Information processing method, intermediate resolver, network device, and storage medium

Abstract

The application discloses an information processing method, an intermediate resolver, a network device and a storage medium. The information processing method comprises the following steps: receiving first domain name system request information; obtaining second domain name system request information according to the first domain name system request information, wherein the second domain name system request information comprises ciphertext sensitive information and first ciphertext mark information, and the first ciphertext mark information is used for indicating that the ciphertext sensitive information is ciphertext information; and sending the second domain name system request information to an authoritative domain name system server, so that the authoritative domain name system server performs information processing according to the ciphertext sensitive information and the first ciphertext mark information. According to the application, the ciphertext sensitive information and the first ciphertext mark information are carried in the second domain name system request information, the whole first domain name system request information does not need to be encrypted, the network resource consumption can be reduced under the condition that the sensitive information is prevented from being exposed to security risks, and the maintenance cost of the device is reduced.

Description

Technical Field

[0001] This invention relates to the field of information processing technology, and in particular to an information processing method, an intermediate parser, a network device, and a storage medium. Background Technology

[0002] The Domain Name System (DNS) is a widely used system for resolving domain names and addresses on the Internet. By querying domain name servers, users can obtain the actual Internet Protocol (IP) address of a target server, thus enabling them to establish a link with that server.

[0003] In related technologies, when a user device initiates a DNS request to obtain the IP address of a domain name, it first sends this DNS request to an intermediate resolver. To provide more accurate location determination, the intermediate resolver can include sensitive information such as the location or identity of the user device or nearby service nodes as supplementary information in the DNS request. However, this exposes this sensitive information to security risks during transmission over the network. Existing DNS security protections encrypt every field in the entire DNS request to address this risk, aiming to prevent forged feedback messages by attackers in the middle and maintain data integrity. However, this does not provide adequate protection against sensitive data leakage. Furthermore, existing security technologies require all devices to have a trust mechanism that supports encryption and decryption of DNS request information, leading to increased network resource overhead and higher equipment maintenance costs. Summary of the Invention

[0004] The following is an overview of the subject matter described in detail herein. This overview is not intended to limit the scope of the claims.

[0005] This invention provides an information processing method, an intermediate parser, a network device, and a storage medium, which can reduce network resource overhead and thus reduce device maintenance costs while avoiding the exposure of sensitive information to security risks.

[0006] In a first aspect, embodiments of the present invention provide an information processing method applied to an intermediate parser, the method comprising:

[0007] Receive the first domain name system request information;

[0008] The second domain name system request information is obtained based on the first domain name system request information, wherein the second domain name system request information includes ciphertext sensitive information and first ciphertext marker information, and the first ciphertext marker information is used to indicate that the ciphertext sensitive information is ciphertext information;

[0009] The second domain name system request information is sent to the authoritative domain name system server, so that the authoritative domain name system server processes the information based on the encrypted sensitive information and the first encrypted tag information.

[0010] Secondly, embodiments of the present invention also provide an intermediate parser, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the computer program to implement the information processing method described above.

[0011] Thirdly, embodiments of the present invention also provide a network device including an intermediate parser as described above.

[0012] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing computer-executable instructions for performing the information processing method described above.

[0013] This invention includes: receiving a first domain name system request (DNS) message; obtaining a second DNS request message based on the first DNS request message, wherein the second DNS request message includes encrypted sensitive information and a first encrypted marker, the first encrypted marker being used to indicate that the encrypted sensitive information is encrypted information; and sending the second DNS request message to an authoritative DNS server, so that the authoritative DNS server processes information based on the encrypted sensitive information and the first encrypted marker.

[0014] This invention includes: receiving a first Domain Name System (DNS) request; obtaining a second DNS request based on the first DNS request, wherein the second DNS request includes encrypted sensitive information and a first encrypted marker, the first encrypted marker indicating that the encrypted sensitive information is encrypted; and sending the second DNS request to an authoritative DNS server, causing the authoritative DNS server to process the information based on the encrypted sensitive information and the first encrypted marker. According to the solution of this invention, by converting the first DNS request into a second DNS request including encrypted sensitive information and the first encrypted marker, there is no need to encrypt the entire first DNS request, thus reducing network resource overhead and equipment maintenance costs while avoiding exposure of sensitive information to security risks.

[0015] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the description, claims, and drawings. Attached Figure Description

[0016] The accompanying drawings are provided to further understand the technical solutions of the present invention and constitute a part of the specification. They are used together with the embodiments of the present invention to explain the technical solutions of the present invention, and do not constitute a limitation on the technical solutions of the present invention.

[0017] Figure 1 This is a schematic diagram of a system architecture for performing an information processing method according to an embodiment of the present invention;

[0018] Figure 2 This is a flowchart of an information processing method provided in one embodiment of the present invention;

[0019] Figure 3 This is a schematic diagram of a message body substructure provided in one embodiment of the present invention;

[0020] Figure 4 This is a schematic diagram of another message body substructure provided in one embodiment of the present invention;

[0021] Figure 5 yes Figure 4 A schematic diagram of the expanded message body substructure of the RDATA element in the diagram;

[0022] Figure 6 yes Figure 2 A flowchart illustrating the specific method of step S120;

[0023] Figure 7 yes Figure 6 A flowchart illustrating the specific method of step S124;

[0024] Figure 8 yes Figure 6 A flowchart of another specific method for step S124;

[0025] Figure 9 yes Figure 5 A flowchart illustrating the specific method of step S1244;

[0026] Figure 10 yes Figure 6 A flowchart illustrating the specific method of step S122;

[0027] Figure 11 yes Figure 10 A flowchart illustrating the specific method of step S1222;

[0028] Figure 12 yes Figure 2 A flowchart of another specific method for step S120;

[0029] Figure 13 yes Figure 12 A flowchart illustrating the specific method of step S128;

[0030] Figure 14 yes Figure 12 A flowchart of another specific method for step S128;

[0031] Figure 15 yes Figure 14 A flowchart illustrating the specific method of step S1284;

[0032] Figure 16 yes Figure 12 A flowchart illustrating the specific method of step S126;

[0033] Figure 17 yes Figure 16 A flowchart illustrating the specific method of step S1262;

[0034] Figure 18 This is a flowchart of an information processing method provided in another embodiment of the present invention;

[0035] Figure 19 yes Figure 18 A flowchart illustrating the specific method of step S150;

[0036] Figure 20 yes Figure 18 A flowchart of another specific method for step S150;

[0037] Figure 21 yes Figure 18 A flowchart of another specific method for step S150;

[0038] Figure 22 This is a flowchart of an information processing method provided by a specific example of the present invention. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0040] It should be noted that although a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown in the flowchart. The terms "first," "second," etc., in the specification, claims, and the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0041] This invention provides an information processing method, an intermediate resolver, a network device, and a storage medium. Upon receiving a first Domain Name System (DNS) request, the method converts the first DNS request into a second DNS request, which includes encrypted sensitive information and a first encrypted marker. The second DNS request is then sent to an authoritative DNS server, allowing the authoritative DNS server to process the information based on the encrypted sensitive information and the first encrypted marker. In other words, this embodiment of the invention transmits the second DNS request, which includes the encrypted sensitive information and the first encrypted marker, without encrypting the entire first DNS request. This reduces network resource overhead and lowers device maintenance costs while avoiding the exposure of sensitive information to security risks. Furthermore, since the first encrypted marker indicates that the encrypted sensitive information is encrypted, the authoritative DNS server can appropriately decrypt the encrypted sensitive information based on the first encrypted marker, thereby improving the accuracy of the authoritative DNS server's processing of the second DNS request.

[0042] The embodiments of the present invention will be further described below with reference to the accompanying drawings.

[0043] like Figure 1 As shown, Figure 1 This is a schematic diagram of a system architecture for performing an information processing method according to an embodiment of the present invention. Figure 1 In the example, the system architecture includes a client device 110, an intermediate resolver 120, and an authoritative domain name system server 130. The intermediate resolver 120 is communicatively connected to both the client device 110 and the authoritative domain name system server 130.

[0044] The intermediate resolver 120 can receive a first domain name system request (DNS) message sent by the client device 110. If the first DNS request message carries sensitive information, the intermediate resolver 120 can encrypt the sensitive information in the first DNS request message to obtain a second DNS request message carrying ciphertext sensitive information. If the first DNS request message does not carry sensitive information, the intermediate resolver 120 can obtain the sensitive information corresponding to the client device 110, encrypt the sensitive information, and then combine it with the first DNS request message to generate a second DNS request message carrying ciphertext sensitive information. Furthermore, the second DNS request message also carries a first ciphertext marker information indicating that the ciphertext sensitive information is ciphertext. Additionally, the intermediate resolver 120 can also send the second DNS request message to the authoritative DNS server 130, enabling the authoritative DNS server 130 to perform relevant information processing based on the ciphertext sensitive information and the first ciphertext marker information. In addition, the intermediate resolver 120 can also obtain feedback information including feedback type information and second ciphertext mark information from the authoritative domain name system server 130. The intermediate resolver 120 can forward the feedback information to the client device 110 according to the feedback type information and second ciphertext mark information, or reconstruct new domain name system request information and send it to the authoritative domain name system server 130, so that the authoritative domain name system server 130 reprocesses the new domain name system request information.

[0045] The system architecture and application scenarios described in the embodiments of this invention are for the purpose of more clearly illustrating the technical solutions of the embodiments of this invention, and do not constitute a limitation on the technical solutions provided by the embodiments of this invention. As those skilled in the art will know, with the evolution of system architecture and the emergence of new application scenarios, the technical solutions provided by the embodiments of this invention are also applicable to similar technical problems.

[0046] It will be understood by those skilled in the art that Figure 1 The system architecture shown does not constitute a limitation on the embodiments of the present invention and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0047] Based on the above system architecture, various embodiments of the data processing method of the present invention are proposed below.

[0048] like Figure 2 As shown, Figure 2 This is a flowchart of an information processing method provided in one embodiment of the present invention. This information processing method can be applied to an intermediate parser, for example... Figure 1 The intermediate parser 120 in the system architecture shown. This information processing method may include, but is not limited to, steps S110, S120, and S130.

[0049] Step S110: Receive the first domain name system request information.

[0050] In this step, the first Domain Name System (DNS) request is used to request the mapping relationship between domain names and Internet Protocol (IP) addresses. The initiators of the first DNS request include, but are not limited to, client devices that need to obtain the mapping relationship between domain names and IP addresses. The recipients of the first DNS request include, but are not limited to, Internet service provider (ISP) devices and intermediate resolvers.

[0051] In one embodiment, the first domain name system request information may carry sensitive information corresponding to the sender of the first domain name system request information. The sensitive information may be used to characterize the Internet Protocol address corresponding to the sender or the hardware identifier code corresponding to the sender's device.

[0052] Specifically, in one embodiment, the first domain name system request information may include Extended Domain Name System Client Subnet (ECS) information, which carries sensitive information. In one embodiment, the first domain name system request information is generated based on the message body structure defined by the Extension Mechanisms for DNS (EDNS) protocol, such as IETF RFC 6891, and some Extended Domain Name System Client Subnet protocols, such as IETF RFC 7871.

[0053] Specifically, in one embodiment, a first domain name system request message is generated using a data structure defined by a domain name system extension mechanism protocol that transmits packet size.

[0054] In one embodiment, the first Domain Name System request message is sent after being encapsulated in User Datagram Protocol (UDP).

[0055] Step S120: Obtain the second domain name system request information based on the first domain name system request information. The second domain name system request information includes encrypted sensitive information and a first encrypted marker, the first encrypted marker indicating that the encrypted sensitive information is encrypted information.

[0056] In this step, since the first domain name system request information was received in step S110, the first domain name system request information can be processed to obtain the second domain name system request information, which includes ciphertext sensitive information generated by encrypting sensitive information. This allows the second domain name system request information containing ciphertext sensitive information to be sent to the authoritative domain name system server in subsequent steps.

[0057] It should be noted that the first domain name system request information may or may not carry sensitive information, and the embodiments of the present invention do not make specific limitations in this regard.

[0058] It should be noted that there are different implementation methods for obtaining the second domain name system request information by performing first information processing on the first domain name system request information, and this embodiment does not specifically limit this. For example, when the first domain name system request information carries sensitive information, the first domain name system request information can be first split into various data parts according to its components, then the sensitive information can be identified in these data parts, and then the identified sensitive information can be encrypted to obtain ciphertext sensitive information. Then, the ciphertext sensitive information and other data in the first domain name system request information can be merged to form the second domain name system request information. Alternatively, the sensitive information can be first identified in the first domain name system request information, then the identified sensitive information can be encrypted to obtain ciphertext sensitive information, and then the sensitive information in the first domain name system request information can be updated to ciphertext sensitive information to obtain the second domain name system request information. The identification of sensitive information in the various data parts of the first domain name system request information, or the identification of sensitive information directly in the first domain name system request information, can be based on predefined identification rules or on an intelligent analysis process; this embodiment does not specifically limit this. For example, when identification is based on predefined rules, these rules define which fields in which tables belong to sensitive information. When identification is based on intelligent analysis, it can automatically determine whether the data is sensitive based on its specific content. Furthermore, if the first DNS request does not carry sensitive information, the recipient of the first DNS request, such as an intermediate resolver, can generate sensitive information corresponding to that recipient. This sensitive information is then encrypted to obtain ciphertext sensitive information. The ciphertext sensitive information is then combined with other data in the first DNS request to form the second DNS request, or the sensitive information in the first DNS request is updated to ciphertext sensitive information to obtain the second DNS request.

[0059] In one embodiment, the first domain name system request information is based on the domain name system extension mechanism information defined in the RFC6891 protocol, and the second domain name system request information extends the TTL element and RDATA element in the message body structure defined in the RFC6891 protocol.

[0060] Specifically, such as Figure 3 As shown, Figure 3 This is a schematic diagram of a message body substructure provided in one embodiment of the present invention. (Refer to...) Figure 3This invention extends the TTL element in the message body structure defined by RFC6891. The message body substructure of the TTL element includes the OPTION-CODE field, the OPTION-LENGTH field, and the EXTENDED-RCODE field. The EXTENDED-RCODE field indicates that the Domain Name System (DNS) request information has been extended and uses an extended return message type. This field, combined with the RCODE field in the header of the DNS request information, can represent more types than the ordinary DNS request return message. For example, if the combined EXTENDED-RCODE field and the RCODE field equals 0x1, it indicates that the DNS request information uses the extended return message type in this invention. Furthermore, if the EXTENDED-RCODE field is 0, it indicates that the extended return message type is not used. Therefore, the EXTENDED-RCODE field in this invention needs to be assigned a non-zero value when the DNS request message is generated.

[0061] It should be noted that the embodiments of the present invention only extend the EXTENDED-RCODE field of the message body substructure of the TTL element, and do not change the message body structure defined by the RFC6891 protocol, thereby ensuring compatibility.

[0062] like Figure 4 As shown, Figure 4 This is a schematic diagram of another message body substructure provided in one embodiment of the present invention, referred to... Figure 4 In this embodiment of the invention, the message body substructure of the RDATA element in the message body structure defined by the RFC6891 protocol includes an OPTION-DATA field, which can accommodate multiple additional information. This embodiment of the invention extends the OPTION-DATA field.

[0063] Specifically, refer to Figure 5 , Figure 5 yes Figure 4 The expanded diagram of the message body substructure of the RDATA element is shown below. Figure 5 In the example, the OPTION-DATA field, after expansion, includes the FAMILY field, ENCRYPTION TYPE field, ENCRYPTION FLAG field, and SIGNATURE field. This embodiment of the invention defines the type of this message body substructure as a Pseudo Address (PADR) type, and the set of the aforementioned FAMILY, ENCRYPTION TYPE, ENCRYPTION FLAG, and SIGNATURE fields is defined as the PADR field.

[0064] In this embodiment of the invention, the OPTION-CODE field in the message body substructure of the RDATA element is used to indicate whether the Domain Name System (DNS) request information carries encrypted ciphertext sensitive information, that is, whether the DNS request information carries the Internet Protocol (IP) address of the user terminal device or the IP address of the intermediate resolver after encryption to obtain a pseudo address.

[0065] The OPTION-LENGTH field is used to indicate the length of the entire OPTION-DATA field.

[0066] The FMAILY field is used to indicate the type of encrypted sensitive information carried in the Domain Name System (DNS) request information. For example, when the encrypted sensitive information is an encrypted Internet Protocol version 4 (IPv4) address, the FMAILY field is assigned a value of 1; when the encrypted sensitive information is an encrypted Internet Protocol version 6 (IPv6) address, the FMAILY field is assigned a value of 2.

[0067] The ECRYPTION TYPE field indicates the type of encryption algorithm used to encrypt sensitive information. For example, if the sensitive information is not encrypted, the ECRYPTION TYPE field is set to 0; if the sensitive information is encrypted using the MD5 message digest algorithm, the ECRYPTION TYPE field is set to 1; and if the Secure Hash Algorithm 1 (SHA-1) is used, the ECRYPTION TYPE field is set to 2.

[0068] The ECRYPTION FLAG field indicates whether encrypted sensitive information has passed verification. For example, an intermediate resolver can determine whether the authoritative DNS server has successfully decrypted the encrypted sensitive information by checking whether the ECRYPTION FLAG field in the feedback details sent to the intermediate resolver by the authoritative DNS server has changed.

[0069] The SIGNATURE field is used to store the string generated after encrypting information that needs to be protected. For example, the SIGNATURE field can store encrypted sensitive information, or it can be used to store the key used to encrypt sensitive information.

[0070] In addition, the message body structure of the RDATA element can also include Extended DNS Client Subnet Options information, which can also be used to store encrypted sensitive information.

[0071] It should be noted that the extended DNS client subnet option information follows either the end of the previous message body in the DNS request information or before it, and the position of the pseudo address field is not fixed.

[0072] Specifically, when the Domain Name System (DNS) request information includes both a pseudo address field and extended DNS client subnet option information, the pseudo address field and extended DNS client subnet option information are set adjacent to each other.

[0073] In one embodiment, when the encrypted sensitive information is stored in the SIGNATURE field of the Domain Name System (DNS) request information, the Extended DNS Client Subnet Option information can be left unset, or the Extended DNS Client Subnet Option information can be set to 0.

[0074] Step S130: Send the second domain name system request information to the authoritative domain name system server, so that the authoritative domain name system server processes the information based on the encrypted sensitive information and the first encrypted tag information.

[0075] In this step, since the second DNS request information, including encrypted sensitive information and first encrypted marker information, was obtained in step S120, it can be sent to the authoritative DNS server. The authoritative DNS server can then process the data based on the encrypted sensitive information and the first encrypted marker information. Because this embodiment of the invention does not encrypt the entire first DNS request information, but instead encrypts the sensitive information separately to obtain the second DNS request information carrying the encrypted sensitive information, it protects the sensitive information. This reduces network resource consumption and equipment maintenance costs while avoiding exposure of sensitive information to security risks. Furthermore, since the first encrypted marker information indicates that the encrypted sensitive information is encrypted, the authoritative DNS server can appropriately decrypt the encrypted sensitive information based on the first encrypted marker information, thereby improving the accuracy of the authoritative DNS server's processing of the second DNS request information.

[0076] It should be noted that after processing the information based on the encrypted sensitive information and the first encrypted marker information, the authoritative domain name system server will send a feedback result to the intermediate resolver. The intermediate resolver can determine whether the authoritative domain name system server has returned the correct mapping relationship between the domain name and the Internet Protocol address based on the feedback result.

[0077] In one embodiment, the first Domain Name System (DNS) request information includes first Extended Domain Name System (ELS) additional options information, wherein the first ELS additional options information includes source-side sensitive information. The first ELS additional options information is generated according to the Extended Domain Name System Client Subnet Protocol (DNS), and the source-side sensitive information includes, but is not limited to, the Internet Protocol (IP) address of the client device.

[0078] In one embodiment, the first ciphertext marker information is stored in the OPTION-CODE field of the second domain name system request information. In this embodiment of the invention, the OPTION-CODE field is used to indicate whether the domain name system request information carries encrypted ciphertext sensitive information, that is, whether the domain name system request information carries a pseudo address obtained by encrypting the Internet Protocol address of the user terminal device or the Internet Protocol address of the intermediate resolver.

[0079] like Figure 6 As shown, Figure 6 yes Figure 2 A flowchart illustrating the specific method of step S120. Figure 6 Further explanation of step S120: step S120 may include, but is not limited to, steps S121, S122, S123, S124, and S125.

[0080] Step S121: Obtain source-side sensitive information from the first extended domain name system additional options information.

[0081] In this step, the source-side sensitive information is generated by the client device and added to the first Domain Name System (DNS) request information. Specifically, the first DNS request information includes first extended DNS additional options information, and the source-side sensitive information is generated by the client device and added to the first extended DNS additional options information. The source-side sensitive information is used to characterize the Internet Protocol (IP) address of the client device.

[0082] It should be noted that the first extended domain name system additional options information can be generated by the client device or by the intermediate resolver.

[0083] It should be noted that source-side sensitive information is not limited to information generated solely by the client device. For example, a first intermediate resolver connected to the user device side is used to achieve data penetration of the first domain name system request information. After obtaining the first domain name system request information, the first intermediate resolver will verify whether the first domain name system request information carries source-side sensitive information. If the first domain name system request information does not carry source-side sensitive information, the first intermediate resolver will obtain local sensitive information based on the first domain name system request information and send a first domain name system request information carrying the local sensitive information to a second intermediate resolver. This local sensitive information is used to replace the source-side sensitive information generated by the client device. After receiving the first domain name system request information, the second intermediate resolver will encrypt the local sensitive information in the first domain name system request information to obtain ciphertext sensitive information.

[0084] In one embodiment, source-side sensitive information may be stored in the ADDRESS field of the first extended domain name system additional options information.

[0085] In one embodiment, source-side sensitive information may also be stored in the SIGNATURE field of the first Domain Name System (DNS) request information.

[0086] Step S122: Encrypt the sensitive information at the source end to obtain ciphertext sensitive information.

[0087] It should be noted that the encryption algorithm used to encrypt sensitive information at the source end can be a symmetric encryption algorithm, an Advanced Encryption Standard (AES) algorithm, or other encryption algorithms. The appropriate algorithm can be selected based on the actual application, and this embodiment does not impose specific limitations on it. A symmetric encryption algorithm refers to an encryption algorithm that uses the same key for both encryption and decryption; the sender and receiver need to agree on a public key before conducting secure communication. The Advanced Encryption Standard (AES), also known as Rijndael encryption, is a block cipher standard that supports a wider range of blocks and key lengths.

[0088] It should be noted that the encryption algorithm or encryption strategy used to encrypt sensitive data can be included in the intermediate resolver, or the intermediate resolver can obtain it from other places, such as from the authoritative domain name system server or from the first domain name system request information. This embodiment does not make specific limitations on this.

[0089] In one embodiment, the encrypted ciphertext sensitive information is stored in the SIGNATURE field of the PADR field of the second domain name system request information.

[0090] In one embodiment, the second domain name system request information includes extended domain name system client subnet option information, and the encrypted ciphertext sensitive information is stored in the extended domain name system client subnet option information.

[0091] In one embodiment, the second Domain Name System (DNS) request information includes an ECRYPTION TYPE field, which indicates the type of encryption algorithm used to encrypt the sensitive information. For example, if the sensitive information is not encrypted, the ECRYPTION TYPE field is set to 0; if the sensitive information is encrypted using the MD5 message digest algorithm, the ECRYPTION TYPE field is set to 1; and if Secure Hash Algorithm 1 (SHA-1) is used, the ECRYPTION TYPE field is set to 2.

[0092] Step S123: Construct first additional option information, wherein the first additional option information includes first ciphertext marker information.

[0093] In this step, the first additional option information includes first ciphertext marker information, which is used to indicate that the ciphertext sensitive information is ciphertext information. After receiving the second domain name system request information, the authoritative domain name system server first checks whether the second domain name system request information carries the first ciphertext marker information. If the authoritative domain name system server detects the first ciphertext marker information, the authoritative domain name system server decrypts the ciphertext sensitive information.

[0094] In one embodiment, the first additional option information is stored in the message body substructure of the RDATA element of the second Domain Name System request information.

[0095] In one embodiment, the encrypted marker information is stored in the OPTION-CODE field of the second Domain Name System (DNS) request information.

[0096] Step S124: Obtain the second Domain Name System request information based on the encrypted sensitive information and the first additional option information.

[0097] In this step, the encrypted sensitive information and the first additional option information in the first domain name system request information are combined to form the second domain name system request information. Since this embodiment of the invention does not encrypt the entire first domain name system request information, but can encrypt the sensitive information separately to obtain the second domain name system request information carrying the encrypted sensitive information, thereby protecting the sensitive information. This reduces network resource consumption and equipment maintenance costs while avoiding the exposure of sensitive information to security risks. In addition, since the first ciphertext marker information is used to indicate that the encrypted sensitive information is encrypted, the authoritative domain name system server can perform appropriate decryption processing on the encrypted sensitive information according to the first ciphertext marker information, thereby improving the accuracy of the authoritative domain name system server in processing the second domain name system request information.

[0098] It should be noted that the encrypted sensitive information and the first additional option information in the embodiments of the present invention are not limited to being in a parallel relationship. For example, the encrypted sensitive information and the first additional option information can be stored in two different fields in the second domain name system request information. Or, the encrypted sensitive information can be included in the first additional option information, so that the encrypted sensitive information and the first additional option information can be stored in the same field in the second domain name system request information.

[0099] In one embodiment, the first additional option information includes a first cryptographic signature field.

[0100] like Figure 7 As shown, Figure 7 yes Figure 6 A flowchart illustrating the specific method of step S124. Figure 7 Further explanation of step S124: step S124 may include, but is not limited to, steps S1241 and S1242.

[0101] Step S1241: Fill the ciphertext sensitive information into the first encryption signature field.

[0102] In this step, the encrypted sensitive information is filled into the first encrypted signature field, which is included in the first additional option information. This first additional option information can be generated according to the Extended Domain Name System (DNS) Client Subnet Options Protocol (DNS). After receiving the second DNS request information, the authoritative DNS server parses it to obtain the first additional option information and then retrieves the encrypted sensitive information by detecting the first encrypted signature field within it.

[0103] In one embodiment, the encrypted sensitive information is filled into the SIGNATURE field of the second domain name system request information.

[0104] Step S1242: Obtain the second Domain Name System request information based on the first additional option information, which includes the first ciphertext marker information and the ciphertext sensitive information.

[0105] In this step, the authoritative domain name system server parses the second domain name system request information after receiving it to obtain the first additional option information, and obtains the ciphertext sensitive information by detecting the first encrypted signature field in the first additional option information. In one embodiment, the first ciphertext marker information can also be obtained from the first additional option information.

[0106] like Figure 8 As shown, Figure 8 yes Figure 6 A flowchart of another specific method in step S124 is provided. Figure 8 Further explanation of step S124: step S124 may include, but is not limited to, steps S1243 and S1244.

[0107] Step S1243: Update the source-side sensitive information in the first extended domain name system additional options information to encrypted sensitive information.

[0108] In this step, the source-side sensitive information in the first extended DNS additional options information is updated to ciphertext sensitive information. Therefore, compared to the first DNS request information, the second DNS request information only encrypts the source-side sensitive information. Furthermore, the ciphertext sensitive information generated after encrypting the source-side sensitive information is still included in the first extended DNS additional options information. Thus, the second DNS request information is not encrypted as a whole. Compared to the first DNS request information, the second DNS request information still has the same data structure. Therefore, the solution of this embodiment transmits the second DNS request information, which includes ciphertext sensitive information and first ciphertext marker information, without encrypting the entire first DNS request information. This reduces network resource overhead and lowers equipment maintenance costs while avoiding the exposure of sensitive information to security risks. Additionally, since the first ciphertext marker information indicates that the ciphertext sensitive information is ciphertext, the authoritative DNS server can appropriately decrypt the ciphertext sensitive information based on the first ciphertext marker information, thereby improving the accuracy of the authoritative DNS server's processing of the second DNS request information.

[0109] In one embodiment, the source-side sensitive information is stored in the SIGNATURE field of the first domain name system request information. The source-side sensitive information is encrypted to obtain ciphertext sensitive information, and the ciphertext sensitive information is filled into the SIGNATURE field of the first domain name system request information to obtain the second domain name system request information.

[0110] Step S1244: Obtain the second domain name system request information based on the updated first extended domain name system additional option information and the first additional option information.

[0111] In this step, the intermediate resolver obtains the second domain name system request information based on the updated first extended domain name system additional option information and the first additional option information. Since the encrypted sensitive information from the source end is still contained in the first extended domain name system additional option information, this embodiment of the invention does not require encryption of the entire first domain name system request information. This reduces network resource overhead and thus lowers equipment maintenance costs while avoiding exposure of sensitive information to security risks. In addition, since the first ciphertext marker information is used to indicate that the ciphertext sensitive information is ciphertext information, the authoritative domain name system server can perform appropriate decryption processing on the ciphertext sensitive information based on the first ciphertext marker information, thereby improving the accuracy of the authoritative domain name system server in processing the second domain name system request information.

[0112] In one embodiment, the first extended domain name system additional option information stores the key used to encrypt sensitive information. The first additional option information includes a SIGNATURE field that stores ciphertext sensitive information. Therefore, the second domain name system request information is obtained based on the updated first extended domain name system additional option information and the first additional option information. It only encrypts the sensitive information and does not encrypt the entire domain name system request information.

[0113] like Figure 9 As shown, Figure 9 yes Figure 5 A flowchart illustrating the specific method of step S1244. Figure 9 Further explanation of step S1244: step S1244 may include, but is not limited to, steps S12441 and S12442.

[0114] Step S12441: Fill the first encryption signature field with key information or first signature information, wherein the key information is used to decrypt ciphertext sensitive information, and the first signature information is used to verify the integrity of the encrypted source sensitive information.

[0115] In this step, the key information can be the public key used to encrypt the sensitive information. The authoritative Domain Name System (DNS) server can decrypt the encrypted sensitive information based on this key information. Furthermore, the key information can also reflect the encryption algorithm used to encrypt the sensitive information. The first signature information can be used to verify the encrypted source sensitive information to ensure its integrity.

[0116] In one embodiment, the SIGNATURE field of the second domain name system request information can also be used to store the public key used to encrypt sensitive information.

[0117] Step S12442: Obtain the second domain name system request information based on the updated first extended domain name system additional option information and the first additional option information including key information or first signature information.

[0118] In this step, the second domain name system request information updates the first extended domain name system additional option information and the first additional option information including key information or first signature information compared to the first domain name system request information. Therefore, this embodiment of the invention does not require encryption of the entire first domain name system request information, thereby reducing network resource consumption and equipment maintenance costs while avoiding exposure of sensitive information to security risks. In addition, since the first ciphertext marker information is used to indicate that the ciphertext sensitive information is ciphertext information, the authoritative domain name system server can perform appropriate decryption processing on the ciphertext sensitive information according to the first ciphertext marker information, thereby improving the accuracy of the authoritative domain name system server in processing the second domain name system request information.

[0119] In one embodiment, the first extended DNS server additional options information may store either encrypted sensitive information or the key used to encrypt the sensitive information. The first additional options information includes a SIGNATURE field, which may store either encrypted sensitive information or the key used to encrypt the sensitive information. Therefore, the second DNS request information obtained based on the updated first extended DNS server additional options information and the first additional options information only encrypts the sensitive information and does not encrypt the entire DNS request information.

[0120] like Figure 10 As shown, Figure 10 yes Figure 6 A flowchart illustrating the specific method of step S122. Figure 10 Further explanation of step S122: step S122 may include, but is not limited to, steps S1221 and S1222.

[0121] Step S1221: Determine the first encryption strategy information based on the information length of the sensitive information at the source end, wherein the first encryption strategy information includes the first ciphertext length.

[0122] In this step, the first encryption policy information is determined by the length of the source-side sensitive information. When the source-side sensitive information is an Internet Protocol version 4 (IPV4) address, the intermediate parser can determine that the remote sensitive information type is an IPV4 address by detecting the length of the source-side sensitive information, and configure the first encryption policy information accordingly. When the source-side sensitive information is an IPV6 (IPV6) address, the intermediate parser can determine that the remote sensitive information type is an IPV6 address by detecting the length of the source-side sensitive information, and configure the first encryption policy information accordingly.

[0123] In one embodiment, the first encryption strategy information includes not only the first ciphertext length but also an encryption method for the source-side sensitive information. For example, when the source-side sensitive information corresponds to an Internet Protocol version 4 (IPV4) address, according to the encryption method, firstly, the domain name field in the form of IPV4 is extracted from the source-side sensitive information and converted into an integer real number using a string conversion function. The converted integer can be limited to between 0 and 15 by numerical restrictions. Since the encrypted pseudo address is also an IPV4 address, 32 bits of address space need to be reserved. The converted integer real number is then converted into four four-bit binary numbers, and the remaining address space is padded with zeros. Then, 8 bits of binary numbers are taken from the beginning each time and converted into decimal numbers to obtain the IPV4 address. Finally, a hash algorithm is used to obtain the pseudo address corresponding to the IPV4 address to achieve encryption of the sensitive information.

[0124] For example, when the source sensitive information corresponds to an Internet Protocol version 6 address, the source sensitive information is treated as an entire string and encrypted according to the encryption method. The encryption algorithm used in this process includes, but is not limited to, the MD5 message digest algorithm. Since the source sensitive information is an Internet Protocol version 6 address, 128 bits of address space need to be reserved.

[0125] For example, when the source sensitive information is too long, the source sensitive information is encrypted a second time according to the encryption strategy to reduce the number of bits in the encrypted ciphertext sensitive information.

[0126] In one embodiment, the length of the source-side sensitive information can be determined by the SIGNATURE in the first Domain Name System Request (DNS) information, or by the length of the data in the first extended DNS additional options information in the first DNS request information.

[0127] Step S1222: Encrypt the source sensitive information according to the first encryption strategy information to obtain ciphertext sensitive information, wherein the length of the ciphertext sensitive information matches the length of the first ciphertext.

[0128] In this step, the source sensitive information is encrypted according to the first encryption strategy information to obtain the ciphertext sensitive information. For example, when the source sensitive information corresponds to an Internet Protocol version 4 (IPV4) address, the first encryption strategy information is configured to correspond to the IPV4 address. Specifically, the domain name field in IPV4 format is first extracted from the source sensitive information and converted into an integer using a string conversion function. The converted integer can be limited to between 0 and 15 by numerical restrictions. Since the encrypted pseudo address is also an IPV4 address, 32 bits of address space need to be reserved. The converted integer is then converted into four four-bit binary numbers, and the remaining address space is padded with zeros. Then, 8 bits of binary numbers are taken from the beginning and converted into decimal numbers to obtain the IPV4 address. Finally, a hash algorithm is used to obtain the pseudo address corresponding to the IPV4 address to achieve encryption of the sensitive information.

[0129] Furthermore, when the source sensitive information corresponds to an Internet Protocol version 6 address, the first encryption policy information is configured to correspond to the first encryption policy information of the Internet Protocol version 6 address, and the source sensitive information is treated as an entire string for encryption. The encryption algorithm used in this process includes, but is not limited to, the MD5 message digest algorithm. Since the source sensitive information is an Internet Protocol version 6 address, 128 bits of address space need to be reserved.

[0130] In one embodiment, the first domain name system request information is constructed based on the pseudo address type message body of the present invention. The type of the source sensitive information can be determined through the first domain name system request information. For example, if the source sensitive information corresponds to Internet Protocol version 4 address, the FAMILY field of the second domain name system request information is assigned a value of 1. If the source sensitive information corresponds to Internet Protocol version 6 address, the FAMILY field of the second domain name system request information is assigned a value of 2.

[0131] In one embodiment, the type of source-side sensitive information is determined by the FAMILY field of the first domain name system request information. For example, when the FAMILY field of the first domain name system request information is set to 1, the source-side sensitive information corresponds to an Internet Protocol version 4 address, and when the FAMILY field of the first domain name system request information is set to 1, the source-side sensitive information corresponds to an Internet Protocol version 6 address.

[0132] like Figure 11 As shown, Figure 11 yes Figure 10 A flowchart illustrating the specific method of step S1222. Figure 11 Further explanation of step S1222: When the first domain name system request information does not include the first extended domain name system additional option information, step S1222 may include, but is not limited to, steps S12221 and S12222.

[0133] Step S12221: Perform first encryption processing on the source sensitive information according to the first encryption strategy information to obtain the first ciphertext information.

[0134] In this step, the source sensitive information is first encrypted according to the first encryption strategy information to obtain the first ciphertext information. The first ciphertext information can be the Internet Protocol address obtained from the source sensitive information. For example, when the source sensitive information corresponds to the Internet Protocol version 4 address, the first encryption strategy information is configured to correspond to the first encryption strategy information of the Internet Protocol version 4 address. Specifically, firstly, the domain name field in the form of Internet Protocol version 4 is extracted from the source sensitive information and converted into an integer real number through a string conversion function. The converted integer can be limited to between 0 and 15 by numerical restriction. Since the encrypted pseudo address is also an Internet Protocol version 4 address, 32 bits of address space need to be reserved. The converted integer real number is then converted into four four-bit binary numbers, and the remaining address space is padded with zeros. Then, 8 bits of binary numbers are taken from the beginning and converted into decimal numbers each time to obtain the Internet Protocol version 4 address. For example, when the source sensitive information corresponds to the Internet Protocol version 6 address, the first encryption policy information is configured to correspond to the first encryption policy information of the Internet Protocol version 6 address, and the 128-bit Internet Protocol version 6 address is obtained by performing the first encryption process on the source sensitive information.

[0135] Step S12222: Perform a second encryption process on the first ciphertext information according to the first encryption strategy information to obtain ciphertext sensitive information, wherein the information length of the ciphertext sensitive information is less than the information length of the first ciphertext information.

[0136] In this step, the first ciphertext information is subjected to a second encryption process based on the first encryption strategy information to obtain the ciphertext sensitive information. For example, firstly, the domain name field in Internet Protocol Version 4 (IPV4) format is extracted from the source sensitive information and converted into an integer using a string conversion function. The converted integer can be limited to between 0 and 15 by numerical constraints. Since the encrypted pseudo address is also an IPV4 address, 32 bits of address space need to be reserved. The converted integer is then converted into four four-bit binary numbers, and the remaining address space is padded with zeros. Then, 8 bits of binary numbers are taken from the beginning and converted into decimal numbers to obtain the IPV4 address. The second encryption process is then used to obtain the pseudo address corresponding to the IPV4 address, thus encrypting the sensitive information. Due to the address bit limit, if the IPV4 address still exceeds 32 bits after one second encryption process, at least one more second encryption process is performed to prevent the length of the encrypted sensitive information from exceeding the length of the first ciphertext, which could lead to information loss.

[0137] For example, when the source sensitive information corresponds to an Internet Protocol version 6 (IPL) address, the first encryption policy information is configured to correspond to the IPL address. The source sensitive information is treated as a single string for encryption. The encryption algorithms used in this process include, but are not limited to, those specified below. Since the source sensitive information corresponds to an IPL address, 128 bits of address space need to be reserved. If the length of the IPL address obtained after the first encryption process still exceeds 128 bits after a second encryption process, at least one more second encryption process is performed to prevent the length of the encrypted sensitive information from exceeding the length of the first ciphertext, thus preventing information loss.

[0138] In one embodiment, the second encryption process employs algorithms including, but not limited to, hash algorithms or MD5 message digest algorithms.

[0139] In one embodiment, after encrypting the sensitive information, the ECRYPTION TYPE field is set according to the type of encryption algorithm used to encrypt the sensitive information. For example, when the sensitive information is not encrypted, the ECRYPTION TYPE field is assigned a value of 0; when the sensitive information is encrypted using the MD5 message digest algorithm, the ECRYPTION TYPE field is assigned a value of 1; and when Secure Hash Algorithm 1 (SHA-1) is used, the ECRYPTION TYPE field is assigned a value of 2.

[0140] like Figure 12 As shown, Figure 12 yes Figure 2 A flowchart of another specific method in step S120, Figure 12 Further explanation of step S120: When the first domain name system request information does not include the first extended domain name system additional option information, step S120 may include, but is not limited to, steps S125, S126, S127 and S128.

[0141] Step S125: Obtain local sensitive information based on the first domain name system request information.

[0142] In this step, the intermediate resolver first checks whether the acquired first DNS request information carries sensitive information. Since sensitive information is carried in the system client's subnet option information, it can be determined whether the first DNS request information carries sensitive information by checking whether it includes the first extended DNS additional option information. If the first DNS request information does not carry sensitive information, the intermediate resolver acquires local sensitive information. Local sensitive information includes, but is not limited to, the intermediate resolver's Internet Protocol address and its hardware identifier.

[0143] Step S126: Encrypt the local sensitive information to obtain ciphertext sensitive information.

[0144] It should be noted that the encryption algorithm used for encrypting sensitive local information can be a symmetric encryption algorithm, an Advanced Encryption Standard (AES) algorithm, or other encryption algorithms. The appropriate algorithm can be selected based on the actual application, and this embodiment does not impose specific limitations on it. A symmetric encryption algorithm refers to an encryption algorithm that uses the same key for both encryption and decryption; the sender and receiver need to agree on a public key before conducting secure communication. The Advanced Encryption Standard (AES), also known as Rijndael encryption, is a block cipher standard that supports a wider range of blocks and key lengths.

[0145] It should be noted that the encryption algorithm or encryption strategy used to encrypt sensitive data can be included in the intermediate resolver, or the intermediate resolver can obtain it from other places, such as from the authoritative domain name system server or from the first domain name system request information. This embodiment does not make specific limitations on this.

[0146] In one embodiment, the encrypted ciphertext sensitive information is stored in the SIGNATURE field of the PADR field of the second domain name system request information.

[0147] In one embodiment, the second domain name system request information includes extended domain name system client subnet option information, and the encrypted ciphertext sensitive information is stored in the extended domain name system client subnet option information.

[0148] In one embodiment, the second Domain Name System (DNS) request information includes an ECRYPTION TYPE field, which indicates the type of encryption algorithm used to encrypt the sensitive information. For example, if the sensitive information is not encrypted, the ECRYPTION TYPE field is set to 0; if the sensitive information is encrypted using the MD5 message digest algorithm, the ECRYPTION TYPE field is set to 1; and if Secure Hash Algorithm 1 (SHA-1) is used, the ECRYPTION TYPE field is set to 2.

[0149] Step S127: Construct second additional option information, wherein the second additional option information includes first ciphertext marker information.

[0150] In this step, the second additional option information includes the first ciphertext marker information, which is used to indicate that the ciphertext sensitive information is ciphertext information. After receiving the second domain name system request information, the authoritative domain name system server first checks whether the second domain name system request information carries the first ciphertext marker information. If the authoritative domain name system server detects the first ciphertext marker information, the authoritative domain name system server decrypts the ciphertext sensitive information.

[0151] In one embodiment, the first domain name system request information is constructed according to the Extended Domain Name System Client Subnet Options Protocol (DNS), and the second additional option information may be included in the extended DNS client subnet options information.

[0152] In one embodiment, the second additional option information is stored in the message body substructure of the RDATA element of the second Domain Name System request information.

[0153] In one embodiment, the first domain name system request information is constructed according to the Extended Domain Name System Client Subnet Options Protocol (DNS), and the second additional option information may be included in the extended DNS client subnet options information.

[0154] In one embodiment, the first ciphertext marker information is stored in the OPTION-CODE field of the second domain name system request information. In this embodiment of the invention, the OPTION-CODE field is used to indicate whether the domain name system request information carries encrypted ciphertext sensitive information, that is, whether the domain name system request information carries a pseudo address obtained by encrypting the Internet Protocol address of the user terminal device or the Internet Protocol address of the intermediate resolver.

[0155] Step S128: Obtain the second Domain Name System (DNS) request information based on the encrypted sensitive information and the second additional option information.

[0156] In this step, the encrypted sensitive information and the second additional option information in the first domain name system request information are combined to form the second domain name system request information. Since the solution of this embodiment transmits the second domain name system request information including encrypted sensitive information and first encrypted marker information, there is no need to encrypt the entire first domain name system request information. This reduces network resource consumption and equipment maintenance costs while avoiding the exposure of sensitive information to security risks. In addition, since the first encrypted marker information is used to indicate that the encrypted sensitive information is encrypted, the authoritative domain name system server can perform appropriate decryption processing on the encrypted sensitive information according to the first encrypted marker information, thereby improving the accuracy of the authoritative domain name system server in processing the second domain name system request information.

[0157] It should be noted that the encrypted sensitive information and the second additional option information in the embodiments of the present invention are not limited to being in a parallel relationship. For example, the encrypted sensitive information and the second additional option information can be stored in two different fields in the second domain name system request information. Or, the encrypted sensitive information can be included in the second additional option information, so that the encrypted sensitive information and the second additional option information can be stored in the same field in the second domain name system request information.

[0158] In one embodiment, the second additional option information includes a second cryptographic signature field.

[0159] like Figure 13 As shown, Figure 13 yes Figure 12 A flowchart illustrating the specific method of step S128. Figure 13 Further explanation of step S128: step S128 may include, but is not limited to, steps S1281 and S1282.

[0160] Step S1281: Fill the ciphertext sensitive information into the second encryption signature field.

[0161] In this step, the encrypted sensitive information is filled into the second encryption signature field, which is included in the second additional option information. This second additional option information can be generated according to the Extended Domain Name System (DNS) Client Subnet Options Protocol (DNS). After receiving the second DNS request information, the authoritative DNS server parses it to obtain the second additional option information and then retrieves the encrypted sensitive information by detecting the second encryption signature field within it.

[0162] In one embodiment, the encrypted sensitive information is filled into the SIGNATURE field of the second domain name system request information.

[0163] Step S1282: Obtain the second domain name system request information based on the second additional option information, which includes the first ciphertext marker information and the ciphertext sensitive information.

[0164] In this step, the authoritative DNS server parses the second DNS request information after receiving it to obtain the second additional option information, and then obtains the encrypted sensitive information by detecting the second encryption signature field in the second additional option information. For example... Figure 14 As shown, Figure 14 yes Figure 12 A flowchart of another specific method in step S128 is provided. Figure 14 Further explanation of step S128: step S128 may include, but is not limited to, steps S1283 and S1284.

[0165] Step S1283: Construct second extended domain name system additional option information based on the encrypted sensitive information, wherein the second extended domain name system additional option information includes the encrypted sensitive information.

[0166] In this step, the second extended DNS request information is constructed based on the encrypted sensitive information. Therefore, compared with the first DNS request information, the second DNS request information only encrypts the local sensitive information. Moreover, the encrypted sensitive information generated after encrypting the local sensitive information is still included in the second extended DNS request information. Therefore, the second DNS request information is not encrypted as a whole. Compared with the first DNS request information, the second DNS request information still has the same data structure. Therefore, the embodiment of the present invention does not encrypt the entire first DNS request information, but can encrypt the sensitive information separately to obtain the second DNS request information carrying the encrypted sensitive information to protect the sensitive information. This eliminates the need for devices in the transmission path to support the encryption and decryption of the entire DNS request information, thereby reducing network resource overhead and lowering device maintenance costs.

[0167] In one embodiment, the encrypted sensitive information is filled into the second extended domain name system additional option information. In addition, the second extended domain name system additional option information can also be used to store the key used for the encrypted encrypted sensitive information.

[0168] In one embodiment, the encrypted sensitive information may be stored in the ADDRESS field of the second extended domain name system additional options information.

[0169] Step S1284: Obtain the second domain name system request information based on the second extended domain name system additional option information and the second additional option information.

[0170] In this step, the intermediate parser obtains the second domain name system request information based on the second additional option information. Since the encrypted sensitive information is still contained in the second additional option information, this embodiment of the invention does not encrypt the entire first domain name system request information. Instead, it can encrypt the sensitive information separately to obtain the second domain name system request information carrying the encrypted sensitive information, thereby protecting the sensitive information. This eliminates the need for devices in the transmission path to support the encryption and decryption of the entire domain name system request information, thereby reducing network resource overhead and lowering device maintenance costs.

[0171] In one embodiment, the first extended DNS server option information may store either encrypted sensitive information or the key used to encrypt the sensitive information. The second additional option information includes a SIGNATURE field, which may store either encrypted sensitive information or the key used to encrypt the sensitive information. Therefore, the second DNS request information is obtained based on the updated first and second extended DNS server option information, which only encrypts the sensitive information and does not encrypt the entire DNS request information.

[0172] like Figure 15 As shown, Figure 15 yes Figure 14 A flowchart illustrating the specific method of step S1284. Figure 15 Further explanation of step S1284: step S1284 may include, but is not limited to, steps S12841 and S12842.

[0173] Step S12841: Fill the second encryption signature field with key information or second signature information, wherein the key information is used to decrypt the ciphertext sensitive information, and the second signature information is used to verify the integrity of the encrypted local sensitive information.

[0174] In this step, the key information can be the public key used to encrypt the sensitive information. The authoritative Domain Name System (DNS) server can decrypt the encrypted sensitive information based on this key information. Furthermore, the key information can also reflect the encryption algorithm used to encrypt the sensitive information. The second signature information can be used to verify the encrypted local sensitive information to ensure its integrity.

[0175] In one embodiment, the SIGNATURE field of the second domain name system request information can also be used to store the public key used to encrypt sensitive information.

[0176] Step S12842: Obtain the second domain name system request information based on the second extended domain name system additional option information and the second additional option information including key information or second signature information.

[0177] In this step, the second domain name system request information carries encrypted sensitive information in the second additional option information compared to the first domain name system request information. Therefore, this embodiment of the invention does not encrypt the entire first domain name system request information, but can encrypt the sensitive information separately to obtain the second domain name system request information carrying encrypted sensitive information in order to protect the sensitive information. This means that the devices in the transmission path do not need to support the encryption and decryption of the entire domain name system request information, thereby reducing the overhead of network resources and lowering the maintenance cost of the devices.

[0178] like Figure 16 As shown, Figure 16 yes Figure 12 A flowchart illustrating the specific method of step S126. Figure 16 Further explanation of step S126: step S126 may include, but is not limited to, steps S1261 and S1262.

[0179] Step S1261: Determine the second encryption strategy information based on the information length of the local sensitive information, wherein the second encryption strategy information includes the second ciphertext length.

[0180] In this step, the second encryption policy information is determined based on the length of the local sensitive information. When the local sensitive information corresponds to an Internet Protocol version 4 (IPv4) address, the intermediate parser can determine that the remote sensitive information type is an IPv4 address by detecting the length of the local sensitive information, and configure the second encryption policy information accordingly. When the local sensitive information corresponds to an Internet Protocol version 6 (IPv4) address, the intermediate parser can determine that the remote sensitive information type is an IPv6 address by detecting the length of the local sensitive information, and configure the second encryption policy information accordingly.

[0181] In one embodiment, the second encryption strategy information includes not only the first ciphertext length but also an encryption method for local sensitive information. For example, when the local sensitive information corresponds to an Internet Protocol version 4 (IPV4) address, according to the encryption method, firstly, the domain name field in the form of IPV4 is extracted from the local sensitive information and converted into an integer real number using a string conversion function. The converted integer can be limited to between 0 and 15 by numerical restrictions. Since the encrypted pseudo address is also an IPV4 address, 32 bits of address space need to be reserved. The converted integer real number is then converted into four four-bit binary numbers, and the remaining address space is padded with zeros. Then, 8 bits of binary numbers are taken from the beginning and converted into decimal numbers to obtain the IPV4 address. Finally, a hash algorithm is used to obtain the pseudo address corresponding to the IPV4 address to achieve encryption of sensitive information.

[0182] For example, when the local sensitive information corresponds to an Internet Protocol version 6 address, the local sensitive information is treated as an entire string and encrypted according to the encryption method. The encryption algorithm used in this process includes, but is not limited to, the MD5 message digest algorithm. Since the local sensitive information is an Internet Protocol version 6 address, 128 bits of address space need to be reserved.

[0183] For example, when the local sensitive information is too long, it can be encrypted a second time according to the encryption method to reduce the number of bits in the encrypted ciphertext sensitive information.

[0184] Step S1262: Encrypt the local sensitive information according to the second encryption strategy information to obtain ciphertext sensitive information, wherein the length of the ciphertext sensitive information matches the length of the first ciphertext.

[0185] In this step, local sensitive information is encrypted according to the second encryption strategy information to obtain ciphertext sensitive information. For example, when the local sensitive information corresponds to an Internet Protocol version 4 (IPv4) address, the second encryption strategy information is configured to correspond to the IPv4 address. Specifically, firstly, the domain name field in the form of IPv4 is extracted from the local sensitive information and converted into an integer using a string conversion function. The converted integer can be limited to between 0 and 15 by numerical restrictions. Since the encrypted pseudo address is also an IPv4 address, 32 bits of address space need to be reserved. The converted integer is then converted into four four-bit binary numbers, and the remaining address space is padded with zeros. Then, 8 bits of binary numbers are taken from the beginning and converted into decimal numbers to obtain the IPv4 address. Finally, a hash algorithm is used to obtain the pseudo address corresponding to the IPv4 address to achieve encryption of the sensitive information.

[0186] In addition, when the local sensitive information corresponds to the Internet Protocol version 6 address, the second encryption policy information is configured to correspond to the second encryption policy information of the Internet Protocol version 6 address, and the local sensitive information is treated as an entire string for encryption. The encryption algorithm used in this process includes, but is not limited to, the MD5 message digest algorithm. Since the local sensitive information is the Internet Protocol version 6 address, 128 bits of address space need to be reserved.

[0187] In one embodiment, the first domain name system request information is constructed based on the pseudo address type message body of the present invention. The type of local sensitive information can be determined through the first domain name system request information. For example, if the local sensitive information corresponds to Internet Protocol version 4 address, the FAMILY field of the second domain name system request information is assigned a value of 1. If the local sensitive information corresponds to Internet Protocol version 6 address, the FAMILY field of the second domain name system request information is assigned a value of 2.

[0188] In one embodiment, the type of local sensitive information is determined by the FAMILY field of the first domain name system request information. For example, when the FAMILY field of the first domain name system request information is set to 1, the local sensitive information corresponds to an Internet Protocol version 4 address, and when the FAMILY field of the first domain name system request information is set to 1, the local sensitive information corresponds to an Internet Protocol version 6 address.

[0189] like Figure 17 As shown, Figure 17 yes Figure 16 A flowchart illustrating the specific method of step S1262. Figure 17 Further explanation of step S1262: step S1262 may include, but is not limited to, steps S12621 and S12622.

[0190] Step S12621: Perform first encryption processing on the local sensitive information according to the second encryption strategy information to obtain the second ciphertext information.

[0191] In this step, the local sensitive information is first encrypted according to the second encryption strategy information to obtain the second ciphertext information. The second ciphertext information can be the Internet Protocol (IP) address obtained from the local sensitive information. For example, when the local sensitive information corresponds to an IP address (IPv4), the second encryption strategy information is configured to correspond to the IPv4 address. Specifically, firstly, the domain name field in IPv4 format is extracted from the local sensitive information and converted into an integer using a string conversion function. The converted integer can be limited to between 0 and 15 by numerical constraints. Since the encrypted pseudo-address is also an IPv4 address, 32 bits of address space need to be reserved. The converted integer is then converted into four 4-bit binary numbers, and the remaining address space is padded with zeros. Then, 8 bits of binary numbers are taken from the beginning and converted into decimal numbers to obtain the IPv4 address. As another example, when the local sensitive information corresponds to an IPv6 address, the second encryption strategy information is configured to correspond to the IPv6 address. The first encryption process using the local sensitive information yields a 128-bit IPv6 address.

[0192] Step S12622: Perform a second encryption process on the second ciphertext information according to the second encryption strategy information to obtain ciphertext sensitive information, wherein the information length of the ciphertext sensitive information is less than the information length of the second ciphertext information.

[0193] In this step, the second encrypted information is subjected to a second encryption process based on the second encryption strategy information to obtain the encrypted sensitive information. For example, firstly, the domain name field in Internet Protocol Version 4 (IPV4) format is extracted from the local sensitive information and converted into an integer using a string conversion function. The converted integer can be limited to between 0 and 15. Since the encrypted pseudo address is also an IPV4 address, 32 bits of address space need to be reserved. The converted integer is then converted into four four-bit binary numbers, and the remaining address space is padded with zeros. Then, 8 bits of binary numbers are taken from the beginning and converted into decimal numbers to obtain the IPV4 address. The second encryption process is then used to obtain the pseudo address corresponding to the IPV4 address, thus encrypting the sensitive information. Due to the address bit limit, if the IPV4 address still exceeds 32 bits after one second encryption process, at least one more second encryption process is performed to prevent the length of the encrypted sensitive information from exceeding the length of the second encrypted information, which could lead to information loss.

[0194] For example, when the local sensitive information corresponds to an Internet Protocol version 6 (IPL) address, the second encryption strategy information is configured to correspond to the IPL address. The local sensitive information is treated as a single string for encryption. The encryption algorithms used in this process include, but are not limited to, those specified below. Since the local sensitive information corresponds to an IPL address, 128 bits of address space need to be reserved. If the length of the IPL address obtained after the first encryption process still exceeds 128 bits after a second encryption process, at least one more second encryption process is performed to prevent the length of the encrypted sensitive information from exceeding the length of the second ciphertext, thus preventing information loss.

[0195] In one embodiment, the second encryption process employs algorithms including, but not limited to, hash algorithms or MD5 message digest algorithms.

[0196] In one embodiment, after encrypting the sensitive information, the ECRYPTION TYPE field is set according to the type of encryption algorithm used to encrypt the sensitive information. For example, when the sensitive information is not encrypted, the ECRYPTION TYPE field is assigned a value of 0; when the sensitive information is encrypted using the MD5 message digest algorithm, the ECRYPTION TYPE field is assigned a value of 1; and when Secure Hash Algorithm 1 (SHA-1) is used, the ECRYPTION TYPE field is assigned a value of 2.

[0197] like Figure 18 As shown, Figure 18 This is a flowchart of an information processing method provided in another embodiment of the present invention, see below. Figure 18 The information processing method may also include, but is not limited to, steps S140 and S150.

[0198] Step S140: Receive feedback information sent by the authoritative domain name system server based on the encrypted sensitive information and the first encrypted tag information, wherein the feedback information includes feedback type information and the second encrypted tag information.

[0199] In this step, after receiving the second domain name system request information, the authoritative domain name system server generates feedback information based on the second domain name system request information and sends the feedback information to the client device. The feedback information is used to enable the client device to obtain the mapping relationship between the required domain name and the Internet Protocol address. In addition, the feedback information is also used to enable the intermediate resolver or the client device to know whether the authoritative domain name system server has successfully decrypted the encrypted sensitive information in the second domain name system request information.

[0200] In one embodiment, the feedback information is constructed using the PADR message body combination type according to an embodiment of the present invention.

[0201] In one embodiment, the feedback information also includes extended Domain Name System (DNS) subnet option information.

[0202] Step S150: Process information based on feedback type information and second ciphertext marker information.

[0203] In this step, the intermediate resolver processes the information based on the feedback type information and the second ciphertext marker information carried in the feedback information, enabling the intermediate resolver to perform further processing based on the processing status of the authoritative domain name system server.

[0204] like Figure 19 As shown, Figure 19 yes Figure 18 A flowchart illustrating the specific method of step S150. Figure 19 Further explanation of step S150: step S150 may include, but is not limited to, steps S151 and S152.

[0205] Step S151: When the feedback type information indicates that the authoritative DNS server cannot recognize the second DNS request information, and the second ciphertext marker information indicates that the authoritative DNS server cannot decrypt the ciphertext sensitive information, the third DNS request information is reconstructed based on the first DNS request information, wherein the third DNS request information does not include the ciphertext sensitive information.

[0206] In this step, if the feedback type information indicates that the authoritative DNS server cannot recognize the second DNS request information, then the authoritative DNS server also cannot decrypt the encrypted sensitive information. Therefore, the intermediate resolver reconstructs the third DNS request information based on the first DNS request information. This third DNS request information does not include the encrypted sensitive information. If the feedback type information indicates that the authoritative DNS server cannot recognize the second DNS request information, for example, if the corresponding authoritative DNS server does not support the extended DNS client subnet option, or if the corresponding authoritative DNS server has not pre-configured the corresponding decryption algorithm, or if the authoritative DNS server is unavailable, then the third DNS request information is reconstructed and sent to the authoritative DNS server to test the availability of the authoritative DNS server.

[0207] In one embodiment, the feedback information uses the pseudo-address type message body structure of the present invention. Therefore, by examining the ECRYPTION FLAG field in the feedback information, it can be determined whether the authoritative domain name system server can recognize the second domain name system request information and whether it can decrypt the encrypted sensitive information in the second domain name system request information.

[0208] Specifically, when the FLAG flag in the ECRYPTION FLAG field of the feedback information is 0, it means that the authoritative DNS server cannot recognize the second DNS request information, nor can it decrypt the encrypted sensitive information in the second DNS request information.

[0209] In one embodiment, when the currently selected authoritative DNS server is detected to be invalid, a new authoritative DNS server is selected.

[0210] It should be noted that the third domain name system request information may or may not carry the second additional option information and / or the first extended domain name system additional option information; this embodiment does not specifically limit this.

[0211] It should be noted that the third domain name system request information may or may not carry the second additional option information and / or the second extended domain name system additional option information; this embodiment does not specifically limit this.

[0212] Step S152: Send the third domain name system request information to the authoritative domain name system server, so that the authoritative domain name system server processes the information according to the third domain name system request information.

[0213] In this step, the intermediate resolver sends the third domain name system request information to the authoritative domain name system server, so that the authoritative domain name system server can process the information according to the third domain name system request information.

[0214] like Figure 20 As shown, Figure 20 yes Figure 18 A flowchart of another specific method in step S150 is provided. Figure 20 Further explanation of step S150: step S150 may include, but is not limited to, steps S153 and S154.

[0215] Step S153: When the feedback type information indicates that the authoritative domain name system server has correctly recognized the second domain name system request information, and the second ciphertext marker information indicates that the authoritative domain name system server has not decrypted the ciphertext sensitive information, the fourth domain name system request information is reconstructed based on the first domain name system request information, wherein the fourth domain name system request information includes the plaintext sensitive information corresponding to the ciphertext sensitive information.

[0216] In this step, if the feedback type information indicates that the authoritative DNS server cannot recognize the second DNS request information, then the authoritative DNS server also cannot decrypt the encrypted sensitive information. Therefore, the intermediate resolver reconstructs the fourth DNS request information based on the first DNS request information. This fourth DNS request information includes the plaintext sensitive information corresponding to the encrypted sensitive information. If the feedback type information indicates that the authoritative DNS server cannot recognize the second DNS request information, for example, if the corresponding authoritative DNS server does not support the Extended DNS Client Subnet option or the corresponding authoritative DNS server has not pre-configured the corresponding decryption algorithm, then the fourth DNS request information using plaintext to record the sensitive information is reconstructed and sent to the authoritative DNS server to improve compatibility.

[0217] In one embodiment, the feedback information uses the pseudo-address type message body structure of the present invention. Therefore, by examining the ECRYPTION FLAG field in the feedback information, it can be determined whether the authoritative domain name system server can recognize the second domain name system request information and whether it can decrypt the encrypted sensitive information in the second domain name system request information.

[0218] Specifically, when the FLAG flag in the ECRYPTION FLAG field of the feedback information is 2, it means that the authoritative DNS server can recognize the second DNS request information, but cannot decrypt the encrypted sensitive information in the second DNS request information.

[0219] It should be noted that the fourth domain name system request information may or may not carry the second additional option information and / or the first extended domain name system additional option information; this embodiment does not specifically limit this.

[0220] It should be noted that the fourth domain name system request information may or may not carry the second additional option information and / or the second extended domain name system additional option information; this embodiment does not specifically limit this.

[0221] Step S154: Send the fourth domain name system request information to the authoritative domain name system server, so that the authoritative domain name system server processes the information based on the plaintext sensitive information.

[0222] In this step, the intermediate resolver sends the fourth domain name system request information to the authoritative domain name system server, so that the authoritative domain name system server processes the information based on the plaintext sensitive information carried in the fourth domain name system request information.

[0223] In one embodiment, the feedback information further includes a target Internet Protocol address, which is the Internet Protocol address corresponding to the first Domain Name System request information.

[0224] like Figure 21 As shown, Figure 21 yes Figure 18 A flowchart of another specific method in step S150 is provided. Figure 21 Further explanation of step S150: step S150 may include, but is not limited to, steps S155 and S156.

[0225] Step S155: When the feedback type information indicates that the authoritative DNS server has correctly recognized the second DNS request information, and the second ciphertext marker information indicates that the authoritative DNS server has correctly decrypted the ciphertext sensitive information, the mapping relationship between the first DNS request information and the target Internet Protocol address is cached.

[0226] In this step, when the feedback type information indicates that the authoritative DNS server correctly recognizes the second DNS request information, and the second ciphertext marker information indicates that the authoritative DNS server correctly decrypts the ciphertext sensitive information, it proves that the authoritative DNS server can correctly recognize the second DNS request information and decrypt the ciphertext sensitive information in the second DNS request information. By caching the mapping relationship between the first DNS request information and the target Internet Protocol address in the intermediate resolver, the efficiency of the client device in obtaining the mapping relationship between the first DNS request information and the target Internet Protocol address can be improved, and the complexity of system scheduling can be reduced.

[0227] In one embodiment, the feedback information uses the pseudo-address type message body structure of the present invention. Therefore, by examining the ECRYPTION FLAG field in the feedback information, it can be determined whether the authoritative domain name system server can recognize the second domain name system request information and whether it can decrypt the encrypted sensitive information in the second domain name system request information.

[0228] Specifically, when the FLAG flag in the ECRYPTION FLAG field of the feedback information is 1, it means that the authoritative domain name system server can recognize the second domain name system request information and can decrypt the encrypted sensitive information.

[0229] Step S156: Forward the feedback information back to the party that initiated the first domain name system request.

[0230] In this step, the feedback information includes the Internet Protocol (IP) address corresponding to the first Domain Name System (DNS) request information. By forwarding the feedback information back to the initiator of the first DNS request information, the initiator can obtain the mapping relationship between the first DNS request information and the target IP address. Furthermore, the feedback information can be encrypted or unencrypted; this embodiment does not specifically limit this.

[0231] It should be noted that the initiator of the first domain name system request information can be either the client device or an intermediate resolver; this embodiment does not specifically limit this.

[0232] To more clearly illustrate the processing flow of the information processing method provided in the embodiments of the present invention, specific examples are given below.

[0233] like Figure 22 As shown, Figure 22 This is a flowchart illustrating an information processing method provided by a specific example of the present invention. The information processing method is applied to [a specific application] and includes the following steps:

[0234] Step S101: Receive the first Domain Name System request information;

[0235] Step S102a: Extract the domain name field from the first domain name system request information and check if there is a corresponding resolution record in the local DNS cache. If there is a corresponding resolution record in the local DNS cache, construct DNS response information based on the resolution record and send it to the user terminal device.

[0236] Step S102b: If there is no corresponding DNS record in the local DNS cache, obtain sensitive information;

[0237] Step S103: Select an encryption algorithm based on the length of the sensitive information to encrypt the sensitive information, thereby obtaining the ciphertext sensitive information;

[0238] Step S104: Reconstruct the first domain name system request information in eDNS0 format based on the encrypted sensitive information to obtain the second domain name system request information;

[0239] Step S105: Encapsulate the second domain name system request information into a UDP packet and send it to the authoritative domain name system server;

[0240] Step S106: Receive feedback information from the authoritative domain name system server, check the RCODE field in the feedback information, and when the RCODE field returns 0, check the ENCRYPTION FLAG field in the PADR field;

[0241] Step S107a: When the return code of the ENCRYPTION FLAG field is 0, fill in the RDATA field with unencrypted sensitive information to construct the third domain name system request information and send it to the authoritative domain name system server;

[0242] Step S107b: When the ENCRYPTION FLAG field returns a code of 1, check the other fields of the feedback information.

[0243] Step S108: If all fields in the feedback information are normal, record the domain name mapping relationship in the feedback information in the local DNS cache and forward the domain name mapping relationship back to the client device.

[0244] It should be noted that the specific method for selecting the encryption algorithm based on the length of the sensitive information in step S103 includes: when the target of the sensitive information is to be mapped to a shorter IPv4 address, 32 bits of address space are reserved, with each 4 bits corresponding to an integer. The sensitive information is converted into an integer real number using a string conversion function, and then the converted integer real number is converted into four 4-bit binary numbers. The remaining address space is padded with zeros, and then 8 bits of binary number are taken from the beginning and converted into decimal numbers to obtain the IPv4 address. During the process of reconstructing the second domain name system request information in eDNS0 format, the EXTENDED-RCODE field in the TTL element is set to 0x1, indicating that the domain name system request information carries encrypted sensitive information. In the RDATA field, setting the OPTION-CODE field to 27000, the OPTION-LENGTH field to 36, and the FAMILY field to 1 indicates that IPv4 address format will be used subsequently. Setting the ENCRYPTION TYPE field to 2 indicates the use of the crc32() and bese_convert() encryption mechanism. Setting the ENCRYPTION FLAG field to 0 is used in DNS request messages to indicate that this message contains an encrypted pseudo-address, and that the remote authoritative DNS server cannot recognize this message by default. The SIGNATURE field contains the encrypted ciphertext sensitive information or the key used in the encryption process. Additionally, the encrypted pseudo-address can be entered into the ADDRESS field of the Extended Domain Name System (DNS) client subnet options information.

[0245] It should be noted that the specific method for selecting the encryption algorithm based on the length of the sensitive information in step S103 further includes: reserving 128 bits of address space when the target of the sensitive information is to be mapped to a longer IPv6 address. The sensitive information is converted into a 128-bit string using MD5, with each 4 bits corresponding to one character to obtain the IPv6 address. During the reconstruction of the second domain name system request information in eDNS0 format, the EXTENDED-RCODE field in the TTL element is set to 0x1, indicating that the domain name system request information carries encrypted sensitive information. The OPTION-CODE field in the RDATA field is set to 27000, the OPTION-LENGTH field is set to 132, and the FAMILY field is set to 2, indicating that the IPv6 address format will be used subsequently; the ENCRYPTION TYPE field is set to 1; the ENCRYPTION FLAG field is set to 0, which is used in DNS request messages to indicate that this message contains an encrypted pseudo address, and by default, the remote DNS authoritative server cannot recognize this message; the SIGNATURE field is filled with the encrypted encrypted sensitive information or the key used in the encryption process. Alternatively, the encrypted pseudo address can be filled into the ADDRESS field of the Extended Domain Name System (DNS) client subnet option information.

[0246] In addition, one embodiment of the present invention provides an intermediate parser, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor.

[0247] The processor and memory can be connected via a bus or other means.

[0248] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0249] It should be noted that the intermediate parser in this embodiment can be applied to, for example... Figure 1 The intermediate parser 120 in the illustrated embodiment can be configured as follows: Figure 1 The system architecture shown in the embodiments is part of the same inventive concept. Therefore, these embodiments have the same implementation principle and technical effect, which will not be described in detail here.

[0250] The non-transitory software program and instructions required to implement the information processing method of the above embodiments are stored in memory. When executed by a processor, the information processing method of the above embodiments is executed, for example, the method described above. Figure 2 Method steps S110 to S130 in the text Figure 6 Method steps S121 to S124 in the text Figure 7 Method steps S1241 to S1242 in the text Figure 8 Method steps S1243 to S1244 in the text Figure 9 Method steps S12441 to S12442 in the text Figure 10 Method steps S1221 to S1222, Figure 11 Method steps S12221 to S12222, Figure 12 Method steps S125 to S128 in the text Figure 13 Method steps S1281 to S1282 in the text Figure 14 Method steps S1283 to S1284 in the text Figure 15 Method steps S12841 to S12842 in the text Figure 16 Method steps S1261 to S1262 in the text Figure 17 Method steps S12621 to S12622 in the text Figure 18 Method steps S140 to S150, Figure 19 Method steps S151 to S152 in the text Figure 20 Method steps S153 to S154 in the text Figure 21 Method steps S155 to S156 or as follows Figure 22 The method steps S101 to S108 are shown in the figure.

[0251] In addition, one embodiment of the present invention also provides a network device that includes the intermediate parser of the above embodiments. Therefore, the network device in this embodiment and the intermediate parser in the above embodiments belong to the same inventive concept. Thus, these embodiments have the same implementation principle and technical effect, which will not be described in detail here.

[0252] The device or system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0253] Furthermore, one embodiment of the present invention provides a computer-readable storage medium storing computer-executable instructions that are executed by a processor or controller, for example, by a processor in the above-described device embodiment, causing the processor to perform the information processing methods described above, such as executing the methods described above. Figure 2 Method steps S110 to S130 in the text Figure 6 Method steps S121 to S124 in the text Figure 7 Method steps S1241 to S1242 in the text Figure 8 Method steps S1243 to S1244 in the text Figure 9 Method steps S12441 to S12442 in the text Figure 10 Method steps S1221 to S1222, Figure 11 Method steps S12221 to S12222, Figure 12 Method steps S125 to S128 in the text Figure 13 Method steps S1281 to S1282 in the text Figure 14 Method steps S1283 to S1284 in the text Figure 15 Method steps S12841 to S12842 in the text Figure 16 Method steps S1261 to S1262 in the text Figure 17 Method steps S12621 to S12622 in the text Figure 18 Method steps S140 to S150, Figure 19 Method steps S151 to S152 in the text Figure 20 Method steps S153 to S154 in the text Figure 21 Method steps S155 to S156 or as follows Figure 22 The method steps S101 to S108 are shown in the figure.

[0254] It will be understood by those skilled in the art that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0255] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of the present invention.

Claims

1. An information processing method applied to an intermediate parser, the method comprising: Receive a first domain name system request message, the first domain name system request message including a first extended domain name system additional option information, the first extended domain name system additional option information including source sensitive information; Obtain the source-side sensitive information from the first extended domain name system additional options information; The source-end sensitive information is encrypted to obtain ciphertext sensitive information; Construct first additional option information, wherein the first additional option information includes first ciphertext marker information; The second domain name system request information is obtained based on the encrypted sensitive information and the first additional option information, wherein the second domain name system request information includes the encrypted sensitive information and the first encrypted tag information, and the first encrypted tag information is used to indicate that the encrypted sensitive information is encrypted information; The second domain name system request information is sent to the authoritative domain name system server, so that the authoritative domain name system server processes the information based on the encrypted sensitive information and the first encrypted tag information.

2. The method according to claim 1, characterized in that, The first additional option information includes a first cryptographic signature field; The step of obtaining the second Domain Name System (DNS) request information based on the encrypted sensitive information and the first additional option information includes: The encrypted sensitive information is filled into the first encryption signature field; The second domain name system request information is obtained based on the first additional option information, which includes the first ciphertext marker information and the ciphertext sensitive information.

3. The method according to claim 1, characterized in that, The step of obtaining the second Domain Name System (DNS) request information based on the encrypted sensitive information and the first additional option information includes: Update the source-side sensitive information in the first extended domain name system additional options information to the encrypted sensitive information; The second domain name system request information is obtained based on the updated first extended domain name system additional option information and the first additional option information.

4. The method according to claim 3, characterized in that, The first additional option information includes a first cryptographic signature field; The step of obtaining the second domain name system request information based on the updated first extended domain name system additional option information and the first additional option information includes: The first encryption signature field is filled with key information or first signature information, wherein the key information is used to decrypt the ciphertext sensitive information, and the first signature information is used to verify the integrity of the encrypted source sensitive information; The second domain name system request information is obtained based on the updated first extended domain name system additional option information and the first additional option information including the key information or the first signature information.

5. The method according to claim 1, characterized in that, The process of encrypting the source-side sensitive information to obtain the ciphertext sensitive information includes: The first encryption strategy information is determined based on the information length of the source-end sensitive information, wherein the first encryption strategy information includes the first ciphertext length; The source-side sensitive information is encrypted according to the first encryption strategy information to obtain the ciphertext sensitive information, wherein the length of the ciphertext sensitive information matches the length of the first ciphertext.

6. The method according to claim 5, characterized in that, The step of encrypting the source-side sensitive information according to the first encryption strategy information to obtain the ciphertext sensitive information includes: The first encrypted information is obtained by performing a first encryption process on the source-side sensitive information according to the first encryption strategy information; The first ciphertext information is subjected to a second encryption process based on the first encryption strategy information to obtain the ciphertext sensitive information, wherein the information length of the ciphertext sensitive information is less than the information length of the first ciphertext information.

7. The method according to any one of claims 1 to 6, characterized in that, After sending the second domain name system request information to the authoritative domain name system server, the method further includes: Receive feedback information sent by the authoritative domain name system server based on the encrypted sensitive information and the first encrypted tag information, wherein the feedback information includes feedback type information and second encrypted tag information; Information processing is performed based on the feedback type information and the second ciphertext marker information.

8. The method according to claim 7, characterized in that, The information processing based on the feedback type information and the second ciphertext marker information includes: When the feedback type information indicates that the authoritative domain name system server cannot recognize the second domain name system request information, and the second ciphertext marker information indicates that the authoritative domain name system server cannot decrypt the ciphertext sensitive information, the third domain name system request information is reconstructed based on the first domain name system request information, wherein the third domain name system request information does not include the ciphertext sensitive information; The third domain name system request information is sent to the authoritative domain name system server, so that the authoritative domain name system server processes the information based on the third domain name system request information.

9. The method according to claim 7, characterized in that, The information processing based on the feedback type information and the second ciphertext marker information includes: When the feedback type information indicates that the authoritative domain name system server normally recognizes the second domain name system request information, and the second ciphertext marker information indicates that the authoritative domain name system server has not decrypted the ciphertext sensitive information, the fourth domain name system request information is reconstructed based on the first domain name system request information, wherein the fourth domain name system request information includes the plaintext sensitive information corresponding to the ciphertext sensitive information; The fourth domain name system request information is sent to the authoritative domain name system server, so that the authoritative domain name system server processes the information based on the plaintext sensitive information.

10. The method according to claim 7, characterized in that, The feedback information also includes the target Internet Protocol address; the information processing based on the feedback type information and the second ciphertext marker information includes: When the feedback type information indicates that the authoritative DNS server has correctly recognized the second DNS request information, and the second ciphertext marker information indicates that the authoritative DNS server has correctly decrypted the ciphertext sensitive information, the mapping relationship between the first DNS request information and the target Internet Protocol address is cached; The feedback information is forwarded back to the party that initiated the first domain name system request.

11. An intermediate parser, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor, when executing the computer program, implements the information processing method as described in any one of claims 1 to 10.

12. A network device, characterized in that, It includes the intermediate parser as described in claim 11.

13. A computer-readable storage medium storing computer-executable instructions for performing the information processing method according to any one of claims 1 to 10.

Images