of the security protection policy.

[0044] Other features and advantages of the invention will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0045] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments of this application will be briefly introduced below. Obviously, the drawings introduced below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 This is a schematic diagram illustrating the interaction process of a DNS security protection system provided in an embodiment of this application.

[0047] Figure 2 A flowchart illustrating a DNS security protection method applied to a DNS proxy module, as provided in this application embodiment;

[0048] Figure 3A flowchart of a DNS security protection method applied to a security management platform is provided as an embodiment of this application;

[0049] Figure 4 A flowchart illustrating a DNS security protection method applied to a DNS server, as provided in this application embodiment;

[0050] Figure 5 This is a schematic diagram of a DNS security protection device provided in an embodiment of this application. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. The described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0052] The terms "first," "second," and similar terms used in this invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the term encompasses the elements or objects listed following the term and their equivalents, without excluding other elements or objects. The term "module" refers to any known or subsequently developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code capable of performing the functions associated with that element.

[0053] It should be noted that the brief descriptions of terms in this application are only for the convenience of understanding the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise stated, these terms should be understood in their ordinary and common meaning.

[0054] In computer communication networks, there is a mapping relationship between domain names (DN) and Internet Protocol (IP) addresses. When a user accesses a website, they usually only need to use the website's domain name to access it, without needing the IP address used for underlying computer communication. The service system that translates the domain name entered by the user into an IP address is called the Domain Name System (DNS). The host that provides this translation service to users based on received DNS query requests is called a DNS server. DNS servers are also an important line of defense against malicious domain name attacks.

[0055] Current DNS security solutions generally bind IP addresses to security policies; however, this approach has limitations in practical applications. On one hand, in scenarios where multiple users share the same public IP address (such as enterprise NAT scenarios or home shared networks), all users' DNS query requests present the same source IP address, forcing multiple users to share the same security policy and making it impossible to implement differentiated domain name blocking measures. On the other hand, when IP addresses change dynamically due to network switching, redialing, or other reasons, security policies cannot follow the user, resulting in security interruptions or mismatches.

[0056] In view of the above problems, this application provides a DNS security protection method, apparatus, and device. By deploying a DNS proxy module on the terminal device to intercept DNS query requests issued by the terminal device, and determining the network access entity and its identity identifier of the DNS query request based on the identity configuration information of the DNS proxy module, the identity identifier is encapsulated into the DNS query request and forwarded to the DNS server. This enables the DNS server to perform security judgment and response processing on the request based on the security protection policy associated with the identity identifier. This binds the security protection policy to a stable identity identifier rather than a volatile IP address, solving the problems of policy failure, mismatch, and cross-pollution caused by IP changes or shared IPs, and improving the pertinence and effectiveness of the security protection policy.

[0057] The specific embodiments of the present invention will now be described with reference to the accompanying drawings.

[0058] It should be noted that the following scenarios are for illustrative purposes only and are not intended to limit the scope of this application. In actual implementation, the technical solutions provided in the embodiments of this application can be flexibly applied according to actual needs.

[0059] like Figure 1 The diagram shown illustrates the interaction process of a DNS security protection system provided in this embodiment of the application. The DNS security protection system includes a DNS proxy module deployed on a terminal device, a DNS server, and a security management platform. The process includes the following steps 101-109.

[0060] Step 101: The security management platform receives the user's security protection requirements for network access entities.

[0061] In this embodiment of the application, the network access entity is the logical subject bound to the security protection policy and is the object to which the security protection policy takes effect.

[0062] In this embodiment, the network access entity can take the form of a user account or a terminal device in different deployment scenarios. Users can define their security protection requirements for specific network access entities through the web configuration interface provided by the security management platform.

[0063] For example, an administrator can configure security protection requirements for the user account "alice@company.com": "Block all gambling and virus / Trojan domains, and block all social media domains during work hours", or configure security protection requirements for conference room computers: "Only allow access to company intranet domains and specified external whitelist domains".

[0064] Step 102: Based on security protection requirements, the security management platform assigns identity identifiers to network access entities, generates security protection policies for network access entities, and establishes the association between security protection policies and identity identifiers.

[0065] In this embodiment of the application, after receiving a security protection request, the security management platform performs identity allocation, as well as policy generation and association.

[0066] Identity Assignment: The security management platform assigns a globally unique identity to each network access entity. Simultaneously, the platform establishes and stores the mapping between these identities and network access entities, and distributes this mapping to the DNS proxy module, enabling the DNS proxy module to identify the network access entity corresponding to intercepted DNS query requests.

[0067] For example, the identifier IT_ALICE_2024XYZ can be assigned to the user account alice@company.com, and this identifier will uniquely represent the user account in subsequent processes. The identifier IT_DEVICE_ConfPC01 can also be assigned to the terminal device Conference-Room-PC-01.

[0068] It should be noted that, in this embodiment of the application, the specific form of identity allocation and distribution varies depending on the different deployment and configuration modes of the DNS proxy module. This application determines how the DNS proxy module determines network access entities and identity identifiers by setting the identity configuration information of the DNS proxy module.

[0069] In this embodiment, the DNS proxy module determines the network access entity and identity identifier corresponding to the DNS query request according to two modes: device-level identifier mode and user account-level identifier mode.

[0070] Device dimension identification mode:

[0071] When security protection requirements target one or more specific terminal devices, the security management platform assigns an identity identifier to that specific terminal device. For example, the identifier IT_DEVICE_ConfPC01 is assigned to the terminal device Conference-Room-PC-01. This identity identifier is pre-configured as a static identity label in the DNS proxy module's installation package or directly configured into the terminal device's DNS proxy module via a secure channel. In this mode, the DNS proxy module only needs to read the local static identity label at runtime to identify the network access entity as its own terminal device and directly use that static identity label as the identity identifier. It is understood that in this mode, multiple terminal devices can be associated with the same static identity label, thus allowing multiple terminal devices to be associated with the same security protection policy.

[0072] User account identification mode:

[0073] When security protection requirements target one or more specific user accounts, the platform assigns an identity identifier to that user. For example, the identifier IT_ALICE_2024XYZ might be assigned to the user account alice@company.com. The platform establishes and maintains a mapping between user accounts and identity identifiers. This mapping is then sent to the DNS proxy module as identity configuration information. In this mode, when a user successfully logs in to their account on the DNS proxy module, the proxy module can identify the network access entity as the currently logged-in user account based on the received mapping and retrieve its corresponding identity identifier. It is understood that in this mode, multiple user accounts can be associated with the same user identifier, thus allowing multiple user accounts to be associated with the same security protection policy.

[0074] Understandably, regardless of the identification mode, the final effect is that a unique identifier precisely points to a specific network access entity (terminal device or user account) and its exclusive security protection policy.

[0075] Policy generation and association: This process transforms and stores users' security protection requirements into structured security protection policies. In some embodiments, security protection policies can be configured one-to-one for individual network access entities based on their security protection requirements, or the same security protection policy can be configured in batches for multiple network access entities. The former assigns a unique user identifier to a single network access entity, while the latter assigns the same user identifier to multiple network access entities.

[0076] In some embodiments, the security protection policy includes domain name blocking rules for determining whether to block DNS query requests based on the domain name access range of the network access entity, access control actions (such as blocking, allowing, or redirecting) executed based on the determination result of the domain name blocking rules, and policy effective conditions (e.g., time condition: weekdays 9:00-18:00) for indicating the effective conditions of the domain name blocking rules. For example, an administrator can configure: when a user is on the company intranet (effective condition), if they access a social networking site (blocking rule), their DNS resolution will be blocked (control action).

[0077] Subsequently, the platform establishes and stores the association between security protection policies and identity identifiers, and then sends the security protection policies and this association to the DNS server, so that the DNS server can determine the security protection policy to be adopted based on the identity identifiers resolved from the DNS query requests.

[0078] In some embodiments, the domain name blocking rules are based on at least one of the following settings: blacklists and whitelists indicating security protection needs, and threat intelligence categories that need to be blocked.

[0079] Optionally, the whitelist rules consisting of allowed target domains, the blacklist rules consisting of prohibited target domains, and the domain blocking rules for preset threat categories are executed in the following order. This takes into account the existence of "exceptional access" scenarios, where certain high-risk domains may be included in the global blacklist, but specific users may still need to access them for business purposes. Therefore, adopting a "whitelist priority" mechanism can ensure both policy flexibility and security. At the same time, the threat intelligence category blocking rules serve as a fallback strategy, enabling proactive defense even when unknown malicious domains are dynamically updated.

[0080] In existing technologies, DNS query requests do not contain user or device identity information, and DNS servers can only perform coarse-grained policy control based on the source IP address. When multiple users share the same public IP (such as enterprise NAT, home routers, or public Wi-Fi), all users can only apply the same policy, making personalized security protection impossible. This application's embodiments use identity identifiers as policy binding intermediaries, enabling the security management platform to configure personalized security protection policies for different network access entities (such as user accounts and terminal devices), and the DNS server to execute the corresponding security protection policy based on the identity identifier in the DNS query request, thereby achieving identity-driven secure access control.

[0081] Step 103: The security management platform distributes the security protection policies and related relationships to the DNS server.

[0082] In this embodiment, the security management platform sends the generated security protection policies and their association with identity identifiers to the DNS server in batches or incrementally through a secure communication channel (such as a dedicated API interface).

[0083] Specifically, the issued content includes:

[0084] Structured data (such as JSON format) of security protection policies includes domain name blocking rules, access control actions, and policy activation conditions;

[0085] A mapping table between identity identifiers and security protection policies is used for fast indexing;

[0086] Policy version number and timestamp to support policy updates and rollbacks.

[0087] After receiving the request, the DNS server stores it in its local cache and creates an index to improve the efficiency of subsequent queries. For example, when it receives an on-time query request carrying the identity identifier IT_ALICE_2024XYZ, it can quickly locate the corresponding security protection policy through a hash lookup.

[0088] In some embodiments, the security management platform also distributes identifier write configuration information to the DNS proxy modules and DNS servers. The identifier write configuration information indicates the target field type for writing the identifier and the validity period of the identifier. The identifier write configuration information is uniformly generated by the security management platform and distributed to all controlled DNS proxy modules and DNS servers.

[0089] In this embodiment, the security management platform sends identifier writing configuration information to the DNS proxy module. This information is used to indicate the target field type for encapsulating the identity identifier (e.g., specifying the use of the private OptionCode 65001 field in the EDNS(0) extension protocol) and the validity period of the identity identifier (e.g., 24 hours), so that when the DNS proxy module determines that the identity identifier is valid based on the validity period, it writes the identity identifier into the extension field of the DNS query request that conforms to the target field type.

[0090] In this embodiment, the security management platform sends an identifier to the DNS server to write configuration information, so that the DNS server knows how to resolve the identity identifier in the request according to the target field type and verify its validity according to the validity period. This enables the DNS server to resolve the identity identifier in the DNS query request according to the target field type, and when the identity identifier is determined to be valid based on the validity period, to perform security judgment and response processing on the DNS query request according to the security protection policy associated with the identity identifier.

[0091] In some embodiments, the security management platform periodically polls the DNS server to confirm whether the security protection policy has been successfully loaded, and triggers a retry mechanism in case of failure to ensure the reliability of policy synchronization.

[0092] In some embodiments, the security management platform will determine whether to notify the DNS proxy module and DNS server to stop providing services to the user based on the validity period of the security protection service subscribed by the user, or the DNS proxy module and DNS server will proactively query the security management platform to see if the service is currently valid before providing services to the user.

[0093] Step 104: The DNS proxy module intercepts DNS query requests sent by the terminal device.

[0094] In this embodiment, the DNS proxy module is deployed as software on the terminal device and intercepts DNS query requests issued by all applications on the terminal device. In some embodiments, the DNS proxy module may be implemented collaboratively by one or more software components, such as a policy proxy program responsible for identification and a DNS proxy service (such as dnsmasq, unbound, or coredns) responsible for DNS protocol processing. This module is automatically integrated into the existing DNS forwarding process after being installed on the terminal device as a software package.

[0095] Step 105: The DNS proxy module determines the network access entity and the identity identifier of the network access entity corresponding to the DNS query request based on the identity configuration information.

[0096] In this embodiment, the identity configuration information includes a static identity label pre-set in the DNS proxy module, or a user account logged into the DNS proxy module. The DNS proxy module determines the network access entity and identity identifier based on the identity configuration information using the following two modes.

[0097] Mode 1: Determine network access entity and identity based on device dimension: If the DNS proxy module obtains its internally preset static identity tag, it will identify the current network access entity as the terminal device itself and directly determine the static identity tag as the terminal device's identity. This mode is suitable for scenarios where a unified security protection policy is configured for a specific terminal device.

[0098] Mode 2 determines network access entities and identities based on user accounts: If the DNS proxy module obtains a user account that has successfully logged in (e.g., an employee authenticating by entering their company account and password), it identifies the current network access entity as that user account. Subsequently, the proxy module retrieves and determines the identity corresponding to that user account based on the preset mapping between user accounts and identities by querying the local cache or sending a request to the security management platform. This mode achieves precise binding between policies and users, rather than devices.

[0099] Step 106: The DNS proxy module encapsulates the identity identifier into the DNS query request and forwards the encapsulated DNS query request to the DNS server.

[0100] Specifically, the DNS proxy module writes configuration information based on a pre-defined identifier, determining the type of the target field to be written and the validity period of the current identifier. If the identifier is determined to be valid based on the validity period, it is written into the extended field of the DNS query request that matches the target field type. Subsequently, the proxy module forwards this encapsulated DNS query request to the DNS server normally.

[0101] It should be noted that this application does not limit the specific encapsulation method of the identity identifier. In one embodiment, given that the EDNS(0) extension method does not require modification of the standard DNS protocol, is compatible with existing DNS infrastructure, and has low deployment costs, a custom Option can be added to the OPT pseudo-resource record through the EDNS(0) extension mechanism of the DNS protocol, with the identity identifier as the payload of its Value field. The Type of this Option can be a value within a private scope or a special registration type. For example, Option Code = 65001 can be used to represent 'identity identifier', and its Value field carries the identity identifier. After the DNS server parses the Option based on the identifier written in the configuration information, it can extract the identity identifier and query the associated security protection policy.

[0102] Step 107: The DNS server resolves the identity identifier from the DNS query request.

[0103] Specifically, after receiving a DNS query request, the DNS server writes configuration information based on the identifier received from the security management platform, determines the target field type (such as Option Code 65001), extracts the identity identifier from the specified extended field, and determines the validity of the identity identifier based on the validity period (for example, checking that the timestamp has not expired). Then it proceeds to the next step. If it is invalid, it can reject the request or apply the default policy.

[0104] Step 108: The DNS server determines the security protection policy corresponding to the identity based on the association between the security protection policy and the identity received from the security management platform.

[0105] Optionally, the DNS server may use the valid identity identifier resolved from the message as the key to query its local cache and retrieve the security protection policy associated with that identity identifier.

[0106] It should be noted that the method for generating security protection strategies can be referred to in the aforementioned embodiments, and will not be repeated here.

[0107] Step 109: The DNS server performs security assessment and response processing on DNS query requests based on security protection policies.

[0108] Optionally, when the DNS server determines that the domain name blocking rule is in effect based on the policy's effective conditions, it identifies the domain name to be accessed corresponding to the DNS query request. Then, it determines whether the domain name to be accessed falls within the domain name access scope of the network access entity based on the domain name blocking rule. Finally, it executes the corresponding access control action based on the determination result.

[0109] In one possible scenario, the DNS server applies the retrieved security protection policies to determine the security of DNS query requests and process responses:

[0110] First, determine whether the domain name blocking rule is effective based on the policy's effective conditions (e.g., whether the current time is a weekday from 9:00 to 18:00). If effective, extract the domain name to be accessed from the DNS query request and determine whether the domain name to be accessed is within the domain name access range of the network access entity based on the domain name blocking rule.

[0111] Secondly, the corresponding access control action is executed based on the judgment result. If it is determined to be a rule violation (such as accessing a social media domain during working hours), an interception action is executed (such as returning NXDOMAIN); if it is determined to be safe, normal recursive resolution is performed and the correct IP address is returned.

[0112] Finally, the response is returned to the original application on the terminal device via the DNS proxy module, completing the security protection process for this DNS query request.

[0113] Based on the same inventive concept, such as Figure 2 The diagram shown is a flowchart of a DNS security protection method applied to a DNS proxy module according to an embodiment of this application. The DNS proxy module is deployed on a terminal device, and the method includes the following steps S201-S203.

[0114] Step S201: Intercept the DNS query request sent by the terminal device, and determine the network access entity and the identity identifier of the network access entity corresponding to the DNS query request based on the identity configuration information of the DNS proxy module.

[0115] Step S202: Encapsulate the identity identifier into the DNS query request.

[0116] Step S203: The encapsulated DNS query request is forwarded to the DNS server so that the DNS server can perform security judgment and response processing on the DNS query request according to the security protection policy associated with the identity.

[0117] As a feasible implementation, the identity configuration information includes a static identity label pre-set in the DNS proxy module, or a user account logged in on the DNS proxy module; the above step S201 is implemented using the following steps S201a-S201b:

[0118] Step S201a: If a static identity tag is obtained, the network access entity is confirmed as a terminal device, and the identity identifier of the terminal device is determined to be a static identity tag.

[0119] In step S201b, if a user account is obtained, the network access entity is confirmed as a user account, and the identity identifier corresponding to the user account is determined based on the preset correspondence between user accounts and identity identifiers.

[0120] As a feasible implementation method, the above step S202 is achieved by the following steps S202a-S202b:

[0121] Step S202a: Based on the preset identifier writing configuration information, determine the target field type used to write the identity identifier and the validity period of the identity identifier;

[0122] Step S202b: If the identity identifier is determined to be valid based on the validity period, then the identity identifier is written into the extended field of the DNS query request that conforms to the target field type.

[0123] The specific implementation method of the DNS security protection method applied to the DNS proxy module deployed on the terminal device described above can be referred to the foregoing embodiments, and will not be repeated here.

[0124] Based on the same inventive concept, such as Figure 3 The diagram shown is a flowchart of a DNS security protection method applied to a security management platform according to an embodiment of this application. The method includes the following steps S301-S303:

[0125] Step S301: Receive the user's security protection request for the network access entity;

[0126] Step S302: Based on security protection requirements, assign identity identifiers to network access entities, generate security protection policies for network access entities, and establish the association between security protection policies and identity identifiers;

[0127] Step S303: The security protection policy and association relationship are sent to the DNS server so that the DNS server receives the DNS query request from the DNS proxy module, resolves the identity identifier from the DNS query request, and performs security judgment and response processing on the DNS query request based on the security protection policy associated with the identity identifier.

[0128] As a feasible implementation, in step S302 above, a security protection policy is generated for the network access entity based on the following steps S302a-S302b:

[0129] Step S302a: Based on security protection requirements, determine at least one type of domain name blocking rule, access control action, and policy effective conditions; the domain name blocking rule is used to determine whether to block DNS query requests based on the domain name access scope of the network access entity; the access control action is used to indicate the response processing operation to be performed on the DNS query request based on the determination result of the domain name blocking rule; the policy effective conditions are used to indicate the conditions under which the domain name blocking rule takes effect.

[0130] Step S302b: Based on the domain name blocking rules, access control actions, and policy activation conditions, a security protection policy for network access entities is obtained.

[0131] In some embodiments, the DNS security protection method applied to the security management platform described above further includes steps S304-S305:

[0132] Step S304: Send identifier writing configuration information to the DNS proxy module. The identifier writing configuration information is used to indicate the target field type of the encapsulated identity identifier and the validity period of the identity identifier, so that when the DNS proxy module determines that the identity identifier is valid based on the validity period, it will write the identity identifier into the extended field of the DNS query request that matches the target field type.

[0133] Step S305: Send the identifier writing configuration information to the DNS server so that the DNS server can resolve the identity identifier in the DNS query request according to the target field type, and when the identity identifier is determined to be valid based on the validity period, perform security judgment and response processing on the DNS query request according to the security protection policy associated with the identity identifier.

[0134] The specific implementation methods of the DNS security protection method applied to the security management platform described above can be referred to the foregoing embodiments, and will not be repeated here.

[0135] Based on the same inventive concept, such as Figure 4 The diagram shown is a flowchart of a DNS security protection method applied to a DNS server, provided in an embodiment of this application. The method includes the following steps S401-S404:

[0136] Step S401: Receive a DNS query request from the DNS proxy module;

[0137] Step S402: Parse the identity identifier from the DNS query request; the identity identifier is used to identify the network access entity corresponding to the DNS query request.

[0138] Step S403: Based on the association between the security protection policy and the identity identifier received from the security management platform, determine the security protection policy corresponding to the identity identifier; the security protection policy is generated by the security management platform based on the user's security protection requirements for network access entities;

[0139] Step S404: Perform security assessment and response processing on DNS query requests based on security protection policies.

[0140] As a feasible implementation method, the above security protection strategy includes domain name blocking rules, access control actions, and policy activation conditions; the domain name blocking rules are used to determine whether to block DNS query requests based on the domain name access scope of the network access entity; the access control actions are used to indicate the response processing operations to be performed on the DNS query requests based on the determination result of the domain name blocking rules; the policy activation conditions are used to indicate the conditions under which the domain name blocking rules take effect; the above step S404 includes the following steps S404a-S404c:

[0141] Step S404a: When the domain name blocking rule is effective based on the policy effective conditions, determine the domain name to be accessed corresponding to the DNS query request;

[0142] Step S404b: Determine whether the domain name to be accessed is within the domain name access range of the network access entity based on the domain name blocking rules;

[0143] Step S404c: Execute the corresponding access control action based on the determination result.

[0144] The specific implementation methods of the DNS security protection method applied to DNS servers described above can be referred to the foregoing embodiments, and will not be repeated here.

[0145] Based on the same inventive concept, embodiments of this application also provide a DNS security protection system, which includes:

[0146] A DNS proxy module deployed on a terminal device is used to execute DNS security protection methods applied to the DNS proxy module;

[0147] A security management platform is used to implement DNS security protection methods applied to the security management platform;

[0148] A DNS server is used to implement DNS security protection methods applied to the DNS server.

[0149] Based on the same inventive concept, this application also provides a DNS security protection method device 500, such as... Figure 5 As shown, it includes at least one processor 502; and a memory 501 communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to execute the DNS security protection method applied to the DNS proxy module, or to execute the DNS security protection method applied to the security management platform, or to execute the DNS security protection method applied to the DNS server.

[0150] Memory 501 is used to store programs. Specifically, the program may include program code, which includes computer operation instructions. Memory 501 may be volatile memory, such as random-access memory (RAM); it may also be non-volatile memory, such as flash memory, hard disk drive (HDD), or solid-state drive (SSD); or it may be any one or a combination of the above-mentioned volatile and non-volatile memory types.

[0151] Processor 502 can be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP. It can also be a hardware chip. The aforementioned hardware chip can be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The aforementioned PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0152] This invention also provides a computer-readable storage medium including instructions that, when executed on a computer, cause the computer to execute the DNS security protection method for a DNS proxy module provided in the above embodiments, or to execute the DNS security protection method for a security management platform, or to execute the DNS security protection method for a DNS server.

[0153] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the above-described device and module can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0154] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, apparatuses, or modules, and may be electrical, mechanical, or other forms.

[0155] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0156] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium.

[0157] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0158] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0159] The technical solutions provided in this application have been described in detail above. Specific examples have been used in this application to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

[0160] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0161] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0162] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0163] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0164] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A DNS security protection method, characterized in that, DNS proxy modules deployed on terminal devices include: The DNS query request sent by the terminal device is intercepted, and the network access entity corresponding to the DNS query request and the identity identifier of the network access entity are determined based on the identity configuration information of the DNS proxy module. The identity identifier is encapsulated into the DNS query request; The encapsulated DNS query request is forwarded to the DNS server, so that the DNS server performs security judgment and response processing on the DNS query request according to the security protection policy associated with the identity.

2. The method according to claim 1, characterized in that, The identity configuration information includes a static identity label pre-set in the DNS proxy module, or a user account logged in on the DNS proxy module; The step of determining the network access entity corresponding to the DNS query request and the identity identifier of the network access entity based on the identity configuration information of the DNS proxy module includes: If the static identity tag is obtained, the network access entity is confirmed as the terminal device, and the identity identifier of the terminal device is determined as the static identity tag; If the user account is obtained, the network access entity is confirmed as the user account, and the identity identifier corresponding to the user account is determined based on the preset correspondence between user accounts and identity identifiers.

3. The method according to claim 1, characterized in that, Encapsulating the identity identifier into the DNS query request includes: Based on the preset identifier writing configuration information, determine the target field type used to write the identity identifier and the validity period of the identity identifier; If the identity identifier is determined to be valid based on the validity period, then the identity identifier is written into the extended field of the DNS query request that conforms to the target field type.

4. A DNS security protection method, characterized in that, Applications in security management platforms include: Receive user security protection requests for network access entities; Based on the security protection requirements, an identity identifier is assigned to the network access entity, a security protection policy is generated for the network access entity, and an association relationship is established between the security protection policy and the identity identifier. The security protection policy and the association relationship are sent to the DNS server so that the DNS server receives the DNS query request from the DNS proxy module, resolves the identity identifier from the DNS query request, and performs security judgment and response processing on the DNS query request based on the security protection policy associated with the identity identifier.

5. The method according to claim 4, characterized in that, The step of generating a security protection policy for the network access entity based on the security protection requirements includes: Based on the aforementioned security protection requirements, at least one type of domain name blocking rule, access control action, and policy activation condition are determined; the domain name blocking rule is used to determine whether to block the DNS query request based on the domain name access range of the network access entity; the access control action is used to indicate the response processing operation to be performed on the DNS query request based on the determination result of the domain name blocking rule; the policy activation condition is used to indicate the conditions under which the domain name blocking rule takes effect. Based on the domain name blocking rules, the access control actions, and the policy activation conditions, a security protection policy for the network access entity is obtained.

6. The method according to claim 4, characterized in that, The method further includes: The DNS proxy module is issued identifier writing configuration information, which is used to indicate the target field type for encapsulating the identity identifier and the validity period of the identity identifier, so that when the DNS proxy module determines that the identity identifier is valid based on the validity period, it writes the identity identifier into the extended field of the DNS query request that conforms to the target field type. The DNS server sends the identifier write configuration information to the DNS server so that the DNS server resolves the identity identifier in the DNS query request according to the target field type, and when it determines that the identity identifier is valid based on the validity period, it performs security judgment and response processing on the DNS query request according to the security protection policy associated with the identity identifier.

7. A DNS security protection method, characterized in that, Applied to DNS servers, including: Receive DNS query requests from the DNS proxy module; The identity identifier is parsed from the DNS query request; the identity identifier is used to identify the network access entity corresponding to the DNS query request; Based on the association between the security protection policy received from the security management platform and the identity identifier, the security protection policy corresponding to the identity identifier is determined; the security protection policy is generated by the security management platform based on the user's security protection requirements for the network access entity; The security protection strategy is used to perform security assessment and response processing on the DNS query request.

8. The method according to claim 7, characterized in that, The security protection strategy includes domain name blocking rules, access control actions, and policy activation conditions; the domain name blocking rules are used to determine whether to block the DNS query request based on the domain name access range of the network access entity. The access control action is used to instruct the response processing operation to be performed on the DNS query request based on the determination result of the domain name blocking rule; The policy activation conditions are used to indicate the conditions under which the domain name blocking rule takes effect; The process of performing security assessment and response processing on the DNS query request based on the security protection strategy includes: When the domain name blocking rule is determined to be effective based on the policy's effective conditions, the domain name to be accessed corresponding to the DNS query request is determined. Based on the domain name blocking rules, it is determined whether the domain name to be accessed is within the domain name access range of the network access entity; The corresponding access control action will be executed based on the determination result.

9. A DNS security protection system, characterized in that, include: A DNS proxy module deployed on a terminal device is used to perform the method as described in any one of claims 1-3; A security management platform for performing the method as described in any one of claims 4-6; A DNS server for performing the method as described in any one of claims 7-8.

10. A DNS security protection method device, characterized in that, The device includes at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method as claimed in any one of claims 1-3, or the method as claimed in any one of claims 4-6, or the method as claimed in any one of claims 7-8.

Images