Security risk quantitative evaluation device for DNS recursive analysis system
By deploying automated measurement probes in the DNS recursive resolution system to detect security risk indices across multiple dimensions, the problem of existing technologies being unable to comprehensively assess the security performance of the DNS recursive resolution system is solved, enabling a more comprehensive quantitative assessment of security risks.
Patent Information
- Application Number
- CN202511221438.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-29
- Publication Date
- 2025-12-12
AI Technical Summary
Existing security risk assessment schemes for DNS recursive resolution systems cannot fully evaluate the security performance of DNS recursive resolution systems configured with complex security extension mechanisms, and there is functional overlap in the attack defense scope of different security extension mechanisms.
This paper proposes a security risk quantification assessment device. By deploying automatic measurement probes in the DNS recursive resolution system, it detects security risk indices in five dimensions: cache pollution, DNS hijacking, direct attacks on recursive servers, exploitation of recursion attacks on other servers, and DNS service software vulnerabilities. The device utilizes collaborative measurement between the client and the authoritative end to achieve a quantitative assessment of system security risks.
It enables a comprehensive security risk assessment of the DNS recursive resolution system, with more comprehensive assessment indicators and more lenient conditions, and can more accurately measure the system's security performance.
Smart Images
Figure CN121125687A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of security protection technology, and more specifically, to a device for quantitatively assessing the security risks of a DNS recursive resolution system. Background Technology
[0002] The primary function of the Domain Name System (DNS) is to provide mapping and resolution services between domain names and IP addresses. Within the DNS, the DNS recursive resolution service acts as a communication bridge between users and authoritative name servers. As a crucial piece of internet infrastructure, the DNS recursive resolution service is constantly threatened by various cyberattacks. The DNS recursive resolution process is frequently exposed to unprotected environments vulnerable to attacks such as DNS hijacking, cache poisoning, and denial-of-service attacks. Currently, the security of the DNS recursive resolution system relies on various DNS security extension mechanisms. However, the industry lacks sufficient awareness of the security risks of DNS recursive resolution services, and the deployment of numerous security mechanisms is far from satisfactory. Furthermore, there is a lack of research evaluating the overall security of the DNS recursive resolution system; existing work typically focuses on specific service software vulnerabilities while neglecting the security defense potential of the recursive resolution system itself.
[0003] Currently, existing technologies mainly propose security risk assessment schemes for DNS recursive resolution systems from the perspective of the three elements of information security. However, these schemes only consider the improvement effects of several common security extension mechanisms on DNS recursive security and do not discuss the recursive server and forwarding server in the recursive resolution system separately. Some researchers have modeled the health of DNS recursive resolution systems. Although they characterize the health of DNS recursive resolution systems from the perspectives of resolvers, name servers, and DNS domains in terms of DoS attacks, resilience, and information leakage, there are still problems such as some indicators being difficult to measure and insufficient consideration of new security extension mechanisms. These models are not suitable for characterizing the security posture of recursive resolution systems or for large-scale DNS system network security governance. Some researchers have also given DNS health assessment models from a qualitative perspective. These models provide eight dimensions for measuring DNS health and propose a health measurement framework. However, these models cannot directly measure the security of recursive systems, and they do not provide specific measurement indicators, so they cannot be directly applied in practice.
[0004] In summary, existing DNS recursive resolution systems require the combination of multiple DNS security extension mechanisms to comprehensively improve server security. However, the attack defense scope of different security extension mechanisms is not completely orthogonal, and there is functional overlap between them. Existing DNS security risk assessment schemes cannot comprehensively evaluate the security performance of DNS recursive resolution systems. Therefore, there is an urgent need for a scheme that can effectively evaluate the security performance of DNS recursive resolution systems configured with complex security extension mechanisms.
[0005] It should be noted that the background information presented here is only for illustrating relevant information about the present invention to aid in understanding the technical solutions of the present invention, and does not imply that the relevant information is necessarily prior art. In the absence of evidence indicating that the relevant information was disclosed before the filing date of this invention, the relevant information should not be considered prior art. Summary of the Invention
[0006] Therefore, the purpose of this invention is to overcome the shortcomings of the prior art and provide a device for quantitatively assessing the security risks of a DNS recursive resolution system.
[0007] The objective of this invention is achieved through the following technical solution:
[0008] According to a first aspect of the present invention, a security risk quantification assessment device for a DNS recursive resolution system is proposed. The DNS recursive resolution system includes a recursive server and a forwarding server. The assessment device is used to detect parameters of the DNS recursive resolution system through five preset dimensions to assess the security risk index of the DNS recursive resolution system. The assessment device includes a client and an authoritative end. The client is used to send multiple different DNS requests to the DNS recursive resolution system to deploy multiple automatic measurement probes in the DNS recursive resolution system. Each preset dimension corresponds to multiple automatic measurement probes, and each automatic measurement probe is used to detect parameters related to the security risk index of its corresponding dimension. The five preset dimensions include: cache pollution dimension, DNS hijacking dimension, direct attack on the recursive server dimension, attack on other servers using recursion dimension, and DNS service software vulnerability dimension. The authoritative end is used to analyze the parameters to be tested in the DNS recursive resolution system and return the analysis results to the client. The client is also configured to: assess the security risk index of each detected dimension based on its parameters, and calculate the overall security risk index of the system based on the assessed security risk index of each dimension.
[0009] Preferably, the apparatus is configured such that: the client sends multiple different DNS requests to the recursive server to deploy automatic measurement probes in the recursive server to detect parameters related to the dimensions of cache pollution, DNS hijacking, direct attack on the recursive server, and DNS service software vulnerabilities; and the client sends multiple different DNS requests to the forwarding server to deploy automatic measurement probes in the forwarding server to detect parameters related to the dimensions of direct attack on the recursive server, and DNS service software vulnerabilities.
[0010] Preferably, the client is configured to calculate the security risk indices of the recursive server and the forwarding server respectively, and use the calculated security risk index as the final security risk index of the DNS recursive resolution system. The security risk index of the recursive server is calculated by the client based on the authoritative analysis results of the recursive server and the parameters detected by the automatic measurement probes in the recursive server. The security risk index of the recursive server includes dimensions of cache pollution, DNS hijacking, direct attack on the recursive server, exploiting recursion to attack other servers, and DNS service software vulnerabilities. The security risk index of the forwarding server is calculated by the client based on the authoritative analysis results of the forwarding server and the parameters detected by the automatic measurement probes in the forwarding server. The security risk index of the forwarding server includes dimensions of direct attack on the recursive server, exploiting recursion to attack other servers, and DNS service software vulnerabilities.
[0011] Preferably, the client is configured to calculate the security risk index of the recursive server in the following manner:
[0012]
[0013] in, This indicates the security risk index of the recursive server. This represents the security risk index of recursive servers in terms of DNS hijacking. This represents the security risk index of the recursive server in terms of cache pollution. This represents the security risk index of a recursive server in terms of direct attacks on recursive servers. This represents the security risk index of a recursive server in terms of using recursion to attack other servers. This represents the security risk index of recursive servers in terms of DNS service software vulnerabilities.
[0014] Preferably, the client is configured to calculate the security risk index of the forwarding server in the following manner:
[0015]
[0016] in, This indicates the security risk index of the forwarding server. This indicates the security risk index of the forwarding server in terms of directly attacking the recursive server. This indicates the security risk index of the forwarding server in terms of recursive attacks on other servers. This indicates the security risk index of the forwarding server in terms of DNS service software vulnerabilities.
[0017] Preferably, the client is configured to calculate the security risk index of the recursive server in the DNS hijacking dimension as follows:
[0018]
[0019] in, This represents the security risk index of recursive servers in terms of DNS hijacking. and These are parameters determined based on the analysis results of the recursive server from the authoritative source or the detection results of the automatic measurement probes in the recursive server. This represents the parameter to minimize QNAME. This represents the DNSSEC chain configuration score calculated based on the DNSSEC chain configuration parameters, when the recursive server is not configured with a DNSSEC chain. The value is When the recursive server is configured with a DNSSEC chain, The value is ,in, This indicates the preset score threshold. This indicates the number of misconfigured DNSSEC chain types that the recursive server can detect. This indicates the number of DNSSEC chains containing configuration error types included in the automatic measurement probe.
[0020] Preferably, the client is configured to calculate the security risk index of the recursive server in the cache pollution dimension as follows:
[0021]
[0022] in, This represents the security risk index of the recursive server in terms of cache pollution. , and These are parameters determined based on the analysis results of the recursive server from the authoritative source or the detection results of the automatic measurement probes in the recursive server. This represents the security risk index of recursive servers in terms of DNS hijacking. This represents the final rule matching parameters determined based on the client-side rule matching parameters and the authoritative rule matching parameters. When both the client-side and authoritative rule matching parameters are 1, this indicates a valid rule matching parameter. The value is 1, otherwise, The value is 0. This indicates whether the recursive server supports authoritative DNS cookies. If supported, then... The value is 1, otherwise, The value is 0. A parameter indicating the degree of randomization of the source port of the recursive server.
[0023] Preferably, the client is configured to calculate the security risk index of the recursive server or forwarding server in the dimension of directly attacking the recursive server in the following manner:
[0024]
[0025] in, This represents the security risk index of a recursive server or forwarding server in terms of direct attacks on recursive servers. This represents the traffic when a recursive server or forwarding server uses security mechanisms. This represents traffic when the recursive server or forwarding server does not use security mechanisms. This represents the total number of recursive servers and forwarding servers that may participate in DNS recursive resolution in the DNS recursive resolution system.
[0026] Preferably, the client is configured to calculate the security risk index of the recursive server or forwarding server in terms of exploiting recursion to attack other servers in the following manner:
[0027]
[0028]
[0029]
[0030] in, This represents the security risk index of a recursive server or forwarding server in terms of its ability to exploit recursion to attack other servers. This represents the security risk index calculated based on the analysis results of the recursive server or forwarding server returned by the authoritative source. This represents a security risk index calculated based on the detection results of the automatic measurement probes returned by the recursive server or forwarding server. This represents the traffic when a recursive server or forwarding server uses security mechanisms. This represents traffic when the recursive server or forwarding server does not use security mechanisms. This parameter indicates whether the recursive server or forwarding server supports client DNS cookies. This indicates that the response from the recursive server or forwarding server has been truncated. This indicates the default traditional DNS response size.
[0031] Preferably, the client is configured to calculate the security risk index of the recursive server or forwarding server on the DNS service software vulnerability dimension in the following way: pre-configure the security risk index of each DNS service software version in the client; obtain the DNS service software version of the recursive server or forwarding server based on the analysis results returned by the authoritative end and the parameters detected by the automatic measurement probe; if the DNS service software version is hidden, the security risk index is 1; otherwise, query the corresponding security risk index from the client based on the DNS service software version.
[0032] Preferably, the client is configured to: based on the analysis results returned by the authoritative server and the parameters detected by the automatic measurement probe in the DNS recursive resolution system, issue risk warnings to the servers in the DNS recursive resolution system using a preset method. The servers in the DNS recursive resolution system include recursive servers and forwarding servers. The preset method is as follows: when a server has an incorrectly configured DNSSEC chain, a risk warning for DNSSEC chain mismatch is issued, and the number of incorrectly configured DNSSEC chains in the server is indicated; when a server does not limit the query access rate of a single user, a risk warning for query access rate is issued; when the random space of the server's source port number or TXID is less than 10000, a risk warning for insufficient randomness is issued; when a server does not hide the DNS service software version it uses, a risk warning for DNS service software version not being hidden is issued; when a server does not deploy TXT large response truncation or the TXT response payload exceeds 1500, a risk warning for TXT large response truncation is issued.
[0033] Compared with the prior art, the advantages of the present invention are as follows:
[0034] This invention utilizes a client-side measurement host to probe specific domain names and establishes an authoritative server to organize partial responses, thereby automating the collection of quantitative indicators. Based on the collected indicators, it conducts a risk assessment of the DNS recursive resolution system from five dimensions: cache pollution, DNS hijacking, direct attacks on recursive servers, using recursion to attack other servers, and DNS service software vulnerabilities. Compared with existing DNS security risk assessment schemes, this invention has more lenient implementation conditions and more comprehensive assessment indicators. Attached Figure Description
[0035] The embodiments of the present invention will be further described below with reference to the accompanying drawings, wherein:
[0036] Figure 1 This is a schematic diagram of a measurement method for an indicator according to an embodiment of the present invention;
[0037] Figure 2 This is a schematic diagram of the risk warning processing flow according to an embodiment of the present invention. Detailed Implementation
[0038] To make the objectives, technical solutions, and advantages of this invention clearer, the invention is further described in detail below through specific embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.
[0039] As mentioned in the background section, existing DNS recursive resolution systems require the combination of multiple DNS security extension mechanisms to comprehensively improve server security. However, the attack defense scope of different security extension mechanisms is not completely orthogonal, and there is functional overlap between them. Therefore, existing DNS security risk assessment schemes cannot comprehensively evaluate the security performance of DNS recursive resolution systems.
[0040] To address the aforementioned issues, this invention proposes a design scheme for a security risk quantification assessment device for DNS recursive resolution systems. This scheme deploys automatic measurement probes within the DNS recursive resolution system to collect parameters, and then comprehensively assesses the security of the DNS recursive resolution system based on the collected parameters from dimensions such as cache pollution, DNS hijacking, direct attacks on recursive servers, exploiting recursion to attack other servers, and DNS service software vulnerabilities.
[0041] According to one embodiment of the present invention, a security risk quantification assessment device for a DNS recursive resolution system is proposed. The DNS recursive resolution system includes a recursive server and a forwarding server. The assessment device is used to detect parameters of the DNS recursive resolution system through five preset dimensions to assess the security risk index of the DNS recursive resolution system. The assessment device includes a client and an authoritative end. The client is used to send multiple different DNS requests to the DNS recursive resolution system to deploy multiple automatic measurement probes in the DNS recursive resolution system. Each preset dimension corresponds to multiple automatic measurement probes, and each automatic measurement probe is used to detect parameters related to the security risk index of its corresponding dimension. The five preset dimensions include: cache pollution dimension, DNS hijacking dimension, direct attack on the recursive server dimension, attack on other servers using recursion dimension, and DNS service software vulnerability dimension. The authoritative end is used to analyze the parameters to be tested in the DNS recursive resolution system and return the analysis results to the client. The client is also configured to: assess the security risk index of each dimension based on the detected parameters, and calculate the overall security risk index of the system based on the assessed security risk index of each dimension.
[0042] To better understand the present invention, the present invention will be described in detail below with reference to specific embodiments.
[0043] According to one embodiment of the present invention, the present invention employs automated active measurement technology to detect and evaluate the relevant parameters required for assessing the security risk index of a DNS recursive resolution system. Specifically, the client sends multiple different DNS requests to the DNS recursive resolution system to deploy multiple automatic measurement probes in the DNS recursive resolution system. The automatic measurement probes automatically return the measured parameters to the client. The automatic measurement probes are categorized according to the type of parameters detected, and each type of automatic measurement probe is as follows: DNS service software detection (1 automatic measurement probe), DNSSEC and its configuration detection (10 automatic measurement probes), response rate detection group (100 automatic measurement probes), TXT large response truncation detection group (23 automatic measurement probes), user-side DNS cookie (1 automatic measurement probe), NXDOMAIN-cut detection (2 automatic measurement probes), TXID and source port number randomization detection group (10 automatic measurement probes), and other mechanism combination detection (1 automatic measurement probe). The present invention analyzes the flag fields and payload data content within the response data packets of the automatic measurement probes to determine whether the remote recursion has deployed these DNS security extension mechanisms in the measurement indicators. The DNS domain name information included in the measurement probes is resolved by the self-built authoritative measurement point, which also performs measurements on the deployment of the recursive-authoritative security extension mechanism. It should be understood that the types of automatic probe pointers and the number of automatic probe pointers used in each type are merely illustrative; implementers can configure them according to their needs.
[0044] According to one embodiment of the present invention, the method of obtaining the parameters required for evaluating the security risk index of the DNS recursive resolution system further includes using a client to send an automatic measurement pointer to the recursive server or forwarding server to be tested, analyzing the deployment of indicators of the recursive server or forwarding server to be tested on the authoritative end, and feeding back the analysis results to the client to complete the parameter collection.
[0045] According to one embodiment of the present invention, the parameters returned by the automatic measurement probe in the recursive server or forwarding server include: a client DNS cookies support parameter, which indicates whether the recursive server or forwarding server supports the client's DNS cookies; if supported, the value of the client DNS cookies support parameter is 1, otherwise the value of the parameter is 0; a client rule matching parameter, which indicates whether the response result of the recursive server or forwarding server is the same as the port number, IP address, DNS question field, and TXID number in the DNS request sent by the client; if the same, the value of the client rule matching parameter is 1, otherwise it is 0; a DNS service software version parameter, which indicates the DNS service software version of the recursive server or forwarding server and whether software version hiding is performed; and a response rate limit parameter, which indicates the number of DNS requests that the recursive server can resolve normally per unit time.
[0046] According to one embodiment of the present invention, the parameters in the analysis results returned by the authoritative server include: an authoritative server DNScookies support parameter, which indicates whether the recursive server or forwarding server supports the authoritative server's DNS cookies; an authoritative server rule matching parameter, which indicates whether the source IP in the DNS request sent by the recursive server or forwarding server to the authoritative server is the IP of the recursive server or forwarding server itself; if yes, the value of the authoritative server rule matching parameter is 1, otherwise the value is 0; a DNSSEC chain configuration parameter, which indicates whether the recursive server or forwarding server can verify the DNSSEC chain, and the number of types of misconfigured DNSSEC chains that can be verified; a QNAME minimization parameter, which indicates the minimum level of support in the recursive server or forwarding server; and a DNS-0x20 encoding parameter, which indicates whether the case of the domain name in the DNS request sent by the recursive server or forwarding server to the authoritative server is randomly shuffled; if yes, the value of the DNS-0x20 encoding parameter is 1. The encoding parameter has a value of 1, otherwise it is 0; the source port randomization parameter indicates the random range of source port numbers in the DNS requests sent by the recursive server or forwarding server to the authoritative server; the NXDOMAIN-cut parameter indicates whether the recursive server or forwarding server is configured with NXDOMAIN-cut, if so, the NXDOMAIN-cut parameter is 1, otherwise it is 0; the TXT large response truncation parameter indicates the maximum length limit of the TXT response of the recursive server or forwarding server in the case of UDP transmission.
[0047] According to one embodiment of the present invention, see Figure 1The figure illustrates all the measurement indicators and measurement methods involved in this invention. This invention collects all measurement data at the client measurement point and completes the measurement of all evaluation indicators by combining client measurement with client-authoritative collaborative measurement. Client measurement evaluates the recursive server or forwarding server from the client's perspective, while client-authoritative collaborative measurement evaluates the recursive server or forwarding server from the authoritative perspective.
[0048] According to an embodiment of the present invention, in client-side measurement, the present invention utilizes a client to send a probe script to a server under test (the server under test includes a recursive server and a forwarding server), receives the response, and analyzes and collects the measurement results. Specifically, the client-side measurement method includes: Step S1, DNS cookie (client) measurement: The client sends a DNS request of any type A containing its own DNS cookie to the server under test. If the received response contains DNS cookies of both the client and the server under test, then the server under test supports client-side DNS cookies; Step S2, rule matching (client) measurement: The client checks whether the port number, IP address, DNS question field, TXID number, and other information in the request and response correspond; Step S3, DNS service software version hiding measurement: The client measurement point sends the measurement command "dig @ipversion.bind chaos txt". If the DNS server version information is returned, the version is not hidden, and vice versa; Step S4: Software update and maintenance measurement: The client measurement point sends the measurement command "dig @ip version.bind The `chaostxt` command returns DNS server version information. If the version is newer, the software maintenance is good; if the version is older, the DNS server software maintenance is poor. Step S5 involves response rate limiting measurement. The client measurement point sends 100 distinct A-type DNS request packets to the server under test within one second and counts the number of successful resolutions. This operation is repeated twice at 10-minute intervals, and the average of the three measurements is used as the recursive response rate limit value. Steps S1 and S2 use one automatic measurement probe, steps S3 and S4 use one probe, and step S5 uses 100 probes.
[0049] According to one embodiment of the present invention, in client-authority collaborative measurement, the present invention utilizes a client to send a probe script to the server under test, and the authority analyzes the deployment of metrics on the server under test, encapsulates the analysis results into a response, and uses recursive forwarding of the response to the client to complete the metric collection and measurement. Specifically, client-authority collaborative measurement includes: Step T1, DNS cookies (authority) measurement, where the measurement point authority checks whether the additional field of the DNS data in the iterative query request sent by the server under test contains its own recursive client cookie. If it does, it indicates that the server under test has deployed DNS cookies (authority), and vice versa. The measurement point authority encapsulates the measurement results into the answer field of the response and sends it to the server under test; Step T2, rule matching (authority) measurement, where the measurement point authority checks whether the server under test has replaced the source IP with its own IP and other content of client rule matching. If it has not replaced, it is considered that rule matching has not been completed, and vice versa. The authoritative measurement point encapsulates the measurement results into the `answer` field of the response and sends it to the server under test. Step T3 involves DNSSEC measurement. On the authoritative measurement point, a correct DNSSEC chain and eight types of incorrect DNSSEC chains are deployed: unverified signature, expired signature, missing DNSKEY, missing zone key, missing nsec, missing rrsig, unsupported DS record, and unsupported DNSKEY. A domain name is assigned to each of these incorrect chains. The client at the measurement point sets the DO bit and AD bit to 1 in its script for verifying a correct DNSSEC chain. If the AD bit is still set to 1 in the response to the correct DNSSEC chain verification, DNSSEC is considered to have been deployed. If the AD bit is not 1, the client requests the authoritative point again to confirm whether DNSSEC verification has been completed on the authoritative side. When probing error verification capabilities, request the corresponding mismatched subdomain. If the server under test returns a response with rcode=2 and contains the correct DNSSEC error type in the additional field, then the DNSSEC mismatch can be correctly verified. In step T4, QNAME minimization measurement is performed by sending a long domain name containing no less than two random subdomains using the measurement point client. If the authoritative end of the measurement point finds that the server under test adds a prefix to each tag during the iterative request process, then the server under test is considered to support QNAME minimization.Step T5, DNS-0x20 encoding measurement: If the authoritative end of the measurement point detects that the case of the English letters in the domain name is randomly shuffled in the recursively sent requests, it is considered to support DNS-0x20 encoding. Step T6, TXID and source port randomization measurement: The client of the measurement point continuously sends multiple distinct domain name requests. If the authoritative end of the measurement point detects that the server under test uses a different source port or TXID each time it makes an iterative request, it calculates the range of random values as the degree of randomization. Step T7, NXDOMAIN-cut measurement: The client of the measurement point sends a request for a subdomain (e.g., a.example.com) resolved by the authoritative end of the measurement point to the server under test, and the authoritative end returns an NXDOMAIN response after receiving the request. The client then sends the subdomain of the subdomain (e.g., 1.a.example.com). If the server under test directly responds with NXDOMAIN, it is considered to have configured NXDOMAIN-cut, and vice versa. Step T8, TXT large response truncation measurement: The authoritative end of the measurement point constructs a large number of responses containing subdomains with TXT content of different sizes. The measurement point client sequentially requests these domain names and records the maximum size of the TXT response that each IP address under test can return. Steps T1, T2, T5, and T4 share one probe: the client sends a request for the domain name "q001.{4-digit random number}.authority domain" to the recursive server or forwarding server. The recursive server or forwarding server responds with an A record, and the measurement result is contained in this A record. Step T3 uses 10 probes: the client sends requests for the domain names "right.authority domain", "www.right4.authority domain", "signatureNotValid.authority domain", "signatureExpired.authority domain", "dnskeyMissing.authority domain", "noZoneKey.authority domain", "nsecMissing.authority domain", "rrsigMissing.authority domain", "unsupportedDs.authority domain", and "unsupportedDnskey.authority domain" to the server under test, respectively. Step T6 uses 10 probes: The client sends 10 requests for the domain name "r{4-digit random number}.authority domain" with 10 different random numbers to the server under test. The server responds with an A record containing the source port number and TXID. Step T6 uses two probes: The client sends two domain names sequentially, "00.authority domain" and "99.00.authority domain". Step T7 uses two probes: The client sends two domain names sequentially, "00.authority domain" and "99.00.authority domain".Step T8 uses 23 probes, sending the following 23 domain names: "len300.authoritative domain", "len400.authoritative domain", "len500.authoritative domain", "len600.authoritative domain", "len700.authoritative domain", "len800.authoritative domain", "len900.authoritative domain", "len1000.authoritative domain", "len1100.authoritative domain", "len1200.authoritative domain", "len1300.authoritative domain", "len1400.authoritative domain", "len1500.authoritative domain", "len1600.authoritative domain", "len1700.authoritative domain", "len1800.authoritative domain", "len1900.authoritative domain", "len2000.authoritative domain", "len2500.authoritative domain", "len3000.authoritative domain", "len3500.authoritative domain", "len4000.authoritative domain", and "len5000.authoritative domain".
[0050] According to one embodiment of the present invention, the security risk index of the recursive server and the forwarding server are measured and calculated separately. The security risk index of the recursive server includes five dimensions, and the security risk index of the forwarding server includes three dimensions. The five dimensions of the security risk index of the recursive server are: cache pollution, DNS hijacking, direct attack on the recursive server, exploiting recursion to attack other servers, and DNS service software vulnerability. The three dimensions of the security risk index of the forwarding server are: direct attack on the recursive server, exploiting recursion to attack other servers, and DNS service software vulnerability. It should be noted that when calculating the security risk index of recursive servers and forwarding servers in the three dimensions of directly attacking recursive servers, exploiting recursion to attack other servers, or DNS service software vulnerabilities, the calculation formula used for recursive servers and forwarding servers is the same, but the parameters used in the calculation are different. Specifically, when calculating the security risk index of recursive servers, the parameters determined by the authoritative analysis results of the recursive server or the detection results of the automatic measurement probes in the recursive server are used for calculation. When calculating the security risk index of forwarding servers, the parameters determined by the authoritative analysis results of the forwarding server or the detection results of the automatic measurement probes in the forwarding server are used for calculation.
[0051] According to one embodiment of the present invention, the security risk index of the recursive server is calculated in the following manner:
[0052]
[0053] in, This indicates the security risk index of the recursive server. This represents the security risk index of recursive servers in terms of DNS hijacking. This represents the security risk index of the recursive server in terms of cache pollution. This represents the security risk index of a recursive server in terms of direct attacks on recursive servers. This represents the security risk index of a recursive server in terms of using recursion to attack other servers. This represents the security risk index of recursive servers in terms of DNS service software vulnerabilities.
[0054] According to one embodiment of the present invention, the security risk index of the forwarding server is calculated in the following manner:
[0055]
[0056] in, This indicates the security risk index of the forwarding server. This indicates the security risk index of the forwarding server in terms of directly attacking the recursive server. This indicates the security risk index of the forwarding server in terms of recursive attacks on other servers. This indicates the security risk index of the forwarding server in terms of DNS service software vulnerabilities.
[0057] According to one embodiment of the present invention, the security risk index of a recursive server in the DNS hijacking dimension is calculated in the following manner:
[0058]
[0059] in, This represents the security risk index of recursive servers in terms of DNS hijacking. and These are parameters determined based on the analysis results of the recursive server from the authoritative source or the detection results of the automatic measurement probes in the recursive server. This represents the parameter to minimize QNAME. The range of values for is (-k, 0). This represents the DNSSEC chain configuration score calculated based on the DNSSEC chain configuration parameters, when the recursive server is not configured with a DNSSEC chain. The value is When the recursive server is configured with a DNSSEC chain, The value is ,in, This indicates the preset score threshold. This indicates the number of misconfigured DNSSEC chain types that the recursive server can detect. This indicates the number of DNSSEC chains containing configuration error types included in the automatic measurement probe.
[0060] According to one embodiment of the present invention, the security risk index of the recursive server in terms of cache pollution is calculated in the following manner:
[0061]
[0062] in, This represents the security risk index of the recursive server in terms of cache pollution. , and These are parameters determined based on the analysis results of the recursive server from the authoritative source or the detection results of the automatic measurement probes in the recursive server. This represents the security risk index of recursive servers in terms of DNS hijacking. This represents the final rule matching parameters determined based on the client-side rule matching parameters and the authoritative rule matching parameters. When both the client-side and authoritative rule matching parameters are 1, this indicates a valid rule matching parameter. The value is 1, otherwise, The value is 0. This indicates whether the recursive server supports authoritative DNS cookies. If supported, then... The value is 1, otherwise, The value is 0. A parameter representing the degree of randomization of the source port of the recursive server. ,in, This represents a window of opportunity, which is subject to the response time limit of the authoritative server (usually 0.1s). This indicates the number of data packets sent by the attacker per second. This indicates the number of authoritative name servers for the domain (approximately 2.5 on average). Indicates the attack time. Indicates the cache duration of the target domain. The value is 256. This represents the random range of TXID and the random range of x source port number.
[0063] According to one embodiment of the present invention, the security risk index of a recursive server or forwarding server in the dimension of directly attacking a recursive server is calculated in the following manner:
[0064]
[0065] in, This represents the security risk index of a recursive server or forwarding server in terms of direct attacks on recursive servers. This represents the traffic when a recursive server or forwarding server uses security mechanisms. =x Rate +x NXDOMAIN +(1-x NXDOMAIN )*(x DNSSEC *min{x Rate ,birthattack(x aveNum )}+(1-x DNSSEC )*x Rate ), x aveNum Indicates the number of second-level domains under the top-level domain, x Rate Indicates the response rate limit, x NXDOMAIN To indicate whether a recursive server or forwarding server is configured with a response truncation parameter, x DNSSEC Parameters indicating whether DNSSEC is supported. This represents the traffic when the recursive server or forwarding server does not use security mechanisms, x normal =x attackRate x attackRate This indicates the attack rate that a single controlled attack machine can achieve. This represents the total number of recursive servers and forwarding servers that may participate in DNS recursive resolution in the DNS recursive resolution system. Specifically, This represents the total number of servers (including recursive servers and forwarding servers) that may participate in DNS recursive resolution in a single DNS query, due to needs such as load balancing and traffic distribution.
[0066] According to one embodiment of the present invention, the security risk index of a recursive server or forwarding server in terms of using recursion to attack other servers is calculated in the following manner:
[0067]
[0068]
[0069]
[0070] in, This represents the security risk index of a recursive server or forwarding server in terms of its ability to exploit recursion to attack other servers. This represents the security risk index calculated based on the analysis results of the recursive server or forwarding server returned by the authoritative source. This represents a security risk index calculated based on the detection results of the automatic measurement probes returned by the recursive server or forwarding server. This represents the traffic when a recursive server or forwarding server uses security mechanisms, x expand =x NXDOMAIN +(1-x NXDOMAIN )*(x DNSSEC *min{x Rate ,birthattack(x aveNum )}+(1-x DNSSEC )*x Rate ), This represents the traffic when the recursive server or forwarding server does not use security mechanisms, x normal =x attackRate , This parameter indicates whether the recursive server or forwarding server supports client DNS cookies. This indicates that the response from the recursive server or forwarding server has been truncated. This indicates the default traditional DNS response size.
[0071] According to one embodiment of the present invention, the security risk index of the recursive server or forwarding server on the DNS service software vulnerability dimension is calculated as follows: the security risk index of each DNS service software version is pre-configured on the client; the version of the DNS service software of the recursive server or forwarding server is obtained based on the analysis results returned by the authoritative end and the parameters detected by the automatic measurement probe. If the DNS service software version is hidden, the security risk index is 1; otherwise, the corresponding security risk index is queried from the client based on the DNS service software version.
[0072] According to one embodiment of the present invention, based on the analysis results returned by the authoritative server and the parameters detected by the automatic measurement probe in the DNS recursive resolution system, a preset method is used to issue risk warnings to the servers in the DNS recursive resolution system. The servers in the DNS recursive resolution system include recursive servers and forwarding servers. The preset method is as follows: when a server is configured with an incorrect DNSSEC chain, a risk warning of DNSSEC chain mismatch is issued, and the number of incorrectly configured DNSSEC chains in the server is disclosed; when a server does not limit the query access rate of a single user, a risk warning of query access rate is issued; when the random space of the server's source port number or TXID is less than 10000, a risk warning of insufficient randomness is issued; when a server does not hide the DNS service software version it uses, a risk warning of DNS service software version not being hidden is issued; when a server does not deploy TXT large response truncation or the TXT response payload exceeds 1500, a risk warning of TXT large response truncation is issued.
[0073] To facilitate understanding of how this invention provides risk warnings to servers in a DNS recursive resolution system, a detailed description will be provided below with reference to the accompanying drawings. Figure 2 The risk warning illustrated in the diagram includes the following steps: First, determine if the test server is configured with DNSSEC. If DNSSEC is configured but an error prevents the server from detecting faulty DNSSEC chains, a warning of "weak DNSSEC mismatch detection capability" is issued, specifying the type of mismatch that failed verification. Second, determine if the test server limits the query access rate for a single user. If this limitation is not implemented, a warning is issued and it is recommended to limit the query access rate for a single user to 20 pkt / s or less. Third, determine if the test server uses a highly randomized random number generator to generate the source port number and TXID. If the randomness of either the source port number or TXID is less than 10,000, a warning of insufficient randomness is issued. Fourth, determine if the test server is hiding the version of the DNS service software it uses. If not, a warning is issued and it is recommended to modify the configuration as soon as possible. Fifth, determine if the test server has deployed TXT large response truncation. If the TXT response load exceeds 1500, a warning response is issued.
[0074] In summary, this invention utilizes a client-side measurement host to probe specific domain names and establishes an authoritative server to organize partial responses, thereby automating the collection of quantitative indicators. Based on the collected indicators, it conducts a risk assessment of the DNS recursive resolution system from five dimensions: cache pollution, DNS hijacking, direct attacks on recursive servers, using recursion to attack other servers, and DNS service software vulnerabilities. Compared with existing DNS security risk assessment schemes, this invention has more lenient implementation conditions and more comprehensive assessment indicators.
[0075] It should be noted that although the steps are described in a specific order above, it does not mean that the steps must be executed in the above specific order. In fact, some of these steps can be executed concurrently, or even in a different order, as long as the required function can be achieved.
[0076] The various embodiments of the present invention have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or technical improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.
Claims
1. A security risk quantification assessment device for a DNS recursive resolution system, the DNS recursive resolution system including a recursive server and a forwarding server, the assessment device being used to assess the security risk index of the DNS recursive resolution system by probing parameters of the DNS recursive resolution system through five preset dimensions, wherein, The evaluation device includes a client and an authority unit, characterized in that: The client is used to send multiple different DNS requests to the DNS recursive resolution system to deploy multiple automatic measurement probes in the DNS recursive resolution system. Each preset dimension corresponds to multiple automatic measurement probes, and each automatic measurement probe is used to detect parameters related to the security risk index of its corresponding dimension. The five preset dimensions include: cache pollution dimension, DNS hijacking dimension, direct attack on recursive server dimension, attack on other servers using recursion dimension, and DNS service software vulnerability dimension. The authoritative end is used to analyze the parameters to be tested in the DNS recursive resolution system and return the analysis results to the client; The client is also configured to: evaluate the security risk index of each detected dimension based on the parameters of each dimension, and calculate the overall security risk index of the system based on the evaluated security risk index of each dimension.
2. The apparatus according to claim 1, characterized in that, The device is configured to: The client sends multiple different DNS requests to the recursive server to deploy an automated measurement probe in the recursive server to detect parameters related to the dimensions of cache pollution, DNS hijacking, direct attack on the recursive server, attack on other servers using recursion, and DNS service software vulnerabilities. The client sends multiple different DNS requests to the forwarding server to deploy an automated measurement probe in the forwarding server to detect parameters related to direct attacks on recursive servers, recursive attacks on other servers, and DNS service software vulnerabilities.
3. The apparatus according to claim 2, characterized in that, The client is configured to calculate the security risk indices of the recursive server and the forwarding server respectively, and use the calculated security risk index as the final security risk index of the DNS recursive resolution system. The security risk index of the recursive server is calculated by the client based on the analysis results of the authoritative end on the recursive server and the parameters detected by the automatic measurement probe in the recursive server. The security risk index of the recursive server includes the dimensions of cache pollution, DNS hijacking, direct attack on the recursive server, attack on other servers by using recursion, and DNS service software vulnerability. The security risk index of the forwarding server is calculated by the client based on the analysis results of the forwarding server from the authoritative end and the parameters detected by the automatic measurement probe in the forwarding server. The security risk index of the forwarding server includes the dimensions of directly attacking the recursive server, using recursion to attack other servers, and DNS service software vulnerabilities.
4. The apparatus according to claim 3, characterized in that, The client is configured to calculate the security risk index of the recursive server in the following manner: in, This indicates the security risk index of the recursive server. This represents the security risk index of recursive servers in terms of DNS hijacking. This represents the security risk index of the recursive server in terms of cache pollution. This represents the security risk index of a recursive server in terms of direct attacks on recursive servers. This represents the security risk index of a recursive server in terms of using recursion to attack other servers. This represents the security risk index of recursive servers in terms of DNS service software vulnerabilities.
5. The apparatus according to claim 4, characterized in that, The client is configured to calculate the security risk index of the forwarding server in the following manner: in, This indicates the security risk index of the forwarding server. This indicates the security risk index of the forwarding server in terms of directly attacking the recursive server. This indicates the security risk index of the forwarding server in terms of recursive attacks on other servers. This indicates the security risk index of the forwarding server in terms of DNS service software vulnerabilities.
6. The apparatus according to claim 5, characterized in that, The client is configured to calculate the security risk index of the recursive server in the DNS hijacking dimension as follows: in, This represents the security risk index of recursive servers in terms of DNS hijacking. and These are parameters determined based on the analysis results of the recursive server from the authoritative source or the detection results of the automatic measurement probes in the recursive server. This represents the parameter to minimize QNAME. This represents the DNSSEC chain configuration score calculated based on the DNSSEC chain configuration parameters, when the recursive server is not configured with a DNSSEC chain. The value is When the recursive server is configured with a DNSSEC chain, The value is ,in, This indicates the preset score threshold. This indicates the number of misconfigured DNSSEC chain types that the recursive server can detect. This indicates the number of DNSSEC chains containing configuration error types included in the automatic measurement probe.
7. The apparatus according to claim 6, characterized in that, The client is configured to calculate the security risk index of the recursive server in terms of cache pollution as follows: in, This represents the security risk index of the recursive server in terms of cache pollution. , and These are parameters determined based on the analysis results of the recursive server from the authoritative source or the detection results of the automatic measurement probes in the recursive server. This represents the security risk index of recursive servers in terms of DNS hijacking. This represents the final rule matching parameters determined based on the client-side rule matching parameters and the authoritative rule matching parameters. When both the client-side and authoritative rule matching parameters are 1, this indicates a valid rule matching parameter. The value is 1, otherwise, The value is 0. This indicates whether the recursive server supports authoritative DNS cookies. If supported, then... The value is 1, otherwise, The value is 0. A parameter indicating the degree of randomization of the source port of the recursive server.
8. The apparatus according to claim 7, characterized in that, The client is configured to calculate the security risk index of the recursive server or forwarding server in the dimension of directly attacking the recursive server in the following manner: in, This represents the security risk index of a recursive server or forwarding server in terms of direct attacks on recursive servers. This represents traffic when a recursive server or forwarding server uses security mechanisms. This represents traffic when the recursive server or forwarding server does not use security mechanisms. This represents the total number of recursive servers and forwarding servers that may participate in DNS recursive resolution in the DNS recursive resolution system.
9. The apparatus according to claim 8, characterized in that, The client is configured to calculate the security risk index of the recursive server or forwarding server in terms of exploiting recursive attacks on other servers in the following manner: in, This represents the security risk index of a recursive server or forwarding server in terms of its ability to exploit recursion to attack other servers. This represents the security risk index calculated based on the analysis results of the recursive server or forwarding server returned by the authoritative source. This represents a security risk index calculated based on the detection results of the automatic measurement probes returned by the recursive server or forwarding server. This represents traffic when a recursive server or forwarding server uses security mechanisms. This represents traffic when the recursive server or forwarding server does not use security mechanisms. This parameter indicates whether the recursive server or forwarding server supports client DNS cookies. This indicates that the response from the recursive server or forwarding server has been truncated. This indicates the default traditional DNS response size.
10. The apparatus according to claim 9, characterized in that, The client is configured to calculate the security risk index of the recursive server or forwarding server on the DNS service software vulnerability dimension in the following manner: Pre-configure the security risk index for each DNS service software version on the client side; Based on the analysis results returned by the authoritative end and the parameters detected by the automatic measurement probe, the version of the DNS service software of the recursive server or forwarding server is obtained. If the DNS service software version is hidden, the security risk index is 1; otherwise, the corresponding security risk index is queried from the client based on the DNS service software version.
11. The apparatus according to claim 10, characterized in that, The client is configured to: based on the analysis results returned by the authoritative source and the parameters detected by the automatic measurement probes in the DNS recursive resolution system, issue risk warnings to the servers in the DNS recursive resolution system using a preset method. The servers in the DNS recursive resolution system include recursive servers and forwarding servers. The preset method is as follows: When the server is configured with an incorrect DNSSEC chain, a risk warning of DNSSEC chain mismatch is issued, and the number of incorrectly configured DNSSEC chains in the server is indicated. If the server does not limit the query access rate for a single user, a risk warning regarding the query access rate will be issued. If the random space of the server's source port number or TXID is less than 10000, a risk warning of insufficient randomness will be issued. If the server fails to hide the version of the DNS service software it is using, a risk warning will be issued indicating that the DNS service software version is not hidden. If the server does not have TXT large response truncation deployed or the TXT response load exceeds 1500, a TXT large response truncation risk warning will be issued.