A DNS request processing method based on a gatekeeper and the gatekeeper

Abstract

The application discloses a DNS request processing method and a gateway based on a gateway, relates to the technical field of network communication, and mainly aims to improve the response speed of a DNS request. The main technical scheme comprises the following steps: a host on the outside of a gateway analyzes and acquires a DNS request, and obtains a domain name carried by the DNS request; if a host on the inside of the gateway determines that an Internet protocol address matched with the domain name exists in a corresponding storage space, the host on the outside of the gateway feeds back the Internet protocol address to a corresponding DNS request initiator.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network communication, in particular to a DNS request processing method based on a gatekeeper and the gatekeeper. BACKGROUND

[0002] A bidirectional gatekeeper is usually deployed between a client and a domain name server, and the bidirectional gatekeeper implements security isolation and data interaction between the client and the domain name server. The bidirectional gatekeeper supports forwarding a DNS (Domain Name System) request of the client to the domain name server, so that the domain name server implements resolution of a domain name to an Internet protocol address.

[0003] At present, the data volume of the DNS request is usually large, and once a large number of DNS requests are concurrent, the gatekeeper cannot forward the DNS request to the domain name server in time. In addition, even if the DNS request is forwarded to the domain name server, the domain name server may not be able to feed back the Internet protocol address corresponding to the DNS request in time due to a large number of DNS requests. It can be seen that the response speed of the DNS request is slow, and the Internet protocol address corresponding to the DNS request cannot be fed back to the client in time. SUMMARY

[0004] Therefore, the present application provides a DNS request processing method based on a gatekeeper and the gatekeeper, which mainly aims to improve the response speed of the DNS request.

[0005] In order to achieve the above purpose, the present application mainly provides the following technical solutions:

[0006] In a first aspect, the present application provides a DNS request processing method based on a gatekeeper, wherein the gatekeeper comprises an outside host and an inside host, and the DNS request processing method based on the gatekeeper comprises the following steps.

[0007] The outside host resolves and obtains a DNS request, and obtains a domain name carried by the DNS request.

[0008] If the inside host determines that there is an Internet protocol address matched with the domain name in the corresponding storage space, the outside host feeds back the Internet protocol address to a corresponding DNS request initiator.

[0009] In some embodiments of the present application, the DNS request processing method based on the gatekeeper further comprises: if the inside host determines that there is no Internet protocol address matched with the domain name in the corresponding storage space, the inside host generates a target DNS request based on the domain name, and sends the target DNS request to a domain name server.

[0010] In some embodiments of the present application, the DNS request processing method based on the gateway further comprises: the inside host resolving the feedback result sent by the domain name server, and sending the Internet protocol address obtained by the resolution to the outside host; wherein the feedback result is the result of the feedback of the domain name server to the target DNS request, and carries the Internet protocol address corresponding to the target DNS request; the outside host feeds back the Internet protocol address to the corresponding DNS request initiator.

[0011] In some embodiments of the present application, the DNS request processing method based on the gateway further comprises: the inside host storing the Internet protocol address obtained by the resolution and the domain name corresponding to the Internet protocol address in the storage space in the form of a mapping pair.

[0012] In some embodiments of the present application, before the outside host feeds back the Internet protocol address to the corresponding DNS request initiator, the DNS request processing method based on the gateway further comprises: the outside host detecting whether the Internet protocol address is allowed to be provided to the corresponding DNS request initiator for use; if the outside host detects that the Internet protocol address is allowed to be provided to the corresponding DNS request initiator for use, it proceeds to the step of feeding back the Internet protocol address to the corresponding DNS request initiator.

[0013] In some embodiments of the present application, the outside host detecting whether the Internet protocol address is allowed to be provided to the corresponding DNS request initiator for use comprises: the outside host judging whether the corresponding DNS request initiator has the permission to access the Internet protocol address; if the outside host judges that the corresponding DNS request initiator of the Internet protocol address has the permission to access the Internet protocol address, it detects that the DNS request initiator is allowed to use.

[0014] In some embodiments of the present application, the DNS request processing method based on the gateway further comprises: if the inside host obtains the Internet protocol address, it encapsulates the Internet protocol address based on a first private data structure to obtain a first private data, and sends the encapsulated first private data to the outside host; wherein the first private data structure is a data structure agreed by the outside host and the inside host.

[0015] In some embodiments of the present application, the inside host sending the target DNS request to the domain name server comprises: the inside host asynchronously pushing the target DNS request to the domain name server.

[0016] In some embodiments of the present application, the inside host pushes the target DNS request to the domain name server asynchronously, comprising: the inside host initializes the target DNS request as a push event, and adds the push event to a first event notification library through a first event notification interface, so that the first event notification library pushes the push event to the domain name server asynchronously; wherein the first event notification library is used to push the added push event asynchronously.

[0017] In some embodiments of the present application, the outside host resolves the obtained DNS request, comprising: the outside host resolves the obtained DNS request asynchronously.

[0018] In some embodiments of the present application, the outside host resolves the obtained DNS request asynchronously, comprising: the outside host initializes the DNS request as a resolution event, and adds the resolution event to a second event notification library through a second event notification interface; wherein the second event notification library is used to resolve the added resolution event asynchronously to obtain the domain name carried by the added resolution event; and the outside host obtains the domain name carried by the DNS request based on the resolution result of the resolution event fed back by the second event notification library.

[0019] In some embodiments of the present application, after the outside host resolves the obtained DNS request to obtain the domain name carried by the DNS request, the DNS request processing method based on the gatekeeper further comprises: the outside host encapsulates the domain name based on a second private data structure to obtain second private data, and pushes the encapsulated second private data to the inside host asynchronously; wherein the second private data structure is a data structure agreed by the outside host and the inside host; and the inside host resolves the second private data based on the second private data structure to obtain the domain name.

[0020] In some embodiments of the present application, the DNS request processing method based on the gatekeeper further comprises: the inside host detects whether the domain name is a legal domain name; and if the inside host detects that the domain name is a legal domain name, the inside host proceeds to the step of judging whether the internet protocol address matched with the domain name exists in the corresponding storage space.

[0021] In some embodiments of the present application, the DNS request processing method based on the gatekeeper further comprises: if the inside host detects that the domain name is not a legal domain name, the inside host feeds back the notification information that the domain name is illegal to the outside host; and the outside host sends the domain name abnormal prompt to the corresponding DNS request initiator based on the notification information.

[0022] In some embodiments of the present application, the inner host determines whether the domain name matches an Internet protocol address in the corresponding storage space, including: the inner host initializes the domain name as a query event, and adds the query event to a third event notification library through a third event notification interface; wherein the third event notification library is used to query the added query event asynchronously to obtain a query result of the added query event in the storage space; and the inner host determines whether the domain name matches an Internet protocol address based on the query result of the third event notification library.

[0023] In some embodiments of the present application, the DNS request processing method based on the gateway further includes: if the inner host obtains the domain name sent by the outer host, the inner host creates a timer and sets a timing time of the timer; if the inner host detects that the timing time of the timer is reached and the Internet protocol address corresponding to the domain name is not obtained, the inner host feeds back notification information of a domain name resolution failure to the outer host; and the outer host sends a resolution failure prompt to the corresponding DNS request initiator based on the notification information.

[0024] In a second aspect, the present application provides a gateway, including an outer host and an inner host.

[0025] The outer host is configured to: analyze the obtained DNS request to obtain a domain name carried by the DNS request; and feed back an Internet protocol address sent by the inner host to a corresponding DNS request initiator.

[0026] The inner host is configured to: if it is determined that the domain name matches an Internet protocol address in the corresponding storage space, send the matched Internet protocol address to the outer host.

[0027] In a third aspect, the present application provides a computer readable storage medium, including a stored program, wherein the program controls a device where the storage medium is located to execute the DNS request processing method based on the gateway in the first aspect when the program is running.

[0028] In a fourth aspect, the present application provides an electronic device, including: a memory configured to store a program; and a processor coupled to the memory and configured to run the program to execute the DNS request processing method based on the gateway in the first aspect.

[0029] The application provides a DNS request processing method based on a gatekeeper and the gatekeeper. When a host outside the gatekeeper obtains a DNS request, the host outside the gatekeeper parses the DNS request to obtain a domain name carried by the DNS request. If the host inside the gatekeeper determines that an Internet protocol address matched with the domain name exists in a corresponding storage space, the host outside the gatekeeper feeds back the Internet protocol address to a corresponding DNS request initiator. It can be seen that in the scheme provided by the embodiment of the application, the host outside the gatekeeper and the host inside the gatekeeper no longer perform large packet transmission of the DNS request, but the host outside the gatekeeper first parses the domain name in the DNS request, and the host outside the gatekeeper only transmits the domain name to the host inside the gatekeeper, so that the data transmission amount between the host outside the gatekeeper and the host inside the gatekeeper can be reduced, the bandwidth can be saved, and the data transmission speed can be improved. In addition, the preset Internet protocol address is stored in the storage space corresponding to the host inside the gatekeeper, and after the host inside the gatekeeper receives the domain name transmitted by the host outside the gatekeeper, the host inside the gatekeeper first matches the Internet protocol address corresponding to the domain name in the storage space, so that if the Internet protocol address matched with the domain name exists in the storage space, the domain name server does not need to perform domain name resolution, and thus the efficiency of determining the Internet protocol address matched with the domain name can be improved. It can be seen that the scheme provided by the embodiment of the application can improve the response speed of the DNS request, so that the Internet protocol address corresponding to the DNS request can be fed back to the DNS request initiator in time.

[0030] The above description is only a summary of the technical scheme of the application. In order to more clearly understand the technical means of the application, the application can be implemented according to the content of the specification, and in order to make the above and other purposes, characteristics and advantages of the application more obvious and easy to understand, the following specific embodiments of the application are described. BRIEF DESCRIPTION OF DRAWINGS

[0031] In order to more clearly illustrate the technical scheme in the embodiments of the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are some embodiments of the application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0032] Figure 1 A flowchart of a DNS request processing method based on a gatekeeper is shown;

[0033] Figure 2 A schematic diagram of a second event notification library is shown;

[0034] Figure 3 A structural schematic diagram of a gatekeeper is shown. DETAILED DESCRIPTION

[0035] Exemplary embodiments of the present disclosure will be described in greater detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it is understood that the present disclosure can be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure can be more thoroughly understood, and so that the scope of the present disclosure can be completely conveyed to those skilled in the art.

[0036] A two-way gate is usually deployed between the client and the domain name server, and the two-way gate implements the security isolation and data interaction between the client and the domain name server. The two-way gate supports forwarding the DNS request of the client to the domain name server, so that the domain name server implements the resolution of the domain name to the Internet protocol address.

[0037] The two-way gate includes an outside host and an inside host. When forwarding the DNS request, the outside host receives the DNS request sent by the client, the outside host sends the DNS request to the inside host, and the inside host forwards the DNS request to the domain name server. The data amount of the DNS request is usually large, and once a large number of DNS requests are concurrent, the forwarding of the DNS request between the outside host and the inside host will consume a large amount of bandwidth and time, resulting in the inability to forward the DNS request to the domain name server in time. In addition, even if the DNS request is forwarded to the domain name server, the domain name server may not be able to feedback the Internet protocol address corresponding to the DNS request in time due to a large number of DNS requests. It can be seen that the response speed of the current DNS request is slow, and the Internet protocol address corresponding to the DNS request cannot be fed back to the initiator of the DNS request in time.

[0038] The inventors have found that the slow response speed of the current DNS request is mainly caused by the following two points: first, the data amount of the DNS request is large, which occupies a large amount of bandwidth and time when being forwarded between the outside host and the inside host, resulting in slow DNS request transmission between the two. Second, the domain name server is slow in resolving the domain name to the Internet protocol address. In order to overcome the above two problems, the inventors consider that the following means can be adopted: first, the large packet transmission of the DNS request between the outside host and the inside host is no longer performed, but the outside host resolves the domain name in the DNS request first, and the outside host only transmits the domain name to the inside host, which can reduce the data transmission amount between the outside host and the inside host, save bandwidth, and improve the data transmission speed. Second, the preset Internet protocol address is stored in the storage space corresponding to the inside host, and the inside host matches the Internet protocol address corresponding to the domain name in the storage space after receiving the domain name transmitted by the outside host. In this way, once the Internet protocol address matched with the domain name exists in the storage space, the domain name server does not need to perform domain name resolution, thereby improving the efficiency of determining the Internet protocol address matched with the domain name.

[0039] Based on the above two considerations, the embodiment of the present application provides a technical scheme of DNS request processing based on a gatekeeper, specifically: a host on the outside of the gatekeeper parses an obtained DNS request to obtain a domain name carried by the DNS request; a host on the inside of the gatekeeper determines whether an Internet protocol address matched with the domain name exists in a corresponding storage space, and if so, the host on the outside of the gatekeeper feeds back the Internet protocol address to a corresponding initiator of the DNS request. It should be noted that the present application does not make a specific limitation on the specific type of the gatekeeper and the Internet communication protocol, which can be specifically determined based on business requirements. For example, the gatekeeper in the embodiment of the present application can be a bidirectional gatekeeper of IPv4(Internet Protocol version 4) or IPv6(Internet Protocol version 6).

[0040] Based on the above provided technical scheme of DNS request processing based on a gatekeeper, the embodiment of the present application provides a method of DNS request processing based on a gatekeeper and a gatekeeper. The method of DNS request processing based on a gatekeeper and the gatekeeper provided by the embodiment of the present application are specifically described below.

[0041] As shown in Figure 1 The embodiment of the present application provides a method of DNS request processing based on a gatekeeper, which is implemented based on a gatekeeper including an outside host and an inside host. The method of DNS request processing mainly includes the following steps 101-102:

[0042] 101. The outside host parses an obtained DNS request to obtain a domain name carried by the DNS request.

[0043] The method of DNS request processing provided by the embodiment of the present application is applied to a gatekeeper including an outside host and an inside host. The outside host interacts with a subject such as a client in a first security domain. The inside host interacts with a subject such as a domain name server (DNS server) in a second security domain.

[0044] The outer host can acquire a DNS request sent by a DNS request initiator in a first security domain using a UDP (User Datagram Protocol) protocol. The outer host parses the acquired DNS request. The purpose of the outer host parsing the acquired DNS request is to obtain a domain name carried by the DNS request. The domain name is key data for acquiring an Internet Protocol Address (IP) corresponding to the DNS request. After the outer host acquires the domain name, when the outer host interacts with the inner host, the outer host only needs to transmit the domain name to the inner host, and the inner host can perform operations related to determining the Internet Protocol Address according to the domain name, without transmitting the entire DNS request to the inner host. In this way, not only can the amount of data interaction between the outer host and the inner host be reduced, and the interaction speed between the outer host and the inner host be improved, but also the operation of the inner host to determine the Internet Protocol Address corresponding to the DNS request will not be affected by the reduction in the amount of data interaction.

[0045] In the embodiment of the application, in order to enable the outer host to quickly parse the DNS request in a high-concurrency DNS request scenario, the outer host performs asynchronous parsing processing on the acquired DNS request. The specific process of the outer host performing asynchronous parsing processing on the acquired DNS request can include the following steps: the outer host initializes the DNS request as a parsing event, and adds the parsing event to a second event notification library through a second event notification interface; and the outer host acquires a domain name carried by the DNS request based on a parsing result of the parsing event fed back by the second event notification library.

[0046] The second event notification library is used to perform asynchronous parsing on the added parsing event to obtain a domain name carried by the added parsing event. The specific process of the second event notification library performing asynchronous parsing on the added parsing event is as follows: the outer host adds the parsing event to the second event notification library through the second event notification interface to complete event registration. The second event notification library mounts the parsing event in a waiting linked list to wait for the parsing event to be triggered. After the parsing event is triggered, the triggered parsing event is separated from the waiting linked list and becomes a ready event. The second event notification library calls a callback function of the ready event to perform event processing, thereby completing parsing of the ready event and obtaining a parsing result corresponding to the ready event. The parsing result includes the domain name carried by the parsing event.

[0047] The core principle of the second event notification library is to use an IO multiplexing manner to process events in a single thread. The asynchronous parsing process is described below by using the schematic diagram of the second event notification library shown in FIG. 2. Figure 2 Figure 2 ​It can be seen that the second event notification library includes an event processor, an event separator, and a kernel. The event processor is used to add a parsing event, complete event registration, and mount the parsing event to a waiting chain table to wait for the parsing event to be triggered. After the parsing event is triggered, the triggered parsing event is separated from the waiting chain table to become a ready event, and the event separator is notified of the ready event. The event separator waits for an I / O event for the ready event. After the kernel notifies the event separator that the I / O event corresponding to the ready event is I / O ready, the event separator notifies the event processor of the I / O ready. After the event processor learns of the I / O ready for the ready event based on the notification, the event processor performs an I / O operation in the kernel, and then calls a callback function of the ready event to perform event processing to perform processing of the ready event and obtain a domain name corresponding to the ready event. The I / O event here is an I / O-related event such as socket readable, socket writable, socket disconnected, device readable, and device writable. The second event notification library mainly uses an epoll model to multiplex I / O events. It should be noted that the specific type of the second event notification library can be selected based on specific business, and the present embodiment does not make a specific limitation. For example, the second event notification library is a Libevent event notification library.

[0048] After the outside host resolves the DNS request and obtains the domain name carried by the DNS request, the domain name needs to be transmitted to the inside host so that the inside host determines an Internet protocol address matched with the domain name. The method for transmitting the domain name from the outside host to the inside host includes at least the following two methods.

[0049] Firstly, the outside host directly pushes the domain name to the inside host asynchronously. This method can reduce the amount of data transmission between the outside host and the inside host, improve the data transmission speed, and the inside host can directly use the obtained domain name when receiving the domain name.

[0050] Secondly, the outside host encapsulates the domain name based on a second private data structure to obtain second private data, and pushes the encapsulated second private data to the inside host asynchronously; and the inside host parses the second private data based on the second private data structure to obtain the domain name. The second private data structure is a data structure agreed by the outside host and the inside host.

[0051] Considering the security of the transmission of the domain name between the outside host and the inside host, the outside host needs to encapsulate the domain name based on the second private data structure to obtain second private data before pushing the encapsulated second private data to the inside host.

[0052] The second private data structure is a data structure agreed by the outer host and the inner host, and the data amount of the second private data obtained based on the data structure is far less than the data amount of the DNS request. The second private data structure defines a transmission protocol between the outer host and the inner host and an encryption mode of the domain name. The specific process of the outer host for encapsulating the domain name based on the second private data structure is as follows: the outer host performs encryption processing on the domain name through the encryption mode to obtain encrypted data; and the outer host encapsulates the encrypted data obtained through the transmission protocol to obtain the second private data. In order to enable the second private data to be transmitted to the inner host as soon as possible, the outer host pushes the second private data to the inner host in an asynchronous push manner. When the inner host obtains the second private data, the inner host first decapsulates the second private data based on the transmission protocol defined by the second private data structure, and then performs decryption processing on the data obtained through the decapsulation based on the encryption mode defined by the second private data structure, so as to obtain the domain name.

[0053] 102. If the inner host determines that the corresponding storage space exists the internet protocol address matched with the domain name, the outer host feeds back the internet protocol address to the corresponding DNS request initiator.

[0054] In order to improve the response speed of the DNS request and quickly feed back the internet protocol address corresponding to the DNS request, the corresponding storage space of the inner host stores at least one internet protocol address and the domain name corresponding to each internet protocol address. The storage space is a storage space dedicated to the inner host or a cache space of the inner host.

[0055] If the inner host obtains the domain name provided by the outer host, the inner host first determines whether the corresponding storage space exists the internet protocol address matched with the domain name. In order to improve the query efficiency of the inner host, the inner host performs asynchronous query on the corresponding storage space.

[0056] The specific process that the inner host determines whether the corresponding storage space exists the internet protocol address matched with the domain name can include the following steps: the inner host initializes the domain name as a query event, and adds the query event to a third event notification library through a third event notification interface; and the inner host determines whether the internet protocol address corresponding to the domain name exists based on the query result of the third event notification library. The third event notification library is used for performing asynchronous query on the added query event to obtain the query result of the added query event in the storage space. If the inner host determines that the internet protocol address corresponding to the domain name does not exist based on the query result of the third event notification library, it is detected that the corresponding storage space does not exist the internet protocol address matched with the domain name. If the inner host determines that the internet protocol address corresponding to the domain name exists based on the query result of the third event notification library, it is detected that the corresponding storage space exists the internet protocol address matched with the domain name.

[0057] The third event notification library is used to asynchronously query the added query event to obtain the Internet protocol address corresponding to the added query event. The specific process of the third event notification library asynchronously querying the added query event is that the inside host adds the query event to the third event notification library through the third event notification interface, and completes event registration. The third event notification library mounts the query event to the waiting linked list, and waits for the triggered event to be parsed. After the query event is triggered, the triggered query event is separated from the waiting linked list and becomes a ready event. The third event notification library calls the callback function of the ready event to execute event processing, thereby completing the query processing of the ready event, obtaining the query result corresponding to the ready event, and the query result includes the corresponding Internet protocol address. The specific structure and execution process of the third event notification library are basically the same as those of the second event notification library shown in the embodiment, and thus will not be described here again. The specific type of the third event notification library can be selected based on specific business, and the embodiment does not make specific limitation. For example, the third event notification library is a Libevent event notification library or an asio event notification library. Figure 2 The specific structure and execution process of the third event notification library are basically the same as those of the second event notification library shown in the embodiment, and thus will not be described here again. The specific type of the third event notification library can be selected based on specific business, and the embodiment does not make specific limitation. For example, the third event notification library is a Libevent event notification library or an asio event notification library.

[0058] If the inside host determines that the Internet protocol address matched with the domain name exists in the corresponding storage space, the inside host no longer provides the domain name to the domain name server for resolution, but directly provides the Internet protocol address matched with the domain name as the resolution result corresponding to the domain name, and feeds back the resolution result to the outside host, so that the outside host feeds back the resolution result to the corresponding DNS request initiator.

[0059] The method for the inside host to transmit the Internet protocol address matched with the domain name to the outside host at least includes the following two methods:

[0060] Firstly, the inside host directly asynchronously pushes the Internet protocol address to the outside host. This method can reduce the data transmission amount between the outside host and the inside host, improve the data transmission speed, and the outside host can directly use the obtained Internet protocol address.

[0061] Secondly, if the inside host obtains the Internet protocol address, the inside host encapsulates the Internet protocol address based on the first private data structure to obtain the first private data, and sends the encapsulated first private data to the outside host. The first private data structure is a data structure agreed by the outside host and the inside host.

[0062] Considering the security of the transmission of the Internet protocol address between the outside host and the inside host, the inside host needs to encapsulate the Internet protocol address based on the first private data structure to obtain the first private data, and then push the encapsulated first private data to the outside host when transmitting the Internet protocol address to the outside host.

[0063] The first private data structure is a data structure agreed by the outer host and the memory host. The first private data structure defines a transmission protocol between the outer host and the inner host and an encryption manner of an Internet protocol address. The specific process of the inner host for encapsulating the domain name based on the first private data structure is as follows: the inner host performs encryption processing on the Internet protocol address by using the encryption manner to obtain encrypted data; and the encrypted data obtained by the encryption is encapsulated by using the transmission protocol to obtain the first private data. In order to enable the first private data to be transmitted to the outer host as soon as possible, the inner host pushes the first private data to the outer host in an asynchronous pushing manner. When the outer host obtains the first private data, the outer host first decapsulates the first private data based on the transmission protocol defined by the first private data structure, and then performs decryption processing on the data obtained by the decapsulation based on the encryption manner defined by the first private data structure, so as to obtain the Internet protocol address.

[0064] After the outer host obtains the Internet protocol address, the outer host processes the Internet protocol address into a DNS result of a corresponding DNS request, and feeds back the DNS result to a corresponding DNS request initiator, so that the DNS request initiator performs network access based on the Internet protocol address carried by the DNS result. It should be noted that, in order to improve the feedback efficiency of the DNS result, the outer host sends the DNS result to the corresponding DNS request initiator in an asynchronous pushing manner.

[0065] Further, in order to avoid unnecessary Internet protocol address query operations of the inner host on the corresponding storage space, the DNS request processing method based on the gatekeeper can further include the following steps: the inner host detects whether the domain name is a legal domain name; and if the inner host detects that the domain name is a legal domain name, the inner host proceeds to the step of determining whether the corresponding storage space has an Internet protocol address matched with the domain name.

[0066] After the inner host obtains the domain name resolved by the outer host, the inner host detects whether the obtained domain name is a legal domain name. The method for detecting the obtained domain name includes the following two methods:

[0067] Firstly, the memory host detects whether the obtained domain name exists in a white list for recording legal domain names; if it is detected that the obtained domain name exists, it is determined that the obtained domain name is a legal domain name; and if it is detected that the obtained domain name does not exist, it is determined that the obtained domain name is an illegal domain name. The white list can be updated over time to ensure that the recorded domain names meet the business requirements.

[0068] Secondly, the memory host detects whether the obtained domain name exists in a black list for recording illegal domain names; if it is detected that the obtained domain name exists, it is determined that the obtained domain name is an illegal domain name. If it is detected that the obtained domain name does not exist, it is determined that the obtained domain name is a legal domain name. The black list can also be updated over time to ensure that the recorded domain names meet the business requirements.

[0069] The inner host only enters the step of determining whether the domain name matches the Internet protocol address in the corresponding storage space when it is detected that the obtained domain name is a legal domain name. In this way, some illegal domain names can be filtered out, and the query amount of the inner host in the storage space can be reduced.

[0070] Further, the inner host feeds back the notification information that the domain name is illegal to the outer host if it is detected that the domain name is not a legal domain name. The outer host sends a domain name abnormality prompt to the corresponding DNS request initiator based on the notification information.

[0071] If the domain name is an illegal domain name, it means that the domain name is a domain name that cannot be accessed by the DNS request initiator, and once accessed, it is extremely likely to cause harm to the DNS request initiator. Therefore, the inner host feeds back the notification information that the domain name is illegal to the outer host. The outer host sends a domain name abnormality prompt to the corresponding DNS request initiator based on the notification information, so that the DNS request initiator terminates the access operation on the domain name in time based on the abnormality prompt.

[0072] The method for processing a DNS request based on a gateway provided in the embodiments of the present application is as follows: when the outer host of the gateway obtains a DNS request, the outer host parses the DNS request to obtain the domain name carried in the DNS request. If the inner host of the gateway determines that the corresponding storage space contains an Internet protocol address that matches the domain name, the outer host feeds back the Internet protocol address to the corresponding DNS request initiator. It can be seen that in the scheme provided in the embodiments of the present application, the outer host and the inner host no longer perform large packet transmission of the DNS request, but the outer host first parses the domain name in the DNS request, and the outer host only transmits the domain name to the inner host. In this way, the data transmission amount between the outer host and the inner host can be reduced, the bandwidth can be saved, and the data transmission speed can be improved. In addition, the preset Internet protocol address is stored in the storage space corresponding to the inner host. After the inner host receives the domain name transmitted by the outer host, the inner host first matches the Internet protocol address corresponding to the domain name in the storage space. In this way, if the storage space contains the Internet protocol address that matches the domain name, the domain name server does not need to perform domain name resolution, and thus the efficiency of determining the Internet protocol address that matches the domain name can be improved. It can be seen that the scheme provided in the embodiments of the present application can improve the response speed of the DNS request, and thus the Internet protocol address corresponding to the DNS request can be fed back to the DNS request initiator in time.

[0073] In some embodiments of the present application, in order to enable the DNS request initiator to obtain the Internet protocol address corresponding to the DNS request, the DNS request processing method based on the gateway can further include the following steps: if the inside host determines that the Internet protocol address corresponding to the domain name does not exist in the corresponding storage space, the inside host generates a target DNS request based on the domain name and sends the target DNS request to the domain name server.

[0074] If the inside host determines that the Internet protocol address corresponding to the domain name does not exist in the corresponding storage space, it means that the existing Internet protocol address in the corresponding storage space cannot feed back the Internet protocol address corresponding to the domain name to the outside host. Therefore, in order to ensure that the domain name can be resolved, a target DNS request is generated based on the domain name, and the target DNS request is sent to the domain name server to resolve the Internet protocol address corresponding to the domain name through the domain name server.

[0075] In order to avoid large packet transmission of DNS requests between the outside host and the inside host and save bandwidth, the outside host does not transmit the DNS request it receives to the inside host, but transmits the domain name obtained by resolving the DNS request to the inside host. When the inside host determines that the domain name server is needed to resolve the Internet protocol address corresponding to the domain name, the domain name needs to be processed again into a DNS request recognizable by the domain name server. The specific process of the inside host generating a target DNS request based on the domain name is: obtaining target data required for generating a DNS request, and then generating a target DNS request based on the target data and the domain name. It should be noted that the target data here is data agreed by the inside host and the domain name server.

[0076] After the inside host generates the target DNS request, the inside host sends the target DNS request to the domain name server. In order to improve the sending efficiency of the target DNS request, the inside host asynchronously pushes the target DNS request to the domain name server. The specific process of the inside host asynchronously pushing the target DNS request to the domain name server is: the inside host initializes the target DNS request as a push event, and adds the push event to a first event notification library through a first event notification interface, so that the first event notification library asynchronously pushes the push event to the domain name server; wherein the first event notification library is used to asynchronously push the added push event.

[0077] The first event notification library is used for asynchronously pushing the added push event to the domain name server. The specific process of the first event notification library for asynchronously pushing the added push event is as follows: the inside host adds the push event to the first event notification library through the first event notification interface, and completes event registration. The first event notification library mounts the push event to a waiting linked list, and waits for the push event to be triggered. After the push event is triggered, the triggered push event is separated from the waiting linked list and becomes a ready event. The first event notification library calls the callback function of the ready event to perform event processing, thereby completing the pushing of the ready event, so that the domain name server obtains the target DNS request corresponding to the ready event. The specific structure and execution process of the first event notification library are basically the same as those of the second event notification library shown in the above embodiment, and thus will not be described herein again. It should be noted that the specific type of the first event notification library can be selected based on specific business, and the present embodiment is not limited in this regard. For example, the first event notification library is a Libevent event notification library or an asio event notification library. Figure 2

[0078] In some embodiments of the present application, after the inside host sends the target DNS request to the domain name server, the domain name server parses the target DNS request and obtains a parsing result for the target DNS request, and feeds back the parsing result as a feedback result to the inside host. Therefore, the DNS request processing method based on the gatekeeper further includes the following steps: the inside host parses the feedback result sent by the domain name server, and sends the Internet protocol address obtained by parsing to the outside host; the feedback result is the result fed back by the domain name server for the target DNS request, and carries the Internet protocol address corresponding to the target DNS request; and the outside host feeds back the Internet protocol address to the DNS request initiator.

[0079] In order to save the bandwidth between the inside host and the outside host and improve the efficiency of data transmission between the two, after the inside host obtains the feedback result fed back by the domain name server for the target DNS request, the inside host does not directly transmit the feedback result to the outside host, but parses the feedback result and sends the Internet protocol address obtained by parsing to the outside host.

[0080] The method for the inside host to transmit the Internet protocol address to the outside host includes at least the following two methods:

[0081] The first method is that the inside host directly asynchronously pushes the Internet protocol address to the outside host. This method can reduce the amount of data transmission between the outside host and the inside host, improve the data transmission speed, and the outside host can directly use the obtained Internet protocol address.

[0082] ​The second, the inner host encapsulates the Internet protocol address based on a third private data structure, and sends the third private data obtained by encapsulation to the outer host. The third private data structure is a data structure agreed by the outer host and the inner host.

[0083] Considering the security of the transmission of the Internet protocol address between the outer host and the inner host, when transmitting the Internet protocol address to the outer host, the inner host needs to encapsulate the Internet protocol address based on the third private data structure to obtain the third private data, and then push the third private data obtained by encapsulation to the outer host.

[0084] The third private data structure is a data structure agreed by the outer host and the inner host. The third private data structure defines the transmission protocol between the outer host and the inner host and the encryption mode of the Internet protocol address. The specific process of the inner host encapsulating the domain name based on the third private data structure is as follows: the inner host encrypts the Internet protocol address by an encryption mode; the data obtained by encryption is encapsulated by a transmission protocol to obtain the third private data. In order to make the third private data transmitted to the outer host as soon as possible, the inner host pushes the third private data to the outer host in an asynchronous push manner. When the outer host obtains the third private data, it first decapsulates the third private data based on the transmission protocol defined by the third private data structure, and then decrypts the data obtained by decapsulation based on the encryption mode defined by the third private data structure, thereby obtaining the Internet protocol address.

[0085] After the outer host obtains the Internet protocol address, the outer host processes the Internet protocol address into a DNS result of a corresponding DNS request, and feeds back the DNS result to a corresponding DNS request initiator, so that the DNS request initiator performs network access based on the Internet protocol address carried by the DNS result. It should be noted that, in order to improve the feedback efficiency of the DNS result, the outer host sends the DNS result to the corresponding DNS request initiator in an asynchronous push manner.

[0086] In some embodiments of the present application, in order to further control the network access of the DNS request initiator, before the outer host feeds back the Internet protocol address to the corresponding DNS request initiator, the DNS request processing method based on the gateway can further include the following steps: the outer host detects whether the Internet protocol address is allowed to be provided to the corresponding DNS request initiator for use; if the outer host detects that the Internet protocol address is allowed to be provided to the corresponding DNS request initiator for use, the outer host proceeds to the step of feeding back the Internet protocol address to the corresponding DNS request initiator.

[0087] Before providing the Internet address to the corresponding DNS request initiator, the outer host needs to detect whether the Internet protocol address is allowed to be provided to the corresponding DNS request initiator for use, so as to avoid providing the Internet protocol address that the DNS request initiator cannot access to the DNS request initiator.

[0088] The specific process in which the outer host detects whether the Internet protocol address is allowed to be provided to the corresponding DNS request initiator for use can include the following two kinds:

[0089] Firstly, the outer host judges whether the corresponding DNS request initiator has the right to access the Internet protocol address; if the outer host judges that the DNS request initiator corresponding to the Internet protocol address has the right to access the Internet protocol address, it is detected that the Internet protocol address is allowed to be provided to the DNS request initiator for use, at this time the outer host can provide the Internet protocol address to the corresponding DNS request initiator. If the outer host judges that the DNS request initiator corresponding to the Internet protocol address does not have the right to access the Internet protocol address, it is detected that the Internet protocol address is not allowed to be provided to the corresponding DNS request initiator for use. At this time, the outer host does not provide the Internet protocol address to the corresponding DNS request initiator, but feeds back a prompt that it has no right to access to the corresponding DNS request initiator.

[0090] Secondly, the outer host judges whether the received Internet protocol address is a legal Internet protocol address; if the outer host judges that the Internet protocol address is a legal Internet protocol address, it is detected that the Internet protocol address is allowed to be provided to the DNS request initiator for use, at this time the outer host can provide the Internet protocol address to the corresponding DNS request initiator. If the outer host judges that the Internet protocol address is not legal, it is detected that the Internet protocol address is not allowed to be provided to the corresponding DNS request initiator for use, at this time the outer host does not provide the Internet protocol address to the corresponding DNS request initiator, but feeds back a prompt that it cannot access the domain name carried by the DNS request to the corresponding DNS request initiator.

[0091] The outer host can set a white list of legal Internet protocol addresses based on the DNS request initiator. The white list is set based on the specific access strategy of the DNS request initiator, and will also be updated as the business changes. If the outer host determines that the received Internet protocol address is included in the white list, it is determined that the received Internet protocol address is legal. If the outer host determines that the received Internet protocol address is not included in the white list, it is determined that the received Internet protocol address is not legal.

[0092] In some embodiments of the present application, in order to enrich the Internet protocol addresses in the storage space corresponding to the inside host, after the inside host resolves the feedback result sent by the domain name server, the DNS request processing method based on the gateway can further include the following steps: the inside host stores the resolved Internet protocol address and the domain name corresponding to the Internet protocol address in the storage space in the form of a mapping pair.

[0093] After the inside host resolves the Internet protocol address carried in the feedback result, if it is detected that the resolved Internet protocol address does not exist in the corresponding storage space, the Internet protocol address and the corresponding domain name are added to the storage space in the form of a mapping pair for subsequent use by the inside host.

[0094] Further, considering that the storage capacity of the storage space is limited, the mapping pairs involving the Internet protocol addresses with a usage frequency less than a preset frequency are cleared from the storage space at a preset period.

[0095] In some embodiments of the present application, if the DNS request initiator cannot receive the Internet protocol address corresponding to the DNS request, it cannot perform corresponding network access. In order to avoid the situation that the DNS request initiator waits for the Internet protocol address for a long time, the DNS request processing method based on the gateway can further include the following steps: if the inside host obtains the domain name sent by the outside host, it creates a timer and sets the timing time of the timer; if the inside host detects that the timing time of the timer is reached and the Internet protocol address corresponding to the domain name is not obtained, it feeds back the notification information of domain name resolution failure to the outside host; and the outside host sends a resolution failure prompt to the corresponding DNS request initiator based on the notification information.

[0096] The timing time of the timer created by the inside host is determined based on the acceptable waiting time of the corresponding DNS request initiator. If the inside host detects that the timing time of the timer is reached and the Internet protocol address corresponding to the domain name is not obtained, it means that the Internet protocol address corresponding to the domain name is not determined within the specified time, and the time has exceeded. At this time, the inside host feeds back the notification information of domain name resolution failure to the outside host. The outside host sends a resolution failure prompt to the corresponding DNS request initiator based on the notification information, so that the DNS request initiator performs abnormal processing such as changing the domain name based on the resolution failure prompt. In the case where the inside host detects that the timing time of the timer is reached and the Internet protocol address corresponding to the domain name is not obtained, in addition to feeding back the notification information of domain name resolution failure to the outside host, it also deletes the timer and releases the corresponding memory.

[0097] Further, if the inside host detects that the timing time of the timer is not reached and the Internet protocol address corresponding to the domain name is obtained, it feeds back the Internet protocol address to the outside host and deletes the timer to release the corresponding memory.

[0098] Furthermore, one embodiment of this application also provides a network gateway, such as... Figure 3 As shown, the gateway includes an outer host 21 and an inner host 22;

[0099] The outer host 21 is used to resolve the obtained DNS request and obtain the domain name carried in the DNS request; and to send back the Internet Protocol address sent by the inner host 22 to the corresponding DNS request initiator.

[0100] The inner host 22 is used to send the matching Internet Protocol address to the outer host if it is determined that there is an Internet Protocol address matching the domain name in the corresponding storage space.

[0101] The network gateway provided in this application embodiment resolves a DNS request when it is received by an external host, obtaining the domain name carried in the DNS request. If the internal host of the gateway determines that a matching Internet Protocol (IP) address exists in the corresponding storage space, the external host sends the IP address back to the DNS request initiator. Therefore, in the solution provided in this application embodiment, the external and internal hosts no longer transmit large packets of DNS requests. Instead, the external host first resolves the domain name in the DNS request and only transmits the domain name to the internal host. This reduces the amount of data transmission between the external and internal hosts, saves bandwidth, and improves data transmission speed. Furthermore, a preset IP address is stored in the storage space corresponding to the internal host. After receiving the domain name transmitted by the external host, the internal host first matches the corresponding IP address in the storage space. Thus, if a matching IP address exists in the storage space, no domain name server is needed for domain name resolution, thereby improving the efficiency of determining the matching IP address. Therefore, the solution provided in this application embodiment can improve the response speed of DNS requests, enabling timely feedback of the corresponding IP address to the DNS request initiator.

[0102] In some embodiments of this application, such as Figure 3 As shown, the inner host 22 is also used to generate a target DNS request based on the domain name and send the target DNS request to the domain name server if it is determined that there is no Internet Protocol address matching the domain name in the corresponding storage space.

[0103] In some embodiments of this application, such as Figure 3The inner host 32 is further configured to analyze the feedback result sent by the domain name server, and send the obtained Internet protocol address to the outer host 31; wherein the feedback result is a result fed back by the domain name server for the target DNS request, and carries the Internet protocol address corresponding to the target DNS request.

[0104] The outer host 21 is further configured to feed back the Internet protocol address to the corresponding DNS request initiator.

[0105] In some embodiments of the present application, as shown in Figure 3 The inner host 22 is further configured to store the obtained Internet protocol address and the domain name corresponding to the Internet protocol address in the storage space in the form of a mapping pair.

[0106] In some embodiments of the present application, as shown in Figure 3 The outer host 21 is further configured to detect whether the Internet protocol address is allowed to be provided to the corresponding DNS request initiator; if it is detected that the Internet protocol address is allowed to be provided to the corresponding DNS request initiator, the step of feeding back the Internet protocol address to the corresponding DNS request initiator is performed.

[0107] In some embodiments of the present application, as shown in Figure 3 The outer host 21 is specifically configured to judge whether the corresponding DNS request initiator has the permission to access the Internet protocol address; if it is judged that the DNS request initiator corresponding to the Internet protocol address has the permission to access the Internet protocol address, it is detected that the DNS request initiator is allowed to use.

[0108] In some embodiments of the present application, as shown in Figure 3 The inner host 22 is further configured to, if the Internet protocol address is obtained, encapsulate the Internet protocol address based on a first private data structure to obtain first private data, and send the encapsulated first private data to the outer host 21; wherein the first private data structure is a data structure agreed by the outer host and the inner host.

[0109] In some embodiments of the present application, as shown in Figure 3 The inner host 22 is specifically configured to asynchronously push the target DNS request to the domain name server.

[0110] In some embodiments of the present application, as shown in Figure 3As shown in the figure, the inner host 22 is specifically configured to initialize the target DNS request as a push event, and add the push event to a first event notification library through a first event notification interface, so that the first event notification library asynchronously pushes the push event to the domain name server; wherein the first event notification library is configured to asynchronously push the added push event.

[0111] In some embodiments of the present application, as shown in the figure, Figure 3 As shown in the figure, the outer host 21 is specifically configured to asynchronously analyze the obtained DNS request.

[0112] In some embodiments of the present application, as shown in the figure, Figure 3 As shown in the figure, the outer host 21 is specifically configured to initialize the DNS request as an analysis event, and add the analysis event to a second event notification library through a second event notification interface; wherein the second event notification library is configured to asynchronously analyze the added analysis event to obtain the domain name carried by the added analysis event; based on the analysis result of the analysis event fed back by the second event notification library, the domain name carried by the DNS request is obtained.

[0113] In some embodiments of the present application, as shown in the figure, Figure 3 As shown in the figure, the outer host 21 is further configured to encapsulate the domain name based on a second private data structure to obtain second private data, and asynchronously push the encapsulated second private data to the inner host; wherein the second private data structure is a data structure agreed by the outer host and the inner host.

[0114] The inner host 22 is further configured to analyze the second private data based on the second private data structure to obtain the domain name.

[0115] In some embodiments of the present application, as shown in the figure, Figure 3 As shown in the figure, the inner host 22 is further configured to detect whether the domain name is a legal domain name; if it is detected that the domain name is a legal domain name, the step of judging whether the corresponding storage space exists the Internet protocol address matched with the domain name is executed.

[0116] In some embodiments of the present application, as shown in the figure, Figure 3 As shown in the figure, the inner host 22 is further configured to feed back the notification information that the domain name is illegal to the outer host if it is detected that the domain name is not a legal domain name.

[0117] The outer host is further configured to send a domain name exception prompt to the corresponding DNS request initiator based on the notification information.

[0118] In some embodiments of the present application, as shown in the figure, Figure 3As shown, the inner host 22 is specifically configured to initialize the domain name as a query event, and add the query event to a third event notification library through a third event notification interface; wherein the third event notification library is configured to perform asynchronous query on the added query event, to obtain a query result of the added query event in the storage space; and based on the query result of the third event notification library, it is determined whether there is an Internet protocol address corresponding to the domain name.

[0119] In some embodiments of the present application, as Figure 3 As shown, the inner host 22 is further configured to, if the domain name sent by the outer host is obtained, create a timer and set a timing time of the timer; if it is detected that the timing time of the timer is reached and the Internet protocol address corresponding to the domain name is not obtained, feedback the notification information of the domain name resolution failure to the outer host 21.

[0120] The outer host 21 is further configured to send a resolution failure prompt to the corresponding DNS request initiator based on the notification information.

[0121] In the gateway provided by the embodiments of the present application, the details used in the running process of each functional module can be referred to the corresponding details of the above-mentioned DNS request processing method based on the gateway, which will not be repeated here.

[0122] Further, one embodiment of the present application further provides a computer readable storage medium, the storage medium includes a stored program, wherein when the program runs, the device where the storage medium is located is controlled to execute the above-mentioned DNS request processing method based on the gateway.

[0123] Further, one embodiment of the present application further provides an electronic device, the electronic device includes: a memory for storing a program; a processor coupled to the memory for running the program to execute the above-mentioned DNS request processing method based on the gateway.

[0124] In the above embodiments, the description of each embodiment has its own emphasis, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0125] It can be understood that the related features in the above method and device can be mutually referred. In addition, "first", "second" and the like in the above embodiments are used to distinguish each embodiment, and do not represent the advantages and disadvantages of each embodiment.

[0126] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system, device and unit described above can refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

[0127] The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, this application is not directed to any particular programming language. It should be understood that the content of this application described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing preferred embodiments of this application.

[0128] In addition, the memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0129] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0130] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data cutover device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data cutover device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0131] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data cutover device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0132] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 Figure 1

[0133] In one typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0134] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) about which the processor can execute instructions. The memory can also include non-volatile memory, such as read only memory (ROM), electrically programmable read only memory (EPROM), electrically erasable programmable read only memory (EEPROM), flash memory, or other memory technologies, about which the processor can execute instructions. The memory is an example of computer readable media.

[0135] Computer readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically programmable read only memory (EEPROM), flash memory or other memory technologies, compact disc read only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to computing devices. According to the definition herein, computer readable media does not include transitory media, such as modulated data signals and carrier waves.

[0136] It should also be noted that the terms "comprising", "comprises", "including", "includes" or any other variation thereof are intended to cover a non-exclusive inclusion, such that a process, method, article or apparatus that comprises a list of elements does not include only those elements recited, but can also include other elements not expressly listed or inherent to such process, method, article or apparatus. Without limitation, an element preceded by "comprises a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article or apparatus that includes the element.

[0137] ​​Those skilled in the art will appreciate that embodiments of the present application can be devised for a method, a system, or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer readable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable program code thereon for use by or in connection with an instruction execution system. For the purposes of this description, a computer usable or computer readable storage medium can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The medium can be electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device) including a computer readable storage medium. Examples of a computer readable storage medium include an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device) including a computer readable storage medium.

[0138] The foregoing is merely illustrative of the principles of the application and various modifications can be made by persons skilled in the art. The present application is not intended to be limited to the embodiments shown, but is to be accorded the full scope that resides in the art thereof. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A method for processing DNS request based on a gateway, characterized in that, The network gateway includes an outer host and an inner host, and the method includes: The outer host resolves the DNS request, obtains the domain name carried in the DNS request, and transmits only the domain name to the inner host; If the inner host determines that the corresponding storage space contains an Internet Protocol address matching the domain name, the inner host directly sends the Internet Protocol address matching the domain name as the resolution result corresponding to the domain name back to the outer host. The outer host then sends the Internet Protocol address back to the corresponding DNS request initiator. The storage space is either a dedicated storage space for the inner host or a cache space for the inner host.

2. The method of claim 1, wherein, The method further includes: If the internal host determines that there is no Internet Protocol address matching the domain name in the corresponding storage space, it generates a target DNS request based on the domain name and sends the target DNS request to the domain name server.

3. The method of claim 2, wherein, The method further includes: The inner host resolves the feedback result sent by the domain name server and sends the obtained Internet Protocol address to the outer host; wherein, the feedback result is the result returned by the domain name server in response to the target DNS request, which carries the Internet Protocol address corresponding to the target DNS request; The external host will send the Internet Protocol address back to the corresponding DNS request initiator.

4. The method of claim 3, wherein, The method further includes: The inner host will store the resolved Internet Protocol address and the corresponding domain name in the storage space as mapping pairs.

5. The method according to claim 1 or 3, characterized in that, Before the outer host sends the Internet Protocol address back to the corresponding DNS request initiator, the method further includes: The external host detects whether the Internet Protocol address is allowed to be provided to the corresponding DNS request initiator. If the external host detects that the Internet Protocol address is allowed to be used by the corresponding DNS request initiator, it proceeds to the step of sending the Internet Protocol address back to the corresponding DNS request initiator.

6. The method according to claim 5, characterized in that, The external host detects whether the Internet Protocol address is allowed to be provided to the corresponding DNS request initiator, including: The external host determines whether the party initiating the corresponding DNS request has permission to access the Internet Protocol address. If the external host determines that the DNS request initiator corresponding to the Internet Protocol address has permission to access the Internet Protocol address, it will detect that the DNS request initiator is allowed to use it.

7. The method according to claim 1 or 3, characterized in that, The method further includes: If the inner host obtains an Internet Protocol address, it encapsulates the Internet Protocol address based on a first private data structure to obtain first private data, and sends the encapsulated first private data to the outer host; wherein, the first private data structure is a data structure agreed upon by the outer host and the inner host.

8. The method according to claim 2, characterized in that, The inner host sends the target DNS request to the domain name server, including: The inner host asynchronously pushes the target DNS request to the domain name server.

9. The method according to claim 8, characterized in that, The inner host asynchronously pushes the target DNS request to the domain name server, including: The inner host initializes the target DNS request as a push event and adds the push event to the first event notification library through the first event notification interface, so that the first event notification library asynchronously pushes the push event to the domain name server; wherein, the first event notification library is used to asynchronously push the added push event.

10. The method according to any one of claims 1-4, 6, 8, and 9, characterized in that, The DNS requests obtained by the external host resolution include: The external host performs asynchronous resolution processing on the obtained DNS requests.

11. The method according to claim 10, characterized in that, The external host performs asynchronous resolution processing on the obtained DNS requests, including: The external host initializes the DNS request as a resolution event and adds the resolution event to the second event notification library through the second event notification interface; wherein, the second event notification library is used to asynchronously resolve the added resolution event to obtain the domain name carried by the added resolution event; The external host obtains the domain name carried in the DNS request based on the resolution result of the resolution event fed back by the second event notification library.

12. The method according to any one of claims 1-4, 6, 8, and 9, characterized in that, After obtaining the domain name carried in the DNS request from the external host, the method further includes: The outer host encapsulates the domain name based on a second private data structure to obtain second private data, and asynchronously pushes the encapsulated second private data to the inner host; wherein, the second private data structure is a data structure agreed upon by the outer host and the inner host; The inner host parses the second private data based on the second private data structure to obtain the domain name.

13. The method according to any one of claims 1-4, 6, 8, and 9, characterized in that, The method further includes: The internal host checks whether the domain name is a valid domain name; If the internal host detects that the domain name is a legitimate domain name, it proceeds to the step of determining whether there is an Internet Protocol address matching the domain name in the corresponding storage space.

14. The method according to claim 13, characterized in that, The method further includes: If the inner host detects that the domain name is not a valid domain name, it sends a notification message to the outer host that the domain name is invalid. The external host sends a domain name anomaly alert to the corresponding DNS request initiator based on the notification information.

15. The method according to claim 13, characterized in that, The inner host determines whether an Internet Protocol address matching the domain name exists in the corresponding storage space, including: The inner host initializes the domain name as a query event and adds the query event to the third event notification library through the third event notification interface; wherein, the third event notification library is used to perform asynchronous queries on the added query event to obtain the query results of the added query event in the storage space; The inner host determines whether the Internet Protocol address corresponding to the domain name exists based on the query results of the third event notification database.

16. The method according to any one of claims 1-4, 6, 8, and 9, characterized in that, The method further includes: If the inner host obtains the domain name sent by the outer host, it creates a timer and sets the timer's duration. If the inner host detects that the timer has expired and has not obtained the Internet Protocol address corresponding to the domain name, it sends a notification message to the outer host that the domain name resolution has failed. The external host sends a resolution failure message to the corresponding DNS request initiator based on the notification information.

17. A network gate, characterized in that, The network gateway includes an outer host and an inner host; The outer host is used to resolve the acquired DNS request, obtain the domain name carried in the DNS request, and only transmit the domain name to the inner host; and to feed back the Internet Protocol address sent by the inner host to the corresponding DNS request initiator. The inner host is configured to, if it determines that an Internet Protocol address matching the domain name exists in the corresponding storage space, directly send the Internet Protocol address matching the domain name as the resolution result corresponding to the domain name to the outer host. The storage space is either a dedicated storage space for the inner host or a cache space for the inner host.

18. A computer-readable storage medium, characterized in that, The storage medium includes a stored program, wherein, when the program is executed, it controls the device where the storage medium is located to execute the DNS request processing method based on any one of claims 1 to 16.

19. An electronic device, characterized in that, The electronic device includes: Memory, used to store programs; A processor, coupled to the memory, is used to run the program to perform the DNS request processing method based on a gateway as described in any one of claims 1 to 16.

Images