DNS request processing method, device, electronic device and storage medium

Abstract

This disclosure relates to a DNS request processing method, apparatus, electronic device, and storage medium. The method includes: receiving a DNS request for domain name resolution service, the DNS request carrying a target domain name to be resolved and node information of the sending node; based on the DNS request, if it is determined that the DNS resolver's cache needs to be activated, searching in the DNS resolver's cache for a target resolution result that matches the target domain name and the node information; if no target resolution result is found, sending a DNS request containing the target domain name and the node information to an authoritative DNS server. By obtaining a target resolution result that matches the target domain name and node information in the DNS request, the method avoids obtaining the same resolution result when resolving the same domain name, thus protecting tenant privacy and improving data security in a tenant-isolated environment.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to DNS request processing methods, apparatus, electronic devices, and storage media. Background Technology

[0002] DNS (Domain Name System) is a distributed database on the Internet that maps domain names to IP addresses. It allows users to access the Internet more conveniently through domain names, without having to remember the IP address strings that machines can directly read. The process of obtaining the IP address corresponding to a domain name is called domain name resolution.

[0003] For VPC (Virtual Private Cloud) networks, domain name resolution within a VPC needs to achieve isolation between tenants to protect the security of information transmission between them. However, when using general domain name resolution methods to resolve domain names for tenants within a VPC, if DNS requests from different tenants contain the same domain name, the same resolution result will be obtained, which cannot effectively protect the privacy between tenants. Summary of the Invention

[0004] This disclosure provides a DNS request processing method, apparatus, electronic device, and storage medium.

[0005] According to one aspect of this disclosure, a DNS request processing method is provided, the method comprising:

[0006] Receive a Domain Name Resolution Service (DNS) request, the DNS request carrying the target domain name to be resolved and the node information of the sending node;

[0007] Based on the DNS request, if it is determined that the DNS resolver's cache needs to be activated, the DNS resolver's cache is searched to see if there is a target resolution result that matches the target domain name and the node information;

[0008] If the target domain name and node information are not found, a DNS request containing the target domain name and node information is sent to an authoritative DNS server.

[0009] According to another aspect of this disclosure, a DNS request processing apparatus is provided, characterized in that,

[0010] The DNS request receiving module is used to receive DNS requests for domain name resolution services. The DNS request carries the target domain name to be resolved and the node information of the sending node.

[0011] The DNS resolution result acquisition module is used to search the cache of the DNS resolver for a target resolution result that matches the target domain name and the node information, based on the DNS request and if it is determined that the cache of the DNS resolver needs to be activated.

[0012] The DNS request sending module is used to send a DNS request containing the target domain name and the node information to an authoritative DNS server when the target resolution result is not found.

[0013] According to a third aspect of this disclosure, an electronic device is provided. The electronic device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the program to implement the method described above.

[0014] According to a fourth aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the methods described above.

[0015] The DNS request processing method, apparatus, electronic device, and storage medium provided in this disclosure involve a DNS resolver that, upon receiving a DNS request, determines whether to activate its cache based on the request. If the cache is required, the resolver searches its cache for a target DNS resolution result that matches the target domain name and node information in the request. If no such result is found, the request is forwarded to an authoritative DNS server for resolution. By obtaining a target DNS resolution result that matches the target domain name and node information in the request, the system avoids obtaining identical resolution results when resolving the same domain name. This approach can protect tenant privacy and improve data security in tenant-isolated environments. Attached Figure Description

[0016] Further details, features, and advantages of this disclosure are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which:

[0017] Figure 1 This is a schematic diagram illustrating an application scenario provided by an exemplary embodiment of the present disclosure;

[0018] Figure 2 A flowchart of a DNS request processing method provided as an exemplary embodiment of this disclosure;

[0019] Figure 3 for Figure 2 Flowchart of step S220;

[0020] Figure 4 for Figure 2Another flowchart of step S220;

[0021] Figure 5 A flowchart of a DNS request processing method provided as an exemplary embodiment of this disclosure;

[0022] Figure 6 A flowchart of a DNS request processing method provided as an exemplary embodiment of this disclosure;

[0023] Figure 7 A flowchart of a DNS request processing method provided as an exemplary embodiment of this disclosure;

[0024] Figure 8 A schematic block diagram of the functional modules of a DNS request processing apparatus provided in an exemplary embodiment of this disclosure;

[0025] Figure 9 A structural block diagram of an electronic device provided as an exemplary embodiment of this disclosure;

[0026] Figure 10 A block diagram of a computer system provided for an exemplary embodiment of this disclosure. Detailed Implementation

[0027] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0028] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0029] The term "comprising" and its variations as used herein are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below. It should be noted that the concepts of "first", "second", etc., used in this disclosure are only used to distinguish different devices, modules, or units, and are not intended to limit the order of functions performed by these devices, modules, or units or their interdependencies.

[0030] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0031] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0032] In a VPC network, to protect tenant information privacy and improve the security of information transmission between tenants, domain name resolution within the VPC needs to achieve isolation between tenants. To further enhance the security of tenant domain name resolution within a VPC, this disclosure provides a DNS request processing method, apparatus, electronic device, and storage medium.

[0033] Figure 1 This is a schematic diagram illustrating a scenario of the DNS request processing method provided in this embodiment of the disclosure, such as... Figure 1 As shown in the embodiments provided in this disclosure, there may be multiple virtual private clouds. The embodiments are illustrated using virtual private cloud 100 and virtual private cloud 200 as examples. A virtual private cloud may include one or more cloud servers. The embodiments are illustrated using two cloud servers as an example.

[0034] like Figure 1 As shown, Virtual Private Cloud 100 includes cloud server 101 and cloud server 102, and Virtual Private Cloud 200 includes cloud server 201 and cloud server 202. When a tenant needs to access a target website through a client on a cloud server, a DNS request containing the target website will be generated. This DNS request will carry the target domain name of the target website and the identifier of the virtual private cloud where the cloud server is located.

[0035] It should be noted that, due to the need for isolation between different Virtual Private Clouds (VPNs), in this embodiment, different tenants pre-configure corresponding identifiers for their VPNs when using different VPNs. These identifiers and the target domain name are included in the DNS request, allowing different domain name resolution results to be pre-configured for the same target domain name depending on the identifier. This avoids different resolution results when different tenants initiate DNS requests through cloud servers in different VPNs, thus protecting the privacy of different tenants.

[0036] Furthermore, in this embodiment, different cloud servers within the same virtual private cloud (VPN) will have different IP addresses, and different domain name resolution results can be configured based on these different IP addresses. For example, within the same VPN, by pre-configuring different domain name resolution results for IP addresses in different network segments, when a tenant initiates a DNS request through different cloud servers within the same VPN, different resolution results can be provided for the same target domain name based on the IP network segment to which the cloud server belongs. Therefore, in this embodiment, the IP address of the cloud server can be included in the DNS request along with the target domain name and the VPN identifier.

[0037] like Figure 1 As shown, Figure 1 The intermediate device 300 is a device with cloud / on-premises connectivity, used to receive DNS requests sent by cloud servers in a virtual private cloud and forward them to the DNS resolver 400. The DNS resolver is a device that supports recursive DNS resolution and caching, and in this embodiment, it exists as the preceding level to the authoritative DNS server 500. The DNS resolver 400 supports caching, meaning it caches the data for a period based on the TTL (Time To Live, the maximum number of network segments an IP packet is allowed to pass through before being dropped by a router) value configured in the DNS record. During the cache's lifetime, the cached value can be directly returned without being passed through to the authoritative DNS server.

[0038] In this embodiment, DNS requests issued by the cloud server in the VPC enter the DNS resolver via an intermediate device. The resolver first retrieves the identifier and client IP information stored in uoa / toa, and then queries the cache. Here, the client IP information refers to the IP address of the cloud server in the VPC; uoa / toa refers to the option field in TCP. If the cache is hit, the cached resolution result is returned directly; otherwise, the resolver wraps the VPC identifier and client IP in an EDNS option and forwards the DNS request to the authoritative DNS server. If a resolution is obtained from the authoritative DNS, the cache is refreshed, and a prefetch operation is performed to update the cache before the TTL expires. If an empty resolution is obtained, the resolver can decide whether to cache the empty resolution based on the configuration to avoid large traffic being forwarded to the authoritative DNS server, thereby putting pressure on the authoritative DNS server.

[0039] For a centrally deployed authoritative DNS in the cloud, achieving tenant-isolated DNS resolution requires matching domain names based on the unique identifier (VXLAN Network ID, or VNI) of each VPC. Therefore, a front-end device is needed to extract the VNI identifier from DNS requests originating from the VPC; this front-end device includes the DNS resolver. Furthermore, the DNS resolver should support caching, meaning it should cache the DNS record for a specified time based on the TTL value configured in the DNS record. During the cache's lifetime, the cached value can be returned directly without being forwarded to the authoritative DNS server. Here, the VNI refers to the node identifier in this embodiment.

[0040] In this embodiment of the disclosure, when a DNS resolver receives a DNS request, it can first determine whether the target domain name carried in the DNS request has a pre-configured domain weight. If a weight has been pre-configured, the caching of the target domain name is turned off, which is equivalent to turning off the caching switch of the target domain name in the DNS resolver's cache by setting a caching switch for the target domain name. That is, when the DNS resolver receives a DNS request, it will determine whether the target domain name in the DNS request has a pre-configured domain weight. If a domain weight has been pre-configured, the DNS resolver will forward the DNS request to the authoritative DNS server. This can avoid the problem of resolution errors when the DNS request is resolved in the DNS resolver's cache. Otherwise, the DNS request can first be resolved through the DNS resolver's cache to obtain the resolution result. If no resolution result is obtained in the DNS resolver's cache, the DNS request is also forwarded to the authoritative DNS server for resolution.

[0041] For example, if a DNS request contains a Virtual Private Cloud (VPN) identifier and a target domain name, and the configured resolution results show that resolution result A has a 33% hit probability and resolution result B has a 67% hit probability, and the DNS resolver's cache only contains resolution result A, then when resolving the DNS request through the DNS resolver's cache, the hit rate of resolution result A will be 100%. This will not correctly reflect the resolution result corresponding to the pre-configured domain name weight, leading to errors in the DNS request resolution.

[0042] Similarly, in this embodiment, if intelligent resolution of the network segment where the cloud server's IP address is located is required, the cloud server's IP address can also be included in the DNS request. When the DNS resolver receives the DNS request, it will check whether the cloud server's IP address needs intelligent resolution. If so, it will forward the DNS request to the authoritative DNS server; otherwise, it needs to be resolved in the DNS resolver's cache. If the resolution result cannot be obtained, the DNS request will be forwarded to the authoritative DNS server for resolution.

[0043] In this embodiment, the DNS request can simultaneously determine whether the target domain name has been pre-configured with domain name weight and whether the IP address of the cloud server needs intelligent resolution, so as to determine whether the DNS needs to be sent directly to the authoritative DNS server, avoiding the problem of resolution errors when resolving through the DNS resolver's cache.

[0044] In conjunction with the above embodiments, in another embodiment provided in this disclosure, a DNS request processing method is also provided. This method can be applied to DNS resolution, such as... Figure 2 As shown, the method may include the following steps:

[0045] In step S210, a Domain Name Resolution Service (DNS) request is received.

[0046] The DNS request carries the target domain name to be resolved and the node information of the sending node.

[0047] In this embodiment, the target domain name is the domain name that needs to be resolved. As can be seen from the above embodiments, since this disclosure can be applied to the scenario of cloud tenants, it avoids the security problems caused by tenants in VPC performing domain name resolution. The DNS request will carry the node information of the sending node. The sending node here can be the cloud server in the VPC in the above embodiments. The node information can include the VPC identifier, and can also include the VPC identifier and the IP address of the cloud server, etc.

[0048] This allows different VPCs to be distinguished by identifiers. Even with the same domain name, different identifiers can yield different DNS resolution results, thus protecting the privacy of different tenants while achieving tenant isolation.

[0049] In step S220, based on the DNS request, if it is determined that the DNS resolver's cache needs to be activated, the DNS resolver's cache is searched to see if there is a target resolution result that matches the target domain name and node information.

[0050] In this embodiment, when a DNS resolver receives a DNS request, it determines whether the target domain name in the request has been configured, such as having a configured domain weight. If the target domain name has been pre-configured, the caching switch for that target domain name is turned off, and the DNS resolver forwards the DNS request to an authoritative DNS server for resolution. Otherwise, the caching switch for the target domain name is turned on so that the resolution result can be obtained from the DNS resolver's cache.

[0051] Additionally, in this embodiment, if the DNS request also carries the IP address of the cloud server, the DNS resolver will determine whether intelligent resolution of that IP address is necessary. If so, the caching switch for the target domain name will be turned off, and the DNS resolver will forward the DNS request to an authoritative DNS server for resolution processing. Otherwise, the caching switch for the target domain name will be turned on so that the resolution result can be obtained from the DNS resolver's cache.

[0052] In addition, based on the DNS request, if it is determined that the DNS resolver cache does not need to be activated, a DNS request containing the target domain name and node information is sent to the authoritative DNS server.

[0053] If no target resolution result is found, in step S230, a DNS request containing the target domain name and node information is sent to the authoritative DNS server.

[0054] If the DNS resolver finds the target resolution result corresponding to the DNS request in its cache, it returns the result to the sending node. If the result is not found in the cache, a DNS request containing the target domain name and node information is sent to the authoritative DNS server. Otherwise, if the result is found, it is sent to the sending node in step S231.

[0055] The NDS request processing method provided in this disclosure involves a DNS resolver, upon receiving a DNS request, determining whether to activate its cache. If the cache is required, the resolver searches its cache for a matching DNS resolution result. If no matching result is found, the request is forwarded to an authoritative DNS server for resolution. This method, by obtaining a matching DNS resolution result, avoids obtaining identical resolution results when resolving the same domain name. In tenant-isolated environments, this approach protects tenant privacy and improves data security.

[0056] In a further embodiment provided in this disclosure, in conjunction with the above embodiments, the node information includes the node identifier of the sending node. The cached data in the cache is pre-divided into multiple data shards. Each data shard contains a hash mapping relationship between the hash value of the key name and the resolution result. The hash value of the key name is generated based on the domain name and the node identifier of the preset node. In this embodiment, different resolution results of the cached data in the DNS cache can be divided into multiple data shards, with one data shard corresponding to one hash value, which is equivalent to a one-to-one mapping. Alternatively, one data shard can correspond to a range of hash values, meaning one data shard can include multiple hash values, which is equivalent to a one-to-many mapping. The hash value is generated through the node identifier and the corresponding domain name. Thus, the corresponding target data shard can be found by using the hash value generated from the identifier and the target domain name in the DNS request, and the resolution result contained in the target data shard is used as the target resolution result of the DNS request.

[0057] Based on the above embodiments, in another embodiment provided in this disclosure, such as Figure 3 As shown, step S220 above may further include the following steps:

[0058] In step S221, the target domain name and node identifier are hashed to obtain the first hash value.

[0059] In this embodiment, the target domain name and node identifier are combined into a key, and the first hash value is obtained by calculating it using a hash algorithm.

[0060] In step S222, it is determined whether the target fragment data matching the first hash value is found in the cache of the DNS resolver.

[0061] As can be seen from the above embodiments, the cached data in the DNS resolver's cache can be pre-divided into multiple data fragments, each containing a correspondence between hash values ​​and resolution results. Therefore, the data fragment corresponding to the first hash value can be found. For example, the data fragment corresponding to the same hash value as the first hash value can be found as the target data fragment, or the data fragment whose hash range includes the first hash value can be found as the target data fragment.

[0062] If a target fragment data matching the first hash value is found in the DNS resolver's cache, in step S223, it is determined that a target resolution result has been found, and the resolution result contained in the target fragment data is used as the target resolution result that matches the target domain name and node information.

[0063] If the DNS resolver finds the target fragment data corresponding to the first hash value in its cache, the resolution result contained in the target fragment data can be used as the target resolution result for the DNS request, and the DNS resolver will send the resolution result to the sending node.

[0064] If no target fragment data matching the first hash value is found in the DNS resolver's cache, in step S224, it is determined that no target resolution result was found.

[0065] If no target fragment data matching the first hash value is found in the DNS resolver's cache, it indicates that the target resolution result of the DNS request is not available in the DNS resolver's cache. The DNS resolver will then forward the DNS request to an authoritative DNS server for further resolution. In this embodiment, the cached data in the DNS resolver is pre-divided into multiple fragments. When resolving a DNS request, the corresponding target fragment data can be quickly found using the hash value corresponding to the node identifier and the target domain name in the DNS request. The resolution result of this target fragment data can then be used as the target resolution result of the DNS request, improving the DNS resolver's efficiency. Furthermore, this embodiment can assign an independent read-write lock to each fragment data in the DNS resolver, thus avoiding performance degradation caused by all threads competing for the same cache lock.

[0066] Based on the above embodiments, in another embodiment provided in this disclosure, such as Figure 4 As shown, step S220 above may further include the following steps:

[0067] In step S225, the DNS resolver cache is checked to see if a first resolution result matching the target domain name exists.

[0068] If a first resolution result matching the target domain name is found in the cache, in step S226, it is determined whether a second resolution result matching the node information exists in the first resolution result.

[0069] If a second parsing result matching the node information exists in the first parsing result, in step S227, it is determined that a target parsing result has been found, and the second parsing result is used as the target parsing result.

[0070] If no first resolution result matching the target domain name is found in the cache, or if no second resolution result matching the node information is found in the first resolution result, in step S228, it is determined that no target resolution result was found.

[0071] If the DNS resolver's cache does not find a first resolution result matching the target domain name, it can directly forward the DNS request to an authoritative DNS server for resolution. If the DNS resolver's cache does find a first resolution result matching the target domain name, since there may be multiple first resolution results, it needs to search for a second resolution result matching the node information from among the first resolution results. If the second resolution result is found, it can be used as the target resolution result for the DNS request; otherwise, if it is determined that the target resolution result for the DNS request is not found, the DNS request needs to be forwarded to an authoritative DNS server for resolution. Additionally, if a second resolution result matching the node information exists in the first resolution results, the second resolution result is sent to the sending node.

[0072] In the embodiments provided in this disclosure, since the same domain name may correspond to multiple different first resolution results, it is necessary to determine the second resolution result corresponding to the node information from these multiple different resolution results. In this way, by combining the node information and the target domain name, the target resolution result corresponding to the DNS request can be determined quickly and effectively.

[0073] Based on the above embodiments, in another embodiment provided in this disclosure, a caching switch can also be configured for the target domain name. Therefore, in the method provided in this disclosure, the node information may include the IP address of the sending node, such as... Figure 5 As shown, the method may further include the following steps:

[0074] In step S240, it is determined whether the target domain name or node information has a pre-defined target configuration. The target configuration includes: the target domain name having domain name weight or the IP address having a corresponding DNS resolution result on the target IP network segment.

[0075] If the target domain name or node information has a pre-configured target, in step S250, it is determined that the DNS resolver cache does not need to be started based on the DNS request.

[0076] If the target domain name and node information do not have a pre-configured target, in step S260, it is determined that the DNS resolver cache needs to be started based on the DNS request.

[0077] When a DNS resolver receives a DNS request, it first determines whether the target domain name in the request has a pre-configured domain weight or whether the resolution result corresponding to the sending node's IP address has been pre-configured. If at least one of the target domain name or the sending node has been pre-configured, the caching of that target domain name is disabled. This is equivalent to turning off the caching switch for that target domain name in the DNS resolver's cache. In other words, when a DNS resolver receives a DNS request, it checks whether the target domain name or the sending node's IP address in the request has been pre-configured. If the domain weight has been pre-configured, the DNS resolver will forward the DNS request to an authoritative DNS server. This avoids resolution errors that might occur if the DNS request is resolved through the DNS resolver's cache. Otherwise, the DNS request can first be resolved through the DNS resolver's cache to obtain a resolution result. If no resolution result is found in the DNS resolver's cache, the DNS request is also forwarded to an authoritative DNS server for resolution.

[0078] In this embodiment, a domain name table can be set up to store pre-configured domain names. When a DNS request is received, the existence of a domain name matching the target domain name in the DNS request is checked in the domain name table to determine whether the target domain name has been pre-configured. Similarly, to confirm whether the IP address of the sending node is a pre-configured IP address, a table lookup can be used to check whether the IP address of the sending node in the DNS request is within the network segment of the configured IP address.

[0079] In the embodiments provided in this disclosure, by setting a caching switch for the target domain name, it is determined whether the DNS request needs to be resolved in the DNS resolver's cache. Otherwise, the DNS needs to be sent directly to the authoritative DNS server. This can avoid the problem of possible resolution errors when resolving through the DNS resolver's cache when resolution through the authoritative DNS server is required, thereby improving the resolution efficiency of the DNS request.

[0080] Based on the above embodiments, in another embodiment provided in this disclosure, such as Figure 6 As shown, the method may further include the following steps:

[0081] In step S270, if it is detected that the authoritative DNS server sends an empty resolution result to the sending node in response to the DNS request, the empty resolution result corresponding to the DNS request is stored in the cache of the DNS resolver.

[0082] In step S280, when receiving a DNS request from a sending node, an empty resolution result is sent to the sending node within a preset time period.

[0083] In this embodiment, typically, when a DNS resolver's cache detects an empty DNS request, it forwards the request to the authoritative DNS server for further processing. If the DNS resolver detects that the authoritative DNS server also sends an empty resolution result to the sending node (meaning the authoritative DNS server also resolved the DNS request to an empty result), the DNS resolver stores the result in its cache. When the DNS resolver receives the same DNS request again, it will directly return the corresponding empty resolution result to the sending node within a certain period. For example, caching the DNS resolver's cache for one minute and returning the empty resolution result corresponding to the same DNS request to the sending node within that minute can prevent a large number of identical DNS requests from being forwarded to the authoritative DNS server, thus reducing the pressure on the authoritative DNS server.

[0084] Based on the above embodiments, in another embodiment provided in this disclosure, such as Figure 7 As shown, the method may further include the following steps:

[0085] In step S291, when a change in the domain name resolution configuration is detected in the authoritative NDS server, the domain name resolution configuration change information is obtained.

[0086] In step S292, the DNS resolution cache is updated based on the domain name resolution configuration change information.

[0087] Since the DNS request resolution result in this embodiment is related not only to the target domain name, but also to the node identifier in the node information, and even the IP address of the sending node, if the node identifier or the IP address of the sending node changes, or the corresponding resolution result changes, it is necessary to refresh the cache in the DNS resolver. Specifically, the domain name resolution configuration change information can be obtained from the authoritative DNS server, and then the resolution result in the DNS resolution cache can be updated according to the domain name resolution configuration change information to avoid resolution errors caused by the DNS resolver's cache not being refreshed in time.

[0088] By dividing each function into corresponding functional modules, this disclosure provides a DNS request processing device, which can be a server or a chip applied to a server. Figure 8 This is a schematic block diagram of the functional modules of a DNS request processing apparatus provided for an exemplary embodiment of this disclosure. Figure 8 As shown, the DNS request processing device includes:

[0089] DNS request receiving module 10 is used to receive DNS requests for domain name resolution services, wherein the DNS request carries the target domain name to be resolved and node information of the sending node;

[0090] The DNS resolution result acquisition module 20 is used to search in the cache of the DNS resolver whether there is a target resolution result that matches the target domain name and the node information, based on the DNS request and when it is determined that the cache of the DNS resolver needs to be activated.

[0091] The DNS request sending module 30 is used to send a DNS request containing the target domain name and the node information to an authoritative DNS server when the target resolution result is not found.

[0092] In another embodiment provided in this disclosure, the node information includes the node identifier of the sending node, and the cached data in the cache is pre-divided into multiple data shards. Each data shard contains a hash mapping relationship between the hash value of the key name and the parsing result. The hash value of the key name is generated based on the domain name and the node identifier of the preset node.

[0093] In another embodiment provided in this disclosure, the parsing result acquisition module is specifically used for:

[0094] The target domain name and the node identifier are hashed to obtain a first hash value;

[0095] Determine whether the target fragment data matching the first hash value is found in the cache of the DNS resolver;

[0096] If a target fragment data matching the first hash value is found in the cache of the DNS resolver, it is determined that the target resolution result has been found, and the resolution result contained in the target fragment data is used as the target resolution result that matches the target domain name and the node information;

[0097] If no target fragment data matching the first hash value is found in the cache of the DNS resolver, it is determined that the target resolution result has not been found.

[0098] In another embodiment provided in this disclosure, each data fragment corresponds to an independent read-write lock.

[0099] In another embodiment provided in this disclosure, the parsing result acquisition module is further specifically used for:

[0100] Check the cache of the DNS resolver to see if there is a first resolution result that matches the target domain name;

[0101] If a first resolution result matching the target domain name is found in the cache, it is determined whether a second resolution result matching the node information exists in the first resolution result.

[0102] If a second parsing result matching the node information exists in the first parsing result, it is determined that the target parsing result has been found, and the second parsing result is used as the target parsing result.

[0103] If no first resolution result matching the target domain name is found in the cache, or if no second resolution result matching the node information is found in the first resolution result, it is determined that the target resolution result was not found.

[0104] In another embodiment provided in this disclosure, the DNS request sending module is further configured to:

[0105] If a second parsing result matching the node information exists in the first parsing result, the second parsing result is sent to the sending node.

[0106] In another embodiment provided in this disclosure, the node information includes the IP address of the sending node; the apparatus further includes:

[0107] The first judgment module is used to determine whether the target domain name or the node information has a pre-defined target configuration; wherein, the target configuration includes: the target domain name has a domain name weight or the IP address has a corresponding resolution result on the target IP network segment;

[0108] The first determining module is configured to determine, based on the DNS request, that a cache that does not require the DNS resolver to be started, should be used if the target domain name or the node information has a pre-configured target.

[0109] The first startup module is used to determine, based on the DNS request, that the DNS resolver cache needs to be started if the target domain name and the node information do not have a pre-configured target.

[0110] In yet another embodiment provided in this disclosure, the apparatus further includes:

[0111] A storage module is configured to store the empty resolution result corresponding to the DNS request in the cache of the DNS resolver when it is detected that the authoritative DNS server sends an empty resolution result to the sending node in response to the DNS request.

[0112] The result sending module is used to send the empty resolution result to the sending node within a preset time period when receiving the DNS request sent by the sending node.

[0113] In yet another embodiment provided in this disclosure:

[0114] The DNS request sending module is further configured to send a DNS request containing the target domain name and the node information to the authoritative DNS server based on the DNS request, provided that it is determined that the DNS resolver cache does not need to be activated.

[0115] In yet another embodiment provided in this disclosure, the apparatus further includes:

[0116] The information acquisition module is used to acquire information about changes in the domain name resolution configuration when changes are detected in the domain name resolution configuration of the authoritative NDS server.

[0117] The update module is used to update the DNS resolution cache results based on the domain name resolution configuration change information.

[0118] For details, please refer to the description of the corresponding method embodiments above, which will not be repeated here.

[0119] The NDS request processing apparatus provided in this disclosure, upon receiving a DNS request, determines whether to activate the NDS resolver's cache based on the DNS request. If the NDS resolver's cache is required to resolve the DNS request, it searches the DNS resolver's cache for a target resolution result that matches the target domain name and node information in the DNS request. If no target resolution result is found, the DNS request is forwarded to an authoritative DNS server for resolution. By obtaining a target resolution result that matches the target domain name and node information in the DNS request, the apparatus avoids obtaining the same resolution result when resolving the same domain name. This can protect tenant privacy and improve data security in a tenant-isolated environment.

[0120] This disclosure also provides an electronic device, including: at least one processor; and a memory for storing processor-executable instructions; wherein the at least one processor is configured to execute the instructions to implement the DNS request processing method disclosed in this disclosure.

[0121] Figure 9 This is a schematic diagram of the structure of an electronic device provided as an exemplary embodiment of this disclosure. For example... Figure 9As shown, the electronic device 1800 includes at least one processor 1801 and a memory 1802 coupled to the processor 1801. The processor 1801 can perform the corresponding steps in the methods disclosed in the embodiments of this disclosure.

[0122] The processor 1801 described above can also be called a central processing unit (CPU), which can be an integrated circuit chip with signal processing capabilities. Each step in the method disclosed in this embodiment can be implemented by the integrated logic circuitry in the processor 1801 or by software instructions. The processor 1801 can be a general-purpose processor, a digital signal processor (DSP), an ASIC, a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this embodiment can be directly implemented by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software modules can be located in the memory 1802, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The processor 1801 reads information from the memory 1802 and, in conjunction with its hardware, completes the steps of the method described above.

[0123] Furthermore, various operations / processes according to this disclosure, implemented via software and / or firmware, can be transmitted from a storage medium or network to a computer system with a dedicated hardware architecture, such as... Figure 10 The computer system 1900 shown is equipped with the programs that constitute the software. When various programs are installed, the computer system is able to perform various functions, including those described above.

[0124] Functions of 12, etc. Figure 10 A block diagram of a computer system provided for an exemplary embodiment of this disclosure.

[0125] Computer System 1900 is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0126] like Figure 10 As shown, the computer system 1900 includes a computing unit 1901, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 1902 or a computer program loaded from a storage unit 1908 into a random access memory (RAM) 1903. The RAM 1903 may also store various programs and data required for the operation of the computer system 1900. The computing unit 1901, ROM 1902, and RAM 1903 are interconnected via a bus 1904. An input / output (I / O) interface 1905 is also connected to the bus 1904.

[0127] Multiple components in computer system 1900 are connected to I / O interface 1905, including: input unit 1906, output unit 1907, storage unit 1908, and communication unit 1909. Input unit 1906 can be any type of device capable of inputting information into computer system 1900. Input unit 1906 can receive input digital or character information and generate key signal inputs related to user settings and / or function control of the electronic device. Output unit 1907 can be any type of device capable of presenting information and may include, but is not limited to, a monitor, speaker, video / audio output terminal, vibrator, and / or printer. Storage unit 1908 may include, but is not limited to, hard disks and optical disks. Communication unit 1909 allows computer system 1900 to exchange information / data with other devices via a network such as the Internet, and may include, but is not limited to, modems, network cards, infrared communication devices, wireless communication transceivers, and / or chipsets, such as Bluetooth™ devices, WiFi devices, WiMax devices, cellular communication devices, and / or the like.

[0128] The computing unit 1901 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 1901 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 1901 performs the various methods and processes described above. For example, in some embodiments, the methods disclosed in this disclosure can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 1908. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 1900 via ROM 1902 and / or communication unit 1909. In some embodiments, the computing unit 1901 can be configured to perform the methods disclosed in this disclosure by any other suitable means (e.g., by means of firmware).

[0129] This disclosure also provides a computer-readable storage medium, wherein when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is able to perform the DNS request processing method disclosed in this disclosure.

[0130] The computer-readable storage medium in this disclosure can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. The aforementioned computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specifically, the aforementioned computer-readable storage medium may include electrical connections based on one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0131] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0132] This disclosure also provides a computer program product, including a computer program, wherein when the computer program is executed by a processor, it implements the DNS request processing method disclosed in the embodiments of this disclosure.

[0133] It should be noted that the electronic devices, computer-readable storage media, and computer program products provided in the embodiments of this disclosure can refer to the descriptions corresponding to the above method embodiments when executing the DNS request processing method, which will not be repeated here.

[0134] In embodiments of this disclosure, computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include, but are not limited to, object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)), or it can be connected to an external computer.

[0135] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0136] The modules, components, or units described in the embodiments of this disclosure can be implemented in software or hardware. The names of the modules, components, or units do not necessarily constitute a limitation on the module, component, or unit itself.

[0137] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary hardware logic components that can be used include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0138] The above description is merely an embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0139] While specific embodiments of this disclosure have been described in detail by way of example, those skilled in the art should understand that the examples are for illustrative purposes only and not intended to limit the scope of this disclosure. Those skilled in the art should understand that modifications can be made to the above embodiments without departing from the scope and spirit of this disclosure. The scope of this disclosure is defined by the appended claims.

Claims

1. A DNS request processing method, characterized in that, The method includes: Receive a Domain Name Resolution Service (DNS) request, the DNS request carrying the target domain name to be resolved and the node information of the sending node, the sending node including a cloud server in a virtual private cloud, the node information including the node identifier of the sending node, and the node identifier including the identifier of the virtual private cloud; Based on the DNS request, if it is determined that the DNS resolver's cache needs to be activated, the DNS resolver's cache is searched to see if there is a target resolution result that matches the target domain name and the node information; If the target resolution result is not found, a DNS request containing the target domain name and the node information is sent to the authoritative DNS server. The method further includes: based on the DNS request, if it is determined that the DNS resolver cache does not need to be activated, sending a DNS request containing the target domain name and the node information to an authoritative DNS server.

2. The method according to claim 1, characterized in that, The cached data in the cache is pre-divided into multiple data shards. Each data shard contains a hash mapping relationship between the hash value of the key name and the parsing result. The hash value of the key name is generated based on the domain name and the node identifier of the preset node.

3. The method according to claim 2, characterized in that, The step of searching the DNS resolver's cache for a target DNS resolution result that matches the target domain name and the node information includes: The target domain name and the node identifier are hashed to obtain a first hash value; Determine whether the target fragment data matching the first hash value is found in the cache of the DNS resolver; If a target fragment data matching the first hash value is found in the cache of the DNS resolver, it is determined that the target resolution result has been found, and the resolution result contained in the target fragment data is used as the target resolution result that matches the target domain name and the node information; If no target fragment data matching the first hash value is found in the cache of the DNS resolver, it is determined that the target resolution result has not been found.

4. The method according to claim 2, characterized in that, Each data shard corresponds to an independent read-write lock.

5. The method according to claim 1, characterized in that, The step of searching the DNS resolver's cache for a target DNS resolution result that matches the target domain name and the node information includes: Check the cache of the DNS resolver to see if there is a first resolution result that matches the target domain name; If a first resolution result matching the target domain name is found in the cache, it is determined whether a second resolution result matching the node information exists in the first resolution result. If a second parsing result matching the node information exists in the first parsing result, it is determined that the target parsing result has been found, and the second parsing result is used as the target parsing result. If no first resolution result matching the target domain name is found in the cache, or if no second resolution result matching the node information is found in the first resolution result, it is determined that the target resolution result was not found.

6. The method according to claim 5, characterized in that, The method further includes: If a second parsing result matching the node information exists in the first parsing result, the second parsing result is sent to the sending node.

7. The method according to claim 1, characterized in that, The node information includes the IP address of the sending node; The method further includes: Determine whether the target domain name or the node information has a pre-defined target configuration; wherein, the target configuration includes: the target domain name having domain name weight or the IP address having a corresponding resolution result on the target IP network segment; If the target domain name or the node information has a pre-configured target, it is determined based on the DNS request that caching of the DNS resolver does not need to be activated; If the target domain name and the node information do not have a pre-configured target, the DNS resolver cache needs to be activated based on the DNS request.

8. The method according to claim 1, characterized in that, The method further includes: If the authoritative DNS server sends an empty resolution result to the sending node in response to the DNS request, the empty resolution result corresponding to the DNS request is stored in the cache of the DNS resolver. When receiving the DNS request sent by the sending node, the empty resolution result is sent to the sending node within a preset time period.

9. The method according to any one of claims 1 to 8, characterized in that, The method further includes: When a change in the domain name resolution configuration is detected in the authoritative DNS server, information about the change in domain name resolution configuration is obtained; The DNS resolution cache is updated based on the domain name resolution configuration change information.

10. A DNS request processing apparatus, characterized in that, The device includes: The DNS request receiving module is used to receive DNS requests for domain name resolution services. The DNS request carries the target domain name to be resolved and the node information of the sending node. The sending node includes a cloud server in a virtual private cloud. The node information includes the node identifier of the sending node, and the node identifier includes the identifier of the virtual private cloud. The DNS resolution result acquisition module is used to search the cache of the DNS resolver for a target resolution result that matches the target domain name and the node information, based on the DNS request and if it is determined that the cache of the DNS resolver needs to be activated. The DNS request sending module is used to send a DNS request containing the target domain name and the node information to the authoritative DNS server when the target resolution result is not found. The DNS request sending module is further configured to send a DNS request containing the target domain name and the node information to an authoritative DNS server based on the DNS request, provided that it is determined that the DNS resolver cache does not need to be activated.

11. An electronic device, characterized in that, include: At least one processor; Memory for storing the at least one processor-executable instruction; The at least one processor is configured to execute the instructions to implement the method as described in any one of claims 1-9.

12. A computer-readable storage medium, characterized in that, When the instructions in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device is able to perform the method as described in any one of claims 1-9.

Images