Method for obtaining security access control of client based on domain name, client and storage medium

Abstract

Embodiments of the present application provide a method, a client and a storage medium for obtaining a secure access control of a client based on a domain name, wherein the domain name obtaining client obtains a domain name resolution request sent by a user through a browser, determines whether a target server domain name needs to be forwarded through a VPN server on the VPN server, sends the server domain name that needs to be forwarded to the domain name obtaining client after marking the server domain name with an identifier according to a domain name forwarding strategy, allocates a virtual IP address to the browser, restores the virtual IP address to a real IP address, and performs a real access request. Embodiments of the present application can realize secure access to a configured target server to be accessed through a domain name.

Description

Technical Field

[0001] The embodiments of this application belong to the field of network security technology, specifically relating to a secure access control method, client, and storage medium based on domain name acquisition of the client. Background Technology

[0002] In existing technologies, users access target servers by initiating access requests through domain names. However, existing VPN technologies lack domain name resolution or domain name access control processes, making it impossible to securely access the configured target server via domain names. Summary of the Invention

[0003] In order to solve or alleviate the technical problems existing in the existing technology.

[0004] In a first aspect, the present invention provides a secure access control method for a client based on domain name acquisition, the method comprising:

[0005] Receive requests for resolving the domain name of the target server sent through the browser;

[0006] The resolution request is forwarded to the VPN server to determine whether the target server domain name needs to be forwarded through the VPN server. If so, the target server domain name that needs to be forwarded is marked with an identifier by the VPN server.

[0007] Receive the target server domain name with an identifier sent by the VPN server;

[0008] Assign a virtual IP address to the browser corresponding to the target server domain name with the identifier, and store the real IP address corresponding to the virtual IP address;

[0009] Receive the access request initiated by the browser through the virtual IP address;

[0010] The virtual IP address is restored to its corresponding real IP address. The real IP address and the identifier corresponding to the virtual IP address are sent to the VPN server. The VPN server determines whether the real IP address is the real IP address corresponding to the domain name of the target server to be forwarded. If so, the access request is forwarded to the target server through the VPN server.

[0011] The target server receives the response result of the access request forwarded by the NPN server;

[0012] After replacing the real IP address with the corresponding virtual IP address, the response result corresponding to the virtual IP address is returned to the browser.

[0013] Compared with existing technologies, this application provides a secure access control method based on a domain name acquisition client. The domain name acquisition client receives domain name resolution requests sent by users through their browsers. The VPN server determines whether the target server domain name needs to be forwarded via the VPN service. Based on the domain name forwarding policy, the server domain names that need forwarding are identified and sent to the domain name acquisition client. A virtual IP address is then assigned to the browser. The domain name acquisition client restores the virtual IP address to a real IP address to make the actual access request. Through this application, before a user formally accesses a target server via a domain name, domain name resolution is performed to determine if the target server domain name is the one to be accessed. Simultaneously, based on the domain name forwarding policy, the target server domain name that can be forwarded by the VPN server is determined, and a virtual IP address can be assigned to it. This application enables secure access to configured target servers via domain names.

[0014] Secondly, embodiments of this application also provide a domain name-based client, including:

[0015] The receiving module is used to receive resolution requests for the target server's domain name sent through the browser;

[0016] The forwarding module is used to forward the resolution request to the VPN server in order to determine whether the target server domain name needs to be forwarded through the VPN server. If so, the VPN server marks the target server domain name that needs to be forwarded with an identifier.

[0017] The receiving module is also used to receive the target server domain name with an identifier sent by the VPN server;

[0018] The allocation module is used to allocate a virtual IP address to the browser corresponding to the target server domain name with the identifier, and to store the real IP address corresponding to the virtual IP address;

[0019] The receiving module is also used to receive access requests initiated by the browser through the virtual IP address;

[0020] The sending module is used to restore the virtual IP address to its corresponding real IP address, and send the real IP address and the identifier corresponding to the virtual IP address to the VPN server. The VPN server determines whether the real IP address is the real IP address corresponding to the domain name of the target server to be forwarded. If so, the VPN server forwards the access request to the target server.

[0021] The receiving module is also configured to receive the response result of the target server forwarded by the NPN server based on the access request;

[0022] The return module is used to replace the real IP address with the corresponding virtual IP address and then return the response result corresponding to the virtual IP address to the browser.

[0023] Thirdly, embodiments of this application also provide a storage medium for storing an executable program of the security access control method described in any one of the first and second aspects.

[0024] Compared with the prior art, the beneficial effects of the technical solutions provided in the second and third aspects are the same as those in the first aspect, and will not be repeated here. Attached Figure Description

[0025] Figure 1 This is a flowchart illustrating a secure access control method for clients based on domain name acquisition provided by the present invention.

[0026] Figure 2 This is a schematic diagram of the interaction process of a secure access control method for clients based on domain name acquisition provided by the present invention;

[0027] Figure 3 This is a schematic diagram of the structure of a domain name acquisition client provided by the present invention;

[0028] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments of this application and are used to explain this application. They do not constitute an undue limitation of this application. Some specific embodiments of this application will be described in detail below with reference to the accompanying drawings in an exemplary and non-limiting manner. Detailed Implementation

[0029] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some, not all, of the embodiments of the present application. All other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative effort should fall within the scope of protection of the present application.

[0030] The domain name acquisition client in this embodiment is a client capable of acquiring domain names and can assign a virtual IP address to the browser. The VPN server assigns a virtual IP address to the domain name acquisition client, and a virtual network card needs to be enabled locally. The virtual network card needs to be bound to the virtual IP address, and an access request to the target server can be initiated through the virtual IP address.

[0031] like Figure 1 As shown in the figure, this application provides a secure access control method based on a domain name acquisition client. The method is applied to a domain name acquisition client and includes:

[0032] Step S01: Receive a DNS resolution request for the target server domain name sent through a browser;

[0033] It should be noted that before a user accesses a target server via a domain name, the target server needs to be resolved. The domain name acquisition client will receive the resolution request for the target server domain name sent by the user through the browser. In specific embodiments, the resolution request may be sent directly to the operating system where the browser is located, and then the operating system sends the resolution request to the domain name acquisition client. The specific method of sending the resolution request needs to be determined according to the browser's functions, and this application does not impose any restrictions on it.

[0034] Step S02: Forward the resolution request to the VPN server to determine whether the target server domain name needs to be forwarded through the VPN server. If so, mark the target server domain name that needs to be forwarded with an identifier through the VPN server.

[0035] It should be noted that the domain name acquisition client sends the obtained resolution request to the VPN server. The VPN server can determine whether the target server domain name needs to be forwarded based on the domain name forwarding policy. Specifically, the domain name forwarding policy is a detailed list of domain names to be forwarded.

[0036] The process of determining whether the target server domain name needs to be forwarded through a VPN server specifically includes:

[0037] The VPN server stores a forwarding domain name policy. The VPN server compares the target server domain name with the forwarding domain name policy. If the forwarding domain name policy contains the target server domain name, then the domain name needs to be forwarded through the VPN server; otherwise, the domain name does not need to be forwarded through the VPN server.

[0038] If the target server domain name is a domain name that needs to be forwarded by the VPN server, then the VPN server will mark the target server domain name that needs to be forwarded with an identifier.

[0039] This application embodiment uses a VPN server to forward domain names, which can be used to verify the domain names of the target server to be accessed in order to determine which domain names are the target server domain names that the user can access. This enables secure access to the configured target server through domain names.

[0040] After the VPN server receives the resolution request, the method further includes: sending the resolution request to a domain name resolution server through the VPN server to resolve the real IP address corresponding to the target server domain name.

[0041] It should be noted that the VPN server sends the resolution request to the domain name resolution server in order to resolve the real IP address corresponding to the target server domain name. The real IP address can be used to determine whether it is the real IP address corresponding to the target server domain name to be forwarded according to the forwarding domain name policy.

[0042] Step S03: Receive the target server domain name with an identifier sent by the VPN server;

[0043] It should be noted that the domain name acquisition client obtains the target server domain name with an identifier, and the VPN server also needs to store the target server and its corresponding identifier.

[0044] Step S04: Assign a virtual IP address to the browser corresponding to the target server domain name with the identifier, and store the real IP address corresponding to the virtual IP address;

[0045] It should be noted that after the domain name acquisition client receives the target server domain name with the identifier, the domain name acquisition client sends the virtual IP address corresponding to the target server domain name with the identifier to the browser. The virtual IP address is a virtual IP address assigned to the domain name acquisition client by the VPN server before the domain name acquisition client sends the resolution request.

[0046] Step S05: Receive the access request initiated by the browser through the virtual IP address;

[0047] It should be noted that the above steps have completed the domain name resolution of the target server to be accessed and obtained the virtual IP address corresponding to the domain name of the target server to be accessed, so that the user can initiate an access request to the target server.

[0048] Step S06: Restore the virtual IP address to its corresponding real IP address, and send the real IP address and the identifier corresponding to the virtual IP address to the VPN server. The VPN server determines whether the real IP address is the real IP address corresponding to the domain name of the target server to be forwarded. If so, the VPN server forwards the access request to the target server.

[0049] It should be noted that the domain name acquisition client needs to restore the virtual IP address to the real IP address so that the user can initiate an access request to the target server through the real IP address. The VPN server determines whether the real IP address needs to forward the access request to the target server through the VPN server in order to access the target server according to the domain name forwarding policy.

[0050] Step S07: Receive the response result from the target server forwarded by the NPN server based on the access request;

[0051] It should be noted that, after confirming the real IP address as the real IP address corresponding to the target server domain name to be forwarded through step S06, the target server responds to the access request and sends the response result to the VPN server, which then sends the response result to the domain name acquisition client.

[0052] Step S08: After replacing the real IP address with the corresponding virtual IP address, return the response result corresponding to the virtual IP address to the browser.

[0053] It should be noted that when a user enters a virtual IP address into the browser to make an access request, the real IP address needs to be restored to the corresponding virtual IP address before the target server's response is returned to the browser; otherwise, the browser will not recognize the returned response.

[0054] In addition, the embodiments of this application resolve all users' real IP addresses through a virtual IP address range. Therefore, the technical solutions provided by the embodiments of this application can reduce the number of routing rules to be configured, reduce the workload of configuration, and improve work efficiency.

[0055] Secondly, such as Figure 2 As shown in the embodiments of this application, a client for obtaining information based on a domain name is also provided, including:

[0056] The receiving module 01 is used to receive the resolution request for the target server domain name sent through the browser;

[0057] Forwarding module 02 is used to forward the resolution request to the VPN server in order to determine whether the target server domain name needs to be forwarded through the VPN server. If so, the VPN server marks the target server domain name that needs to be forwarded with an identifier.

[0058] The receiving module 01 is also used to receive the target server domain name with an identifier sent by the VPN server;

[0059] The allocation module 03 is used to allocate a virtual IP address to the browser corresponding to the target server domain name with the identifier, and to store the real IP address corresponding to the virtual IP address;

[0060] The receiving module 01 is also used to receive the access request initiated by the browser through the virtual IP address;

[0061] The sending module 04 is used to restore the virtual IP address to its corresponding real IP address, and send the real IP address and the identifier corresponding to the virtual IP address to the VPN server. The VPN server determines whether the real IP address is the real IP address corresponding to the domain name of the target server to be forwarded. If so, the VPN server forwards the access request to the target server.

[0062] The receiving module 01 is also used to receive the response result of the target server forwarded by the NPN server according to the access request;

[0063] The return module 05 is used to replace the real IP address with the corresponding virtual IP address and return the response result corresponding to the virtual IP address to the browser.

[0064] Thirdly, embodiments of this application also provide a storage medium for storing an executable program of the security access control method described in any of the first aspects.

[0065] Compared with the prior art, the beneficial effects of the technical solutions provided in the second and third aspects are the same as those in the first aspect, and will not be repeated here.

[0066] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A secure access control method for clients based on domain name acquisition, characterized in that, The method includes: Receive requests for resolving the domain name of the target server sent through the browser; The resolution request is forwarded to the VPN server to determine whether the target server domain name needs to be forwarded through the VPN server. If so, the target server domain name that needs to be forwarded is marked with an identifier by the VPN server. Receive the target server domain name with an identifier sent by the VPN server; Assign a virtual IP address to the browser corresponding to the target server domain name with the identifier, and store the real IP address corresponding to the virtual IP address; Receive the access request initiated by the browser through the virtual IP address; The virtual IP address is restored to its corresponding real IP address. The real IP address and the identifier corresponding to the virtual IP address are sent to the VPN server. The VPN server determines whether the real IP address is the real IP address corresponding to the domain name of the target server to be forwarded. If so, the access request is forwarded to the target server through the VPN server. The target server receives the response result of the access request forwarded by the VPN server; After replacing the real IP address with the corresponding virtual IP address, the response result corresponding to the virtual IP address is returned to the browser; The DNS resolution request is forwarded to the VPN server to determine whether the target server domain name needs to be forwarded through the VPN server. If so, the VPN server marks the target server domain name that needs to be forwarded with an identifier, including: The VPN server stores a forwarding domain policy. The VPN server compares the target server domain name with the forwarding domain policy. If the forwarding domain policy contains the target server domain name, then the domain name needs to be forwarded through the VPN server; otherwise, the domain name does not need to be forwarded through the VPN server. By forwarding domain names through a VPN server, it is possible to verify the domain names of the target servers to be accessed in order to determine which domain names are the target server domain names that the user can access. This enables secure access to the configured target servers through domain names.

2. The secure access control method for clients based on domain name acquisition as described in claim 1, characterized in that, The method further includes: The VPN server sends the resolution request to the domain name resolution server to resolve the real IP address corresponding to the target server domain name.

3. The secure access control method for clients based on domain name acquisition as described in claim 1, characterized in that, The forwarding of the resolution request to the VPN server to determine whether the target server domain name needs to be forwarded through the VPN server includes: The VPN server stores a forwarding domain name policy. The VPN server compares the target server domain name with the forwarding domain name policy. If the forwarding domain name policy contains the target server domain name, then the domain name needs to be forwarded through the VPN server; otherwise, the domain name does not need to be forwarded through the VPN server.

4. The secure access control method for clients based on domain name acquisition as described in claim 1, characterized in that, Before receiving the resolution request for the target server domain name sent through the browser, the process includes: Receive the virtual IP address assigned by the VPN server.

5. The secure access control method for clients based on domain name acquisition as described in claim 1, characterized in that, Before receiving the resolution request for the target server domain name sent through the browser, the method further includes: Configure the forwarding domain name policy on the VPN server and store the forwarding domain name policy on the VPN server.

6. The secure access control method for clients based on domain name acquisition as described in claim 1, characterized in that, After the VPN server marks the target server domain name that needs to be forwarded with an identifier, it includes: The target server domain name to be forwarded and its corresponding identifier are stored on the VPN server.

7. A client for obtaining information based on a domain name, characterized in that, include: The receiving module is used to receive resolution requests for the target server's domain name sent through the browser; The forwarding module is used to forward the resolution request to the VPN server in order to determine whether the target server domain name needs to be forwarded through the VPN server. If so, the VPN server marks the target server domain name that needs to be forwarded with an identifier. The receiving module is also used to receive the target server domain name with an identifier sent by the VPN server; The allocation module is used to allocate a virtual IP address to the browser corresponding to the target server domain name with the identifier, and to store the real IP address corresponding to the virtual IP address; The receiving module is also used to receive access requests initiated by the browser through the virtual IP address; The sending module is used to restore the virtual IP address to its corresponding real IP address, and send the real IP address and the identifier corresponding to the virtual IP address to the VPN server. The VPN server determines whether the real IP address is the real IP address corresponding to the domain name of the target server to be forwarded. If so, the VPN server forwards the access request to the target server. The receiving module is also used to receive the response result of the target server forwarded by the VPN server based on the access request; The return module is used to replace the real IP address with the corresponding virtual IP address and then return the response result corresponding to the virtual IP address to the browser. The DNS resolution request is forwarded to the VPN server to determine whether the target server domain name needs to be forwarded through the VPN server. If so, the VPN server marks the target server domain name that needs to be forwarded with an identifier, including: The VPN server stores a forwarding domain policy. The VPN server compares the target server domain name with the forwarding domain policy. If the forwarding domain policy contains the target server domain name, then the domain name needs to be forwarded through the VPN server; otherwise, the domain name does not need to be forwarded through the VPN server. By forwarding domain names through a VPN server, it is possible to verify the domain names of the target servers to be accessed in order to determine which domain names are the target server domain names that the user can access. This enables secure access to the configured target servers through domain names.

8. A domain name-based client as described in claim 7, characterized in that, The receiving module is also used to receive the virtual IP address assigned by the VPN server.

9. A storage medium, characterized in that, Used to store the executable program of the secure access control method as described in any one of claims 1 to 6.

Images