Domain name resolution method and apparatus, communication device, storage medium, and product

Abstract

The present application relates to a domain name resolution method and apparatus, a communication device, a storage medium, and a product. The method comprises: an edge cloud server receiving a DNS request sent by a terminal on the basis of a first domain name of the edge cloud server, wherein the first domain name is obtained from a local DNS server corresponding to the terminal; on the basis of the DNS request, determining a second domain name and target resource information that the terminal requests to access; and when it is determined on the basis of the target resource information that the terminal possesses a corresponding access permission, the local DNS server sending to the terminal a domain name resolution result corresponding to the second domain name.

Description

Domain name resolution methods, devices, communication equipment, storage media and products

[0001] Related applications

[0002] This application claims priority to Chinese patent application filed on July 19, 2024, with application number 202410970003.1, entitled "Domain name resolution method, apparatus, communication equipment, storage medium and product", the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of computing network technology, and in particular to a domain name resolution method, apparatus, communication equipment, storage medium and product. Background Technology

[0004] Domain name resolution refers to the process by which a terminal accesses a website through a domain name, involving querying the domain name and the Internet Protocol (IP) address of the resource. The conventional domain name resolution process is implemented through multi-level recursion; that is, the terminal's local Domain Name System (DNS) server recursively queries the root name server, top-level name server, and authoritative name server for the IP address.

[0005] However, in this conventional approach, all terminals can only passively accept the domain name resolution results through a unified process, making it impossible to differentiate access permissions for different terminals. Summary of the Invention

[0006] Therefore, it is necessary to provide a domain name resolution method, device, communication equipment, storage medium, and product that can set access permissions for terminals and differentiate the domain name resolution process of terminals to address the above-mentioned technical problems.

[0007] This application provides a domain name resolution method in a first aspect, comprising: receiving a DNS request sent by a terminal based on a first domain name of an edge cloud server, wherein the first domain name is obtained from a local DNS server corresponding to the terminal; decrypting the DNS request to obtain a second domain name requested by the terminal and access path information of the terminal; resolving the access path information of the terminal to obtain identification information of the terminal and target resource information requested by the terminal; if it is determined that the terminal has corresponding access rights based on the target resource information, determining whether a corresponding local resolution record exists in a policy database based on the identification information of the terminal; if a corresponding local resolution record exists in the policy database, sending resolution indication information to the local DNS server, wherein the resolution indication information is used to instruct the local DNS server to determine the domain name resolution result corresponding to the second domain name and send the domain name resolution result to the terminal; if a corresponding local resolution record does not exist in the policy database, sending the domain name resolution result corresponding to the second domain name to the local DNS server, so that the local DNS server forwards the domain name resolution result to the terminal.

[0008] In one embodiment, determining that the terminal has the corresponding access permission based on the target resource information includes: obtaining preset resource information configured for the terminal from the policy library based on the terminal's identification information; and determining that the terminal has the corresponding access permission when the target resource information belongs to the preset resource information.

[0009] In one embodiment, based on the terminal's identification information, preset resource information configured for the terminal is obtained from the policy library, including: determining the target user set to which the terminal belongs based on the terminal's identification information; and determining the target policy set associated with the target user set, and obtaining the preset resource information corresponding to the target policy set from the policy library.

[0010] In one embodiment, before receiving a Domain Name System (DNS) request sent by the terminal based on the first domain name of the edge cloud server, the method further includes: receiving a reversible DNS code sent by the edge cloud orchestrator; determining the identification information of the terminal configured with preset resource information based on the reversible DNS code; and sending the identification information of the terminal and the first domain name of the edge cloud server to the local DNS server.

[0011] This application provides a domain name resolution method in a second aspect, comprising: receiving a first domain name of an edge cloud server sent by a local DNS server; generating a DNS request based on a second domain name requested by a terminal and target resource information; sending the DNS request to the edge cloud server based on the first domain name; and receiving a domain name resolution result corresponding to the second domain name; wherein the domain name resolution result is sent by the edge cloud server to the terminal through the local DNS server when the target resource information in the DNS request determines that the terminal has the corresponding access rights; the terminal's identification information is used by the edge cloud server to determine whether a local resolution record corresponding to the terminal exists; the domain name resolution result corresponding to the second domain name is determined and sent to the terminal by the local DNS server based on the resolution indication information sent by the edge cloud server when a local resolution record corresponding to the terminal exists, or the local DNS server forwards the domain name resolution result sent by the edge cloud server to the terminal when a local resolution record corresponding to the terminal does not exist.

[0012] In one embodiment, before generating access path information for the terminal based on the terminal's identification information and the target resource information requested by the terminal, and before generating a DNS request based on the second domain name requested by the terminal and the terminal's access path information, the method further includes: receiving a digital certificate of an edge cloud server sent by a local DNS server; and extracting the corresponding public key from the digital certificate of the edge cloud server; wherein generating a DNS request based on the second domain name requested by the terminal and the terminal's access path information includes: generating an initial DNS request based on the second domain name requested by the terminal and the terminal's access path information; and encrypting the initial DNS request using the public key to obtain an encrypted DNS request.

[0013] This application also provides a domain name resolution device in a third aspect, comprising: a request receiving module, configured to receive a DNS request sent by a terminal based on a first domain name of an edge cloud server, wherein the first domain name is obtained from a local DNS server corresponding to the terminal; an information determining module, configured to determine, based on the DNS request, a second domain name and target resource information requested by the terminal; wherein the information determining module comprises: a request decryption unit, configured to decrypt the DNS request to obtain the second domain name requested by the terminal and the access path information of the terminal; an information parsing unit, configured to parse the access path information of the terminal to obtain the identification information of the terminal and the target resource information requested by the terminal; and a result sending module, configured to determine, based on the target resource information, that the terminal has corresponding access permissions. In the case of a second domain name, the domain name resolution result corresponding to the second domain name is sent to the terminal through the local DNS server. The result sending module includes: a record query unit, used to determine whether a corresponding local resolution record exists in the policy base based on the terminal's identification information; and a result sending unit, used to send resolution indication information to the local DNS server if a corresponding local resolution record exists, and to send the domain name resolution result corresponding to the second domain name to the local DNS server if no corresponding local resolution record exists, so that the local DNS server forwards the domain name resolution result to the terminal. The resolution indication information is used to instruct the local DNS server to determine the domain name resolution result corresponding to the second domain name and send the domain name resolution result to the terminal.

[0014] This application also provides a domain name resolution apparatus in a fourth aspect, comprising: a domain name receiving module for receiving a first domain name of an edge cloud server sent by a local DNS server; a request generation module for generating a DNS request based on a second domain name requested by a terminal and target resource information; wherein the request generation module includes: a path generation unit for generating access path information of the terminal based on the terminal's identification information and the target resource information requested by the terminal; a request generation unit for generating the DNS request based on the second domain name requested by the terminal and the access path information of the terminal; a request sending module for sending a DNS request to the edge cloud server based on the first domain name; and a result receiving module for receiving the result of the second domain name request. The domain name resolution result is as follows: the domain name resolution result is sent by the edge cloud server to the terminal through the local DNS server when the terminal has the corresponding access permissions based on the target resource information in the DNS request; the terminal's identification information is used by the edge cloud server to determine whether there is a local resolution record corresponding to the terminal; the domain name resolution result corresponding to the second domain name is determined and sent to the terminal by the local DNS server based on the resolution indication information sent by the edge cloud server when there is a local resolution record corresponding to the terminal, or the local DNS server forwards the domain name resolution result sent by the edge cloud server to the terminal when there is no local resolution record corresponding to the terminal.

[0015] This application also provides a communication device in a fifth aspect, comprising: a transmitter, a receiver, a processor, and a memory, the memory storing a computer program; wherein the receiver is configured to receive a DNS request sent by a terminal based on a first domain name of an edge cloud server, wherein the first domain name is obtained from a local DNS server corresponding to the terminal; the processor is configured to execute the computer program to decrypt the DNS request to obtain a second domain name requested by the terminal and access path information of the terminal; to parse the access path information of the terminal to obtain identification information of the terminal and target resource information requested by the terminal; if it is determined that the terminal has the corresponding access permission based on the target resource information, to determine whether there is a corresponding local resolution record in the policy base based on the identification information of the terminal; the transmitter is configured to send resolution indication information to the local DNS server if a corresponding local resolution record exists, and to send the domain name resolution result corresponding to the second domain name to the local DNS server if no corresponding local resolution record exists, so that the local DNS server forwards the domain name resolution result to the terminal; wherein the resolution indication information is configured to instruct the local DNS server to determine the domain name resolution result corresponding to the second domain name and send the domain name resolution result to the terminal.

[0016] This application also provides a communication device in a sixth aspect, comprising: a transmitter, a receiver, a processor, and a memory, the memory storing a computer program; wherein the receiver is configured to receive a first domain name of an edge cloud server sent by a local DNS server; the processor is configured to execute the computer program to generate access path information of the terminal based on the terminal's identification information and the target resource information requested by the terminal; and to generate a DNS request based on the second domain name requested by the terminal and the access path information of the terminal; the transmitter is configured to send a DNS request to the edge cloud server based on the first domain name; and the receiver is further configured to receive a domain name resolution result corresponding to the second domain name; wherein the domain name resolution result is sent to the terminal by the local DNS server when the edge cloud server determines that the terminal has the corresponding access rights based on the target resource information in the DNS request; the terminal's identification information is used by the edge cloud server to determine whether a local resolution record corresponding to the terminal exists; the domain name resolution result corresponding to the second domain name is determined and sent to the terminal by the local DNS server based on the resolution indication information sent by the edge cloud server when a local resolution record corresponding to the terminal exists, or the local DNS server forwards the domain name resolution result sent by the edge cloud server to the terminal when a local resolution record corresponding to the terminal does not exist.

[0017] In a seventh aspect, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, causes the processor to implement the methods described in the embodiments of the first or second aspects above.

[0018] This application also provides a computer program product in an eighth aspect, including a computer program that, when executed by a processor, causes the processor to implement the methods described in the embodiments of the first or second aspect above.

[0019] The aforementioned domain name resolution method, apparatus, communication equipment, storage medium, and product involve an edge cloud server receiving a DNS request from a terminal based on a first domain name sent by the edge cloud server. The first domain name is obtained from the local DNS server corresponding to the terminal. Based on the DNS request, a second domain name and target resource information requested by the terminal are determined. If the terminal has the corresponding access permissions based on the target resource information, the domain name resolution result corresponding to the second domain name is sent to the terminal via the local DNS server. This application deploys an edge cloud server locally to provide domain name resolution services to terminals. Compared to the recursive query method in the prior art, this application simplifies the domain name resolution process and effectively reduces latency. Furthermore, the edge cloud server can identify the terminal's access permissions based on the target resource information, thereby differentiating the domain name resolution process for different terminals and providing a more secure and flexible domain name resolution service. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the accompanying drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without any creative effort.

[0021] Figure 1 is an application environment diagram of the domain name resolution method according to an embodiment of this application.

[0022] Figure 2 is a flowchart illustrating a domain name resolution method applied to an edge cloud server according to an embodiment of this application.

[0023] Figure 3 is a flowchart illustrating the process of determining the target resource information requested by a terminal according to an embodiment of this application.

[0024] Figure 4 is a schematic diagram of the process of sending the domain name resolution result to the terminal according to an embodiment of this application.

[0025] Figure 5 is a schematic diagram of the process of sending the first domain name to the local DNS server according to an embodiment of this application.

[0026] Figure 6 is a flowchart illustrating a domain name resolution method applied to a terminal according to an embodiment of this application.

[0027] Figure 7 is a flowchart illustrating a domain name resolution method applied to an edge cloud server according to another embodiment of this application.

[0028] Figure 8 is a structural block diagram of a domain name resolution device configured on an edge cloud server according to an embodiment of this application.

[0029] Figure 9 is a structural block diagram of a domain name resolution device configured on an edge cloud server according to another embodiment of this application.

[0030] Figure 10 is a structural block diagram of a domain name resolution device configured on an edge cloud server according to another embodiment of this application.

[0031] Figure 11 is a structural block diagram of a domain name resolution device configured on a terminal according to an embodiment of this application.

[0032] Figure 12 is a structural block diagram of a domain name resolution device configured on a terminal according to another embodiment of this application.

[0033] Figure 13 is an internal structural diagram of a computer device according to an embodiment of this application.

[0034] Figure 14 is an internal structural diagram of a computer device according to another embodiment of this application. Detailed Implementation

[0035] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0036] The domain name resolution method provided in this application embodiment can be applied to the application environment shown in Figure 1. The terminal is assigned a corresponding local DNS server, and the terminal can communicate with the local DNS server via the network to obtain the first domain name of the corresponding edge cloud server. This edge cloud server is deployed based on an edge cloud software as a service (SaaS) environment, specifically as an edge cloud resolution instance within the edge cloud SaaS environment. It can interact with edge cloud orchestrators, policy libraries, reversible DNS (rDNS) maintenance libraries, and customized interfaces of the domain name resolution service on the same or different servers.

[0037] The reversible DNS maintenance library is used to publish the public code for reversible DNS functionality and maintain customized versions for users. Different users' customized reversible DNS functions are compiled, interpreted, and executed within the reversible DNS maintenance library, ensuring the normal operation of the domain name resolution process for each user's terminal. The customization interface provides user login functionality and allows configuration of the domain name resolution function of the edge cloud server. Specifically, it allows customization of environment variables for the edge cloud server, such as the policy library's Uniform Resource Locator (URL), server URL, cache time-to-live (TTL), policy download latency, log level, and response timeout. The customization interface can also customize the geographical distribution of the edge cloud server, performance billing options, user sets, customized domain names, and authentication modes, which can be implemented through an Application Programming Interface (API).

[0038] After obtaining the first domain name of the corresponding edge cloud server, the terminal can send a DNS request to the edge cloud server based on the first domain name. The edge cloud server receives the DNS request, resolves it to obtain the second domain name and target resource information requested by the terminal, and identifies whether the terminal has the corresponding access permissions based on the target resource information. If the terminal has the corresponding access permissions, the edge cloud server sends the domain name resolution result to the terminal's corresponding local DNS server, so that the local DNS server forwards the domain name resolution result to the terminal, completing the domain name resolution process.

[0039] The terminals can be, but are not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle systems, and projection devices. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted displays. Head-mounted displays can include virtual reality (VR) devices, augmented reality (AR) devices, and smart glasses.

[0040] In the current domain name resolution system, access devices such as gateways, Broadband Access Servers / Broadband Remote Access Servers (BAS / BRAS), or Session Management Functions (SMFs) automatically assign public service domain name DNS resolver addresses to terminals through protocols such as Dynamic Host Configuration Protocol (DHCP) and Stateless Address Auto-Configuration (SLAAC). The terminal initiates a domain name query request to the obtained DNS resolver. In the absence of local cached records, the DNS resolver recursively queries the root server (or its mirror), top-level domain (TLD) servers, and name servers to find the address of the resource.

[0041] Existing technologies rely on source address discrimination through Extended DNS Client Subnet (ECS), which fails to account for cross-network and user customization factors. Therefore, passively optimizing resolution results based on the source address makes it difficult to differentiate and meet the diverse and customized domain name resolution needs of different user groups. Furthermore, domain name resolution shares resources with public network DNS servers, preventing the use of isolated resources to respond to terminal domain name resolution requests, thus impacting the stability of the public DNS platform. In addition, the deployment process for the aforementioned domain name resolution is complex, based on a public service model, and lacks flexibility. When users require encryption of DNS requests, the ECS field cannot be obtained for domain name resolution.

[0042] Managing domain access control permissions through browser plugins has a limited scope of application, is difficult to manage, and also poses privacy risks.

[0043] To address the aforementioned technical issues, this application provides a domain name resolution method in an exemplary embodiment, as shown in FIG2. Taking the application of this method to the edge cloud server in FIG1 as an example, the method may include the following steps S201 to S203.

[0044] S201: Receive the DNS request sent by the receiving terminal based on the first domain name of the edge cloud server.

[0045] A local DNS server is a local domain name server pre-assigned to the terminal. Specifically, it can be automatically assigned by the terminal or assigned by the ISP; this embodiment does not impose any restrictions on this. For example, the local DNS server can be an intranet server in scenarios such as enterprises or schools.

[0046] An edge cloud server is an edge cloud DNS instance deployed based on an edge cloud SaaS environment. A new edge cloud SaaS environment is built on the metropolitan area network, and then user instances, i.e., edge cloud servers, are built.

[0047] The terminal first obtains the first domain name of the corresponding edge cloud server, and then sends a DNS request to the corresponding edge cloud server based on the first domain name. The first domain name can be obtained from the terminal's local DNS server.

[0048] For example, when a user accesses the network using a terminal, such as accessing any Web (World Wide Web) website through a browser, the terminal first sends a domain name retrieval request to the local DNS server, instructing the local DNS server to return the first domain name of the edge cloud server corresponding to the terminal. Optionally, this domain name retrieval request can also be a DNS request. Then, based on the first domain name, the terminal sends subsequent DNS requests to the corresponding edge cloud server. Accordingly, the edge cloud server receives the DNS requests sent by the terminal.

[0049] S202: Based on the DNS request, determine the second domain name and target resource information requested by the terminal.

[0050] The edge cloud server resolves the DNS request to obtain the second domain name requested by the terminal and the target resource information requested by the terminal. The second domain name and target resource information can be carried in the DNS request, or they can be added as a suffix to the original DNS request and then carried in the suffix of the DNS request.

[0051] For example, when a terminal accesses a website, the second domain name requested is the domain name of the website, and the target resource information includes, but is not limited to, the URL information of website resources in the website.

[0052] S203: If it is determined that the terminal has the corresponding access rights based on the target resource information, the domain name resolution result corresponding to the second domain name is sent to the terminal through the local DNS server.

[0053] The edge cloud server identifies the terminal based on the terminal's identifier information in the target resource information, thus determining whether the terminal has the corresponding access permissions. These permissions can include the terminal's access permissions to a second domain name, access permissions to network resources such as website resources, and the terminal's own network access permissions.

[0054] Once it is confirmed that the terminal has the corresponding access permissions, the edge cloud server provides domain name resolution services to the terminal. Through the local DNS server corresponding to the terminal, the domain name resolution result of the second domain name is sent to the terminal to complete the domain name resolution process.

[0055] Optionally, the edge cloud server determines, based on the target resource information, whether the terminal has access permissions to the corresponding second domain name, such as access permissions to a website, and whether the terminal does not have access permissions to some website resources, such as access permissions to website advertisements. Therefore, the edge cloud server can send the domain name resolution results corresponding to the second domain name to the terminal via a local DNS server, while simultaneously providing advertisement filtering services to the terminal.

[0056] Optionally, if it is determined from the target resource information that the terminal does not have the corresponding access permissions, the domain name resolution service can be directly refused to be provided to the terminal, that is, the domain name resolution result is not returned, or an error message is returned, and further resolution is prohibited.

[0057] In the aforementioned domain name resolution method, the edge cloud server receives a DNS request sent by the terminal based on a first domain name obtained from the terminal's local DNS server. Based on the DNS request, the server determines the second domain name and target resource information requested by the terminal. If the terminal has the corresponding access permissions based on the target resource information, the server sends the domain name resolution result corresponding to the second domain name to the terminal via the local DNS server. This embodiment deploys an edge cloud server nearby to provide domain name resolution services to the terminal. Compared to the recursive query method in the prior art, this embodiment can effectively reduce the latency in the domain name resolution process. Furthermore, the edge cloud server can identify the terminal's access permissions based on the target resource information, thereby enabling differentiated control of the domain name resolution process for different terminals and providing a more secure and flexible domain name resolution service.

[0058] In an exemplary embodiment, as shown in FIG3, step S202 may include steps S301 to S302.

[0059] S301: Decrypt the DNS request to obtain the second domain name requested by the terminal and the terminal's access path information.

[0060] The DNS requests received by the edge cloud server can be encrypted, such as DNS messages encrypted using DoH (DNS over HTTPS). DoH encryption uses Hypertext Transfer Protocol Secure (HTTPS) to transmit DNS messages to prevent eavesdropping by intermediaries and privacy breaches.

[0061] For example, the edge cloud server receives a DNS request sent by the terminal through the DoH server, decrypts the DNS request, and obtains the second domain name requested by the terminal and the terminal's access path information. The terminal's access path information can be appended to the second domain name. Generally, the requested second domain name is represented as "www.xx.com", and the terminal's access path information includes the terminal's URI / url path, which can be used to identify the terminal, represented as "company1.com / c1xda". Here, "c1" identifies the specific policy set.

[0062] Optionally, the local DNS server receives the digital certificate of the edge cloud server issued by the edge cloud orchestrator and sends the digital certificate to the terminal so that the terminal can extract the public key corresponding to the edge cloud server from the digital certificate and then use the public key to encrypt the DNS request.

[0063] The encryption of DNS requests using a public key includes: encrypting the terminal's one-time personal identification number (PIN) to form a new uniform resource identifier (URI) field in the terminal's access path information in the DNS request. The terminal's access path information can be represented as "company1.com / c1xda / user_encrypt_id_sneoxlsnes".

[0064] Accordingly, the edge cloud server receives the digital certificate issued by the edge cloud orchestrator, and decrypts the encrypted DNS request sent by the terminal using the private key corresponding to the digital certificate, thereby obtaining the second domain name requested by the terminal and the terminal's access path information.

[0065] Optionally, a terminal-unique fingerprint encryption information can be integrated into the URI. This fingerprint encryption information can be implemented using a fingerprint encryption algorithm such as Message-Digest Algorithm 5 (MD5). If fingerprint encryption verification fails, the domain name resolution result will be refused to be provided to the terminal.

[0066] Optionally, the edge cloud server decrypts the double-encrypted DNS request and sends it to the corresponding user authentication website for terminal identification, and receives the identification result from the user authentication website.

[0067] S302: Parse the terminal's access path information to obtain the terminal's identification information and the target resource information requested by the terminal.

[0068] Furthermore, the edge cloud server parses the decrypted terminal's access path information, such as parsing "company1.com / c1xda", to obtain the target resource information requested by the terminal and the terminal's identification information.

[0069] For example, when a terminal accesses a website, the requested second domain name carries the terminal's access path information. Parsing this information allows the terminal's identification information and the target resource information requested by the terminal to be determined. It is understood that the terminal's identification information allows the edge cloud server to identify the terminal's identity and thus determine whether the terminal has the corresponding access permissions for the second domain name and the target resource information. For example, whether it has access permissions to entertainment video websites unrelated to work, spam forwarding domains, or network resources such as pop-up advertising pages corresponding to the target resource information.

[0070] In this embodiment, by decrypting the DNS request, the second domain name requested by the terminal and the terminal's access path information are obtained. Then, the terminal's access path information is parsed to obtain the terminal's identification information and the target resource information requested by the terminal. This embodiment provides a method for DNS message transmission between the terminal and the edge cloud server, and for the edge cloud server to decrypt the messages. This ensures the security and reliability of DNS message transmission, accurately decrypts the DNS requests sent by the terminal, and allows the edge cloud server to accurately obtain the newly added terminal identification information and the target resource information requested by the terminal, thereby improving the accuracy of subsequent access permission determination for the terminal.

[0071] In an exemplary embodiment, as shown in FIG4, step S203 may include steps S401 to S403.

[0072] S401: Based on the terminal's identification information, determine whether a corresponding local parsing record exists in the policy library.

[0073] The policy library stores various domain name resolution policy sets. Different policy sets form different policy groups. The policy library can also store local resolution records of different terminals on the edge cloud server. The policy library can be deployed on the edge cloud server or on other servers associated with the edge cloud server; this embodiment does not impose any restrictions on this.

[0074] If the edge cloud server has previously provided domain name resolution services for the second domain name to the terminal, the corresponding local resolution record is stored in the policy library of the edge cloud server. Therefore, after determining the terminal's identification information, the edge cloud server first checks the policy library to see if there is a local resolution record of the terminal on the edge cloud server.

[0075] For example, the edge cloud server sends a parsing record query request carrying the terminal's identification information to the server where the policy library is located, so that the server where the policy library is located can query the corresponding local parsing record based on the terminal's identification information, and then feed the query result back to the edge cloud server.

[0076] In some embodiments, the edge cloud server can directly determine whether a corresponding local resolution record exists based on the terminal's identification information, without needing to send a corresponding request to the policy library.

[0077] If a corresponding local parsing record exists in the policy library, proceed to step S402; if no corresponding local parsing record exists in the policy library, proceed to step S403.

[0078] S402: Send a resolution instruction message to the local DNS server to instruct the local DNS server to determine the domain name resolution result corresponding to the second domain name and send the domain name resolution result to the terminal.

[0079] If a corresponding local DNS record is detected, it means that the terminal has already accessed the second domain name. Therefore, the terminal has the corresponding access permission and the local DNS server (i.e., the intranet server) will directly provide domain name resolution services for the terminal.

[0080] Specifically, the edge cloud server sends a resolution instruction to the local DNS server corresponding to the terminal; the resolution instruction is used to instruct the local DNS server to determine the domain name resolution result corresponding to the second domain name and send the domain name resolution result to the terminal.

[0081] The domain name resolution result corresponding to the second domain name can be either cached locally by the local DNS server in the previous domain name resolution process, or it can be resolved in real time in the current domain name resolution process.

[0082] S403: Send the domain name resolution result corresponding to the second domain name to the local DNS server so that the local DNS server forwards the domain name resolution result to the terminal.

[0083] If no corresponding local DNS record is found, it means that the terminal is likely accessing the second domain name for the first time. Therefore, if the terminal has the corresponding access rights based on the target resource information, the edge cloud server provides domain name resolution services for the terminal and sends the domain name resolution result corresponding to the second domain name to the local DNS server corresponding to the terminal. The local DNS server then forwards it to the terminal.

[0084] Specifically, the policy base contains a distributed high-speed domain name cache. When the cache is not hit (i.e., there is no corresponding local resolution record), recursive resolution is used to recursively send the domain name resolution result to the terminal through the local DNS server.

[0085] In some embodiments, users can request callbacks for all domain name resolutions involving local DNS servers in the domain name resolution configuration or the policy library configuration. That is, the local DNS server is responsible for the actual resolution of all domain names related to itself. Alternatively, users can request that the actual resolution of all domain names involving local DNS servers be performed by the edge cloud server.

[0086] In this embodiment, while adhering to the format of DNS resolution records and basic forwarding methods, edge cloud processing resources are effectively utilized to improve the service quality and flexibility of secure domain name resolution services from the cloud network level, while also enhancing the application deployment efficiency and scenario adaptability of secure resolution.

[0087] Specifically, once it is determined that the terminal has the corresponding access permissions, the system identifies whether there is a corresponding local DNS record based on the terminal's identification information. Then, different DNS resolution steps are taken: either the local DNS server performs the actual DNS resolution and returns it to the terminal, or the edge cloud server performs the actual DNS resolution and forwards it to the terminal through the local DNS server. This ensures the accuracy of DNS resolution and, in the case of repeated DNS resolution, optimizes the DNS resolution process, shortens the DNS resolution latency, and provides more efficient DNS resolution services for the terminal.

[0088] As an optional implementation in this embodiment, the local DNS server and the edge cloud server can automatically switch the actual object for domain name resolution. For example, when the edge cloud server fails, it automatically switches to the local DNS server for domain name resolution; when the local DNS server fails, the mapped edge cloud server automatically takes over the resolution task, provided that an internal network resolution mapping table has been pre-established; when the performance of the edge cloud server or the local DNS server is insufficient, the two perform load balancing processing on the domain name resolution initiated by the terminal.

[0089] In some embodiments, by configuring the domain name resolution object through a customized interface, a smooth migration between local DNS servers and edge cloud servers can be achieved, and the domain name resolution function can be automatically distributed and deployed. For example, when a remote user accesses an internal network domain name through a Virtual Private Network (VPN), the resolution speed of the local DNS server is higher than that of the edge cloud server, so the user can switch to the local DNS server to determine the domain name resolution result.

[0090] In an exemplary embodiment, the domain name resolution method further includes: obtaining preset resource information configured for the terminal from a policy library based on the terminal's identification information; if the target resource information belongs to the preset resource information, then determining that the terminal has the corresponding access permission.

[0091] In this embodiment, the domain name resolution service is pre-configured with preset resource information for different terminals. This preset resource information is used to characterize the terminal's access permissions to different domain names and / or network resources.

[0092] In some embodiments, network service providers offer different domain name resolution services to users on different terminals. For example, based on user needs, a network service provider may provide specific domain name resolution services to users accessing the corporate intranet via terminals. This domain name resolution service is implemented by configuring preset resource information, preventing these users from accessing entertainment video websites unrelated to their work via their terminals.

[0093] In practical applications, network service providers (ISPs) can offer different domain name resolution services for users to choose from, each with different preset resource information configured for the terminal. ISPs can also provide users with custom interfaces for domain name resolution services, allowing users to create projects and grant edge cloud servers access to the domain name resolution code. This enables the domain name resolution code to be configured with parameters and automatically compiled in the cloud, allowing users to customize different functions within the domain name resolution service.

[0094] It should be noted that the access control function in this embodiment includes, but is not limited to, filtering advertisements, filtering domain name resolutions unrelated to the main business, and differentiating and managing access control permissions for domain names of different departments.

[0095] In some embodiments, the terminal's identification information is associated with the identification information of the preset resource information configured for the terminal and stored in an edge cloud server. The edge cloud server determines the identification information of the preset resource information configured for the terminal based on the terminal's identification information, and then retrieves the preset resource information configured for the terminal from the policy library based on the identification information of the preset resource information configured for the terminal.

[0096] For example, the edge cloud server sends identification information of preset resource information configured for the terminal to the server where the policy library is located, so that the server where the policy library is located can retrieve the preset resource information configured for the terminal from the policy library.

[0097] In some embodiments, the target user set to which the terminal belongs is determined based on the terminal's identification information; the target policy set associated with the target user set is determined, and the preset resource information corresponding to the target policy set is obtained from the policy library.

[0098] Users within the same user set enjoy the same domain name resolution service. User sets can be bound to policy sets, and one user set can correspond to multiple policy sets. Multiple fixed policy sets form a policy group, thereby providing the same policy group to terminals within the same user set. Policy sets can specifically correspond to various types of access control, such as ad filtering, secure search, privacy control lists, and third-party trusted DNS categorization sources.

[0099] For example, there exist at least public policy sets A1, A2, and A3, and custom policy sets B1 and B2. The policy groups formed by these sets include, but are not limited to, C1 = A1 + A3, C2 = A1 + B2, and C3 = B1 + B2. Correspondingly, there exist at least three user sets Z1, Z2, and Z3. User set Z1 corresponds to policy group C1, user set Z2 corresponds to policy group C2, and user set Z3 corresponds to policy group C3.

[0100] Based on the terminal's identification information, the target user set to which the terminal belongs is determined to be Z1. Therefore, the target policy group associated with the target user set Z1 is determined to be C1. The target policy sets associated with the target user set Z1 include A1 and A3. Then, the preset resource information corresponding to A1 and A3 is obtained from the policy library.

[0101] Furthermore, the edge cloud server compares the target resource information requested by the terminal with the preset resource information configured for the terminal; if the target resource information belongs to the preset resource information, it is determined that the terminal has full access rights to the target resource information; if the target resource information does not belong to the preset resource information, it is determined that the terminal does not have full access rights to the target resource information; if the target resource information partially belongs to the preset resource information, it is determined that the terminal has partial access rights to the target resource information.

[0102] This embodiment provides a hierarchical policy entry mechanism that differentiates and merges policy sets and identifies designated terminals by extending the domain name URI. It offers features such as on-demand scaling up and down in domain name resolution services, as well as flexible billing based on metrics like traffic, requests, and computation time. Specifically, it pre-configures preset resource information for terminals, declaring which network resources the terminal has corresponding access permissions to. Then, it compares the target resource information requested by the terminal with the preset resource information to identify whether the terminal has the corresponding access permissions in the current domain name resolution process, determining whether to provide the domain name resolution result to the terminal. Since different terminals can customize different preset resource information, the edge cloud server can respond accordingly to DNS requests from different terminals, providing differentiated control over the domain name resolution process for different terminals and offering a more secure and flexible domain name resolution service.

[0103] In an exemplary embodiment, as shown in FIG5, the above-described domain name resolution method further includes the following steps S501 to S503.

[0104] S501: Receives reversible DNS codes sent by the edge cloud orchestrator.

[0105] The edge cloud orchestrator is used for debugging and deploying code within the edge cloud SaaS environment, as well as allocating resources such as the central processing unit (CPU), memory, bandwidth, address, and storage of edge cloud servers. The edge cloud orchestrator can simultaneously manage the domain name resolution functions of multiple edge cloud servers, distributing the reversible DNS code (i.e., domain name resolution code) required for domain name resolution to each edge cloud server via a Digital Copyright Identifier (DCI) or over the network.

[0106] Accordingly, the edge cloud server receives the reversible DNS code sent by the edge cloud orchestrator.

[0107] It should be noted that deploying edge cloud servers does not involve the management of the file system, underlying operating system (OS), network exit and address. Only the reversible DNS code needs to be implemented and modified to encrypt and protect the access process in the domain name resolution process of the terminal, so as to gradually and smoothly migrate the domain name resolution service of the terminal to the edge cloud server as needed.

[0108] S502: Determine the identification information of the terminal configured with preset resource information based on the reversible DNS code.

[0109] Terminals are configured with preset resource information by selecting the type of domain name resolution service provided by the network service provider or by customizing the required domain name resolution service through the custom interface of the domain name resolution service. The reversible DNS code sent by the edge cloud orchestrator to the edge cloud server provides the edge cloud server with domain name resolution functionality. Therefore, the edge cloud server can identify the terminal with the preset resource information based on the reversible DNS code and determine the terminal's identification information.

[0110] S503: Send the terminal's identification information and the first domain name of the edge cloud server to the local DNS server.

[0111] Before the terminal initiates domain name resolution, the edge cloud server synchronously or asynchronously sends the terminal's identification information and its own first domain name to the corresponding local DNS server. This notifies the terminals with preset resource information configured in the region to which each local DNS server belongs, as well as the edge cloud server corresponding to each terminal. This allows each local DNS server to send the first domain name of the edge cloud server corresponding to the terminal to the terminal when it receives a request from the terminal.

[0112] For example, the terminal's identification information and the first domain name of the edge cloud server are pushed to the terminal's browser's custom domain name resolution settings through the mobile application service (APP), so that the terminal can access the edge cloud server deployed on the edge cloud from the nearest location and apply the corresponding policy set or policy group.

[0113] In this embodiment, by coordinating the configuration and deployment of edge cloud computing power, the scheduling and processing of domain name resolution on edge cloud servers are realized. Under the premise of security and controllability, domain name resolution service is encapsulated as a basic capability, enabling rapid deployment of edge cloud servers and allowing them to respond locally. The reversible DNS instances used by different terminals for domain name resolution are isolated from each other, but physical layer resources are reused. Edge cloud servers can be deployed incrementally, allowing for resolution callbacks, load balancing, and failure redundancy, which can improve the performance and availability of local DNS servers. This allows users' critical services on different terminals to be gradually decomposed and migrated from private clouds to public clouds and hybrid clouds.

[0114] Specifically, before the terminal initiates domain name resolution, the terminal's identification information and the first domain name of the edge cloud server corresponding to the terminal are sent to the local DNS server corresponding to the terminal. This enables the local DNS server to guide the domain name resolution of the terminal, ensuring the stability and reliability of the domain name resolution process and executing the domain name resolution process more efficiently in a distributed edge cloud environment.

[0115] In an exemplary embodiment of this application, as shown in FIG6, a domain name resolution method is also provided. Taking the application of this method to the terminal in FIG1 as an example, the method includes the following steps S601 to S604.

[0116] S601: Receives the first domain name of the edge cloud server sent by the local DNS server.

[0117] S602: Generate a DNS request based on the second domain name and target resource information requested by the terminal.

[0118] S603: Send a DNS request to the edge cloud server based on the first domain name.

[0119] S604: Receive the domain name resolution result corresponding to the second domain name.

[0120] Among them, the domain name resolution result is sent to the terminal by the edge cloud server through the local DNS server after determining that the terminal has the corresponding access permissions based on the target resource information in the DNS request.

[0121] In the aforementioned domain name resolution method, the terminal receives the first domain name of the edge cloud server sent by the local DNS server, generates a DNS request based on the second domain name requested by the terminal and the target resource information, sends the DNS request to the edge cloud server based on the first domain name, and receives the domain name resolution result corresponding to the second domain name. This embodiment deploys the edge cloud server locally to provide domain name resolution services to the terminal. Compared with the recursive query method in the prior art, this application can effectively reduce the latency in the domain name resolution process. Furthermore, the edge cloud server can identify the terminal's access permissions based on the target resource information, thereby differentiating the domain name resolution process for different terminals and providing a more secure and flexible domain name resolution service.

[0122] In an exemplary embodiment, step S602 may include: generating access path information for the terminal based on the terminal's identification information and the target resource information requested by the terminal; and generating a DNS request based on the second domain name requested by the terminal and the terminal's access path information.

[0123] In some embodiments, the terminal's identification information is used by the edge cloud server to determine whether a local DNS record corresponding to the terminal exists; the domain name resolution result corresponding to the second domain name is determined by the local DNS server based on the resolution indication information sent by the edge cloud server and sent to the terminal if a local DNS record corresponding to the terminal exists, or the local DNS server forwards the domain name resolution result sent by the edge cloud server to the terminal if a local DNS record corresponding to the terminal does not exist.

[0124] This embodiment provides a method for generating and encrypting DNS requests, which can ensure the security and reliability of DNS message transmission. This allows the edge cloud server to accurately obtain the identification information of newly added terminals and the target resource information requested by the terminals, thereby improving the accuracy of the edge cloud server in determining the access permissions of the terminals.

[0125] In an exemplary embodiment, the above domain name resolution method may further include: receiving a digital certificate of an edge cloud server sent by a local DNS server; and extracting the corresponding public key from the digital certificate of the edge cloud server.

[0126] The local DNS server can receive the digital certificate of the edge cloud server sent by the edge cloud server, and then forward it to the corresponding terminal so that the corresponding terminal can extract the corresponding public key from the digital certificate.

[0127] Accordingly, an initial DNS request can be generated based on the second domain name requested by the terminal and the terminal's access path information; the initial DNS request is then encrypted using a public key to obtain an encrypted DNS request.

[0128] After generating the initial DNS request, the terminal encrypts it using the public key corresponding to the edge cloud server, resulting in an encrypted DNS request. Correspondingly, the edge cloud server possesses a private key that allows it to decrypt the encrypted DNS request.

[0129] It should be noted that the encrypted DNS request can be sent to the edge cloud server via DoH encryption to achieve secondary encryption of the DNS request.

[0130] In this embodiment, before the terminal initiates domain name resolution, the local DNS server provides it with the encryption method corresponding to the edge cloud server. Thus, when the terminal initiates domain name resolution, the DNS request is encrypted using the corresponding encryption method, and the edge cloud server completes the corresponding decryption, thereby improving the security of DNS request transmission and ensuring the security of domain name resolution.

[0131] In an exemplary embodiment of this application, as shown in FIG7, a domain name resolution method is also provided, including the following steps S701 to S714.

[0132] S701: Receives reversible DNS codes sent by the edge cloud orchestrator.

[0133] S702: Determine the identification information of the terminal configured with preset resource information based on the reversible DNS code.

[0134] S703: Sends the terminal's identification information and the first domain name of the edge cloud server to the local DNS server.

[0135] S704: Receives a Domain Name System (DNS) request sent by the receiving terminal based on the first domain name of the edge cloud server.

[0136] The first domain name is obtained from the local DNS server corresponding to the terminal.

[0137] S705: Decrypt the DNS request to obtain the second domain name requested by the terminal and the terminal's access path information.

[0138] S706: Parse the terminal's access path information to obtain the terminal's identification information and the target resource information requested by the terminal.

[0139] S707: Determine the target user set to which the terminal belongs based on the terminal's identification information.

[0140] S708: Determine the target policy set associated with the target user set, and obtain the preset resource information corresponding to the target policy set from the policy library.

[0141] S709: Determine whether the target resource information belongs to the preset resource information.

[0142] If yes, then execute S710; otherwise, execute S714.

[0143] S710: Determine that the terminal has the corresponding access permissions.

[0144] S711: Based on the terminal's identification information, determine whether a corresponding local parsing record exists in the policy library.

[0145] If it exists, execute S712; if it does not exist, execute S713.

[0146] S712: Sends resolution instruction information to the local DNS server.

[0147] The resolution instruction information is used to instruct the local DNS server to determine the domain name resolution result corresponding to the second domain name and send the domain name resolution result to the terminal.

[0148] S713: Send the domain name resolution result corresponding to the second domain name to the local DNS server so that the local DNS server forwards the domain name resolution result to the terminal.

[0149] S714: Determined that the terminal does not have the corresponding access permissions, domain name resolution is rejected.

[0150] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0151] Based on the same inventive concept, this application also provides a domain name resolution apparatus for implementing the domain name resolution method described above. The solution provided by this apparatus is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more domain name resolution apparatus embodiments provided below can be found in the limitations of the domain name resolution method described above, and will not be repeated here.

[0152] In an exemplary embodiment of this application, as shown in FIG8, a domain name resolution device 1 is also provided, including: a request receiving module 10, an information determining module 20, and a result sending module 30, wherein:

[0153] The request receiving module 10 is used to receive a DNS request sent by the terminal based on the first domain name of the edge cloud server, wherein the first domain name is obtained from the local DNS server corresponding to the terminal.

[0154] Information determination module 20 is used to determine the second domain name and target resource information requested by the terminal based on the DNS request; and

[0155] The result sending module 30 is used to send the domain name resolution result corresponding to the second domain name to the terminal through the local DNS server when it is determined that the terminal has the corresponding access rights based on the target resource information.

[0156] In an exemplary embodiment, as shown in FIG9, the information determination module 20 may further include:

[0157] The request decryption unit 21 is used to decrypt the DNS request to obtain the second domain name requested by the terminal and the terminal's access path information; and

[0158] The information parsing unit 22 is used to parse the access path information of the terminal to obtain the terminal's identification information and the target resource information requested by the terminal.

[0159] In an exemplary embodiment, as shown in FIG10, the result sending module 30 may further include:

[0160] The record query unit 31 is used to determine whether a corresponding local parsing record exists in the policy base based on the terminal's identification information; and

[0161] The result sending unit 32 is used to send a resolution instruction to the local DNS server when a corresponding local resolution record exists, and to send the domain name resolution result corresponding to the second domain name to the local DNS server when no corresponding local resolution record exists, so that the local DNS server forwards the domain name resolution result to the terminal.

[0162] The resolution instruction information is used to instruct the local DNS server to determine the domain name resolution result corresponding to the second domain name and send the domain name resolution result to the terminal.

[0163] In an exemplary embodiment, the result sending module 30 may further include:

[0164] The configuration query unit is used to retrieve preset resource information configured for the terminal from the policy library based on the terminal's identification information; and

[0165] The permission determination unit is used to determine whether the terminal has the corresponding access permission when the target resource information belongs to the preset resource information.

[0166] In an exemplary embodiment, the configuration query unit may further include:

[0167] The user set determination subunit is used to determine the target user set to which the terminal belongs based on the terminal's identification information; and

[0168] The configuration acquisition subunit is used to determine the target policy set associated with the target user set and to obtain the preset resource information corresponding to the target policy set from the policy library.

[0169] In one exemplary embodiment, the domain name query device may further include:

[0170] The code receiving module is used to receive reversible DNS codes sent by the edge cloud orchestrator;

[0171] The identifier determination module is used to determine the identifier information of a terminal configured with preset resource information based on the reversible DNS code; and

[0172] The domain name sending module is used to send the terminal's identification information and the first domain name of the edge cloud server to the local DNS server.

[0173] In an exemplary embodiment of this application, as shown in FIG11, a domain name resolution device 2 is also provided, including: a domain name receiving module 40, a request generation module 50, a request sending module 60, and a result receiving module 70, wherein:

[0174] Domain name receiving module 40 is used to receive the first domain name of the edge cloud server sent by the local DNS server;

[0175] The request generation module 50 is used to generate a DNS request based on the second domain name and target resource information requested by the terminal.

[0176] Request sending module 60 is used to send a DNS request to the edge cloud server based on the first domain name; and

[0177] Result receiving module 70 is used to receive the domain name resolution result corresponding to the second domain name.

[0178] Among them, the domain name resolution result is sent to the terminal by the edge cloud server through the local DNS server after determining that the terminal has the corresponding access permissions based on the target resource information in the DNS request.

[0179] In an exemplary embodiment of this application, as shown in FIG12, the request generation module 50 may further include:

[0180] The path generation unit 51 is used to generate access path information for the terminal based on the terminal's identification information and the target resource information requested by the terminal; and

[0181] The request generation unit 52 is used to generate a DNS request based on the second domain name requested by the terminal and the terminal's access path information.

[0182] In an exemplary embodiment of this application, the domain name query device 2 may further include:

[0183] The certificate receiving module is used to receive the digital certificate of the edge cloud server sent by the local DNS server; and

[0184] The public key extraction module is used to extract the corresponding public key from the digital certificate of the edge cloud server.

[0185] Accordingly, the request generation unit 52 may further include:

[0186] The first request generation subunit is used to generate an initial DNS request based on the second domain name requested by the terminal and the terminal's access path information; and

[0187] The request encryption subunit is used to encrypt the initial DNS request using a public key to obtain the encrypted DNS request.

[0188] In an exemplary embodiment, the terminal's identification information is used by the edge cloud server to determine whether a local DNS record corresponding to the terminal exists; the domain name resolution result corresponding to the second domain name is determined by the local DNS server based on the resolution indication information sent by the edge cloud server and sent to the terminal if a local DNS record corresponding to the terminal exists, or if the local DNS server forwards the domain name resolution result sent by the edge cloud server to the terminal if a local DNS record corresponding to the terminal does not exist.

[0189] Each module in the aforementioned domain name resolution device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0190] In an exemplary embodiment, a computer device is provided, which may be deployed with an edge cloud server, and its internal structure diagram is shown in Figure 13. The computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is connected to the system bus via the I / O interfaces. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes non-volatile storage media and internal memory. The non-volatile storage media stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database of the computer device stores user set and policy set data. The I / O interfaces of the computer device are used for exchanging information between the processor and external devices. The communication interface of the computer device is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a domain name resolution method.

[0191] In an exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram is shown in Figure 14. The computer device includes a processor, memory, input / output interface, communication interface, display unit, and input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interface. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The input / output interface of the computer device is used for exchanging information between the processor and external devices. The communication interface of the computer device is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements a domain name resolution method. The display unit of the computer device is used to form a visually visible image and may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0192] Those skilled in the art will understand that the structures shown in Figures 13 and 14 are merely block diagrams of some structures related to the present application and do not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than shown in the figures, or combine certain components, or have different component arrangements.

[0193] In one exemplary embodiment of this application, a communication device is also provided, including: a transmitter, a receiver, a processor, and a memory, wherein the memory stores a computer program; the receiver is configured to receive a DNS request sent by a terminal based on a first domain name of an edge cloud server; wherein the first domain name is obtained from a local DNS server corresponding to the terminal; the processor is configured to execute the computer program to determine, according to the DNS request, a second domain name and target resource information requested by the terminal to access; and the transmitter is configured to send the domain name resolution result corresponding to the second domain name to the terminal through the local DNS server, provided that the terminal has the corresponding access rights based on the target resource information.

[0194] In one exemplary embodiment of this application, a communication device is also provided, including: a transmitter, a receiver, a processor, and a memory, wherein the memory stores a computer program; the receiver is configured to receive a first domain name of an edge cloud server sent by a local DNS server; the processor is configured to execute the computer program to generate a DNS request based on a second domain name and target resource information requested by a terminal; the transmitter is configured to send a DNS request to the edge cloud server based on the first domain name; the receiver is further configured to receive the domain name resolution result corresponding to the second domain name; wherein the domain name resolution result is sent to the terminal by the edge cloud server through the local DNS server when the edge cloud server determines that the terminal has the corresponding access rights based on the target resource information in the DNS request.

[0195] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, causes the processor to implement the aforementioned domain name resolution method.

[0196] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, causes the processor to implement the aforementioned domain name resolution method.

[0197] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0198] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0199] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A domain name resolution method, comprising: receiving a domain name system (DNS) request sent by a terminal based on a first domain name of an edge cloud server, wherein the first domain name is obtained from a local DNS server corresponding to the terminal; decrypting the DNS request to obtain a second domain name requested to be accessed by the terminal and access path information of the terminal, and parsing the access path information of the terminal to obtain identification information of the terminal and target resource information requested to be accessed by the terminal; in a case where it is determined according to the target resource information that the terminal has corresponding access authority, determining whether there is a corresponding local resolution record in a policy library according to the identification information of the terminal; when there is a corresponding local resolution record in the policy library, sending resolution instruction information to the local DNS server, wherein the resolution instruction information is used to instruct the local DNS server to determine a domain name resolution result corresponding to the second domain name and send the domain name resolution result to the terminal; when there is no corresponding local resolution record in the policy library, sending a domain name resolution result corresponding to the second domain name to the local DNS server, so that the local DNS server forwards the domain name resolution result to the terminal. 2.The method of claim 1, wherein the determining that the terminal has corresponding access authority according to the target resource information comprises: obtaining preset resource information configured for the terminal from a policy library according to the identification information of the terminal; and determining that the terminal has corresponding access authority when the target resource information belongs to the preset resource information. 3.The method of claim 2, wherein the obtaining preset resource information configured for the terminal from a policy library according to the identification information of the terminal comprises: determining a target user set to which the terminal belongs according to the identification information of the terminal; and determining a target policy set associated with the target user set and obtaining preset resource information corresponding to the target policy set from a policy library. 4.The method of claim 1, before the receiving a domain name system (DNS) request sent by a terminal based on a first domain name of an edge cloud server, the method further comprises: receiving a reversible DNS code sent by an edge cloud orchestrator; determining identification information of a terminal configured with preset resource information according to the reversible DNS code; and sending the identification information of the terminal and the first domain name of the edge cloud server to the local DNS server. 5.A domain name resolution method, comprising: receiving a first domain name of an edge cloud server sent by a local DNS server; generating access path information of a terminal according to identification information of the terminal and target resource information requested to be accessed by the terminal; generating a DNS request according to a second domain name requested to be accessed by the terminal and the access path information of the terminal; sending the DNS request to the edge cloud server based on the first domain name; and ​ ​ ​ ​ receive a domain name resolution result corresponding to the second domain name, wherein the domain name resolution result is sent by the edge cloud server to the terminal through the local DNS server in a case where the edge cloud server determines that the terminal has corresponding access authority based on the target resource information in the DNS request; and the identification information of the terminal is used for the edge cloud server to determine whether there is a local resolution record corresponding to the terminal; the domain name resolution result corresponding to the second domain name is determined by the local DNS server based on the resolution instruction information sent by the edge cloud server and sent to the terminal in a case where there is a local resolution record corresponding to the terminal, or is forwarded by the local DNS server to the terminal in a case where there is no local resolution record corresponding to the terminal.

6. The method of claim 5, generating the access path information of the terminal according to the identification information of the terminal and the target resource information requested to be accessed by the terminal. and before generating the DNS request according to the second domain name requested by the terminal to access and the access path information of the terminal, the method further comprises: receiving the digital certificate of the edge cloud server sent by the local DNS server; and extracting the corresponding public key from the digital certificate of the edge cloud server; wherein the generating the DNS request according to the second domain name requested by the terminal to access and the access path information of the terminal comprises: generating an initial DNS request according to the second domain name requested by the terminal to access and the access path information of the terminal; and encrypting the initial DNS request using the public key to obtain an encrypted DNS request.

7. A domain name resolution apparatus, comprising: a request receiving module configured to receive a DNS request sent by a terminal based on a first domain name of an edge cloud server, wherein the first domain name is obtained from a local DNS server corresponding to the terminal; an information determining module configured to determine a second domain name requested by the terminal to access and target resource information according to the DNS request; wherein the information determining module comprises: a request decryption unit configured to decrypt the DNS request to obtain the second domain name requested by the terminal to access and access path information of the terminal; and an information parsing unit configured to parse the access path information of the terminal to obtain identification information of the terminal and target resource information requested by the terminal to access; and The result sending module is configured to send the domain name resolution result corresponding to the second domain name to the terminal through the local DNS server in a case where it is determined according to the target resource information that the terminal has corresponding access authority; wherein the result sending module comprises: a record querying unit configured to determine whether there is a corresponding local resolution record in a policy library according to the identification information of the terminal; and a result sending unit configured to send resolution instruction information to the local DNS server in a case where there is a corresponding local resolution record, and send the domain name resolution result corresponding to the second domain name to the local DNS server in a case where there is no corresponding local resolution record, so that the local DNS server forwards the domain name resolution result to the terminal; wherein the resolution instruction information is used to instruct the local DNS server to determine the domain name resolution result corresponding to the second domain name and send the domain name resolution result to the terminal.

8. A domain name resolution apparatus, comprising: a domain name receiving module configured to receive a first domain name of an edge cloud server sent by a local DNS server; a request generating module configured to generate a DNS request according to a second domain name requested to be accessed by a terminal and target resource information; wherein the request generating module comprises: a path generating unit configured to generate access path information of the terminal according to identification information of the terminal and the target resource information requested to be accessed by the terminal; and a request generating unit configured to generate the DNS request according to the second domain name requested to be accessed by the terminal and the access path information of the terminal; a request sending module configured to send the DNS request to the edge cloud server based on the first domain name; and a result receiving module configured to receive a domain name resolution result corresponding to the second domain name; wherein the domain name resolution result is sent by the edge cloud server to the terminal through the local DNS server in a case where it is determined based on the target resource information in the DNS request that the terminal has corresponding access authority; the identification information of the terminal is used for the edge cloud server to determine whether there is a local resolution record corresponding to the terminal; and the domain name resolution result corresponding to the second domain name is determined by the local DNS server based on resolution instruction information sent by the edge cloud server and sent to the terminal in a case where there is a local resolution record corresponding to the terminal, or is forwarded by the local DNS server to the terminal in a case where there is no local resolution record corresponding to the terminal.

9. A communication device comprising: a transmitter, a receiver, a processor and a memory, the memory storing a computer program; wherein the receiver is configured to receive a DNS request sent by a terminal based on a first domain name of an edge cloud server, wherein the first domain name is obtained from a local DNS server corresponding to the terminal; the processor is configured to execute the computer program to decrypt the DNS request to obtain a second domain name requested to be accessed by the terminal and access path information of the terminal; The access path information of the terminal is parsed to obtain identification information of the terminal and target resource information requested to be accessed by the terminal; in a case where it is determined according to the target resource information that the terminal has corresponding access permission, it is determined according to the identification information of the terminal whether there is a corresponding local resolution record in a policy library; The transmitter is configured to send resolution indication information to the local DNS server in a case where there is a corresponding local resolution record, and send domain name resolution results corresponding to the second domain name to the local DNS server in a case where there is no corresponding local resolution record, so that the local DNS server forwards the domain name resolution results to the terminal; wherein the resolution indication information is used to instruct the local DNS server to determine the domain name resolution results corresponding to the second domain name and send the domain name resolution results to the terminal.

10. A communication device comprising: A transmitter, a receiver, a processor and a memory, the memory storing a computer program; Wherein The receiver is configured to receive a first domain name of an edge cloud server sent by a local DNS server; The processor is configured to execute the computer program to generate access path information of a terminal according to identification information of the terminal and target resource information requested to be accessed by the terminal; Generate a DNS request according to a second domain name requested to be accessed by the terminal and the access path information of the terminal; The transmitter is configured to send the DNS request to the edge cloud server based on the first domain name; And The receiver is further configured to receive domain name resolution results corresponding to the second domain name; wherein the domain name resolution results are sent by the edge cloud server to the terminal through the local DNS server in a case where it is determined based on the target resource information in the DNS request that the terminal has corresponding access permission; the identification information of the terminal is used for the edge cloud server to determine whether there is a local resolution record corresponding to the terminal; The domain name resolution results corresponding to the second domain name are determined and sent to the terminal by the local DNS server based on resolution indication information sent by the edge cloud server in a case where there is a local resolution record corresponding to the terminal, or are forwarded to the terminal by the local DNS server in a case where there is no local resolution record corresponding to the terminal.

11. A computer-readable storage medium having a computer program stored thereon, the computer program being executed by a processor to cause the processor to implement the method of any one of claims 1 to 6.

12. A computer program product comprising a computer program, the computer program being executed by a processor to cause the processor to implement the method of any one of claims 1 to 6.

Images