A control method for scheduling concurrent recursive numbers of DNS

Abstract

The present application relates to a control method for scheduling the concurrent recursive number of a DNS server, the method comprising: setting the overall maximum concurrent recursive number of a DNS server; dividing the overall maximum concurrent recursive number into a first maximum concurrent recursive number during primary scheduling and a second maximum concurrent recursive number during secondary scheduling; the recursive query first undergoes primary scheduling, and when the current concurrent recursive number reaches the first maximum concurrent recursive number, enters secondary scheduling; the second maximum concurrent recursive number is further divided into multiple slot numbers; the slot ID number that falls into is calculated, and if the current concurrent recursive number of the slot corresponding to the slot ID number that falls into is less than the maximum concurrent recursive number of each slot, a recursive query is issued. Under the premise of satisfying normal DNS recursive queries, the present application can also limit the impact of abnormal DNS recursive queries or attacks to a certain range, thereby reducing the impact on normal traffic.

Description

Technical Field

[0001] The present application relates to the technical field of computer domain name resolution, and in particular to a control method, computer equipment and storage medium for DNS concurrent recursive number scheduling. Background Art

[0002] DNS recursive query needs to initiate a DNS query to an external DNS server to obtain the required DNS records. However, since each DNS recursive query link needs to occupy certain resources (IP port of the local machine, memory data structure of each link, etc.), basically all DNS server software has a limit on the maximum number of concurrent recursive queries. If there are a large number of recursive outbound queries, when the number of outbound recursive query links reaches the set maximum value, no new recursive query links will be generated, but the servfail status will be directly returned to the query client, so as to ensure that system resources are not over-consumed.

[0003] The current mainstream DNS server software (BIND for example) has a global parameter for the maximum number of concurrent recursions, which means that all outbound queries will consume this value. Under normal circumstances, due to the existence of the DNS cache, DNS recursive queries are relatively random, so there is no problem with this global sharing mechanism. However, in some extreme cases such as attacks, this mechanism will cause more serious problems. For example, a certain type of attack source only attacks the attack.com domain: in order to consume system resources, the attacker launches a large number of random domain names of attack.com. Because these domain names are random, they will not hit the cache, which will trigger recursive queries. When the maximum number of concurrent recursions is triggered, normal recursive queries will not be served, resulting in normal queries being unable to be answered. Summary of the invention

[0004] Based on this, it is necessary to provide a control method, device, computer equipment and storage medium for DNS concurrent recursive number scheduling in response to the above technical problems, so that under the premise of satisfying normal DNS recursive queries, the impact of abnormal DNS recursive queries or attacks can be limited to a certain range, thereby reducing the impact on normal traffic.

[0005] A first aspect of the present invention provides a method for controlling DNS concurrent recursive number scheduling, comprising:

[0006] Set the overall maximum number of concurrent recursions for the DNS server;

[0007] Dividing the overall maximum concurrent recursion number into a first maximum concurrent recursion number in primary scheduling and a second maximum concurrent recursion number in secondary scheduling;

[0008] All recursive queries first go through the first-level scheduling. When the current number of concurrent recursions reaches the first maximum number of concurrent recursions set, they enter the second-level scheduling.

[0009] Dividing the second maximum concurrent recursion number into multiple slot numbers to form a maximum concurrent recursion number for each slot;

[0010] Calculate the slot ID number that the query falls into. If the current concurrent recursion number of the slot corresponding to the slot ID number that the query falls into is less than the maximum concurrent recursion number of each slot, a recursive query request is issued externally.

[0011] Furthermore, the calculation of the slot ID number includes:

[0012] Query the domain name to obtain the domain required for calculation;

[0013] Calculate the hash value of the corresponding domain through the domain;

[0014] The hash value and the number of slots are modulo each other to obtain the slot ID number.

[0015] Furthermore, during the first-level scheduling, if the current concurrent recursion number has not reached the set first maximum concurrent recursion number, the current concurrent recursion number is increased by one and the status is saved at the same time; if after the recursive query is responded to or the query times out, if it is detected that the recursive query comes to the first-level scheduling, the current concurrent recursion number during the first-level scheduling is reduced by one.

[0016] Furthermore, during secondary scheduling, after a recursive query is issued, the current concurrent recursive number of the specified slot is increased by one, and the slot ID number is saved; when the recursive query is answered or times out, if it is detected that the recursive query comes from secondary scheduling, the current concurrent recursive number of the slot is reduced by one.

[0017] Preferably, the first maximum concurrent recursion number and the second maximum concurrent recursion number are both set to half of the overall maximum concurrent recursion number.

[0018] Optionally, the domain is a secondary domain or a tertiary domain.

[0019] Preferably, the number of slots is 2 to the power of n.

[0020] Preferably, the number of slots is 128.

[0021] A second aspect of the present invention provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, one of the methods described in the first aspect of the present invention is implemented.

[0022] According to a third aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, one of the methods described in the first aspect of the present invention is implemented.

[0023] The control method, computer device and storage medium for DNS concurrent recursive number scheduling provided by the present invention divide the overall maximum concurrent recursive number of the DNS domain name system into two levels. The first level is compatible with the existing recursive number logic to meet the DNS recursive query under normal traffic. The second level uses domain-divided hash logic to control the impact of a certain type of attack traffic within a small range without affecting the recursive query of other normal traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A schematic diagram of the process of DNS recursive sending in an embodiment of the present invention;

[0025] Figure 2 A schematic diagram of a process of DNS recursive release in an embodiment of the present invention;

[0026] Figure 3 It is a structural principle diagram of a computer device in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. In addition, for the sake of clarity and brevity, the description of well-known functions and structures is omitted.

[0028] The terms used herein are only used to describe various embodiments of the present invention and are not intended to limit the present invention. Unless the context clearly indicates otherwise, the singular form is intended to include the plural form. In the present invention, it should be understood that the term "including" or "having" indicates the presence of features, numbers, steps, operations, elements, parts or combinations thereof, and does not exclude the presence of one or more other features, numbers, steps, operations, elements, parts or combinations thereof, or the possibility of adding one or more other features, numbers, steps, operations, elements, parts or combinations thereof.

[0029] For the convenience of description, some terms used in this embodiment are defined as follows:

[0030] C: The maximum number of concurrent recursions of the entire system.

[0031] C1: Maximum number of concurrent recursions at the first level.

[0032] N1: Current number of concurrent recursions at the first level.

[0033] C2: Maximum number of concurrent recursions at the second level.

[0034] N2: The current number of concurrent recursions at the second level.

[0035] S: The number of slots at the second level.

[0036] SC: Maximum number of concurrent recursions per slot.

[0037] SN: Specifies the current concurrent recursion number of the slot.

[0038] Qname: The domain name to be queried.

[0039] Qdomain: Query the domain corresponding to the domain name.

[0040] Qhash: Query the hash value of the domain corresponding to the domain name.

[0041] Qslot: Query the slot ID number.

[0042] Figure 1 The present invention is a flowchart of a method for controlling the number of concurrent recursive DNS scheduling provided according to an exemplary embodiment of the present application.

[0043] The present invention first divides the overall maximum concurrent recursion number C of the DNS system into two levels of scheduling, namely, first-level scheduling and second-level scheduling. The sum of the concurrent recursion numbers of the two levels of scheduling is the overall maximum concurrent recursion number, and the maximum concurrent recursion number of each level of scheduling is half of the overall maximum concurrent recursion number.

[0044] Among them, the first level is the global concurrent recursive scheduling layer, and the logic of this layer is consistent with the existing maximum concurrent recursive number logic, but the capacity becomes half of the existing one, that is, the first-level maximum concurrent recursive number C1=C / 2. The second level is the hash recursive scheduling layer, and its capacity is half of the overall capacity, that is, the second-level maximum concurrent recursive number C2=C / 2. The function of this layer is fine scheduling. The first-level scheduling is performed first, and the second-level scheduling process is entered when certain conditions are met. Of course, those skilled in the art should be able to understand that the capacity settings of the first-level maximum concurrent recursive number and the second-level maximum concurrent recursive number are the same, both of which are half of the total capacity, but they are not limited to this quantity setting method, and the two can also be set to different.

[0045] Reference Figure 1 , Figure 2 As shown, the method mainly includes the following steps:

[0046] 1. First-level scheduling

[0047] All recursive queries first go through the first-level scheduling. For recursive queries from DNS, as long as the concurrent recursive count at this level does not reach the upper limit value (i.e., N1 < C1), a recursive query request is normally sent outwards, and the current concurrent recursive count at this layer is incremented by one (N1 = N1 + 1). At the same time, the query status is saved, indicating that this recursive query comes from the first level for use when subsequent recursive releases occur. If the concurrent recursive count at this layer reaches the upper limit (i.e., N1 == C1), the scheduling logic of the following second level is entered. Under normal traffic, usually the maximum concurrent recursive count at the first level does not reach the upper limit, and this method is fully compatible with the existing DNS maximum recursive count logic.

[0048] 2. Second-level scheduling

[0049] At the second level, the second-level maximum concurrent recursive count C2 is further divided into S slots. A slot is a logical concept, and the number of slots of a node represents the resource capacity or computing power of this node. It is equivalent to saying that a slot is the resource unit of Hadoop, similar to the concept of a set channel or layer. For the sake of uniform hashing later, S needs to be set to a power of 2, i.e., 2 / 4 / 8 / 16 / 32 / 64 / 128 / 256, etc. If it is too small, it will increase the impact of attacks; if it is too large, it will increase the system load. It is preferably set to 128, which can not only meet the capacity but also avoid being vulnerable to attacks due to being too small. The maximum concurrent recursive count for each slot is SC = C2 / S.

[0050] First, the domain (Qdomain) required for calculation is obtained by querying the domain name (Qname). Usually, Qdomain is a second-level domain. For example, if Qname is www.baidu.com, then Qdomain is baidu.com. However, there are two special cases. For Qname with suffixes such as com.cn / net.cn / org.cn / edu.cn, its Qdomain is a third-level domain. For example, if Qname is www.icbc.com.cn, then its Qdomain is icbc.com.cn.

[0051] Then, the hash value Qhash of the corresponding domain is calculated through the domain Qdomain. Exemplarily, the hash algorithm of DNS TSIG can be used, such as HMAC-SHA256 or HMAC-SHA512, etc., to obtain the hash value. Then, Qhash is taken modulo with the slot to obtain the slot ID (index), that is: Qhash = hash(Qdomain); Qslot = Qhash % S. The arrangement of QHash is an ID obtained after calling the global hash function qhash(). This ID can be obtained almost immediately after calling the function, so its positioning speed is very fast.

[0052] Finally, if the SN corresponding to Qslot is less than SC, a recursive query request is issued, SN is increased by 1, and the Qslot value is saved for subsequent release; otherwise, servfail is returned directly, indicating that no recursive number is available.

[0053] Assume that the total maximum concurrent recursive number of the entire system is: C = 1024, then C1 of the first level is 512, and C2 of the second level is 512; suppose the number of second-level slots is 16, that is, S = 16, then the capacity of each slot is: SC = 512 / 16 = 32.

[0054] If the queried domain name is: Qname = www.attack.com, then QDomain = attack.com. If we use the SHA256 HASH algorithm, then the obtained Qhash = 0xb1ba2f733095f35466823ace54ec05ecf8ac1b842802847819c6f1a6081e1ee3, and the corresponding Qslot = Qhash%S = 3, which means that the domain name falls into the slot with index 3. If the SN corresponding to this slot (index 3) is 2, which is less than SC (32), external recursive queries can be made; if the SN corresponding to this slot is 32, it means that it is full and external recursive queries are rejected.

[0055] The secondary scheduling of this application uses domain hashing logic to limit the impact of attack traffic on system resources (such as recursive links and memory consumption) within a certain range (becomes 1 / S) under attack traffic, so as not to affect the DNS recursive queries of other normal traffic.

[0056] 3. Recursive release

[0057] When the recursive query is responded or times out, if it is determined that the recursive request comes from the first level, the N1 of the first level is reduced by one (N1=N1-1); if it is determined that the recursive request comes from the second level, the slot ID (index) is obtained according to the saved Qslot value, the SN corresponding to the slot is reduced by one (SN=SN-1), and the recursive memory is released.

[0058] This application divides the maximum concurrent recursion number of the DNS domain name system into two levels. The first level is compatible with the existing recursion number logic to meet the DNS recursive query under normal traffic; the second level uses domain hash logic to control the impact range of a certain type of attack traffic within a small range without affecting the recursive query of other normal traffic.

[0059] Another embodiment of the present invention provides a computer device, the internal structure of which can be shown as follows: Figure 3 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with other terminals or services through a network connection. When the computer program is executed by the processor, a control method for concurrent recursive number scheduling of DNS is implemented. Among them, the computer device can be a server, and the server can also include a database, and the database of the server can store pre-trained classification models. The computer device can also be a terminal, and the terminal can also include a display screen and an input device. The display screen of the terminal can be a liquid crystal display screen or an electronic ink display screen. The input device of the terminal can be a touch layer covered on the display screen, or a key, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc., or a voice recognition device or a text recognition device.

[0060] Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0061] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, and when the computer program is executed by the processor, the processor executes the steps of the control method for scheduling the concurrent recursive number of DNS. The steps of the control method for scheduling the concurrent recursive number of DNS here can be the steps in the control method for scheduling the concurrent recursive number of DNS in each of the above embodiments: setting the overall maximum concurrent recursive number of the DNS server; dividing the overall maximum concurrent recursive number into the first maximum concurrent recursive number during the first-level scheduling and the second maximum concurrent recursive number during the second-level scheduling; all recursive queries first go through the first-level scheduling, and when the current concurrent recursive number reaches the set first maximum concurrent recursive number, enter the second-level scheduling; the second maximum concurrent recursive number is further divided into multiple slot numbers to form the maximum concurrent recursive number of each slot; the slot ID number that falls into is calculated, and if the current concurrent recursive number of the slot corresponding to the slot ID number that falls into is less than the maximum concurrent recursive number of each slot, a request for a recursive query is issued externally.

[0062] Another embodiment of the present invention further provides a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to execute the steps of the control method for concurrent recursive number scheduling of DNS. The steps of the control method for concurrent recursive number scheduling of DNS here may be the steps of the control method for concurrent recursive number scheduling of DNS in each of the above embodiments.

[0063] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0064] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0065] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A control method for scheduling concurrent recursive DNS requests, characterized in that: include: Set the overall maximum number of concurrent recursions for the DNS server; Dividing the overall maximum concurrent recursion number into a first maximum concurrent recursion number in primary scheduling and a second maximum concurrent recursion number in secondary scheduling; All recursive queries first go through the first-level scheduling. When the current number of concurrent recursions reaches the first maximum number of concurrent recursions set, they enter the second-level scheduling. Dividing the second maximum concurrent recursion number into a plurality of slot numbers to form a maximum concurrent recursion number for each slot, wherein the slot is used to represent the resource capacity of the node; Calculate the ID number of the slot that falls into it. If the current concurrent recursion number of the slot corresponding to the slot ID number that falls into it is less than the maximum concurrent recursion number of each slot, a recursive query request is issued externally.

2. The method according to claim 1, characterized in that Calculation of the slot ID number includes: Query the domain name to obtain the domain required for calculation; Calculate the hash value of the corresponding domain through the domain; The hash value and the number of slots are modulo each other to obtain the slot ID number.

3. The method according to claim 2, characterized in that During the first-level scheduling, if the current concurrent recursion number does not reach the set first maximum concurrent recursion number, the current concurrent recursion number is increased by one and the status is saved at the same time; if after the recursive query is answered or the query times out, if it is detected that the recursive query comes from the first-level scheduling, the current concurrent recursion number during the first-level scheduling is reduced by one.

4. The method according to claim 2, characterized in that In secondary scheduling, after a recursive query is issued, the current concurrent recursive number of the specified slot is increased by one, and the slotID number is saved at the same time; when the recursive query is answered or times out, if it is detected that the recursive query comes from secondary scheduling, the current concurrent recursive number of the slot is reduced by one.

5. The method according to claim 1, characterized in that The first maximum concurrent recursion number and the second maximum concurrent recursion number are both set to half of the overall maximum concurrent recursion number.

6. The method according to claim 2, characterized in that The domain is a secondary domain or a tertiary domain.

7. The method according to claim 2, characterized in that Set the number of slots to a power of 2.

8. The method according to claim 7, characterized in that The number of slots is 128.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images