A domain name resolution method suitable for mobile target defense

Abstract

The application discloses a domain name resolution method suitable for mobile target defense, and comprises the following steps: 1) a domain name system continuous updating device random address flow; 2) an identity authentication-oriented key negotiation flow; 3) a network device identity authentication flow; 4) a network device random address obtaining flow of a communication opposite end device; and 5) a network communication flow. The method can realize convenient authentication and security protection of internet devices, and help to improve the security of next-generation internet devices on the basis of guaranteeing the security of the internet.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security, specifically a domain name resolution method suitable for defending against mobile targets. Background Technology

[0002] With the widespread adoption of 5G technology, and under the coordination of the International Telecommunication Union (ITU), China established the IMT-2030 (6G) Promotion Group in 2022 to conduct 6G technology research and development trials for future development. As the next generation of digital information infrastructure, 6G technology possesses several key features, including ubiquitous connectivity, multi-dimensional sensing, and full-area coverage, enabling it to deeply serve various aspects of production and daily life. According to market forecasts released by the IMT-2030 Promotion Group, the number of 6G terminal connections is expected to reach 121.6 billion by 2040, including approximately 33 billion IoT terminals for daily life and 88 billion for industrial production. However, like 5G IoT, 6G IoT faces numerous cybersecurity challenges, such as network scanning, distributed denial-of-service attacks, and advanced persistent threat (APS) attacks. Therefore, 6G IoT requires next-generation cybersecurity defense technologies to support the implementation of intrinsic security, a key technology in 6G innovation, thereby improving overall network security.

[0003] While common firewalls, intrusion detection systems, and recently emerged security systems based on generative pre-trained transformers (GPT) can address cybersecurity challenges facing the future internet to some extent, they still struggle to cope with persistent nation-state cyber threats. Therefore, the U.S. National Science and Technology Council proposed using Moving Target Defense (MTD) to mitigate these cybersecurity threats. MTD is primarily applied to network-level security, dynamically changing network addresses to make it difficult for attackers to locate target devices, thus effectively mitigating security threats faced by IoT devices. Furthermore, MTD can compensate for the inability to manage the security of public networks. Previous research has demonstrated that MTD's protective effectiveness in IPv6 networks is exponentially higher than that in IPv4 networks. Therefore, mobile defense technology is suitable for use in the Internet where IPv6 technology is widely used, in order to ensure Internet security.

[0004] However, while moving targets can effectively change network addresses, numerous practical application issues remain. For example, existing research on moving target defense technology primarily focuses on how to efficiently and randomly move protected devices and how to improve the effectiveness of randomization. There is little research on the convenient communication between protected devices and devices in unprotected areas during practical applications. This results in the inability of current IoT devices to use addressing methods such as the Domain Name System (DNS), making it difficult for frequently moving Internet devices to communicate with devices protected by moving target defense technology. This significantly hinders the application of moving target defense security technology in next-generation networks. Therefore, solving the problem of Internet device address location after using moving target defense technology becomes a dynamic security challenge in the next-generation Internet.

[0005] Mobile target defense is an emerging technology for effectively addressing cybersecurity threats, and domain name resolution is indispensable for adapting to the next-generation Internet. However, there is currently limited research on readily deployable domain name systems based on mobile target defense technology, and related technologies are still in the early stages of research. One method proposed by Wang et al. is RDAM (random domain name and address mutation). This method dynamically changes the host's IP address and domain name through an SDN architecture. Before a client can connect to the service, it must first request the correct domain name, thus improving the defense effectiveness against network probing and scanning. However, RDAM requires special configuration on the client side to take effect, reducing its practicality. Another method proposed by Li et al. uses a DHCP server to synchronize dynamically changing IP addresses to a DNS server, providing a method for querying the domain name of the protected device to locate the device protected by mobile target defense technology. However, Li et al.'s method lacks security authentication; once a network attacker obtains the domain name used by the device, they can continuously query the DNS server to obtain the latest dynamic address of the device.

[0006] To address the security issues of DNS services, Song et al. and Hyder et al. have proposed a method of periodically and dynamically changing DNS ports based on software-defined networking (SDN) to enhance the privacy protection capabilities of DNS services. While port changing can alleviate the problem of DNS eavesdropping to some extent, the port changing space involved in network-level methods is limited to only 64511, making it less resistant to rapid network scanning and deep packet inspection based on artificial intelligence. Furthermore, technologies such as DNS over HTTPS (DoH) based on Secure Sockets Layer can also ensure the security of DNS transmission to some extent; however, standard DNS services lack the ability to verify clients. Furthermore, regarding DNS authentication and verification issues, Hu et al. and Zhang et al. proposed using blockchain technology to enhance DNS security. However, due to the performance bottleneck of blockchain, the execution time is relatively large. Faced with the problem of balancing performance and security, Hasegawa et al. proposed using a whitelist method to deal with distributed denial-of-service attacks. Krahenbuhl et al. proposed a lightweight security authentication method for services such as DNS through extension. Analyzing these methods can provide ideas for solving the problem of balancing security and performance.

[0007] Therefore, ensuring network security protection effectiveness while improving DNS service performance is a crucial goal of DNS service optimization. Regarding DNS performance issues, Ahmad et al. proposed using multiple network ports to implement load balancing across network links. This method utilizes dynamically allocated interfaces to access multiple different DNS servers, optimizing query performance. However, Ahmad et al.'s method is a stopgap measure; further optimization of the DNS cache design is needed for better results. Additionally, YANG et al.'s research on caching algorithms shows that LRU caching only demonstrates advantages when cache size is severely limited, providing a reference for DNS resolver design. Furthermore, Liu Wenfeng et al.'s research concluded that cache hit rate follows a logarithmic distribution with TTL value. This conclusion implies that for frequent DNS record updates common in mobile target defense, using a cache of a certain size can effectively increase DNS service performance. However, Liu Wenfeng et al.'s research report also reflects that DNS caching algorithms have not differed much in recent years due to their focus on generalized scenarios, and no researchers have conducted updated research on them for many years. Therefore, cache design related to cache entry lifetime in mobile target defense needs to refer to other relevant research directions.

[0008] In research on time-limited entry caching, Kim et al. proposed a mobile edge computing caching system that achieves low-latency and high-bandwidth content access and provides seamless 4K ultra-high-definition video streaming by pre-caching content on edge servers in cellular networks. Kim et al.'s method shares some similarities with the need for timely updates of cached content after the passage of time in mobile target defense, and can provide a reference for the design of this technical solution. Al-Abbasi et al. proposed a method called TTLCache, which periodically removes long-unused elements from the cache to improve cache performance. Analysis of TTLCache by Al-Abbasi et al. shows that periodically updating elements within the cache can improve processing efficiency. Furthermore, Chen et al. proposed a wireless edge caching system that uses dynamic deletion of expired content to free up storage resources for future content needs within limited space. Analysis of literature on time-limited caching reveals that there is currently no caching method perfectly suited for DNS records used in mobile target defense; therefore, caching methods need to be extended to meet the requirements of the Domain Name System for mobile target defense.

[0009] Furthermore, Huang Xiaoyong's patent on address translation processing method and device primarily addresses the time difference that occurs between translation devices after using mobile target defense technology. This method solves the problem of data packets being lost at the terminal due to the use of old addresses, rather than directly providing network security services. Current mobile target defense technology randomizes device addresses, which makes it difficult for other devices to access them. Additionally, existing Domain Name System (DNS) technology does not consider the need for authentication before DNS queries, thus failing to meet the requirement that randomized addresses are only provided to authorized devices for querying.

[0010] The purpose of this invention is to address the shortcomings of existing technologies by providing a domain name resolution method suitable for mobile target defense. This method, while ensuring internet network security, enables convenient authentication and security protection for internet devices, and helps improve the security of next-generation internet devices.

[0011] The technical solution to achieve the objective of this invention is:

[0012] A domain name resolution method for mobile target defense includes a domain name system network for mobile target defense. The domain name system network for mobile target defense includes an unprotected zone and a protected zone, wherein the unprotected zone and the protected zone are connected via the Internet. The unprotected zone is equipped with network devices and a set of routers for forwarding data packets. After the routers are physically connected, data packets sent by the network devices in the unprotected zone are transmitted to the Internet via the routers in that zone. The protected zone is equipped with network devices, a set of routers supporting mobile target defense, and a domain name system for mobile target defense, MTDDNS (Moving Target Defense Domain Name System). The network devices are connected to the routers supporting mobile target defense, and the routers supporting mobile target defense are connected to the Internet and to the domain name system for mobile target defense. The network devices in the unprotected zone communicate with the network devices in the protected zone via the Internet. The method is characterized by the following steps:

[0013] 1) Domain Name System (DNS) Continuous Update of Device Random Addresses: Upon system startup, the DNS continuously updates device random addresses process, which requires frequent updates and is time-consuming, to ensure that the random addresses recorded in the DNS record database are up-to-date. This facilitates service provision for other processes. Specifically:

[0014] 1-1) First, the mobile target defense system periodically collects valid random addresses of the network devices under its jurisdiction;

[0015] 1-2) The moving target defense system checks whether there are any newly appearing random addresses in the currently collected valid random addresses. If no new random addresses appear, it continues to wait for a period of time and then continues to collect, and jumps to step 1-1); if a new random address appears in the currently collected valid random addresses, it proceeds to step 1-3).

[0016] 1-3) The mobile target defense system encapsulates newly collected random addresses for easy push notification;

[0017] 1-4) The mobile target defense system periodically pushes new valid random addresses to the Domain Name System;

[0018] 1-5) After the Domain Name System obtains a new valid random address, it saves the address information to the database and deletes expired records in the database at the same time;

[0019] 2) Key negotiation process for identity authentication: To ensure that only authorized network devices can obtain the random address of network devices using the moving target defense technology, identity authentication is required first. Before identity authentication, an identity authentication key negotiation process must be executed, specifically as follows:

[0020] 2-1) The Domain Name System (MTDDNS) for mobile target defense generates authentication keys;

[0021] 2-2) Network devices share keys with the Domain Name System (MTDDNS) for mobile target defense using standard cryptographic methods;

[0022] 2-3) The network device obtains the authentication key and saves it to the network device's storage area;

[0023] 3) Network Device Authentication Process: To address the issue of network devices requiring authorization before obtaining the random address of devices protected by the mobile target defense technology, a network device authentication process is required, specifically:

[0024] 3-1) The network device checks the validity of the authentication key. If no valid authentication key is found, proceed to step 2) to obtain a valid authentication key; if the check result is that the key is valid, proceed to the next step.

[0025] 3-2) Load a valid authentication key from the network device storage area in step 2-3);

[0026] 3-3) Using the currently loaded authentication key, the network address of the network device and the system time are combined and encrypted to complete the preprocessing of the identity authentication string;

[0027] 3-4) According to the domain name query standard, the identity authentication string is encapsulated into a compliant domain name, and any domain name that has been registered with the domain name service provider is added to the end of the string so that the sent identity authentication domain name can be received by the Domain Name System MTDDNS applicable to mobile target defense;

[0028] 3-5) The network device sends the encapsulated identity authentication domain name to MTDDNS;

[0029] 3-6) MTDDNS identifies the received authentication domain name query request. If it confirms that the current DNS query is an authentication query request, it authenticates the current network device. If the authentication fails, it marks the authentication as failed and sends a message to prompt the network device to re-authenticate, while proceeding to step 3-3). If the authentication is successful, it marks the authentication as successful and proceeds to step 3-7).

[0030] 3-7) MTDDNS stores the identifier of the network device that has completed authentication in the database for use in the process of obtaining a random address;

[0031] 4) Network device obtains random address of communication peer device: The process of network device obtaining random address of communication target device is a core part of the Domain Name System (DNS) for mobile target defense, used to provide address resolution services, specifically as follows:

[0032] 4-1) First, MTDDNS, in conjunction with the data stored in step 3-7), checks whether the current network device has completed authentication. If authentication has not been completed, it proceeds to step 3) to perform authentication. If the current device has completed authentication, it proceeds to step 4-2).

[0033] 4-2) The network device sends the domain name of the protected device that needs to be queried to MTDDNS;

[0034] 4-3) MTDDNS resolves DNS queries sent by network devices, associates them with the updated MTDDNS database in steps 1-5, and retrieves the corresponding domain name information from it;

[0035] 4-4) MTDDNS retrieves the query results from the database. If the query fails, it notifies the network device to perform the domain name query again, proceeding to step 4-2). If the query succeeds, it proceeds to step 4-5.

[0036] 4-5) MTDDNS retrieves the random address of the queried network device from the database and returns it to the network device that initiated the DNS query;

[0037] 4-6) After receiving the domain name resolution data returned by MTDDNS, the network device that initiated the DNS query stores the resolution data and sets the validity period corresponding to the currently obtained random address according to the lifespan marked in the resolution data;

[0038] 5) Network communication process: including:

[0039] 5-1) When a network device begins network communication with a network device protected by the mobile target defense technology, it first checks whether the currently stored random address resolution record of the protected device is valid. If it is not valid, proceed to step 4); if it is valid, proceed to step 5-2).

[0040] 5-2) The network device extracts the random address corresponding to the protected network device obtained in step 4-6);

[0041] 5-3) Network devices and protected devices communicate using currently valid random addresses;

[0042] 5-4) The network device periodically checks whether the validity period of the random address record of the protected device has expired. If it has expired, proceed to step 5-1; if it has not expired, continue to step 5-3 if communication is still required; if communication ends, proceed to step 5-5.

[0043] 5-5) After the network device completes communication with the protected device, it reclaims the relevant occupied resources to reduce the pressure on the device.

[0044] This technical solution primarily addresses the device addressing problem after mobile target defense. Compared to Huang Xiaoyong's address translation method, this solution does not employ the "using the old translation mechanism if the translation conditions are not met" approach mentioned in that invention. Instead, this solution directly enters the rejection translation process when the initial authentication is not met, offering the following advantages:

[0045] 1. Without requiring additional modifications to the network device's system configuration, authentication can be performed, and on this basis, the addressing of devices using mobile target defense technology can be achieved. The Domain Name System applicable to mobile target defense uses DNS lookup methods to authenticate DNS clients before the device begins DNS lookup, in order to solve the problem of unauthorized clients illegally obtaining the mobile target defense randomized address of the target device after using DNS services to perform DNS lookup. This ensures the security of the use of mobile target defense randomized address, improves the application system applicable to mobile target defense, and enables the prerequisite for the application of mobile target defense technology in the next generation Internet.

[0046] 2. The mobile target defense query method can support addressing of devices protected by mobile target defense technology, thereby effectively solving the problem of external device addressing difficulties faced by mobile target defense technology after address changes are random, and providing basic support for the application of mobile target defense technology in the next generation Internet;

[0047] 3. A database-based method for storing DNS records with time-of-validity randomization is adopted, which can support the use of DNS record changes in mobile target defense scenarios. Traditional DNS services mainly use query-optimized data storage methods, which have high overhead for frequent data structure modifications. This technical solution adopts a database-based method for storing DNS records with time-of-validity randomization to enable efficient addition and modification of DNS server records.

[0048] This method is used to achieve convenient authentication and security protection for Internet devices while ensuring Internet network security, and helps improve the security of next-generation Internet devices. Attached Figure Description

[0049] Figure 1This is a schematic diagram of the Domain Name System network architecture applicable to mobile target defense in the embodiment;

[0050] Figure 2 The following is a flowchart and related diagram of the network device communication, the network device obtaining the random address of the communication peer device, the network device authentication, the key negotiation for authentication, and the domain name system continuously updating the random address of the device in the embodiment.

[0051] Figure 3 This is a schematic diagram of the communication process for obtaining the IP address corresponding to the domain name using the method in this embodiment. Implementation

[0052] The present invention will be further described below with reference to the accompanying drawings and embodiments, but this is not intended to limit the scope of the invention. Example

[0053] Reference Figure 2 , Figure 3 A domain name resolution method suitable for mobile target defense, including, for example Figure 1 The illustrated Domain Name System (DNS) network for mobile target defense includes an unprotected zone and a protected zone. The unprotected zone and the protected zone are connected via the Internet. The unprotected zone is equipped with network devices and a set of routers for forwarding data packets. After the routers are physically connected, data packets sent by the network devices in the unprotected zone are transmitted to the Internet via the routers in that zone. The protected zone is equipped with network devices, a set of routers supporting mobile target defense, and a DNS system (MTDDNS) for mobile target defense. The network devices are connected to the routers supporting mobile target defense, and the routers supporting mobile target defense are connected to the Internet and the DNS system for mobile target defense. The network devices in the unprotected zone communicate with the network devices in the protected zone via the Internet. The method is characterized by the following steps:

[0054] 1) Domain Name System (DNS) Continuous Update of Device Random Addresses: Upon system startup, the DNS continuously updates device random addresses process, which requires frequent updates and is time-consuming, to ensure that the random addresses recorded in the DNS record database are up-to-date. This facilitates service provision for other processes. Specifically:

[0055] 1-1) First, the mobile target defense system periodically collects valid random addresses of the network devices under its jurisdiction;

[0056] 1-2) The moving target defense system checks whether there are any newly appearing random addresses in the currently collected valid random addresses. If no new random addresses appear, it continues to wait for a period of time and then continues to collect, and jumps to step 1-1); if a new random address appears in the currently collected valid random addresses, it proceeds to step 1-3).

[0057] 1-3) The mobile target defense system encapsulates newly collected random addresses for easy push notification;

[0058] 1-4) The mobile target defense system periodically pushes new valid random addresses to the Domain Name System;

[0059] 1-5) After the Domain Name System obtains a new valid random address, it saves the address information to the database and deletes expired records in the database at the same time;

[0060] 2) Key negotiation process for identity authentication: To ensure that only authorized network devices can obtain the random address of network devices using the moving target defense technology, identity authentication is required first. Before identity authentication, an identity authentication key negotiation process must be executed, specifically as follows:

[0061] 2-1) The Domain Name System (MTDDNS) for mobile target defense generates authentication keys;

[0062] 2-2) Network devices share keys with the Domain Name System (MTDDNS) for mobile target defense using standard cryptographic methods;

[0063] 2-3) The network device obtains the authentication key and saves it to the network device's storage area;

[0064] 3) Network Device Authentication Process: To address the issue of network devices requiring authorization before obtaining the random address of devices protected by the mobile target defense technology, a network device authentication process is required, specifically:

[0065] 3-1) The network device checks the validity of the authentication key. If no valid authentication key is found, proceed to step 2) to obtain a valid authentication key; if the check result is that the key is valid, proceed to the next step.

[0066] 3-2) Load a valid authentication key from the network device storage area in step 2-3);

[0067] 3-3) Using the currently loaded authentication key, the network address of the network device and the system time are combined and encrypted to complete the preprocessing of the identity authentication string;

[0068] 3-4) According to the domain name query standard, the identity authentication string is encapsulated into a compliant domain name, and any domain name that has been registered with the domain name service provider is added to the end of the string so that the sent identity authentication domain name can be received by the Domain Name System MTDDNS applicable to mobile target defense;

[0069] 3-5) The network device sends the encapsulated identity authentication domain name to MTDDNS;

[0070] 3-6) MTDDNS identifies the received authentication domain name query request. If it confirms that the current DNS query is an authentication query request, it authenticates the current network device. If the authentication fails, it marks the authentication as failed and sends a message to prompt the network device to re-authenticate, while proceeding to step 3-3). If the authentication is successful, it marks the authentication as successful and proceeds to step 3-7).

[0071] 3-7) MTDDNS stores the identifier of the network device that has completed authentication in the database for use in the process of obtaining a random address;

[0072] 4) Network device obtains random address of communication peer device: The process of network device obtaining random address of communication target device is a core part of the Domain Name System (DNS) for mobile target defense, used to provide address resolution services, specifically as follows:

[0073] 4-1) First, MTDDNS, in conjunction with the data stored in step 3-7), checks whether the current network device has completed authentication. If authentication has not been completed, it proceeds to step 3) to perform authentication. If the current device has completed authentication, it proceeds to step 4-2).

[0074] 4-2) The network device sends the domain name of the protected device that needs to be queried to MTDDNS;

[0075] 4-3) MTDDNS resolves DNS queries sent by network devices, associates them with the updated MTDDNS database in steps 1-5, and retrieves the corresponding domain name information from it;

[0076] 4-4) MTDDNS retrieves the query results from the database. If the query fails, it notifies the network device to perform the domain name query again, proceeding to step 4-2). If the query succeeds, it proceeds to step 4-5.

[0077] 4-5) MTDDNS retrieves the random address of the queried network device from the database and returns it to the network device that initiated the DNS query;

[0078] 4-6) After receiving the domain name resolution data returned by MTDDNS, the network device that initiated the DNS query stores the resolution data and sets the validity period corresponding to the currently obtained random address according to the lifespan marked in the resolution data;

[0079] 5) Network communication process: including:

[0080] 5-1) When a network device begins network communication with a network device protected by the mobile target defense technology, it first checks whether the currently stored random address resolution record of the protected device is valid. If it is not valid, proceed to step 4); if it is valid, proceed to step 5-2).

[0081] 5-2) The network device extracts the random address corresponding to the protected network device obtained in step 4-6);

[0082] 5-3) Network devices and protected devices communicate using currently valid random addresses;

[0083] 5-4) The network device periodically checks whether the validity period of the random address record of the protected device has expired. If it has expired, proceed to step 5-1; if it has not expired, continue to step 5-3 if communication is still required; if communication ends, proceed to step 5-5.

[0084] 5-5) After the network device completes communication with the protected device, it reclaims the relevant occupied resources to reduce the pressure on the device.

[0085] In this example, firstly, the random addresses corresponding to the managed domain names are preloaded from the Mobile Target Defense (MTD) system's database. Then, MTDDNS and the network devices use a pre-shared key to complete the necessary preparatory work for authentication. After the initialization steps are complete, the network device's client sends an authentication request to MTDDNS. Upon receiving the authentication request, MTDDNS performs authentication and returns the authentication result. Once authentication is complete, the network device can begin performing normal DNS lookup operations. When sending domain names managed by the MTDDNS, MTDDNS returns the temporary network address record corresponding to the currently queried domain name. Finally, network devices in the unprotected area and network devices protected by MTDDNS can communicate normally.

Claims

1. A domain name resolution method for mobile target defense, comprising a domain name system network for mobile target defense, wherein the domain name system network for mobile target defense includes an unprotected zone and a protected zone, wherein the unprotected zone and the protected zone are connected via the Internet, the unprotected zone is equipped with network devices and a set of routers for forwarding data packets, the routers are physically connected via a network, and data packets sent by the network devices in the unprotected zone are transmitted to the Internet via the routers in that zone; the protected zone is equipped with network devices, a set of routers supporting mobile target defense, and a domain name system (MTDDNS) for mobile target defense, the network devices are connected to the routers supporting mobile target defense, the routers supporting mobile target defense are connected to the Internet and connected to the domain name system for mobile target defense, and the network devices in the unprotected zone communicate with the network devices in the protected zone via the Internet, characterized in that, The method includes the following steps: 1) Domain Name System (DNS) Continuous Update Process for Random Device Addresses: Upon system startup, the DNS continuously updates the random device addresses, a process that requires frequent and time-consuming updates. This ensures that the random addresses recorded in the DNS database are up-to-date. Specifically: 1-1) First, the mobile target defense system periodically collects valid random addresses of the network devices under its jurisdiction; 1-2) The moving target defense system checks whether there are any newly appearing random addresses in the currently collected valid random addresses. If no new random addresses appear, it continues to wait for a period of time and then continues to collect, and jumps to step 1-1). If a new random address appears in the currently collected valid random addresses, it proceeds to the next step. 1-3) The moving target defense system encapsulates the newly collected random addresses; 1-4) The mobile target defense system periodically pushes new valid random addresses to the Domain Name System; 1-5) After the Domain Name System obtains a new valid random address, it saves the address information to the database and deletes expired records in the database at the same time; 2) Key negotiation process for identity authentication: Only authorized network devices can obtain the random address of network devices using mobile target defense technology. Identity authentication is required first, and before authentication, an identity authentication key negotiation process must be executed, specifically: 2-1) The Domain Name System (MTDDNS) for mobile target defense generates authentication keys; 2-2) Network devices share keys with the Domain Name System (MTDDNS) for mobile target defense using standard cryptographic methods; 2-3) The network device obtains the authentication key and saves it to the network device's storage area; 3) Network Device Authentication Process: The network device authentication process is as follows: 3-1) The network device checks the validity of the authentication key. If no valid authentication key is found, proceed to step 2) to obtain a valid authentication key; if the check result is that the key is valid, proceed to the next step. 3-2) Load a valid authentication key from the network device storage area in step 2-3); 3-3) Using the currently loaded authentication key, the network address of the network device and the system time are combined and encrypted to complete the preprocessing of the identity authentication string; 3-4) According to the domain name query standard, the identity authentication string is encapsulated into a compliant domain name, and any domain name that has been registered with the domain name service provider is added to the end of the string so that the sent identity authentication domain name can be received by the Domain Name System MTDDNS applicable to mobile target defense; 3-5) The network device sends the encapsulated identity authentication domain name to MTDDNS; 3-6) MTDDNS identifies the received authentication domain name query request. If it confirms that the current DNS query is an authentication query request, it authenticates the current network device. If the authentication fails, it marks the authentication as failed and sends a message to prompt the network device to re-authenticate, while proceeding to step 3-3). If the authentication is successful, it marks the authentication as successful and proceeds to step 3-7). 3-7) MTDDNS stores the identifier of the network device that has completed authentication in the database for use in the process of obtaining a random address; 4) Process for network devices to obtain the random address of the communication peer device: The specific process for network devices to obtain the random address of the communication target device is as follows: 4-1) First, MTDDNS, in conjunction with the data stored in step 3-7), checks whether the current network device has completed authentication. If authentication has not been completed, it proceeds to step 3) to perform authentication. If the current device has completed authentication, it proceeds to step 4-2). 4-2) The network device sends the domain name of the protected device that needs to be queried to MTDDNS; 4-3) MTDDNS resolves DNS queries sent by network devices, associates them with the updated MTDDNS database in steps 1-5, and retrieves the corresponding domain name information from it; 4-4) MTDDNS retrieves the query results from the database. If the query fails, it notifies the network device to perform the domain name query again, proceeding to step 4-2). If the query succeeds, it proceeds to step 4-5. 4-5) MTDDNS retrieves the random address of the queried network device from the database and returns it to the network device that initiated the DNS query; 4-6) After receiving the domain name resolution data returned by MTDDNS, the network device that initiated the DNS query stores the resolution data and sets the validity period corresponding to the currently obtained random address according to the lifespan marked in the resolution data; 5) Network communication process: including: 5-1) When a network device begins network communication with a network device protected by the mobile target defense technology, it first checks whether the currently stored random address resolution record of the protected device is valid. If it is not valid, proceed to step 4); if it is valid, proceed to step 5-2). 5-2) The network device extracts the random address corresponding to the protected network device obtained in step 4-6); 5-3) Network devices and protected devices communicate using currently valid random addresses; 5-4) The network device periodically checks whether the validity period of the random address record of the protected device has expired. If it has expired, proceed to step 5-1; if it has not expired, continue to step 5-3 if communication is still required; if communication ends, proceed to step 5-5. 5-5) After the network device and the protected device have finished communicating, reclaim the relevant occupied resources.

Images