DNS domain name resolution method, DNS server, and computer-readable storage medium

Abstract

The present invention relates to the field of network communication technology, and specifically to a DNS domain name resolution method, a DNS server, and a computer-readable storage medium. The method can resolve the public key and / or signature of a target encryption algorithm, such as a national encryption algorithm, by configuring a bypass authentication verification route in the server, so as to solve the problem that DNSSEC and DNS resolution systems are incompatible when using different encryption algorithms. The DNS domain name resolution method provided by the present invention, in which a trust anchor of an authentication center with bypass authentication based on the target encryption algorithm is configured in the DNS server, comprises: step S1, performing DNS domain name request resolution, and receiving digital signature information of data source security authentication during the DNS domain name request resolution process; step S2, determining whether the digital signature information adopts the target encryption algorithm, and if so, bypassing the digital signature to the authentication center for authentication, and if not, continuing to perform data source security authentication.

Description

Technical Field

[0001] The present invention relates to the field of network communication technology, and in particular to a DNS domain name resolution method, a DNS server and a computer-readable storage medium. Background Art

[0002] DNSSEC (Domain Name System Security Extensions) is a series of DNS security authentication mechanisms provided by the IETF. DNSSEC adds digital signature information to the data in the DNS, allowing the recursive server to check the signature information after receiving the response message to determine whether the response data is authoritative and authentic. This provides data source verification and data integrity verification for DNS data, which can prevent related attacks against DNS.

[0003] When using DNS Security Extensions to verify the source of DNS data, a trust chain also needs to be established. This trust chain consists of each node in the DNS domain name resolution process. The previous node digitally signs the public key hash value of the next node, ensuring that each node in the trust chain is trustworthy. There are many different encryption algorithms for public keys and signatures, and each DNS server supports different encryption algorithms. In actual applications, if DNSSEC uses a certain encryption algorithm, it must support this type of encryption algorithm throughout the entire chain, that is, it must support this type of encryption algorithm from the root. Otherwise, the data source verification process will fail.

[0004] In the existing technology, common cryptographic algorithms include symmetric algorithms, asymmetric algorithms, and hash algorithms. Symmetric algorithms include ZUC, SM1, SM4, SM7, DES, TDES, and AES; asymmetric algorithms include SM2, SM9, RSA, and ECC; and hash algorithms include SM3, SHA1, SHA256, SHA512, and MD5. Of these algorithms, ZUC, SM1, SM2, SM3, SM4, SM7, and SM9 are currently recognized commercial cryptographic algorithms in China, also known as national cryptographic algorithms. The remaining algorithms are international algorithms. However, the current DNS resolution system only supports the international encryption algorithm DNSSEC. DNS systems that support national cryptographic algorithms are incompatible with the existing DNS resolution system. Summary of the Invention

[0005] In response to the above problems, the present invention provides a DNS domain name resolution method, a DNS server and a computer-readable storage medium, which can resolve the public key and / or signature of the target encryption algorithm, such as the national encryption algorithm, by configuring a bypass authentication verification route in the server, so as to solve the problem that DNSSEC and the DNS resolution system are incompatible when using different encryption algorithms, thereby facilitating the promotion and application of encryption algorithms that are not originally supported by the DNS resolution system.

[0006] In the technical solution of the present invention, a DNS domain name resolution method is provided, in which a trust anchor of an authentication center with bypass authentication based on a target encryption algorithm is configured in a DNS server, including: step S1, performing DNS domain name request resolution, and receiving digital signature information of data source security authentication during the DNS domain name request resolution process; step S2, judging whether the digital signature information adopts the target encryption algorithm, if so, bypassing the digital signature to the authentication center for authentication, if not, continuing with data source security authentication.

[0007] According to the technical solution of the present invention, when DNS domain name resolution is performed, the returned DNS resolution result will be verified for data source, and DNSSEC uses public key encryption to sign and authenticate the DNS resource record set (RRset). However, if the public key is encrypted with an incompatible encryption algorithm, the data source verification will fail. In the technical solution of the present invention, when DNSSEC performs data source verification, any node returns a message encrypted with an incompatible encryption algorithm, namely the target encryption algorithm. It can be directly bypassed to the authentication center for digital signature verification through the trust anchor of the authentication center based on the bypass authentication of the target encryption algorithm preset in the DNS server. There is no need to request the hash value verification key of the DNSSEC public key in the parent domain corresponding to the node, so that all domain names signed with the target encryption algorithm are bypassed to the authentication center corresponding to the target encryption algorithm for verification. While being compatible with different encryption algorithms, it makes the verification configuration simpler and more efficient.

[0008] Preferably, in the technical solution of the present invention, the DNS domain name resolution method also includes step S0, judging whether the domain name to be resolved hits the domain name / domain corresponding to the target encryption algorithm. If so, the domain name to be resolved is sent to the server corresponding to the target encryption algorithm for DNS domain name request resolution; if not, the domain name to be resolved is sent to the server corresponding to the non-target encryption algorithm for DNS domain name request resolution.

[0009] According to the technical solution of the present invention, before performing domain name resolution, it is possible to determine whether the domain name to be resolved hits the domain name / domain corresponding to the target encryption algorithm, and send the domain name to the root domain server corresponding to the target encryption algorithm, directly avoiding encountering messages using incompatible encryption algorithms during subsequent resolution and data source verification, so that the domain name that hits the target encryption algorithm can successfully complete the data source verification from the authoritative domain name server corresponding to the domain name to the root server. Domain names that do not hit the target encryption algorithm are still resolved according to the above-mentioned DNS domain name resolution method. During the verification process, any node that returns a message encrypted using the target encryption algorithm can be directly bypassed to the authentication center for digital signature verification through the trust anchor of the authentication center based on the bypass authentication of the target encryption algorithm preset in the DNS server. Thus, it is achieved that domain name discrimination is performed directly according to user needs, and while being compatible with different encryption algorithms, domain names using various encryption algorithms can all be conveniently and efficiently resolved and verified for data sources.

[0010] Furthermore, in the technical solution of the present invention, the DNS domain name resolution method further includes step S3, after completing the data source security authentication, returning the resolution result of the DNS domain name request resolution.

[0011] According to the technical solution of the present invention, after completing the domain name resolution and data source security authentication of the domain name to be resolved, the resolution result with correct data source can be returned to the requester so that the requester can connect and access the domain name.

[0012] Preferably, in the technical solution of the present invention, step S1 in the DNS domain name resolution method also includes: step S11, transmitting the domain name to be resolved to the root server, and according to the subdomain server address returned by the root server, transmitting the domain name to be resolved to the subdomain server, and according to the subdomain server address of the subdomain server returned by the subdomain server, querying downward step by step until the server returns the resolution result of the domain name to be resolved; step S12, sending a security verification request for the data source to the parent domain server of the server that returns the resolution result of the domain name to be resolved, receiving the digital signature information returned by the parent domain server, and then sending a security verification request for the data source to the parent domain server of the parent domain server, and sending the security verification request for the data source upward step by step until the digital signature information sent and returned by the root server is received.

[0013] According to the technical solution of the present invention, after obtaining a domain name resolution result, starting from the server that returned the domain name resolution result, a data source security verification request is sent to its parent domain server, i.e., the server immediately above the server that returned the domain name resolution result, all the way to the root server. This ensures that every node in the trust chain for data source verification is trustworthy. Furthermore, if the message returned by any of these nodes uses the target decryption algorithm, it can be directly bypassed to the authentication center for digital signature verification, eliminating the need for verification on the node's corresponding parent domain server. This avoids data source security verification failures due to incompatibility with the target decryption algorithm.

[0014] In the technical solution of the present invention, the trust anchor of the authentication center based on the bypass authentication of the target encryption algorithm in the DNS domain name resolution method is a public key or a hash value of the public key. The message content using the target encryption algorithm can be directly signed and authenticated through the public key or the hash value of the public key.

[0015] In the technical solution of the present invention, the target encryption algorithm in the DNS domain name resolution method is the national encryption algorithm.

[0016] According to the technical solution of the present invention, the National Secret Algorithm is a commercial secret algorithm recognized in China. The National Secret Algorithm has obvious advantages in algorithm speed and key data volume, and is more suitable for application scenarios with large data volume, small resources and low power consumption. The DNS domain name resolution method provided in the technical solution of the present invention can enable the DNS resolution system that originally does not support the National Secret Algorithm to achieve compatibility with the National Secret Algorithm, thereby realizing the promotion of the National Secret Algorithm in the DNS resolution system.

[0017] In the technical solution of the present invention, a DNS server is also provided, in which a trust anchor of an authentication center with bypass authentication based on a target encryption algorithm is configured, including one or more processors; and a memory, the memory storing one or more programs configured to be executed by one or more processors, the one or more programs including instructions for performing the following operations: step S1, performing DNS domain name request resolution, and obtaining digital signature information of data source security authentication during the resolution process; step S2, determining whether the digital signature information adopts the target encryption algorithm, if so, bypassing the digital signature to the authentication center for authentication, if not, continuing with data source security authentication.

[0018] According to the technical solution of the present invention, when the above-mentioned DNS server performs DNSSEC data source verification, any node returns a message encrypted with an incompatible encryption algorithm, namely the target encryption algorithm, which can be directly bypassed to the authentication center for digital signature verification through the trust anchor of the authentication center based on the bypass authentication of the target encryption algorithm preset in the DNS server. There is no need to request the hash value verification key of the DNSSEC public key in the parent domain corresponding to the node, so that all domain names signed with the target encryption algorithm are bypassed to the authentication center corresponding to the target encryption algorithm for verification. While being compatible with different encryption algorithms, the verification configuration is simpler and more efficient.

[0019] In the technical solution of the present invention, a computer-readable storage medium is further provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned DNS domain name resolution method are implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a flow chart of a DNS domain name resolution method provided in an embodiment of the present invention;

[0021] Figure 2 This is a flowchart of step S1 in a DNS domain name resolution method provided in an embodiment of the present invention;

[0022] Figure 3 This is a flowchart of step S0 in a DNS domain name resolution method provided in an embodiment of the present invention;

[0023] Figure 4 It is a schematic diagram of a DNS server provided in an embodiment of the present invention.

[0024] Reference numerals: 100 - DNS server, 101 - processor, 102 - memory. DETAILED DESCRIPTION

[0025] The following will be combined with the accompanying drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0026] Figure 1 It is a flowchart of a DNS domain name resolution method provided in an embodiment of the present invention.

[0027] like Figure 1As shown, in an embodiment of the present invention, a DNS domain name resolution method is provided, in which a trust anchor of an authentication center with bypass authentication based on a target encryption algorithm is configured in a DNS server, including: step S1, performing DNS domain name request resolution, and receiving digital signature information of data source security authentication during the DNS domain name request resolution process; step S2, judging whether the digital signature information adopts the target encryption algorithm, if so, bypassing the digital signature to the authentication center for authentication, if not, continuing with data source security authentication.

[0028] In an embodiment of the present invention, the target encryption algorithm described in the above-mentioned DNS domain name resolution method is a national encryption algorithm.

[0029] In the existing technology, common cryptographic algorithms include symmetric algorithms, asymmetric algorithms, and hash algorithms. Symmetric algorithms include ZUC, SM1, SM4, SM7, DES, TDES, and AES; asymmetric algorithms include SM2, SM9, RSA, and ECC; and hash algorithms include SM3, SHA1, SHA256, SHA512, and MD5. Of these, ZUC, SM1, SM2, SM3, SM4, SM7, and SM9 are currently recognized commercial encryption algorithms in China, also known as national encryption algorithms. The remaining algorithms are international algorithms. In practical applications, commercial encryption algorithms should generally be used during the certification process for commercial encryption products, and international algorithms should be avoided as much as possible.

[0030] Taking the common international algorithms RSA2048 and the national secret algorithm SM2 as examples, the RSA public key algorithm has a first-mover advantage and is widely used both internationally and domestically. However, the RSA public key algorithm is slower. In typical applications, key generation and signature algorithms are significantly slower than the SM2 algorithm of comparable strength. For example, in common IC cards, RSA2048 key generation speeds are typically measured in seconds, while SM2 key generation speeds are measured in milliseconds, a difference that can be as much as a thousand times. RSA2048 also uses more memory for keys than SM2. For example, in common IC cards, RSA2048 private keys are at least 640 bytes, while SM2 private keys are only 32 bytes. In summary, the national secret algorithm SM2 has significant advantages over the international algorithm RSA2048 in terms of algorithm speed and key data size, making it more suitable for applications with large data volumes, limited resources, and low power consumption. However, the existing DNS resolution system only supports the international encryption algorithm DNSSEC, so promoting DNS resolution using the national secret algorithm will encounter compatibility issues.

[0031] According to the technical solution of the present invention, the DNS domain name resolution method provided in the technical solution of the present invention can enable all domain names signed with the target encryption algorithm, namely the national encryption algorithm, to be bypassed to the authentication center corresponding to the target encryption algorithm for verification. The DNS resolution system that originally does not support the national encryption algorithm can achieve compatibility with the national encryption algorithm, thereby realizing the promotion of the national encryption algorithm in the DNS resolution system.

[0032] Figure 2 This is a flowchart of step S1 in a DNS domain name resolution method provided in an embodiment of the present invention.

[0033] like Figure 2 As shown, in an embodiment of the present invention, step S1 in the DNS domain name resolution method also includes: step S11, transmitting the domain name to be resolved to the root server, and according to the subdomain server address returned by the root server, transmitting the domain name to be resolved to the subdomain server, and according to the subdomain server address of the subdomain server returned by the subdomain server, querying downward step by step until the server returns the resolution result of the domain name to be resolved; step S12, sending a security verification request for the data source to the parent domain server of the server that returns the resolution result of the domain name to be resolved, receiving the digital signature information returned by the parent domain server, and then sending a security verification request for the data source to the parent domain server of the parent domain server, and sending the security verification request for the data source upward step by step until the digital signature information sent and returned by the root server is received.

[0034] Specifically, when a DNS server performs DNS domain name resolution, taking the domain name to be resolved as www.example.cn as an example, the local DNS server, acting as a recursive server, performs iterative queries as follows: First, the recursive server sends an iterative query request to the root domain name server (.root). The root domain name server returns the address of the next-level DNS server, the top-level domain name server (.cn). Then, the recursive server sends an iterative query request to the top-level domain name server (.cn). The top-level domain name server (.cn) returns the address of the next-level DNS server, the second-level domain name server (example.cn). Next, the recursive server sends an iterative query request to the second-level domain name server (example.cn). If the second-level domain name server (example.cn) returns the resolution result for the domain name to be resolved, such as the IP address 192.1.1.1, the iterative query is complete. Otherwise, the second-level domain name server (example.cn) returns the address of the next-level DNS server (third-level domain name server). This process continues in this order until a certain level of DNS server has an iterative query result. The child domain server refers to the next-level server of each server in the domain name resolution process, and the parent domain server refers to the previous-level server of each server in the domain name resolution process.

[0035] After completing DNS domain name resolution, the resolution result needs to be authenticated for data source security. DNSSEC adds digital signature information to the data in DNS, so that the recursive server can check the signature information to determine whether the response data is authoritative and authentic after receiving the response message, thereby providing data source verification and data integrity verification for DNS data, which can prevent related attacks against DNS.

[0036] Specifically, DNSSEC adds three new resource record types: Resource Record Signature (RRSIG), which is used to store the DNSSEC signature of each record of the current domain name; DNS Public Key record (DNSKEY), which is used to check the public key of the DNSSEC signature; DS record (Delegation Signer), which is used to record the hash value of the DNSSEC public key.

[0037] The data origin security authentication process is the opposite of the DNS domain name resolution process. First, a data origin security verification request is sent to the server (example.cn) that returns the domain name resolution result of www.example.cn A 192.1.1.1. The DNSKEY of the server (example.cn) and the location of the DS record corresponding to example.cn, that is, the server (.cn)'s parent server (.cn), are obtained. Then, a data origin security verification request is sent to the parent server (.cn). The DS record corresponding to example.cn is verified to ensure that the DNSKEY of the server (example.cn) is correct, thereby confirming the source security of the data sent by the server (example.cn). At the same time, the DNSKEY of the server (.cn) and the location of the DS record corresponding to .cn, that is, the server (.cn)'s parent server (.root), are obtained. Then, a data origin security verification request is sent to the parent server (.root), and the DS record corresponding to .cn is verified to ensure that the DNSKEY of the server (.cn) is correct, thereby confirming the source security of the data sent by the server (.cn). At the same time, the key of the root server is obtained and verified, thereby ensuring the data origin security of the entire resolution path of the domain name www.example.cn.

[0038] In the above-mentioned DNS domain name resolution and security verification process, DNSSEC uses public key encryption for signing and authentication. However, if the public key is encrypted using an incompatible encryption algorithm, data source verification will fail.

[0039] In an embodiment of the present invention, when DNSSEC performs data source verification, any node returns a message encrypted with an incompatible encryption algorithm such as the national encryption algorithm, which can be directly bypassed to the authentication center for digital signature verification through the trust anchor of the authentication center based on the bypass authentication of the target encryption algorithm preset in the DNS server. For example, during verification, if it is found that the DNSKEY of the node example.cn uses the national encryption algorithm, it will be directly authenticated by the centralized authentication center without requesting the hash value verification key of the DNSSEC public key in the parent domain (.cn) corresponding to the node, so that all domain names signed with the target encryption algorithm are bypassed to the authentication center corresponding to the target encryption algorithm for verification, which can avoid the failure of data source security verification due to incompatibility with the target decryption algorithm, and make the verification configuration simpler and more efficient while being compatible with different encryption algorithms.

[0040] Furthermore, in an embodiment of the present invention, the DNS domain name resolution method further includes step S3, where, after completing data source security authentication, the DNS domain name resolution result is returned. Specifically, after completing domain name resolution and data source security authentication for the domain name to be resolved, the resolution result (www.example.cn A 192.1.1.1) indicating the correct data source is returned to the requester, allowing the requester to connect and access the domain name.

[0041] Figure 3 This is a flowchart of step S0 in a DNS domain name resolution method provided in an embodiment of the present invention.

[0042] like Figure 3 As shown, in an embodiment of the present invention, the DNS domain name resolution method also includes step S0, judging whether the domain name to be resolved hits the domain name / domain corresponding to the target encryption algorithm. If so, the domain name to be resolved is sent to the server corresponding to the target encryption algorithm for DNS domain name request resolution; if not, the domain name to be resolved is sent to the server corresponding to the non-target encryption algorithm for DNS domain name request resolution.

[0043] In an embodiment of the present invention, before performing the domain name resolution of step S1-2, it is possible to determine whether the domain name to be resolved hits the domain name / domain corresponding to the target encryption algorithm. Taking the target encryption algorithm as the national encryption algorithm as an example, the domain corresponding to the target encryption algorithm is defined as .cn. When the DNS server resolves the domain names www.example.cn and www.example.com, it uses different resolution paths. Among them, if www.example.cn hits the domain (.cn) corresponding to the target encryption algorithm, the domain name www.example.cn can be sent directly to the root domain server (.cn) corresponding to the target encryption algorithm for resolution; if www.example.com does not hit the domain (.cn) corresponding to the target encryption algorithm, the domain name www.example.com can be sent directly to other root domain servers other than the root domain server (.cn) corresponding to the target encryption algorithm for resolution.

[0044] Sending the domain name to the root domain server corresponding to the target encryption algorithm directly prevents it from encountering messages using incompatible encryption algorithms during the subsequent resolution and data source verification process, so that the domain name that hits the target encryption algorithm can successfully complete the data source verification from the authoritative domain name server corresponding to the domain name to the root server. Domain names that do not hit the target encryption algorithm are still resolved according to the above-mentioned DNS domain name resolution method. During the verification process, any node that returns a message encrypted with the target encryption algorithm can be directly bypassed to the authentication center for digital signature verification through the trust anchor of the authentication center based on the bypass authentication of the target encryption algorithm preset in the DNS server. In this way, domain name discrimination can be directly performed according to user needs, and while compatibility with different encryption algorithms is achieved, domain names using various encryption algorithms can all be conveniently and efficiently resolved and verified for data sources.

[0045] Figure 4 It is a schematic diagram of a DNS server provided in an embodiment of the present invention.

[0046] like Figure 4 As shown, in an embodiment of the present invention, a DNS server 100 is further provided, including one or more processors 101; and a memory 102, wherein the memory 102 stores one or more programs configured to be executed by the one or more processors 101, and the one or more programs include instructions for performing the following operations:

[0047] Step S1, perform DNS domain name request resolution, and receive the digital signature information of data source security authentication during the DNS domain name request resolution process; Step S2, determine whether the digital signature information adopts the target encryption algorithm. If so, bypass the digital signature to the authentication center for authentication. If not, continue with data source security authentication.

[0048] In an embodiment of the present invention, when the above-mentioned DNS server 100 performs DNSSEC data source verification, any node returns a message encrypted with an incompatible encryption algorithm, namely the target encryption algorithm, which can be directly bypassed to the authentication center for digital signature verification through the trust anchor of the authentication center based on the bypass authentication of the target encryption algorithm preset in the DNS server. There is no need to request the hash value verification key of the DNSSEC public key in the parent domain corresponding to the node, so that all domain names signed with the target encryption algorithm are bypassed to the authentication center corresponding to the target encryption algorithm for verification, which can avoid the failure of data source security verification due to incompatibility with the target decryption algorithm, and make the verification configuration simpler and more efficient while being compatible with different encryption algorithms.

[0049] In an embodiment of the present invention, the processor 101 and the memory 102 in the DNS server 100 can be located in the same storage medium, such as a DNS server, a computer storage medium, etc., or can be located in different hardware, software, or cloud networks. In other words, the above-mentioned DNS server 100 can be composed of an independent DNS server, a computer, or other devices, or can be composed of one or more combinations of multiple hardware, software, hardware and software, and cloud networks.

[0050] In addition, it should be noted that the memory 102 may include non-volatile memory, such as read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), flash memory (FLASH), or any other device capable of storing program instructions or data with or without applied power. The memory 102 may also include volatile memory, such as random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), and synchronous dynamic random access memory (SDRAM). Other types of RAM may also be used to implement the memory 102. The memory 102 may be implemented using a single memory module or multiple memory modules. Although the memory 102 is depicted as being locally interconnected with the processor 101, those skilled in the art will recognize that the memory 102 may be provided separately from the processor 101 in a different computer without departing from the scope of the subject technology.

[0051] Processor 101 may be a general-purpose processor, a processor core, a multiprocessor, a reconfigurable processor, a microcontroller, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a graphics processing unit (GPU), a field-programmable gate array (FPGA), a programmable logic device (PLD), a controller, a state machine, gating logic, discrete hardware components, or any other processing unit, as well as a combination of one or more of the foregoing processors.

[0052] In an embodiment of the present invention, a computer-readable storage medium is further provided. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the steps of the above-mentioned DNS domain name resolution method are implemented.

[0053] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the principles and spirit of the present invention are included in the scope of protection of the present invention.

Claims

1. A DNS domain name resolution method, characterized in that: The DNS server is configured with a trust anchor for the authentication center that uses bypass authentication based on the target encryption algorithm, including: Step S0, determining whether the domain name to be resolved hits the domain name / domain corresponding to the target encryption algorithm. If so, the domain name to be resolved is sent to the server corresponding to the target encryption algorithm for DNS domain name resolution; if not, the domain name to be resolved is sent to a server not corresponding to the target encryption algorithm for DNS domain name resolution; Step S1, performing DNS domain name request resolution, and receiving digital signature information of data source security authentication during the DNS domain name request resolution process; Step S2, determine whether the digital signature information adopts the target encryption algorithm. If so, bypass the digital signature to the authentication center for authentication. If not, continue with the data source security authentication.

2. The DNS domain name resolution method according to claim 1, wherein: Also includes: Step S3, after completing the data source security authentication, returns the resolution result of the DNS domain name request resolution.

3. The DNS domain name resolution method according to claim 1, wherein: Step S1 further includes: Step S11: The domain name to be resolved is transmitted to the root server. Based on the subdomain server address returned by the root server, the domain name to be resolved is transmitted to the subdomain server. Based on the subdomain server address of the subdomain server returned by the subdomain server, queries are made downward step by step until the server returns the resolution result of the domain name to be resolved. Step S12: Send a security verification request for the data source to the parent domain server of the server that returns the resolution result of the domain name to be resolved, receive the digital signature information returned by the parent domain server, and then send a security verification request for the data source to the parent domain server of the parent domain server, and send the security verification request for the data source upward step by step until the digital signature information sent and returned by the root server is received.

4. The DNS domain name resolution method according to claim 1, wherein: The trust anchor is a public key or a hash value of a public key.

5. The DNS domain name resolution method according to claim 1, wherein: The target encryption algorithm is the national secret algorithm.

6. A DNS server, characterized in that: The DNS server is configured with a trust anchor of an authentication center for bypass authentication based on a target encryption algorithm, including: one or more processors; and a memory storing one or more programs configured to be executed by the one or more processors, the one or more programs including instructions for performing the following operations: Step S0, determining whether the domain name to be resolved hits the domain name / domain corresponding to the target encryption algorithm. If so, the domain name to be resolved is sent to the server corresponding to the target encryption algorithm for DNS domain name resolution; if not, the domain name to be resolved is sent to a server not corresponding to the target encryption algorithm for DNS domain name resolution; Step S1: Perform DNS domain name resolution, and obtain digital signature information of data source security authentication during the resolution process; Step S2, determine whether the digital signature information adopts the target encryption algorithm. If so, bypass the digital signature to the authentication center for authentication. If not, continue with the data source security authentication.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the DNS domain name resolution method according to any one of claims 1 to 5.

Images