Method for verifying the credibility of dns system root zone file based on multi-element heterogeneous data

Abstract

This invention provides a DNS system root zone file trustworthiness association verification system based on multi-source heterogeneous data. It includes a multi-source heterogeneous data acquisition module, which is connected to an IANA Root Zone Database data acquisition module, an AXFR transfer data acquisition module, and an active probe data module. This system solves the technical problem that previous methods of acquiring root zone file data were often single-source, relying solely on DNS requests or zone transfer requests. However, these methods could not determine whether the acquired file was the latest version or whether it had been hijacked and tampered with. This invention allows for the dynamic construction of trustworthy root zone file data and enables dynamic monitoring of root zone files. The constructed trustworthy root zone file can be used to establish local roots, optimize the DNS resolution process, improve resolution efficiency, and also for detecting root-side resolution anomalies.

Description

A Method for Verifying the Trustworthiness of Root Zone Files in a DNS System Based on Multi-variable Heterogeneous Data Technical Field

[0001] This invention relates to a method for verifying the trustworthiness of root zone files in a DNS system, and more particularly to a method for verifying the trustworthiness of root zone files in a DNS system based on multi-variable heterogeneous data. Background Technology

[0002] In recent years, the DNS system has been continuously updated and improved. As the top-level domain in the DNS system, the root domain is particularly important in the DNS resolution process. However, it is also the first to be exposed to various network attacks. The fundamental factor affecting the success of DNS resolution is the trustworthiness of the root zone file.

[0003] In the past, obtaining root zone file data was often a single-source process, that is, obtaining the file only through DNS requests or zone transfer requests, but it was impossible to determine whether the obtained file was the latest version, or whether the file had been tampered with due to hijacking.

[0004] In addition, the time delay caused by root zone file transfer synchronization and BGP route convergence will affect the real-time performance of root zone data and reduce DNS resolution efficiency. Summary of the Invention

[0005] This invention addresses the technical problem of inaccurate and unreliable data in existing DNS system root zone files by providing a method for verifying the credibility of DNS system root zone files based on multi-source heterogeneous data.

[0006] Therefore, the technical solution of the present invention is a DNS system root zone file trustworthiness association verification system based on multi-variable heterogeneous data, including a multi-variable heterogeneous data acquisition module, which is connected to an IANA Root Zone Database data acquisition module, an AXFR transmission data acquisition module, and an active probe data module.

[0007] The active data detection module connects to the root domain SOA record module and the top-level domain NS record module;

[0008] The IANA Root Zone Database data acquisition module, AXFR transmission data acquisition module, active probe data module are connected to the SOA sequence number comparison strategy module. The SOA sequence number comparison strategy module is connected to the initial screening dataset module. The initial screening dataset module is connected to the A / AAAA / NS record ratio verification strategy module and the DNSSEC trusted verification strategy module. The A / AAAA / NS record ratio verification strategy module and the DNSSEC trusted verification strategy module are connected to the trusted data filtering module.

[0009] The trusted data filtering module is also connected to the multi-source heterogeneous data acquisition module;

[0010] The trusted data filtering module is connected to the trusted root zone file dataset module.

[0011] The method for verifying the trustworthiness of root zone files in a DNS system based on multi-source heterogeneous data mainly includes the following steps:

[0012] Step 1: Acquisition of multivariate heterogeneous data. The specific steps are as follows:

[0013] Step 1-1: Request the download of root zone file data from the web server and FTP server provided by IANA; Step 1-2: Send AXFR query requests to the 7 root servers with full zone transfer capabilities and the 2 servers provided by ICANN to obtain the root zone file data;

[0014] Steps 1-3: Starting from several probe points in different geographical locations, actively request NS records for top-level domains and SOA records for root domains from 13 root servers to complete the active probe data.

[0015] Steps 1-4: Obtain WHOIS data for the top-level domain from the WHOIS server whois.iana.org, and extract the NS record and its corresponding A / AAAA record, as well as the DS record.

[0016] Step two involves verifying the credibility of the multi-source heterogeneous data obtained in step one. The specific steps are as follows:

[0017] Step 2-1: Perform preliminary screening of the diverse heterogeneous data using SOA sequence numbers, identify the largest SOA sequence number, and discard all datasets with SOA sequence numbers smaller than the largest.

[0018] Step 2-2 Combine the data filtered by SOA sequence number with WHOIS probe data as the initial screening dataset; extract A / AAAA / NS records for each top-level domain from the multivariate data of the initial screening dataset, and count the proportions of different records, selecting the record with the largest proportion that is greater than the set threshold as the trusted record;

[0019] Step 2-3: Based on the obtained DNSSEC resource records, verify the data source and integrity of the top-level domain resource records in the root zone file. First, use the root domain DS record to verify the key signature public key of the top-level domain resource record. If it passes, obtain and verify the zone signature public key of the top-level domain resource record. If the verification passes, use the zone signature public key to verify the top-level resource record.

[0020] Steps 2-4: For each resource record of each top-level domain, filter the resource records that simultaneously meet the verification requirements of Step 2 and Step 3, construct a trusted root zone file dataset, and complete the trusted data filtering; store the filtered root zone file data with high trustworthiness and high accuracy to form a trusted root zone file dataset.

[0021] Step 3 involves dynamic cyclic monitoring, acquiring multi-dimensional heterogeneous data and verifying its reliability at regular intervals to obtain a real-time reliable root zone file; this process repeats steps 1 and 2.

[0022] Preferably, the threshold value set in step 2-2 is 0.5.

[0023] Preferably, the cyclic monitoring cycle in step three should be less than or equal to 8 hours.

[0024] The beneficial effects of this invention are that it can dynamically construct trusted root zone file data and realize dynamic monitoring of root zone files; the constructed trusted root zone file can be used to establish local roots, optimize the DNS resolution process, improve resolution efficiency, and can also be used for root-side resolution anomaly detection. Attached Figure Description

[0025] Figure 1 is a schematic diagram of the structure for implementing dynamic monitoring and credibility verification of root zone files according to the present invention. Detailed Implementation

[0026] The present invention will be further described below with reference to embodiments.

[0027] Figure 1 shows a module connection block diagram and logical relationship diagram of the root zone file dynamic monitoring and trustworthiness verification implementation of the present invention. In this implementation, a DNS system root zone file trustworthiness association verification system based on multi-heterogeneous data includes a multi-heterogeneous data acquisition module, which is connected to the IANA Root Zone Database data acquisition module, the AXFR transmission data acquisition module, and the active probe data module.

[0028] The active data detection module connects to the root domain SOA record module and the top-level domain NS record module;

[0029] The IANA Root Zone Database data acquisition module, AXFR transmission data acquisition module, active probe data module are connected to the SOA sequence number comparison strategy module. The SOA sequence number comparison strategy module is connected to the initial screening dataset module. The initial screening dataset module is connected to the A / AAAA / NS record ratio verification strategy module and the DNSSEC trusted verification strategy module. The A / AAAA / NS record ratio verification strategy module and the DNSSEC trusted verification strategy module are connected to the trusted data filtering module.

[0030] The trusted data filtering module is also connected to the multi-source heterogeneous data acquisition module;

[0031] The trusted data filtering module is connected to the trusted root zone file dataset module.

[0032] The module functions in this embodiment are described as follows:

[0033] To avoid delays in the root zone file synchronization process and data hijacking issues, the multi-source heterogeneous data acquisition module needs to establish a highly reliable dataset, which requires the integration and analysis of data from different sources.

[0034] The IANA Root Zone Database data acquisition module requests and downloads root zone file data from the web server and FTP server provided by IANA.

[0035] The AXFR data acquisition module sends an AXFR request to a server that supports root full zone transfer functionality to retrieve the root zone file.

[0036] The active data probe module refers to actively requesting the NS records of each top-level domain and the SOA records of the root domain from several probe points in different geographical locations, and obtaining a set of response resource records. This set is the basis for proportional verification.

[0037] The SOA serial number comparison strategy module determines the latest version of the current root zone file by comparing the size of the SOA serial numbers. The larger the serial number, the newer the root zone file.

[0038] The WHOIS data module obtains WHOIS data for each top-level domain from the WHOIS server (whois.iana.org), and extracts NS records and their corresponding A / AAAA records, as well as DS records.

[0039] The initial screening dataset module refers to the data filtered using the SOA sequence number comparison strategy and the latest WHOIS data;

[0040] The A / AAAA / NS record ratio verification strategy module extracts the A / AAAA / NS records from the multivariate data in the initial screening dataset into a resource record set, and counts the ratio of different records. The reliable dataset must have the largest proportion and at least more than half of the records. The remaining datasets will be judged as outdated / missing / unreliable data.

[0041] The DNSSEC trusted verification strategy module uses DNSSEC to verify the source and data integrity of NS records and glue records for each top-level domain.

[0042] The trusted data filtering module filters out resource records that simultaneously meet both the proportional verification policy and the DNSSEC trusted verification policy.

[0043] The dynamic cyclic monitoring strategy module updates the root zone file dynamically and cyclically based on time series to maintain its timeliness.

[0044] The Trusted Root Zone File Dataset Module stores root zone file data that is highly reliable and accurate.

[0045] In this implementation, the DNS system root zone file trustworthiness association verification method based on multi-source heterogeneous data first obtains multi-source heterogeneous data related to the root zone file through WHOIS information requests, online data acquisition from the IANA root zone database, full zone transfer (AXFR) of the root zone file, and active probing. Then, it performs association trustworthiness verification, including: SOA sequence comparison, multi-source ratio verification of A / AAAA / NS resource records, and verification based on DNSSEC data source and data integrity. Finally, a trustworthy root zone file dataset is constructed. Specifically, the DNS system root zone file trustworthiness association verification method based on multi-source heterogeneous data mainly includes the following steps:

[0046] Step 1: Acquisition of multivariate heterogeneous data. The specific steps are as follows:

[0047] Step 1-1: Request and download the root zone file data from the web server and FTP server provided by IANA; request addresses: https: / / www.internic.net / domain / root.zone, ftp: / / rs.internic.net / domain / root.zone;

[0048] Steps 1-2: Send AXFR query requests to the seven root servers (roots: B / C / D / E / F / G / K) and two servers provided by ICANN (lax.xfr.dns.icann.org, iad.xfr.dns.icann.org) with full zone transfer capabilities to obtain root zone file data;

[0049] Steps 1-3: Starting from several probe points in different geographical locations, actively request NS records for top-level domains and SOA records for root domains from 13 root servers to complete the active probe data.

[0050] Steps 1-4: Obtain WHOIS data for the top-level domain from the WHOIS server whois.iana.org, and extract the NS record and its corresponding A / AAAA record, as well as the DS record.

[0051] Step two involves verifying the credibility of the multi-source heterogeneous data obtained in step one. The specific steps are as follows:

[0052] Step 2-1: Perform preliminary screening of the diverse heterogeneous data using SOA sequence numbers, identify the largest SOA sequence number, and discard all datasets with SOA sequence numbers smaller than the largest.

[0053] Step 2-2 Combine the data filtered by SOA sequence number with WHOIS probe data as the initial screening dataset; extract A / AAAA / NS records for each top-level domain from the multivariate data of the initial screening dataset, and count the proportions of different records, selecting the record with the largest proportion that is greater than the set threshold as the trusted record;

[0054] Step 2-3: Based on the obtained DNSSEC resource records, verify the data source and integrity of the top-level domain resource records (A / AAAA / NS records) in the root zone file. First, use the root domain DS record to verify the key signature public key (KSK) of the top-level domain resource record. If it passes, obtain and verify the zone signature public key (ZSK) of the top-level domain resource record. If the verification passes, use the ZSK to verify the top-level resource record.

[0055] Steps 2-4: For each resource record of each top-level domain, filter the resource records that simultaneously meet the verification requirements of Step 2 and Step 3, construct a trusted root zone file dataset, and complete the trusted data filtering; store the filtered root zone file data with high trustworthiness and high accuracy to form a trusted root zone file dataset.

[0056] Step 3 involves dynamic cyclic monitoring, acquiring multi-dimensional heterogeneous data and verifying its reliability at regular intervals to obtain a real-time reliable root zone file; this process repeats steps 1 and 2.

[0057] Preferably, the threshold value set in step 2-2 is 0.5.

[0058] Preferably, the cyclic monitoring cycle in step three should be less than or equal to 8 hours.

[0059] Since the current root zone file is updated 2-3 times a day and the update time is not fixed, the cyclic monitoring cycle should be less than or equal to 8 hours.

[0060] The method of this invention can dynamically construct trusted root zone file data and realize dynamic monitoring of root zone files; the constructed trusted root zone file can be used to establish local roots, optimize the DNS resolution process, improve resolution efficiency, and can also be used for root-side resolution anomaly detection.

[0061] However, the above description is merely a specific embodiment of the present invention and should not be construed as limiting the scope of the present invention. Therefore, any substitution of equivalent components or equivalent changes and modifications made in accordance with the scope of protection of the present invention should still fall within the scope of the claims of the present invention.

Claims

1. A method for verifying the trustworthiness of root zone files in a multi-variable heterogeneous data DNS system, characterized by: The main steps include: Step 1: Acquisition of diverse heterogeneous data. The specific steps are as follows: Step 1-1: Download root zone file data by requesting the WEB and FTP servers provided by IANA; Step 1-2: Send AXFR query requests to the 7 root servers with full zone transfer capabilities and the 2 servers provided by ICANN to obtain the root zone file data; Step 1-3: Starting from several probe points at different geographical locations, actively request NS records for top-level domains and SOA records for root domains from the 13 root servers to complete active data probing; Step 1-4: Obtain WHOIS data for top-level domains from the WHOIS server whois.iana.org, extracting NS records and their corresponding A / AAAA records, as well as DS records; Step 2: Verify the credibility of the diverse heterogeneous data acquired in Step 1. The specific steps are as follows: Step 2-1: Initially filter the diverse heterogeneous data using SOA sequence numbers, finding the largest SOA sequence number and discarding all datasets with SOA sequence numbers smaller than the largest; Step 2-2: ... The data filtered by SOA sequence number is combined with WHOIS probe data to form the initial screening dataset. A / AAAA / NS records for each top-level domain are extracted from the multivariate data of the initial screening dataset, and the proportion of different records is counted. The record with the largest proportion exceeding a set threshold is selected as a trusted record. Steps 2-3 verify the data source and integrity of the top-level domain resource records in the root zone file based on the obtained DNSSEC resource records. First, the key signature public key of the top-level domain resource record is verified using the root domain DS record. If successful, the zone signature public key of the top-level domain resource record is obtained and verified. If the verification is successful again, the zone signature public key is used to verify the top-level resource record. Steps 2-4 filter resource records that simultaneously satisfy the verification in steps 2 and 3 for each top-level domain resource record, constructing a trusted root zone file dataset to complete the trusted data filtering. The filtered root zone file data with high trustworthiness and high accuracy is stored to form a trusted root zone file dataset. Step 3 involves dynamic cyclic monitoring, acquiring multivariate heterogeneous data and performing associated trusted verification every time period to obtain a real-time trusted root zone file. Steps 1 and 2 are repeated.

2. The method for verifying the trustworthiness of root zone files in a multi-variable heterogeneous data DNS system according to claim 1, characterized in that: The threshold set in step 2-2 is 0.

5.

3. The method for verifying the trustworthiness of root zone files in a multi-variable heterogeneous data DNS system according to claim 1, characterized in that: The cyclic monitoring cycle in step three should be less than or equal to 8 hours.

Images