Domain name security policy configuration method and device for distributed devices

Abstract

This application relates to a method and apparatus for configuring domain name security policies in a distributed device. The method includes: a service board of the distributed device acquiring domain name configuration information; when the domain name configuration information is precise domain name configuration information, the service board activates the security policy corresponding to the precise domain name configuration information; when the domain name configuration information is fuzzy domain name configuration information, the service board sends the fuzzy domain name configuration information to the main control board of the distributed device; the service board periodically sends precise domain name configuration information to the main control board; the main control board matches the fuzzy domain name configuration information with the precise domain name configuration information; and the security policy corresponding to the successfully matched precise domain name configuration information is activated. The domain name security policy configuration method and apparatus for a distributed device disclosed in this application efficiently activates domain name security policies and reduces the number of communications between the service board and the main control board, avoiding channel blockage between the service board and the main control board that could lead to other serious problems.

Description

Technical Field

[0001] This disclosure relates to the field of computer information processing, and more specifically, to a method and apparatus for configuring domain name security policies for distributed devices. Background Technology

[0002] Typically, users only know the domain name of a server on the network, but not its IP address. Therefore, network security devices generally provide methods for configuring security policies based on domain names. In scenarios where policies are based on domain names (such as security policies and bandwidth policies), the device needs to obtain the IP address corresponding to the domain name to effectively filter user traffic.

[0003] With the development of the internet, the number of servers and domain names on the network is increasing. If users were to configure a security policy for each domain, the manpower required for configuration would increase dramatically, leading to higher maintenance costs for network equipment. Therefore, network devices need a method to configure security policies based on fuzzy domain names. For example, for domains like www.baidu.zhidao.com and www.baidu.baike.com, a fuzzy domain name, www.baidu*.com, can be configured, and then a security policy can be configured for this fuzzy domain.

[0004] To improve the processing capabilities of packet forwarding devices, an increasing number of network devices acting as packet forwarding nodes are adopting distributed processing architectures. Distributed processing architectures scale performance horizontally, that is, by increasing the number of parallel processing units with similar functions within the device. Therefore, there is an urgent need in current technology for a method to configure security policies based on fuzzy domain names, and specifically, a method for configuring security policies on distributed devices based on fuzzy domain names.

[0005] The information disclosed in the background section is only intended to enhance the understanding of the background of this application, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0006] In view of this, this application provides a method and apparatus for configuring domain name security policies for distributed devices. The domain name security policies are implemented efficiently, and the number of communications between the service board and the main control board can be reduced, thus avoiding channel blockage between the service board and the main control board that could lead to other serious problems.

[0007] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part from practice of this application.

[0008] According to one aspect of this application, a method for configuring domain name security policies in a distributed device is proposed. The method includes: a service board of the distributed device acquiring domain name configuration information; when the domain name configuration information is precise domain name configuration information, the service board activates the security policy corresponding to the precise domain name configuration information; when the domain name configuration information is fuzzy domain name configuration information, the service board sends the fuzzy domain name configuration information to the main control board of the distributed device; the service board periodically sends precise domain name configuration information to the main control board; the main control board matches the fuzzy domain name configuration information with the precise domain name configuration information; and the security policy corresponding to the successfully matched precise domain name configuration information is activated.

[0009] In one exemplary embodiment of this application, the service board of a distributed device obtains domain name configuration information, including: obtaining access control list information for packet redirection; obtaining domain name configuration information based on the access control list information; and parsing the domain name configuration information.

[0010] In one exemplary embodiment of this application, making the security policy corresponding to the precise domain name configuration information effective includes: obtaining the IP address corresponding to the precise domain name configuration information from a DNS server; and making the security policy corresponding to the precise domain name configuration information effective.

[0011] In one exemplary embodiment of this application, obtaining the IP address corresponding to the precise domain name configuration information by a DNS server includes: sending a DNS request to the DNS server based on the precise domain name configuration information; obtaining the response message of the DNS server based on the DNS request; and parsing the response message to obtain the IP address corresponding to the precise domain name configuration information.

[0012] In one exemplary embodiment of this application, making the security policy corresponding to the precise domain name configuration information effective includes: sending the IP address corresponding to the precise domain name configuration information to the security policy module; and the security policy module applying the security policy based on the IP address.

[0013] In one exemplary embodiment of this application, the service board periodically sends precise domain name configuration information to the main control board, including: based on the dual-table switching function, the service board sends the IP address corresponding to the precise domain name configuration information to the main control board through the timer.

[0014] In one exemplary embodiment of this application, based on the dual-table switching function, the IP address corresponding to the precise domain name configuration information is sent to the main control board via the timer, including: initializing a first linked list and a second linked list, a first pointer and a second pointer; the service board stores the precise domain name configuration information and its corresponding IP address in the linked list pointed to by the first pointer; the service board periodically switches the pointers between the first linked list and the second linked list; and the precise domain name configuration information and its corresponding IP address in the linked list pointed to by the second pointer are sent to the main control board via the inter-board channel.

[0015] In one exemplary embodiment of this application, initializing the first linked list and the second linked list, the first pointer and the second pointer includes: creating the first linked list and the second linked list, the first pointer and the second pointer; initializing the first pointer to point to the first linked list; and initializing the second pointer to an empty address.

[0016] In one exemplary embodiment of this application, sending the precise domain name configuration information and its corresponding IP address in the linked list pointed to by the second pointer to the main control board via the inter-board channel includes: concatenating the precise domain name configuration information and its corresponding IP address in the linked list pointed to by the second pointer to generate a message; and sending the message to the main control board via the inter-board channel.

[0017] According to one aspect of this application, a domain name security policy configuration device for a distributed device is proposed. The device includes: an information module for a service board of the distributed device to obtain domain name configuration information; a precision module for the service board to activate the security policy corresponding to the precision domain name configuration information when the domain name configuration information is precision domain name configuration information; a fuzzy module for the service board to send the fuzzy domain name configuration information to the main control board of the distributed device when the domain name configuration information is fuzzy domain name configuration information; a timing module for the service board to periodically send the precision domain name configuration information to the main control board; a matching module for the main control board to match the fuzzy domain name configuration information and the precision domain name configuration information; and a policy module for activating the security policy corresponding to the successfully matched precision domain name configuration information.

[0018] According to one aspect of this application, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs; and, when the one or more programs are executed by the one or more processors, causing the one or more processors to implement the method as described above.

[0019] According to one aspect of this application, a computer-readable medium is provided having a computer program stored thereon that, when executed by a processor, implements the method described above.

[0020] According to the domain name security policy configuration method and apparatus for distributed devices of this application, domain name configuration information is obtained through the service board of the distributed device; when the domain name configuration information is precise domain name configuration information, the service board enables the security policy corresponding to the precise domain name configuration information to take effect; when the domain name configuration information is fuzzy domain name configuration information, the service board sends the fuzzy domain name configuration information to the main control board of the distributed device; the service board periodically sends the precise domain name configuration information to the main control board; the main control board matches the fuzzy domain name configuration information and the precise domain name configuration information; and the method of enabling the security policy corresponding to the successfully matched precise domain name configuration information is highly efficient in enabling domain name security policies, and can also reduce the number of communications between the service board and the main control board, avoiding channel blockage between the service board and the main control board that could lead to other serious problems.

[0021] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this application. Attached Figure Description

[0022] The above and other objects, features, and advantages of this application will become more apparent from the detailed description of exemplary embodiments with reference to the accompanying drawings. The drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0023] Figure 1 This is a flowchart illustrating a domain name security policy configuration method for a distributed device according to an exemplary embodiment.

[0024] Figure 2 This is a flowchart illustrating a domain name security policy configuration method for a distributed device according to an exemplary embodiment.

[0025] Figure 3 This is a flowchart illustrating a domain name security policy configuration method for a distributed device according to another exemplary embodiment.

[0026] Figure 4 This is a flowchart illustrating a domain name security policy configuration method for a distributed device according to another exemplary embodiment.

[0027] Figure 5 This is a block diagram illustrating a domain name security policy configuration apparatus for a distributed device according to an exemplary embodiment.

[0028] Figure 6 This is a block diagram illustrating an electronic device according to an exemplary embodiment.

[0029] Figure 7 This is a block diagram illustrating a computer-readable medium according to an exemplary embodiment. Detailed Implementation

[0030] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, they are provided so that this application will be thorough and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted.

[0031] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0032] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0033] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0034] It should be understood that although the terms first, second, third, etc., may be used herein to describe various components, these components should not be limited by these terms. These terms are used to distinguish one component from another. Therefore, the first component discussed below may be referred to as the second component without departing from the teachings of this application. As used herein, the term "and / or" includes all combinations of any one and more of the associated listed items.

[0035] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of exemplary embodiments, and the modules or processes in the drawings are not necessarily essential for implementing this application, and therefore cannot be used to limit the scope of protection of this application.

[0036] The technical abbreviations used in this application are explained as follows:

[0037] Distributed devices: To break the computational power limit of a single computer (centralized device), multiple computers are combined into a single device in a certain way (physically or logically). A computationally intensive problem is broken down into multiple subproblems, which are then processed by multiple members of the device. After all subproblems are completed, a final result is merged and returned to the problem submitter. This type of device is called a distributed device, and this computational method is called distributed computing. The computational power of a distributed device is equal to the sum of the computational power of all its member devices (excluding the small amount of performance consumed by internal interactions between member devices), thus significantly improving performance compared to centralized devices. A typical example is a chassis-based device.

[0038] Main control board: Used in chassis-type devices, it controls the normal operation of the entire device, centrally manages the configuration distribution and status display of all boards, and centrally stores all configuration files for the device. The main control board contains a CPU and a CF card for storing configurations, and is used to control the operation of the entire device. The device requires at least one main control board to function properly. Some main control boards include a switching chip.

[0039] Service board: A board specifically designed for handling security services, similar to a firewall service board or a load balancer service board. The configuration of the service board is distributed from the main control board.

[0040] DNS: Short for Domain Name System, it's a core service of the Internet. As a distributed database that maps domain names to IP addresses, it allows people to access the internet more easily without having to remember the IP address strings that machines can directly read. DNS is a tree-structured namespace, and its core function is to translate domain names into IP addresses, using TCP and UDP port 53.

[0041] ACL (Access Control List) is a traffic access control technology that sets a series of entries in the packet forwarding path of network devices (and security devices) to specify packet matching conditions and packet processing actions, thereby enabling specific control over specific packets.

[0042] A domain name, also known as a network domain, is a string of names separated by dots on the Internet, used to identify a computer or group of computers during data transmission (sometimes also referring to geographical location). Because IP addresses are inconvenient to remember and cannot display the name and nature of the address organization, domain names were designed and mapped to IP addresses using the Domain Name System (DNS), making it easier for people to access the Internet without having to remember strings of numbers that can be directly read by machines.

[0043] Timer: A function provided by the operating system that allows a program to execute a segment of code after a specified period of time.

[0044] In view of the technical deficiencies in the prior art, this application proposes a method for configuring domain name security policies for distributed devices. The solution in this application provides a method for configuring security policies for distributed devices based on fuzzy domain names.

[0045] This application can distinguish between precise domain names and fuzzy domain names. Precise domain names enable security policies to take effect promptly by actively sending DNS request messages.

[0046] This application adds a dual-table switching function, allowing the timer to send the domain name and IP mapping relationship learned by the service board to the main control board process, and the service board's protocol stack to resolve DNS messages without interference, enabling simultaneous execution and improving the device's message processing performance. This disclosure addresses... Figure 3 and 4 The purpose of assigning values ​​to current_DNS_list_p and send_DNS_list_p is to allow the protocol stack and timer to use different linked lists, thus enabling the switching between the two lists.

[0047] This application reduces the number of communications between the service board and the main control board by storing the domain name and IP address mapping obtained from DNS message parsing by the protocol stack in a linked list and periodically sending the information to the main control board using a timer. This avoids channel blockage between the service board and the main control board, which could lead to other serious problems. For example, if the service board sends information to the main control board every time it parses a DNS message, a sudden increase in DNS messages would require the service board to send a large number of messages to the main control board, causing channel blockage between the service board and the main control board, and affecting other functions that need to use this channel.

[0048] The content of this application will be described in detail below with the aid of specific embodiments.

[0049] Figure 1This is a flowchart illustrating a domain name security policy configuration method for a distributed device according to an exemplary embodiment. The domain name security policy configuration method 10 for a distributed device includes at least steps S102 to S112.

[0050] like Figure 1 As shown, in S102, the service board of the distributed device obtains domain name configuration information. It can obtain access control list information used for packet redirection; based on the access control list information, the service board of the distributed device obtains domain name configuration information; and parses the domain name configuration information.

[0051] In S104, when the domain name configuration information is precise domain name configuration information, the service board makes the security policy corresponding to the precise domain name configuration information effective. The IP address corresponding to the precise domain name configuration information can be obtained from the DNS server; thus, the security policy corresponding to the precise domain name configuration information becomes effective.

[0052] In one embodiment, for example, a DNS request may be sent to a DNS server based on the precise domain name configuration information; a response message from the DNS server may be obtained based on the DNS request; and the response message may be parsed to obtain the IP address corresponding to the precise domain name configuration information.

[0053] In one embodiment, for example, the IP address corresponding to the precise domain name configuration information may be sent to the security policy module; the security policy module applies the security policy based on the IP address.

[0054] The method described in this application can distinguish between precise domain names and fuzzy domain names. For precise domain names, the security policy can take effect in a timely manner by actively sending DNS request messages.

[0055] In S106, when the domain name configuration information is fuzzy domain name configuration information, the service board sends the fuzzy domain name configuration information to the main control board of the distributed device.

[0056] In S108, the service board periodically sends precise domain name configuration information to the main control board. Based on the dual-table switching function, the service board can send the IP address corresponding to the precise domain name configuration information to the main control board via the timer.

[0057] In one embodiment, for example, a first linked list and a second linked list, a first pointer and a second pointer may be initialized; the service board stores the precise domain name configuration information and its corresponding IP address in the linked list pointed to by the first pointer; the service board periodically switches the pointers between the first linked list and the second linked list; and the precise domain name configuration information and its corresponding IP address in the linked list pointed to by the second pointer are sent to the main control board through the inter-board channel.

[0058] More specifically, a first linked list and a second linked list, a first pointer and a second pointer can be created; the first pointer is initialized to point to the first linked list; the second pointer is initialized to an empty address.

[0059] This application adds a dual-table switching function, allowing the timer to send the domain name and IP mapping relationship learned by the service board to the main control board process, and the service board protocol stack to resolve DNS messages without interfering with each other, so that they can be carried out simultaneously, thus improving the device's message processing performance.

[0060] This application saves the domain name and IP address mapping obtained by the protocol stack from resolving DNS messages into a linked list, and sends the information to the main control board periodically through a timer, thereby reducing the number of communications between the service board and the main control board and avoiding channel blockage between the service board and the main control board that could lead to other serious problems.

[0061] More specifically, the precise domain name configuration information in the linked list pointed to by the second pointer and its corresponding IP address can be concatenated to generate a message; the message can then be sent to the main control board through the inter-board channel.

[0062] In S110, the main control board matches the fuzzy domain name configuration information with the precise domain name configuration information.

[0063] More specifically, after receiving the precise domain name and IP address information, the master controller performs domain name matching based on the fuzzy domain name previously saved by the kernel. If the matching fails, the received precise domain name and IP address information is ignored. If the matching is successful, the IP address is sent to the security policy module, so that the security policy module can apply the corresponding security policy based on the IP address.

[0064] In S112, the security policy corresponding to the successfully matched precise domain name configuration information will be applied.

[0065] According to the domain name security policy configuration method for distributed devices in this application, domain name configuration information is obtained through the service board of the distributed device; when the domain name configuration information is precise domain name configuration information, the service board enables the security policy corresponding to the precise domain name configuration information to take effect; when the domain name configuration information is fuzzy domain name configuration information, the service board sends the fuzzy domain name configuration information to the main control board of the distributed device; the service board periodically sends the precise domain name configuration information to the main control board; the main control board matches the fuzzy domain name configuration information with the precise domain name configuration information; and the method of enabling the security policy corresponding to the successfully matched precise domain name configuration information is highly efficient in enabling domain name security policies, and can also reduce the number of communications between the service board and the main control board, avoiding channel blockage between the service board and the main control board that could lead to other serious problems.

[0066] Figure 2This is a flowchart illustrating a domain name security policy configuration method for a distributed device according to an exemplary embodiment. The domain name security policy configuration method 20 for a distributed device includes at least steps S202 to S208.

[0067] like Figure 2 As shown, in S202, the configuration terminal issues the configuration.

[0068] In one embodiment, for example, an ACL (Acceptance Decision Clause) could be issued to redirect all DNS packets to the service board CPU. After the ACL takes effect, all DNS packets passing through the current device will be sent to the service board CPU for processing. During the service board CPU's processing, which is a system software process, DNS packets can be resolved within this process. If the ACL is not issued, the DNS packets will be directly forwarded by the switching chip, which is hardware and cannot resolve DNS packets.

[0069] In one embodiment, for example, a security policy based on a domain name can be issued on a configuration terminal such as a web page or command line to determine whether the domain name is an exact domain name or a fuzzy domain name.

[0070] In S204, determine whether it is a fuzzy domain name.

[0071] In S206, the fuzzy domain name rules are saved to the kernel. If it is a fuzzy domain name, the fuzzy domain name is sent to the main control board kernel for storage. The fuzzy domain name usually contains one or more wildcards like '*'. The device can use the obtained precise domain name to match the fuzzy domain name to determine whether the precise domain name meets the matching conditions of the fuzzy domain name.

[0072] In S208, a DNS request message is sent.

[0073] In S210, a response message is received.

[0074] In S212, the response message is resolved. If it is an exact domain name (e.g., www.baidu.com), the device actively sends a DNS request message to the DNS server to request the IP address of www.baidu.com. The device will receive a DNS response message returned by the DNS server, and resolving this DNS response message will obtain the IP address corresponding to the www.baidu.com domain name.

[0075] In S214, the security policy takes effect.

[0076] For example, the IP address obtained from resolving the DNS message can be sent to the security policy module, so that the security policy module can apply the corresponding security policy based on the IP address.

[0077] In S216, the process ends.

[0078] It should be clearly understood that this application describes how specific examples are formed and used, but the principles of this application are not limited to any details of these examples. Rather, based on the teachings of the disclosure of this application, these principles can be applied to many other embodiments.

[0079] Figure 3 This is a flowchart illustrating a domain name security policy configuration method for a distributed device according to another exemplary embodiment. Figure 3 The process shown in step 30 is a detailed description of the process by which the service board receives messages.

[0080] like Figure 3 As shown, a DNS message is received in S302.

[0081] In one embodiment, two linked lists can be added to the service board side, namely the first linked list: DNS_list_a and the second linked list: DNS_list_b. A first linked list pointer: current_DNS_list_p is added, which is initialized to point to the linked list DNS_list_a (that is, current_DNS_list_p is assigned the memory address of the linked list DNS_list_a). A second linked list pointer: send_DNS_list_p is added, which is initialized to an invalid address NULL.

[0082] In S304, DNS messages are resolved to obtain domain names and IP addresses.

[0083] In S306, the data is saved to the linked list pointed to by the first pointer. The service board CPU protocol stack's message receiving process determines whether the received message is a DNS message based on whether the protocol port is port 53. If a DNS message is received, it is parsed to obtain the exact domain name and IP address mapping. This exact domain name and IP address information is then saved to the linked list pointed to by the linked list pointer current_DNS_list_p. If current_DNS_list_p points to the linked list DNS_list_a, the relevant information is saved to the linked list DNS_list_a.

[0084] In S308, the DNS message is forwarded.

[0085] Figure 4 This is a flowchart illustrating a domain name security policy configuration method for a distributed device according to another exemplary embodiment. Figure 4 The process shown in Flow 40 is a detailed description of the execution process of the timer on the service board.

[0086] like Figure 4As shown, in S402, the timer process begins. A timer can be started in the kernel on the service board side, and the timer period can be set to execute once every 30 seconds, for example.

[0087] In S404, the first pointer is assigned to the second pointer. When the timer is triggered, current_DNS_list_p can be assigned to send_DNS_list_p, that is, send_DNS_list_p = current_DNS_list_p. At this time, the send_DNS_list_p and current_DNS_list_p pointers are equal.

[0088] In S406, it is determined whether the first pointer points to the first linked list. For example, it is determined whether current_DNS_list_p points to DNS_list_a. If it points to DNS_list_a, then current_DNS_list_p is assigned the value of DNS_list_b; otherwise, it is assigned the value of DNS_list_a. At this point, send_DNS_list_p and current_DNS_list_p are not equal; one points to the linked list DNS_list_a, and the other points to DNS_list_b.

[0089] In S408, the first linked list is assigned to the second linked list.

[0090] In S410, the value is assigned to the first linked list.

[0091] In S412, the domain names and IP addresses stored in the linked list pointed to by the second pointer are sent to the master controller. The service board continues to use the inter-board channel between the service board and the master controller to concatenate all the precise domain name and IP address information in the linked list pointed to by the send_DNS_list_p pointer into a single message, and send it to the master controller. After sending, all the precise domain name and IP address information in the linked list pointed to by the send_DNS_list_p pointer are released.

[0092] In S414, the current timer process has been completed.

[0093] Those skilled in the art will understand that all or part of the steps of the above embodiments are implemented as a computer program executed by a CPU. When the computer program is executed by the CPU, it performs the functions defined by the method provided in this application. The program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk, or an optical disk.

[0094] Furthermore, it should be noted that the above figures are merely illustrative representations of the processes included in the method according to exemplary embodiments of this application, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0095] The following are embodiments of the apparatus described in this application, which can be used to execute the embodiments of the method described in this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the method described in this application.

[0096] Figure 5 This is a block diagram illustrating a domain name security policy configuration apparatus for a distributed device according to an exemplary embodiment. Figure 5 As shown, the domain name security policy configuration device 50 for distributed devices includes: an information module 502, a precise module 504, a fuzzy module 506, a timing module 508, a matching module 510, and a policy module 512.

[0097] The information module 502 is used for the service board of the distributed device to obtain domain name configuration information; to obtain access control list information for packet redirection; the information module 502 is also used for the service board of the distributed device to obtain domain name configuration information based on the access control list information; and to parse the domain name configuration information.

[0098] The precision module 504 is used by the service board to make the security policy corresponding to the precision domain name configuration information take effect when the domain name configuration information is precision domain name configuration information; the precision module 504 is also used to obtain the IP address corresponding to the precision domain name configuration information from the DNS server; so that the security policy corresponding to the precision domain name configuration information takes effect.

[0099] The fuzzy module 506 is used by the service board to send the fuzzy domain name configuration information to the main control board of the distributed device when the domain name configuration information is fuzzy domain name configuration information;

[0100] The timing module 508 is used by the service board to send precise domain name configuration information to the main control board at regular intervals; the timing module 508 is also used by the service board to send the IP address corresponding to the precise domain name configuration information to the main control board through the timer based on the dual table switching function.

[0101] The matching module 510 is used by the main control board to match the fuzzy domain name configuration information and the precise domain name configuration information;

[0102] Policy module 512 is used to apply the security policy corresponding to the matched precise domain name configuration information.

[0103] According to the domain name security policy configuration device for distributed devices of this application, domain name configuration information is obtained through the service board of the distributed device; when the domain name configuration information is precise domain name configuration information, the service board enables the security policy corresponding to the precise domain name configuration information to take effect; when the domain name configuration information is fuzzy domain name configuration information, the service board sends the fuzzy domain name configuration information to the main control board of the distributed device; the service board periodically sends precise domain name configuration information to the main control board; the main control board matches the fuzzy domain name configuration information and the precise domain name configuration information; and the method of enabling the security policy corresponding to the successfully matched precise domain name configuration information is highly efficient in enabling domain name security policies, and can also reduce the number of communications between the service board and the main control board, avoiding channel blockage between the service board and the main control board that could lead to other serious problems.

[0104] Figure 6 This is a block diagram illustrating an electronic device according to an exemplary embodiment.

[0105] The following reference Figure 6 To describe an electronic device 600 according to this embodiment of the present application. Figure 6 The electronic device 600 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0106] like Figure 6 As shown, the electronic device 600 is presented in the form of a general-purpose computing device. The components of the electronic device 600 may include, but are not limited to: at least one processing unit 610, at least one storage unit 620, a bus 630 connecting different system components (including storage unit 620 and processing unit 610), a display unit 640, etc.

[0107] The storage unit stores program code that can be executed by the processing unit 610, causing the processing unit 610 to perform the steps described in this specification according to various exemplary embodiments of this application. For example, the processing unit 610 can perform actions such as... Figure 1 , Figure 2 , Figure 3 , Figure 4 The steps are shown in the figure.

[0108] The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 6201 and / or a cache storage unit 6202, and may further include a read-only memory unit (ROM) 6203.

[0109] The storage unit 620 may also include a program / utility 6204 having a set (at least one) program module 6205, such program module 6205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0110] Bus 630 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0111] Electronic device 600 can also communicate with one or more external devices 600' (e.g., keyboard, pointing device, Bluetooth device, etc.), enabling users to communicate with devices that interact with electronic device 600, and / or any device that allows electronic device 600 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 650. Furthermore, electronic device 600 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 660. Network adapter 660 can communicate with other modules of electronic device 600 via bus 630. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0112] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software, or by combining software with necessary hardware. Therefore, as... Figure 7 As shown, the technical solution according to the embodiments of this application can be embodied in the form of a software product. The software product can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, mobile hard drive, etc.) or on a network, and includes several instructions to cause a computing device (such as a personal computer, server, or network device, etc.) to execute the above-described method according to the embodiments of this application.

[0113] The software product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0114] The computer-readable storage medium may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0115] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0116] The aforementioned computer-readable medium carries one or more programs. When these programs are executed by a device, the computer-readable medium performs the following functions: the service board of the distributed device obtains domain name configuration information; when the domain name configuration information is precise domain name configuration information, the service board makes the security policy corresponding to the precise domain name configuration information effective; when the domain name configuration information is fuzzy domain name configuration information, the service board sends the fuzzy domain name configuration information to the main control board of the distributed device; the service board periodically sends precise domain name configuration information to the main control board; the main control board matches the fuzzy domain name configuration information and the precise domain name configuration information; and the security policy corresponding to the successfully matched precise domain name configuration information is effective.

[0117] Those skilled in the art will understand that the above modules can be distributed in the device as described in the embodiments, or they can be modified accordingly and placed in one or more devices that are unique to this embodiment. The modules in the above embodiments can be combined into one module, or they can be further divided into multiple sub-modules.

[0118] Through the description of the above embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this application.

[0119] Exemplary embodiments of this application have been specifically shown and described above. It should be understood that this application is not limited to the detailed structures, arrangements, or implementation methods described herein; rather, this application is intended to cover various modifications and equivalent arrangements contained within the spirit and scope of the appended claims.

Claims

1. A method for configuring domain name security policies for distributed devices, characterized in that, include: The service board of the distributed device obtains domain name configuration information; When the domain name configuration information is precise domain name configuration information, the service board enables the security policy corresponding to the precise domain name configuration information to take effect; When the domain name configuration information is fuzzy domain name configuration information, the service board sends the fuzzy domain name configuration information to the main control board of the distributed device; The service board periodically sends precise domain name configuration information to the main control board. The main control board matches the fuzzy domain name configuration information with the precise domain name configuration information; The security policy corresponding to the accurately matched domain name configuration information will be applied.

2. The method as described in claim 1, characterized in that, The service board of the distributed device obtains domain name configuration information, including: Obtain access control list information used for message redirection; Based on the access control list information, the service board of the distributed device obtains the domain name configuration information; The domain name configuration information is parsed.

3. The method as described in claim 1, characterized in that, To make the security policy corresponding to the precise domain name configuration information effective, the following are included: The IP address corresponding to the precise domain name configuration information is obtained from the DNS server; This enables the security policy corresponding to the precise domain name configuration information to take effect.

4. The method as described in claim 3, characterized in that, The IP address corresponding to the precise domain name configuration information is obtained from the DNS server, including: A DNS request is sent to the DNS server based on the precise domain name configuration information; Obtain the response message from the DNS server based on the DNS request; The response message is parsed to obtain the IP address corresponding to the precise domain name configuration information.

5. The method as described in claim 3, characterized in that, To make the security policy corresponding to the precise domain name configuration information effective, the following are included: Send the IP address corresponding to the precise domain name configuration information to the security policy module; The security policy module applies security policies based on the IP address.

6. The method as described in claim 1, characterized in that, The service board periodically sends precise domain name configuration information to the main control board, including: Based on the dual-table switching function, the service board sends the IP address corresponding to the precise domain name configuration information to the main control board through the timer.

7. The method as described in claim 6, characterized in that, Based on the dual-table switching function, the timer sends the IP address corresponding to the precise domain name configuration information to the main control board, including: Initialize the first linked list and the second linked list, as well as the first pointer and the second pointer; The service board stores the precise domain name configuration information and its corresponding IP address in the linked list pointed to by the first pointer; The business board periodically switches pointers between the first and second linked lists. The precise domain name configuration information and its corresponding IP address in the linked list pointed to by the second pointer are sent to the main control board via the inter-board channel.

8. The method as described in claim 7, characterized in that, Initialize the first linked list and the second linked list, the first pointer and the second pointer, including: Create a first linked list and a second linked list, as well as a first pointer and a second pointer; The first pointer is initialized to point to the first linked list; The second pointer is initialized to a null address.

9. The method as described in claim 7, characterized in that, The precise domain name configuration information and its corresponding IP address in the linked list pointed to by the second pointer are sent to the main control board via the inter-board channel, including: The precise domain name configuration information and its corresponding IP address in the linked list pointed to by the second pointer are concatenated to generate a message; The message is sent to the main control board through the inter-board channel.

10. A domain name security policy configuration device for a distributed device, characterized in that, include: The information module is used by the service boards of distributed devices to obtain domain name configuration information. The precision module is used by the service board to make the security policy corresponding to the precision domain configuration information take effect when the domain configuration information is precision domain configuration information; The fuzzy module is used by the service board to send the fuzzy domain name configuration information to the main control board of the distributed device when the domain name configuration information is fuzzy domain name configuration information; The timing module is used by the service board to send precise domain name configuration information to the main control board at regular intervals; The matching module is used by the main control board to match the fuzzy domain name configuration information with the precise domain name configuration information; The policy module is used to apply the security policy corresponding to the matched precise domain name configuration information.

Images