DNS encryption transmission and flow dynamic allocation method and system based on TLS

Abstract

The invention relates to a DNS encrypted transmission and flow dynamic allocation method and system based on TLS, and the method comprises the steps: executing a TLS protocol handshake to generate an encrypted transmission channel through building a TCP connection, and limiting an 853 port to only receive a TLS handshake message; the encrypted DNS query is sent and processed through the encrypted transmission channel, and the transmission efficiency is optimized by using pipeline scheduling and a disordered response mechanism; by monitoring a network state and a server load, an encrypted transmission mode or an unencrypted transmission mode is dynamically switched based on a preset threshold value. By decoupling the DoT module and the recursion function, flexible configuration and dynamic loading are supported, full-process encryption communication between the recursion server and the authoritative server is achieved, and the problem that in the prior art, a safety link is incomplete is solved. A dynamic allocation mechanism is introduced, encrypted and unencrypted paths are intelligently switched according to the network state and the load, and the safety and the availability are balanced.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network communication, and particularly relates to a DNS encryption transmission and flow dynamic allocation method and system based on TLS. BACKGROUND

[0002] The domain name system (DNS) is the core infrastructure of the Internet, responsible for mapping domain names to IP addresses to support network communication. Traditional DNS queries are mainly transmitted in plaintext form through the UDP protocol on port 53, and are widely adopted due to their efficiency, but there are significant security risks such as DNS hijacking, network monitoring, and buffer poisoning. For large DNS responses (such as DNSSEC or IPv6-related records), TCP protocol is often used to ensure reliable transmission, but its configuration is complex and inefficient in encrypted scenarios. The DNS encryption transmission protocol based on TLS (DoT) implements encrypted communication through port 853, which improves security, but still has defects.

[0003] A Chinese patent CN116155614A proposes a recursive encryption transmission method based on DoT, which supports encrypted communication between recursive servers and authoritative servers, but its encryption function and recursive resolution logic are strongly coupled, lacking flexible modular design, leading to difficult debugging and insufficient deployment adaptability. In addition, existing DoT schemes usually use static configuration, making it difficult to dynamically adjust encrypted and unencrypted transmission according to network status (such as link congestion, handshake failure) or server load, affecting service availability. At the same time, there is a lack of fine monitoring of the state of the encryption module, which is prone to SSL DDoS attack risks or performance bottlenecks. SUMMARY

[0004] The purpose of the present application is to provide a DNS encryption transmission and flow dynamic allocation method and system based on TLS to solve the problem that the prior art cannot achieve full-process encrypted communication, dynamic path allocation, and modular deployment.

[0005] To achieve one of the above-mentioned purposes, an embodiment of the present application provides a DNS encryption transmission and flow dynamic allocation method based on TLS, the method comprising,

[0006] By establishing a TCP connection, performing a TLS protocol handshake to generate an encrypted transmission channel, and limiting the 853 port to only receive TLS handshake messages;

[0007] Send and process encrypted DNS queries through the encrypted transmission channel, and optimize transmission efficiency using pipeline scheduling and out-of-order response mechanisms;

[0008] By monitoring network status and server load, dynamically switching between encrypted transmission or unencrypted transmission modes based on preset thresholds.

[0009] As a further improvement of an embodiment of the application, the method further comprises that the generating an encrypted transmission channel by establishing a TCP connection and performing a TLS protocol handshake comprises,

[0010] sending a TCP connection request message to the server through the 853 port of the client;

[0011] sending a TLS Client Hello message on the established TCP connection. The TLS Client Hello message includes supported TLS versions, encryption suites, and server domain names, used to initiate identity authentication and key negotiation;

[0012] verifying by the server whether the TLS Client Hello message is a TLS handshake message;

[0013] generating a server certificate and a Server Hello message by the server, verifying the legality of the server certificate by the client and negotiating a session key to complete the TLS handshake and generate an encrypted transmission channel.

[0014] As a further improvement of an embodiment of the application, the method further comprises that the limiting the 853 port to only receive TLS handshake messages comprises,

[0015] configuring a firewall rule to limit the 853 port to only receive TLS handshake messages and reject plaintext DNS messages;

[0016] monitoring the traffic characteristics of the 853 port, and if non-TLS messages are detected to exceed a preset threshold, triggering an alarm and temporarily blocking the abnormal source IP;

[0017] controlling the client to prohibit sending plaintext DNS data through the 853 port.

[0018] As a further improvement of an embodiment of the application, the method further comprises that the sending and processing encrypted DNS queries through the encrypted transmission channel comprises,

[0019] in response to the client sending batch encrypted DNS queries through the encrypted transmission channel, enabling TCP pipelining operation to support concurrent queries;

[0020] decrypting the encrypted DNS queries by the server and handing them over to the DNS resolution system for processing to generate response data;

[0021] encrypting the response data by the server and sending it to the client according to the out-of-order response rule;

[0022] decrypting the encrypted response data by the client and matching the original query through the message ID and QNAME fields to complete DNS resolution.

[0023] As a further improvement of an embodiment of the application, the method further comprises that the optimizing transmission efficiency by using the pipeline scheduling and out-of-order response mechanism comprises,

[0024] Configure the single-source IP maximum connection number, the global connection total number, the maximum DNS transaction number and the timeout time;

[0025] Allow the client to send a subsequent query on the encrypted transmission channel without waiting for a previous response;

[0026] Match the out-of-order response through the message ID and QNAME fields;

[0027] Release the TCP connection according to the timeout time or the maximum transaction number.

[0028] As a further improvement of an embodiment of the application, the method further comprises that the dynamically switching the encrypted transmission or unencrypted transmission mode based on a preset threshold by monitoring the network state and the server load comprises,

[0029] Monitor the CPU occupancy rate, memory occupancy rate, concurrent connection number of the 853 port, and the network type and connection success rate of the client, and generate a decision basis for transmission mode switching;

[0030] When the 853 port load exceeds a preset threshold, generate a TLS temporary overload alarm and send it to the client through a TCP connection;

[0031] After the client receives the TLS temporary overload alarm, switch to the 53 port to suspend encrypted transmission to relieve the server load;

[0032] When the load falls below the preset threshold, cancel the alarm and restore encrypted transmission.

[0033] As a further improvement of an embodiment of the application, the method further comprises that when encrypted transmission is unavailable, using the 53 port to process plaintext DNS queries through a degradation logic to ensure compatibility with the traditional DNS system, specifically comprising,

[0034] When encrypted transmission failure is detected, trigger the degradation logic and switch to the 53 port to send plaintext DNS queries;

[0035] The server processes the plaintext DNS queries of the 53 port according to the traditional DNS logic through a compatibility processing mechanism and returns a plaintext response;

[0036] The client records the degradation reason for optimizing subsequent connection decisions;

[0037] Support the DoT protocol stack through recursive servers and authoritative servers to ensure the continuity of the end-to-end encrypted link, and maintain the traffic separation of the 853 port and the 53 port through a traffic isolation mechanism.

[0038] To achieve one of the above-mentioned objectives, an embodiment of the present invention also provides a DNS encrypted transmission and dynamic traffic allocation system based on TLS, the system comprising an encrypted channel establishment module, an encrypted query processing module, and a dynamic allocation decision module;

[0039] The encrypted channel establishment module is used to generate an encrypted transmission channel by establishing a TCP connection and performing a TLS handshake, while restricting port 853 to only receive TLS handshake messages.

[0040] The encrypted query processing module is used to send and process encrypted DNS queries through an encrypted transmission channel, and optimizes transmission efficiency using pipeline scheduling and unordered response mechanisms.

[0041] The dynamic allocation decision module is used to dynamically switch between encrypted and unencrypted transmission modes based on preset thresholds by monitoring network status and server load.

[0042] To achieve one of the above-mentioned objectives, an embodiment of the present invention also provides an electronic device, including a memory and a processor, characterized in that the memory stores a computer program that can run on the processor, and when the program is executed on the processor, it implements the steps in the TLS-based DNS encrypted transmission and dynamic traffic allocation method described above.

[0043] To achieve one of the above-mentioned objectives, an embodiment of the present invention also provides a storage medium storing a computer program, characterized in that, when the computer program is executed by a processor, it implements the steps in the TLS-based DNS encrypted transmission and dynamic traffic allocation method described above.

[0044] Compared with existing technologies, this invention provides a TLS-based DNS encrypted transmission and dynamic traffic allocation method and system. By decoupling the DoT module and recursive function, it supports flexible configuration and dynamic loading, achieving end-to-end encrypted communication between the recursive server and the authoritative server, thus overcoming the problem of incomplete security links in existing technologies. The introduction of a dynamic allocation mechanism intelligently switches between encrypted and unencrypted paths based on network status and load, balancing security and availability. Status monitoring and optimization of the encryption module ensure the stability of TLS communication, avoid performance bottlenecks, and improve the reliability and deployment flexibility of DNS services. Attached Figure Description

[0045] Figure 1 This is an overall flowchart of the DNS encrypted transmission and dynamic traffic allocation method based on TLS described in this invention.

[0046] Figure 2This is a schematic diagram of the architecture of the DNS encrypted transmission and dynamic traffic allocation system based on TLS described in this invention. Detailed Implementation

[0047] The present invention will now be described in detail with reference to the specific embodiments shown in the accompanying drawings. However, these embodiments do not limit the present invention, and any structural, methodological, or functional modifications made by those skilled in the art based on these embodiments are included within the scope of protection of the present invention.

[0048] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0049] In Embodiment 1 of the present invention, the present invention provides a method for DNS encrypted transmission and dynamic traffic allocation based on TLS, such as... Figure 1 As shown, the method includes,

[0050] S1: Establish a TCP connection, perform a TLS handshake to generate an encrypted transmission channel, and restrict port 853 to only receive TLS handshake messages;

[0051] S2: Send and process encrypted DNS queries through an encrypted transmission channel, and optimize transmission efficiency using pipeline scheduling and out-of-order response mechanisms;

[0052] S3: By monitoring network status and server load, it dynamically switches between encrypted and unencrypted transmission modes based on preset thresholds.

[0053] In one specific embodiment of the present invention, the step of establishing a TCP connection and performing a TLS handshake to generate an encrypted transmission channel includes:

[0054] The client sends a TCP connection request message to port 853 of the server.

[0055] A TLS Client Hello message is sent over the established TCP connection. This TLS Client Hello message includes the supported TLS versions, cipher suites, and server domain name, used to initiate authentication and key negotiation.

[0056] The server verifies whether the TLS Client Hello message is a TLS handshake message;

[0057] The server generates a server certificate and a Server Hello message, and the client verifies the validity of the server certificate and negotiates a session key to complete the TLS handshake and generate an encrypted transmission channel.

[0058] It should be noted that the establishment of the encrypted transmission channel is achieved through the collaborative work of the TCP connection management module, the traffic isolation module, and the DoT protocol processing module. This process sequentially completes the establishment of a reliable connection, the transmission of handshake messages, security verification, and key negotiation, forming a secure encrypted transmission channel that provides the foundation for subsequent encrypted DNS queries and dynamic allocation.

[0059] Furthermore, the client sends a TCP connection request message (SYN message) to port 853 of the server through the TCP connection management module to initiate the establishment of a reliable transmission channel. After receiving the SYN message, the server returns an acknowledgment message (ACK), completing the TCP three-way handshake and establishing a bidirectional communication connection. The TCP connection management module is configured with parameters including the maximum number of connections per source IP, the total number of global connections, and the timeout period to optimize connection resource allocation and prevent resource exhaustion.

[0060] Furthermore, on the established TCP connection, the client sends a TLS ClientHello message through the DoT protocol processing module. The message includes the supported TLS version (e.g., TLS 1.2 or 1.3), a list of cipher suites (e.g., AES-GCM, ChaCha20-Poly1305), and the server name indication (SNI) for initiating authentication and key negotiation. The client may also include supported signature algorithms and extended fields (e.g., ALPN) to ensure protocol compatibility and security.

[0061] Furthermore, the server's traffic isolation module verifies the received TLS Client Hello messages, confirming them as legitimate TLS handshake messages through firewall rules and packet characteristic analysis (such as TLS record layer header format). If a non-TLS message (such as a plaintext DNS query) is detected, it is rejected and an anomaly alarm is triggered. If necessary, the abnormal source IP is temporarily blocked to prevent malicious traffic interference.

[0062] Furthermore, the server generates a server certificate and a Server Hello message via the DoT protocol processing module. The server certificate contains a public key and a certificate chain, while the Server Hello message specifies the final selected TLS version and cipher suite. Upon receiving this, the client verifies the certificate's legitimacy using the DoT protocol processing module, including checking the integrity of the certificate chain, its validity period, and its match with the server's domain name. If verification is successful, the client and server negotiate a session key using the Diffie-Hellman or Elliptic Curve Diffie-Hellman (ECDH) algorithm, completing the TLS handshake and establishing an encrypted transmission channel. This encrypted channel supports encrypted transmission of subsequent DNS queries, ensuring data confidentiality and integrity.

[0063] In one specific embodiment of the present invention, the restriction that port 853 only receives TLS handshake messages includes,

[0064] Configure firewall rules to restrict port 853 to accept only TLS handshake messages and reject plaintext DNS messages;

[0065] Monitor the traffic characteristics of port 853. If non-TLS packets are detected and exceed the preset threshold, trigger an alarm and temporarily block the abnormal source IP.

[0066] Control the client to prevent the sending of plaintext DNS data through port 853.

[0067] It should be noted that restricting port 853 from receiving TLS handshake messages works in conjunction with the firewall rules, real-time monitoring, and client protocol stack configuration of the traffic isolation module. This strictly limits port 853 to receiving only TLS handshake messages, preventing interference from plaintext DNS messages or malicious traffic. Together with the encryption function of the DoT protocol processing module and the connection optimization of the TCP connection management module, this ensures the security and reliability of the encrypted transmission channel.

[0068] Furthermore, the server's traffic isolation module is configured with firewall rules that, based on TLS protocol message characteristics (such as TLS record layer header format and protocol version identifier), restrict port 853 to only accept TLS handshake messages (such as Client Hello and Server Hello), rejecting plaintext DNS messages or other non-TLS protocol data. The rules identify legitimate TLS handshake messages by matching the message's preamble and length field, while simultaneously prohibiting unencrypted DNS query messages from being transmitted through port 853, ensuring the purity of the encrypted channel.

[0069] Furthermore, the traffic isolation module monitors the traffic characteristics of port 853 in real time, including packet length, protocol header structure, and traffic rate. If the proportion of non-TLS packets (such as plaintext DNS queries or abnormal packets) exceeds a preset threshold (e.g., non-TLS packet proportion exceeds 5% per second or the number of consecutive abnormal packets exceeds 10), an alarm mechanism is triggered. The alarm is reported to the administrator through logging or notification system, and the abnormal source IP is added to a temporary blacklist to prevent it from further accessing port 853. The duration is determined by a preset policy (e.g., 5 minutes).

[0070] Furthermore, the client configures the DoT protocol stack to prohibit the sending of plaintext DNS data on port 853. This is specifically implemented by setting a mandatory TLS encapsulation policy in the client's protocol stack, ensuring that all DNS queries sent to port 853 are encrypted using the TLS record layer. When the client detects an unencrypted DNS query request, it automatically rejects the request or redirects it to port 53, preventing security risks caused by misuse of port 853.

[0071] In one specific embodiment of the present invention, encrypted DNS queries are sent and processed through an encrypted transmission channel, specifically as follows:

[0072] In response to the client sending a batch of encrypted DNS queries through the encrypted transmission channel, TCP pipeline operation is enabled to support concurrent queries;

[0073] The server decrypts the encrypted DNS query and hands it over to the DNS resolution system for processing, generating response data.

[0074] The server encrypts the response data and sends it to the client according to the unordered response rules;

[0075] The client decrypts the encrypted response data and matches the original query using the message ID and QNAME fields to complete the DNS resolution.

[0076] It should be noted that the sending and processing of encrypted DNS queries are accomplished through the collaborative efforts of the encryption / decryption function of the DoT protocol processing module, the pipeline scheduling of the TCP connection management module, and the out-of-order response mechanism. Pipeline operation and out-of-order responses optimize transmission efficiency, message ID and QNAME matching ensure resolution accuracy, and the encrypted channel establishment (TLS handshake) and traffic isolation modules work together to guarantee a secure and efficient DNS service.

[0077] Furthermore, in response to the client sending batch encrypted DNS queries over the established encrypted transmission channel via the DoT protocol processing module, the query data is fragmented, compressed, and encrypted through the TLS record layer to form TLS encrypted messages. The client enables TCP pipelining, allowing multiple DNS query requests to be sent consecutively without receiving responses to preceding queries. The query messages include message ID and QNAME fields to identify the query content. The TCP connection management module supports high throughput for concurrent queries and reduces response latency by configuring the maximum number of DNS transactions and timeout.

[0078] Furthermore, the server receives encrypted DNS query messages through the DoT protocol processing module, decrypts the TLS record layer data using the session key, and extracts the original DNS query content, including the message ID, QNAME, and query type (such as A or AAAA records). The decrypted query is then processed by the DNS resolution system, which searches for the corresponding IP address or other resource record in the domain name record database and generates response data. The resolution process supports recursive queries or initiating DoT encrypted queries to authoritative servers, ensuring end-to-end security.

[0079] Furthermore, the server's DoT protocol processing module encrypts the response data generated by the DNS resolution system and encapsulates it into a TLS record layer message, containing message ID and QNAME fields to correspond to the original query. Responses are sent according to an out-of-order response rule, meaning they are scheduled to the client via the TCP connection management module based on server processing efficiency rather than the query reception order. This out-of-order response mechanism optimizes the task queue, prioritizing queries that have already been resolved, reducing waiting time, and improving overall throughput.

[0080] Furthermore, the client receives the encrypted response message, uses the DoT protocol processing module to decrypt the TLS record layer data using the session key, and extracts the DNS response content. The client compares the message ID and QNAME fields in the response message with the original query to ensure a correct correspondence between the response and the query. If the match is successful, the client completes the DNS resolution and returns the resolution result (such as an IP address) to the upper-layer application. If the match fails, the client can discard the invalid response or initiate a retry.

[0081] In one specific embodiment of the present invention, encrypted DNS queries are sent and processed through an encrypted transmission channel, specifically as follows:

[0082] In response to the client sending a batch of encrypted DNS queries through the encrypted transmission channel, TCP pipeline operation is enabled to support concurrent queries;

[0083] The server decrypts the encrypted DNS query and hands it over to the DNS resolution system for processing, generating response data.

[0084] The server encrypts the response data and sends it to the client according to the unordered response rules;

[0085] The client decrypts the encrypted response data and matches the original query using the message ID and QNAME fields to complete the DNS resolution.

[0086] It should be noted that the sending and processing of encrypted DNS queries via an encrypted transmission channel relies on the encryption / decryption functions of the DoT protocol processing module, the pipelined scheduling and priority queue management of the TCP connection management module, and the recursive query support of the end-to-end compatibility module to work together to achieve efficient sending, processing, and resolution of encrypted DNS queries. Pipeline operation and out-of-order responses optimize transmission efficiency, error handling mechanisms enhance reliability, and together with the encrypted channel establishment (TLS handshake) and traffic isolation modules, they ensure a secure and efficient DNS service.

[0087] Furthermore, the client responds to upper-layer application requests via the DoT protocol stack, encapsulating multiple DNS query requests into TLS record layer messages containing message ID, QNAME fields, and query type (such as A or AAAA records), and sending them to the server's port 853 via an encrypted transmission channel. TCP pipelined operation is enabled by the DoT protocol processing module, allowing the client to continuously send subsequent queries even without receiving a preceding response. High throughput is supported by the concurrency control mechanisms of the TCP connection management module (such as transaction priority and queue management). Transaction priorities are allocated based on query urgency or application requirements, optimizing the scheduling efficiency of concurrent queries.

[0088] Furthermore, the server uses the session key to decrypt the received TLS record layer message via the DoT protocol processing module, extracting the structured content of the DNS query, including the message ID, QNAME, and query type. The decrypted query is then processed by the DNS resolution system. The system first checks its local cache; if the cache is not found, it initiates a DoT encrypted query to the recursive server or authoritative server through the end-to-end compatibility module to obtain the resource record (such as the IP address) corresponding to the domain name. The resolution system employs a cache-first strategy to reduce the overhead of repeated queries and improve response speed.

[0089] Furthermore, the server's DoT protocol processing module encrypts the response data generated by the DNS resolution system using the TLS record layer, generating an encrypted response message containing message ID and QNAME fields. The response is sent to the client via the TCP connection management module according to out-of-order response rules. Scheduling is based on a priority queue algorithm, prioritizing high-priority queries that have already been resolved, thus optimizing response latency. The response message includes a TLS record header and a DNS response payload, ensuring consistency with the identifier of the original query.

[0090] Furthermore, the client uses the session key to decrypt the received encrypted response message through the DoT protocol processing module, extracting DNS response data, including the message ID, QNAME, and resource record. The client compares the message ID and QNAME fields with the original query to confirm the validity of the response. If the match is successful, the resolution result is passed to the upper-layer application; if the match fails (e.g., message ID mismatch), the client discards the invalid response or initiates a retry through the error handling mechanism, with a maximum of a preset number of retries (e.g., 3 times). Retry requests reuse existing TCP connections, reducing connection overhead.

[0091] In one specific embodiment of the present invention, transmission efficiency is optimized using pipeline scheduling and disordered response mechanisms, specifically as follows:

[0092] Configure the maximum number of connections per source IP, the total number of global connections, the maximum number of DNS transactions, and the timeout period;

[0093] This allows clients to send subsequent queries over the encrypted transmission channel without waiting for a prior response;

[0094] Match out-of-order responses using the message ID and QNAME fields;

[0095] Release TCP connections based on timeout or maximum number of transactions.

[0096] It should be noted that pipelined scheduling and out-of-order response optimization for transmission efficiency are achieved through the collaborative work of the parameter configuration and scheduling mechanism of the TCP connection management module and the response generation and matching function of the DoT protocol processing module. Parameter configuration supports resource management for concurrent queries, pipelined operations and out-of-order responses improve transmission efficiency, connection release ensures resource reclamation, and the encryption channel establishment (TLS handshake), traffic isolation, and DNS query processing modules work together to ensure secure and efficient DNS services.

[0097] Furthermore, the TCP connection management module configures the maximum number of connections per source IP (e.g., a limit of 50 connections per IP), the total number of global connections (e.g., a maximum of 10,000 concurrent connections supported by the server), the maximum number of DNS transactions (e.g., a maximum of 100 DNS queries per connection), and the timeout period (e.g., closing idle connections after 30 seconds). These parameters dynamically adjust connection resource allocation to prevent a single client from consuming too many resources or the server from exhausting resources due to high concurrency, while also supporting efficient concurrent query processing.

[0098] Furthermore, the client enables TCP pipelined operation on the encrypted transmission channel through the DoT protocol processing module, allowing subsequent query requests to be sent continuously even without receiving a response to a preceding DNS query. The TCP connection management module maintains a task queue and schedules requests based on query priority (e.g., urgent queries take precedence) or the order of receipt. The server processes multiple query requests concurrently, maximizing the utilization of TCP connection bandwidth, reducing response latency, and achieving transmission efficiency close to UDP.

[0099] Furthermore, the server generates an encrypted DNS response via the DoT protocol processing module, containing message ID and QNAME fields. The response is sent out of order, meaning it's scheduled based on the resolution completion time rather than the query reception order. Upon receiving the response, the client decrypts the message using the DoT protocol processing module, extracts the message ID and QNAME fields, and compares them one by one with the corresponding fields from the original query. If a match is found, the response is considered valid; if a match fails (e.g., message IDs are inconsistent), the client discards the response, records the error, and initiates a retry if necessary.

[0100] Furthermore, the TCP connection management module triggers a connection release mechanism based on the configured timeout period or the maximum number of DNS transactions. When the connection idle time exceeds the preset timeout period (e.g., 30 seconds) or the number of transactions reaches the maximum limit (e.g., 100 queries), the server actively closes the TCP connection, sends a FIN packet, and the client responds with an ACK confirmation, completing the connection release. The released resources are then reallocated through memory reclamation and connection pool management, supporting efficient processing of subsequent queries.

[0101] In one specific embodiment of the present invention, by monitoring network status and server load, the encrypted or unencrypted transmission mode is dynamically switched based on a preset threshold. Specifically,

[0102] Monitor the CPU utilization, memory utilization, concurrent connections, client network type, and connection success rate of port 853 to generate decision-making basis for switching transmission modes;

[0103] When the load on port 853 exceeds a preset threshold, a temporary TLS overload alarm is generated and sent to the client via a TCP connection;

[0104] After receiving the TLS temporary overload alarm, the client switches to port 53 to suspend encrypted transmission in order to alleviate the server load;

[0105] When the load drops below a preset threshold, cancel the alarm and resume encrypted transmission.

[0106] It should be noted that the dynamic switching of transmission modes achieves dynamic switching between encrypted and unencrypted transmission modes through the real-time monitoring, alarm generation, and recovery mechanisms of the dynamic allocation decision module, combined with the encrypted transmission of the DoT protocol processing module, the connection multiplexing of the TCP connection management module, and the degradation support of the end-to-end compatibility module. Monitoring data drives alarms and switching decisions, client policy adjustments ensure service continuity, and together with the encrypted channel establishment, traffic isolation, and DNS query processing modules, they guarantee the security, efficiency, and compatibility of DNS services.

[0107] Furthermore, the server's dynamic allocation decision module monitors the operating status of port 853 at a fixed frequency (e.g., once per second). Collected metrics include CPU utilization (e.g., percentage), memory utilization (e.g., percentage of available memory), concurrent connections (e.g., current active TCP connections), client network type (public or private, determined by IP address range or RTT), and connection success rate (based on TLS handshake success rate). The monitoring data is weighted using an algorithm (e.g., a weighted average of CPU and memory usage) to generate a comprehensive load score, which serves as the basis for transmission mode switching decisions. Data acquisition is achieved through system performance counters and network protocol stack interfaces, ensuring real-time performance and accuracy.

[0108] Furthermore, when the overall load score exceeds a preset threshold (e.g., CPU utilization exceeding 80% or concurrent connections exceeding 10,000), the dynamic allocation decision module generates a temporary TLS overload alarm. The alarm message uses a standard DNS response format, includes a specific error code (such as an "overload" identifier), and is sent to the client via an encrypted transmission channel over an existing TCP connection. After the alarm is generated, the server logs the load exceedance event for subsequent performance analysis and threshold optimization.

[0109] Furthermore, upon receiving a TLS temporary overload alarm, the client adjusts its transmission strategy via the DoT protocol stack, suspending encrypted DNS queries on port 853 and switching to send plaintext DNS queries on port 53. The switching process includes protocol stack redirection (switching from the DoT protocol stack to the traditional DNS protocol stack) and query message format conversion (removing the TLS record layer encapsulation) to ensure a seamless query transition. The client logs the switching event and marks it as "server overload" to optimize the priority of subsequent connection attempts.

[0110] Furthermore, the dynamic allocation decision module continuously monitors the load on port 853. When the overall load score drops below a preset threshold (e.g., CPU utilization below 60% and concurrent connections less than 8,000), an alarm cancellation notification is generated and sent to the client via an encrypted transmission channel. Upon receiving the notification, the client resumes sending encrypted DNS queries through port 853, prioritizing the reuse of existing TCP connections to reduce reconnection overhead. The recovery process re-enables TLS record layer encapsulation via the DoT protocol stack to ensure the continuity of encrypted transmission.

[0111] In one specific embodiment of the present invention, when encrypted transmission is unavailable, plaintext DNS queries are processed using port 53 through degradation logic to ensure compatibility with the traditional DNS system. Specifically,

[0112] When an encrypted transmission failure is detected, a degradation logic is triggered, switching to port 53 to send a plaintext DNS query;

[0113] The server processes plaintext DNS queries on port 53 using a compatibility mechanism according to traditional DNS logic and returns a plaintext response.

[0114] The client records the reasons for the downgrade, which is used to optimize subsequent connection decisions;

[0115] The DoT protocol stack is supported by recursive servers and authoritative servers to ensure the continuity of the end-to-end encrypted link, and the traffic isolation mechanism maintains the separation of traffic on port 853 and port 53.

[0116] It should be noted that the degradation logic and compatibility handling work together through the degradation support of the end-to-end compatibility module, the alarm triggering of the dynamic allocation decision module, the port separation of the traffic isolation module, and the protocol stack management of the DoT protocol processing module to achieve seamless degradation when encrypted transmission is unavailable. The degradation logic ensures compatibility with traditional DNS, records and optimizes subsequent connections, and the DoT protocol stack and traffic isolation maintain the independence of encrypted links and ports. Together with the encrypted channel establishment, traffic isolation, and DNS query processing modules, they ensure the security, efficiency, and compatibility of DNS services.

[0117] It should be noted that the client detects encrypted transmission failures through the DoT protocol processing module. Failure scenarios include TLS handshake timeouts (e.g., failure to complete within 5 seconds), server return of TLS overload alarms, or connection loss. Upon detecting a failure, the client triggers degradation logic, automatically switching to the traditional DNS protocol stack and sending plaintext DNS query messages through port 53. The switching process includes protocol stack adjustment (switching from the DoT protocol stack to the UDP or TCP traditional DNS protocol stack) and query message format conversion (removing the TLS record layer encapsulation and generating standard DNS messages) to ensure query compatibility with the traditional DNS system.

[0118] Furthermore, the server receives plaintext DNS query messages on port 53 through a full-link compatibility module, supporting traditional DNS logic using UDP and TCP protocols. The compatibility handling mechanism parses the message ID, QNAME, and query type from the query message, queries the local DNS record database, or retrieves resource records (such as A and AAAA records) from authoritative servers via recursive queries, generating a plaintext response message. The response message is encapsulated in standard DNS format and returned directly to the client via port 53, ensuring compatibility with un-upgraded devices.

[0119] Furthermore, the client records the reasons for downgrades through the DoT protocol processing module, including the failure type (such as TLS handshake timeout, server overload), timestamp, and network environment information (such as public / private network). These records are stored locally in logs or caches to optimize subsequent connection decisions, such as prioritizing attempts on port 53 or adjusting the retry interval (e.g., increasing from 5 seconds to 10 seconds). The optimization logic dynamically adjusts the client's transmission strategy by analyzing the frequency and causes of downgrades, thereby improving the connection success rate.

[0120] Furthermore, the recursive server and authoritative server support the DoT protocol stack through the end-to-end compatibility module, configuring TLS encrypted communication capabilities to ensure the continuity of the end-to-end encrypted link, enabling DoT queries to be processed even in degraded scenarios. The traffic isolation module configures firewall rules to explicitly distinguish between port 853 (TLS encrypted traffic) and port 53 (plaintext DNS traffic), rejecting TLS packets on port 53 and plaintext packets on port 853 through packet characteristic analysis (such as TLS record layer headers or DNS packet formats). This isolation mechanism prevents traffic obfuscation and maintains the independence of encrypted and unencrypted transmissions.

[0121] In a second embodiment of the present invention, the present invention provides a DNS encrypted transmission and dynamic traffic allocation system based on TLS, such as... Figure 2 As shown, the system includes an encrypted channel establishment module 1, an encrypted query processing module 2, and a dynamic allocation decision module 3;

[0122] The encrypted channel establishment module 1 is used to establish a TCP connection, perform a TLS protocol handshake to generate an encrypted transmission channel, and at the same time restrict port 853 to only receive TLS handshake messages.

[0123] The encrypted query processing module 2 is used to send and process encrypted DNS queries through an encrypted transmission channel, and optimizes transmission efficiency by using pipeline scheduling and unordered response mechanisms.

[0124] The dynamic allocation decision module 3 is used to dynamically switch between encrypted and unencrypted transmission modes based on preset thresholds by monitoring network status and server load.

[0125] In one specific implementation of the present invention, the encrypted channel establishment module 1 includes a DoT protocol processing module.

[0126] The DoT protocol processing module is configured to implement encrypted transmission and resolution of DNS data. Specific functions include: fragmenting, compressing, and encrypting DNS application layer data through the TLS record layer; performing handshake, authentication, and key negotiation in conjunction with the TLS protocol layer to establish an encrypted transmission channel; generating a TLS Client Hello message on the client side to verify the server certificate's validity and negotiate the session key; receiving the TLS handshake message on the server side, returning the certificate and encryption parameters, completing key exchange, encrypting / decrypting DNS queries and responses, and parsing the protocol to distinguish between DNS messages and TLS control messages; and collaborating with the end-to-end compatibility module to ensure that the encrypted transmission channel supports end-to-end DNS queries.

[0127] Furthermore, the encrypted query processing module 2 includes a TCP connection management module and a traffic isolation module.

[0128] The TCP connection management module is configured to achieve reliable transmission and efficiency optimization, addressing the limitations and unreliability of UDP packet length. Specific functions include: managing the establishment and release of TCP connections, supporting reliable transmission of large DNS responses; configuring performance optimization parameters, including the maximum number of connections per source IP, the total number of global connections, idle connection timeout, and the maximum number of DNS transactions; implementing TCP query pipeline scheduling, allowing clients to send subsequent queries without waiting for preceding responses, with the server matching out-of-order responses using message ID and QNAME fields, thus improving transmission efficiency; and collaborating with the encrypted query processing module and the end-to-end compatibility module to support efficient transmission of encrypted DNS queries and compatibility with unencrypted transmission.

[0129] The traffic isolation module is configured to distinguish between encrypted and unencrypted DNS traffic to enhance transmission security. Specific functions include: restricting port 853 to receive only TLS handshake messages and rejecting plaintext DNS messages through firewall rules, maintaining the purity of the encrypted transmission channel; monitoring the traffic characteristics of port 853, triggering alarms and temporarily blocking abnormal source IPs when non-TLS messages exceed a preset threshold; controlling clients to prevent sending plaintext DNS data through port 853, reserving port 53 for handling unencrypted DNS traffic; and collaborating with the end-to-end compatibility module to ensure the separation of traffic on ports 853 and 53, supporting a smooth transition between encrypted and unencrypted transmissions.

[0130] Furthermore, the dynamic allocation decision module 3 is configured to dynamically switch between encrypted and unencrypted transmission modes based on network status and server load. Specific functions include: monitoring client network type (public / private network), port 853 connection success rate, user privacy preferences, and server port 853 CPU / memory usage, concurrent connections, and port 53 load; when the client detects a public network environment and port 853 is reachable, encrypted transmission is prioritized; when the port 853 load exceeds a preset threshold, a load alarm is generated and sent to the client, triggering a switch to unencrypted transmission on port 53; in conjunction with the end-to-end compatibility module, load alarms support degradation logic, enabling dynamic optimization of the transmission mode.

[0131] Furthermore, the TLS-based DNS encrypted transmission and dynamic traffic allocation system also includes a full-link compatibility module.

[0132] The end-to-end compatibility module is configured to achieve compatibility between encrypted DNS transmission and the traditional DNS system, supporting end-to-end encrypted links and a smooth transition. Specific functions include: The client integrates the DoT protocol stack, configured to perform TLS handshakes, certificate verification, and TCP pipeline operations, supporting automatic switching between encrypted and unencrypted transmission channels, and performing traditional DNS resolution via port 53 when encrypted transmission fails; the recursive server acts as an intermediate node, configured to support DoT queries to upstream authoritative servers and DoT responses to downstream clients, ensuring end-to-end continuity of the encrypted transmission channel; the authoritative server deploys the DoT service, configured to store domain name resolution records, maintain TLS certificates and private keys, and support high-concurrency encrypted query processing; the server simultaneously opens ports 853 and 53, distinguishing between encrypted and unencrypted traffic through a traffic isolation mechanism, processing plaintext DNS queries on port 53 according to traditional DNS logic, achieving compatibility with the existing DNS system.

[0133] In a third embodiment of the present invention, the present invention provides an electronic device, including a memory and a processor, characterized in that the memory stores a computer program that can run on the processor, and when the program is executed on the processor, it implements the steps in the TLS-based DNS encrypted transmission and dynamic traffic allocation method as described above.

[0134] In Embodiment 4 of the present invention, the present invention provides a storage medium storing a computer program, characterized in that, when the computer program is executed by a processor, it implements the steps in the TLS-based DNS encrypted transmission and dynamic traffic allocation method as described above.

[0135] In summary, this invention provides a TLS-based DNS encrypted transmission and dynamic traffic allocation method and system. By decoupling the DoT module and recursive functionality, it supports flexible configuration and dynamic loading, achieving end-to-end encrypted communication between the recursive server and the authoritative server, thus overcoming the problem of incomplete security links in existing technologies. The introduction of a dynamic allocation mechanism intelligently switches between encrypted and unencrypted paths based on network status and load, balancing security and availability. Status monitoring and optimization of the encryption module ensure the stability of TLS communication, avoid performance bottlenecks, and improve the reliability and deployment flexibility of DNS services.

[0136] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the modules described above can be referred to the corresponding process in the aforementioned method implementation, and will not be repeated here.

[0137] The modules described as separate components may or may not be physically separate. Similarly, the components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0138] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated module can be implemented in hardware or in a combination of hardware and software functional modules.

[0139] The integrated modules implemented as software functional modules described above can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer system (which may be a personal computer, server, or network system, etc.) or processor to execute some steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0140] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for DNS encrypted transmission and dynamic traffic allocation based on TLS, characterized in that: include, By establishing a TCP connection, performing a TLS handshake to generate an encrypted transmission channel, and restricting port 853 to only receive TLS handshake messages; Encrypted DNS queries are sent and processed through an encrypted transmission channel, and transmission efficiency is optimized using pipeline scheduling and out-of-order response mechanisms. By monitoring network status and server load, the system dynamically switches between encrypted and unencrypted transmission modes based on preset thresholds.

2. The TLS-based DNS encrypted transmission and dynamic traffic allocation method according to claim 1, characterized in that: The process of establishing a TCP connection and performing a TLS handshake to generate an encrypted transmission channel includes: The client sends a TCP connection request message to port 853 of the server. A TLS Client Hello message is sent over the established TCP connection. This TLS Client Hello message includes the supported TLS versions, cipher suites, and server domain name, used to initiate authentication and key negotiation. The server verifies whether the TLS Client Hello message is a TLS handshake message; The server generates a server certificate and a Server Hello message, and the client verifies the validity of the server certificate and negotiates a session key to complete the TLS handshake and generate an encrypted transmission channel.

3. The TLS-based DNS encrypted transmission and dynamic traffic allocation method according to claim 2, characterized in that: The restriction that port 853 can only receive TLS handshake messages includes, Configure firewall rules to restrict port 853 to accept only TLS handshake messages and reject plaintext DNS messages; Monitor the traffic characteristics of port 853. If non-TLS packets are detected and exceed the preset threshold, trigger an alarm and temporarily block the abnormal source IP. Control the client to prevent the sending of plaintext DNS data through port 853.

4. The TLS-based DNS encrypted transmission and dynamic traffic allocation method according to claim 3, characterized in that: The sending and processing of encrypted DNS queries through an encrypted transmission channel includes, In response to the client sending a batch of encrypted DNS queries through the encrypted transmission channel, TCP pipeline operation is enabled to support concurrent queries; The server decrypts the encrypted DNS query and hands it over to the DNS resolution system for processing, generating response data. The server encrypts the response data and sends it to the client according to the unordered response rules; The client decrypts the encrypted response data and matches the original query using the message ID and QNAME fields to complete the DNS resolution.

5. The TLS-based DNS encrypted transmission and dynamic traffic allocation method according to claim 4, characterized in that: The optimization of transmission efficiency using pipeline scheduling and out-of-order response mechanisms includes... Configure the maximum number of connections per source IP, the total number of global connections, the maximum number of DNS transactions, and the timeout period; This allows clients to send subsequent queries over the encrypted transmission channel without waiting for a prior response; Match out-of-order responses using the message ID and QNAME fields; Release TCP connections based on timeout or maximum number of transactions.

6. The TLS-based DNS encrypted transmission and dynamic traffic allocation method according to claim 5, characterized in that: The method of dynamically switching between encrypted and unencrypted transmission modes based on a preset threshold by monitoring network status and server load includes: Monitor the CPU utilization, memory utilization, concurrent connections, client network type, and connection success rate of port 853 to generate decision-making basis for switching transmission modes; When the load on port 853 exceeds a preset threshold, a temporary TLS overload alarm is generated and sent to the client via a TCP connection; After receiving the TLS temporary overload alarm, the client switches to port 53 to suspend encrypted transmission in order to alleviate the server load; When the load drops below a preset threshold, cancel the alarm and resume encrypted transmission.

7. The TLS-based DNS encrypted transmission and dynamic traffic allocation method according to claim 1, characterized in that: It also includes, When encrypted transmission is unavailable, a fallback logic is used to handle plaintext DNS queries on port 53, ensuring compatibility with the traditional DNS system. Specifically, this includes... When an encrypted transmission failure is detected, a degradation logic is triggered, switching to port 53 to send a plaintext DNS query; The server processes plaintext DNS queries on port 53 using a compatibility mechanism according to traditional DNS logic and returns a plaintext response. The client records the reasons for the downgrade, which is used to optimize subsequent connection decisions; The DoT protocol stack is supported by recursive servers and authoritative servers to ensure the continuity of the end-to-end encrypted link, and the traffic isolation mechanism maintains the separation of traffic on port 853 and port 53.

8. A TLS-based DNS encrypted transmission and dynamic traffic allocation system, characterized in that: It includes an encrypted channel establishment module, an encrypted query processing module, and a dynamic allocation decision module; The encrypted channel establishment module is used to generate an encrypted transmission channel by establishing a TCP connection and performing a TLS handshake, while restricting port 853 to only receive TLS handshake messages. The encrypted query processing module is used to send and process encrypted DNS queries through an encrypted transmission channel, and optimizes transmission efficiency using pipeline scheduling and unordered response mechanisms. The dynamic allocation decision module is used to dynamically switch between encrypted and unencrypted transmission modes based on preset thresholds by monitoring network status and server load.

9. An electronic device, comprising a memory and a processor, characterized in that: The memory stores a computer program that can run on the processor, and when the program is executed on the processor, it implements the steps of the TLS-based DNS encrypted transmission and dynamic traffic allocation method as described in any one of claims 1-7.

10. A storage medium storing a computer program, characterized in that: When the computer program is executed by the processor, it implements the steps in the TLS-based DNS encrypted transmission and dynamic traffic allocation method as described in any one of claims 1-7.

Images