A domain name system (DNS) domain name resolution method and related apparatus

Abstract

This application discloses a Domain Name System (DNS) domain name resolution method and related apparatus, relating to the field of network security technology, used to improve the security and integrity of data in DNS. The method includes: a root server receiving a domain name query request sent by a DNS server, obtaining multiple cipher suites supported by the DNS server from the domain name query request; then, according to the signature algorithms it supports, selecting a target cipher suite from the multiple cipher suites; filtering out target signature algorithms that meet priority conditions from the target cipher suites, and digitally signing the first-level domain name obtained based on the domain name query request according to the target signature algorithm to obtain the signed first-level domain name; finally, sending the signed first-level domain name and the target cipher suite to the DNS server, so that the DNS server can digitally verify the signed first-level domain name based on the target signature algorithm in the target cipher suite to obtain the verified first-level domain name.

Description

Technical Field

[0001] This application mainly relates to the field of network security technology, and in particular to a Domain Name System (DNS) domain name resolution method and related apparatus. Background Technology

[0002] Domain Name System Security Extensions (DNSSEC) is a series of DNS security authentication mechanisms provided by the IETF. DNSSEC ensures the integrity of DNS data by adding digital signature information to the data in the DNS.

[0003] Currently, most of the signature algorithms used in DNSSEC are traditional signature algorithms, such as RSA encryption algorithm and Elliptic Curve Digital Signature Algorithm (ECDSA).

[0004] However, with the rapid development of Shor's quantum algorithm and quantum computing, the powerful computing capabilities and speed of quantum algorithms have made traditional signature algorithms vulnerable to being cracked by quantum algorithms. In other words, the traditional signature algorithm used by DNSSEC can no longer completely resist attacks by quantum algorithms, which in turn reduces the security of DNSSEC using traditional signature algorithms.

[0005] Although Post-Quantum Cryptography (PQC) is a new generation of signature algorithms that can resist quantum computing attacks on existing signature algorithms and ensure the security of signature algorithms in a quantum environment, DNSSEC is not currently fully capable of using PQC.

[0006] For example, the current DNSSEC can only set a traditional signature algorithm or a post-quantum cryptography algorithm separately, and cannot select the best signature algorithm suitable for DNSSEC based on DNSSEC's compatibility with signature algorithms.

[0007] Therefore, how to select the best signature algorithm for DNSSEC to ensure data security and integrity and achieve domain name resolution is an urgent problem to be solved. Summary of the Invention

[0008] This application provides a DNS domain name resolution method and related apparatus to ensure that DNSSEC can select the best signature algorithm. By employing cryptographic suites and setting the priority between quantum signature algorithms and traditional signature algorithms, the integrity and security of data in DNS are ensured.

[0009] Firstly, this application provides a Domain Name System (DNC) domain name resolution method, the method comprising:

[0010] The root server receives a domain name query request sent by the DNS server, and obtains multiple cipher suites supported by the DNS server from the domain name query request; wherein each cipher suite represents: a traditional signature algorithm or a post-quantum signature algorithm supported by the DNS server;

[0011] The root server selects a target cryptographic suite from the plurality of cryptographic suites based on the signature algorithms it supports; wherein the target cryptographic suite includes: a traditional signature algorithm or a post-quantum signature algorithm supported by the root server;

[0012] The root server selects target signature algorithms that meet priority conditions from the target cryptographic suite, and performs digital signature on the first-level domain name obtained based on the domain name query request according to the target signature algorithm to obtain the signed first-level domain name.

[0013] The root server sends the signed top-level domain name and the target cipher suite to the resolution server, so that the resolution server performs digital signature verification on the signed top-level domain name based on the target signature algorithm in the target cipher suite, and obtains the top-level domain name after successful signature verification.

[0014] In one optional implementation, the post-quantum signature algorithm has a first priority, and the conventional signature algorithm has a second priority; wherein the first priority is higher than the second priority.

[0015] In one optional implementation, the root server selects a target cipher suite from the plurality of cipher suites based on the signature algorithms it supports, including:

[0016] For each of the aforementioned cipher suites, perform the following operations respectively:

[0017] The root server obtains the public key hash values ​​of each of the multiple signature algorithms contained in a cryptographic suite, as well as the public key hash value corresponding to each signature algorithm; wherein, each public key hash value represents: the type of the corresponding signature algorithm;

[0018] If the public key hash value of each of the multiple signature algorithms contains the public key hash value of each signature algorithm, then the one cipher suite is used as the target cipher suite.

[0019] In one optional implementation, the root server sends the signed top-level domain name and the target cipher suite to the resolution server, so that the resolution server performs digital signature verification on the signed top-level domain name based on the target signature algorithm in the target cipher suite. After obtaining the successfully verified top-level domain name, the process further includes:

[0020] The root server instructs the DNS server to send a domain name query request to the first-level sub-server of the root server, so that the DNS server receives the second-level domain name digitally signed by the first-level sub-server based on the domain name query request, and performs digital signature verification on the digitally signed second-level domain name to obtain the second-level domain name after successful verification; wherein, the domain name information completeness corresponding to the second-level domain name after successful verification is greater than the domain name information completeness corresponding to the first-level domain name after successful verification.

[0021] In one optional implementation, the DNS server is instructed to send a domain name query request to a first-level sub-server of the root server, so that the DNS server receives the second-level domain name digitally signed by the first-level sub-server based on the domain name query request, and performs digital signature verification on the digitally signed second-level domain name. After obtaining the successfully verified second-level domain name, the method further includes:

[0022] The root server instructs the DNS server to send a third-level domain name query request to the second-level sub-server of the root server, so that the DNS server receives the third-level domain name after the second-level server digitally signs the domain name query request, and performs digital signature verification on the digitally signed second-level domain name to obtain the second-level domain name after successful signature verification; wherein the domain name information completeness corresponding to the third-level domain name after successful signature verification is greater than the domain name information completeness corresponding to the second-level domain name after successful signature verification.

[0023] Secondly, this application provides a Domain Name System (DNS) domain name resolution device, the device comprising:

[0024] The receiving module is used for the root server to receive a domain name query request sent by the resolution server, and to obtain multiple cryptographic suites supported by the resolution server from the domain name query request; wherein each cryptographic suite represents: a traditional signature algorithm and / or a post-quantum signature algorithm supported by the resolution server;

[0025] The selection module is used by the root server to select a target cryptographic suite from the plurality of cryptographic suites based on the signature algorithms it supports; wherein the target cryptographic suite includes: a traditional signature algorithm or a post-quantum signature algorithm supported by the root server;

[0026] The first processing module is used for the root server to filter out target signature algorithms that meet priority conditions from the target cryptographic suite, and to digitally sign the first-level domain name obtained based on the domain name query request according to the target signature algorithm, so as to obtain the signed first-level domain name.

[0027] The second processing module is used by the root server to send the signed top-level domain name and the target cipher suite to the parsing server, so that the parsing server performs digital signature verification on the signed top-level domain name based on the target signature algorithm in the target cipher suite, and obtains the top-level domain name after successful verification.

[0028] In one optional implementation, the post-quantum signature algorithm has a first priority, and the conventional signature algorithm has a second priority; wherein the first priority is higher than the second priority.

[0029] In one optional implementation, the root server selects a target cipher suite from the plurality of cipher suites based on the signature algorithms it supports, wherein the selection module is specifically used for:

[0030] For each of the aforementioned cipher suites, perform the following operations respectively:

[0031] The root server obtains the public key hash values ​​of each of the multiple signature algorithms contained in a cryptographic suite, as well as the public key hash values ​​corresponding to each signature algorithm; wherein, each public key hash value represents: the type of the corresponding signature algorithm;

[0032] If the public key hash value of each of the multiple signature algorithms contains the public key hash value of each signature algorithm, then the one cipher suite is used as the target cipher suite.

[0033] In one optional implementation, the root server sends the signed top-level domain name and the target cipher suite to the resolution server, so that the resolution server performs digital signature verification on the signed top-level domain name based on the target signature algorithm in the target cipher suite. After obtaining the successfully verified top-level domain name, the second processing module is further configured to:

[0034] The root server instructs the DNS server to send a domain name query request to the first-level sub-server of the root server, so that the DNS server receives the encrypted second-level domain name based on the domain name query request from the first-level sub-server, and performs digital signature decryption on the encrypted second-level domain name to obtain the decrypted second-level domain name; wherein, the domain name information completeness corresponding to the decrypted second-level domain name is greater than the domain name information completeness corresponding to the decrypted first-level domain name.

[0035] In one optional implementation, the DNS server is instructed to send a domain name query request to a first-level sub-server of the root server, so that the DNS server receives the second-level domain name digitally signed by the first-level sub-server based on the domain name query request, and performs digital signature verification on the digitally signed second-level domain name. After obtaining the successfully verified second-level domain name, the second processing module is further configured to:

[0036] The root server instructs the DNS server to send a third-level domain name query request to the second-level sub-server of the root server, so that the DNS server receives the third-level domain name after the second-level server digitally signs the domain name query request, and performs digital signature verification on the digitally signed second-level domain name to obtain the third-level domain name after successful signature verification; wherein, the domain name information completeness corresponding to the successfully verified third-level domain name is greater than the domain name information completeness corresponding to the successfully verified second-level domain name.

[0037] Thirdly, this application provides an electronic device, comprising:

[0038] Memory, used to store computer programs;

[0039] When a processor executes a computer program stored in the memory, it implements the steps of the DNS domain name resolution method described above.

[0040] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the aforementioned DNS domain name resolution method.

[0041] Through the technical solutions in one or more of the above embodiments of this application, the embodiments of this application have at least the following beneficial effects:

[0042] In the DNS domain name resolution method provided in this application embodiment, firstly, the root server receives a domain name query request sent by the resolution server, obtains multiple cipher suites supported by the resolution server from the domain name query request, and then selects a target cipher suite from the multiple cipher suites according to the signature algorithms it supports. In this way, the root server can select the best cipher suite. Further, the root server filters out the target signature algorithm that meets the priority conditions from the target cipher suite, and performs digital signature on the first-level domain name obtained based on the domain name query request according to the target signature algorithm to obtain the signed first-level domain name. Finally, the root server sends the signed first-level domain name and the target cipher suite to the resolution server, so that the resolution server performs digital signature verification on the signed first-level domain name based on the target signature algorithm in the target cipher suite to obtain the first-level domain name after successful verification.

[0043] By setting up cipher suites and prioritizing post-quantum signature algorithms over traditional signature algorithms, and when DNSSEC is able to use post-quantum signature algorithms, digital signatures will be made using post-quantum signature algorithms. This ensures that both parties can use the best signature algorithm, accelerates the migration from traditional signature algorithms to post-quantum signature algorithms, and guarantees the availability, compatibility, and security of DNS services.

[0044] Furthermore, it avoids the limitation of related technologies that can only set traditional signature algorithms or post-quantum signature algorithms for DNSSEC separately.

[0045] For the various aspects of the second to fourth aspects mentioned above, and the technical effects that each aspect may achieve, please refer to the above description of the technical effects that can be achieved for the first aspect and the various possible solutions in the first aspect. They will not be repeated here. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0047] Figure 1 A schematic diagram of a system architecture provided for an embodiment of this application;

[0048] Figure 2 A schematic diagram illustrating the implementation process of a DNS domain name resolution method provided in this application embodiment;

[0049] Figure 3 A schematic diagram illustrating the implementation process of a method for selecting a target cipher suite, provided in an embodiment of this application;

[0050] Figure 4 This application provides an interactive diagram illustrating the DNS domain name resolution process.

[0051] Figure 5 This is a schematic diagram of a DNS domain name resolution device provided in an embodiment of this application;

[0052] Figure 6 This is a schematic diagram of an electronic device structure provided in an embodiment of this application. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this application. Obviously, the described embodiments are only some embodiments of the technical solutions of this application, and not all embodiments. Based on the embodiments recorded in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the technical solutions of this application.

[0054] It should be noted that in the description of this application, "multiple" is understood as "at least two". "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. A connected to B can represent: A and B directly connected, or A and B connected through C. Furthermore, in the description of this application, terms such as "first" and "second" are used only for descriptive purposes and should not be construed as indicating or implying relative importance or order.

[0055] The following explanations of some technical terms used in the embodiments of this application are provided to facilitate understanding by those skilled in the art.

[0056] (1) Digital signature: also known as public key digital signature, is a string of numbers that can only be generated by the sender of the information and cannot be forged by others. This string of numbers is also a valid proof of the authenticity of the information.

[0057] (2) Hash value: also known as hash value, is the value calculated by a one-way hash function based on the content of a message, and can be used to check the integrity of a message.

[0058] Furthermore, based on the above explanation of technical terms, the design concept of the embodiments of this application will be briefly introduced below:

[0059] Currently, most signature algorithms used in DNSSEC are traditional signature algorithms, such as RSA and ECDSA encryption algorithms. However, with the rapid development of Shor's quantum algorithm and quantum computing, the powerful computing capabilities and speed of quantum algorithms pose a risk that traditional signature algorithms can be cracked by quantum algorithms. In other words, the traditional signature algorithms used by DNSSEC are no longer completely resistant to quantum algorithm attacks.

[0060] Although Post-Quantum Cryptography (PQC) is a new generation of signature algorithms that can resist quantum computing attacks on existing signature algorithms and ensure the security of signature algorithms in a quantum environment, DNSSEC is not currently fully capable of using PQC.

[0061] For example, the current DNSSEC can only set a traditional signature algorithm or a post-quantum cryptography algorithm separately, and cannot select the best signature algorithm suitable for DNSSEC based on DNSSEC's compatibility with signature algorithms.

[0062] Therefore, it is currently impossible to select the best signature algorithm for DNSSEC to ensure data security and integrity and to achieve domain name resolution.

[0063] In view of this, in order to select the best signature algorithm for DNSSEC and ensure that DNSSEC directly selects the post-quantum signature algorithm instead of the traditional signature algorithm when it is available, this application proposes a DNS domain name resolution method, which specifically includes: First, the root server receives a domain name query request sent by the resolution server and obtains multiple cipher suites supported by the resolution server from the domain name query request; wherein each cipher suite represents either a traditional signature algorithm or a post-quantum signature algorithm supported by the resolution server; then, the root server selects a target cipher suite from the multiple cipher suites according to the signature algorithms it supports; wherein the target cipher suite includes either a traditional signature algorithm or a post-quantum signature algorithm supported by the root server; further, the root server filters out the target signature algorithm that meets the priority conditions from the target cipher suite, and performs a digital signature on the first-level domain name obtained based on the domain name query request according to the target signature algorithm to obtain the signed first-level domain name; finally, the root server sends the signed first-level domain name and the target cipher suite to the resolution server, so that the resolution server performs a digital signature verification on the signed first-level domain name based on the target signature algorithm in the target cipher suite to obtain the verified first-level domain name.

[0064] It should be noted that the preferred embodiments of this application are described below with reference to the accompanying drawings. The preferred embodiments described herein are only for illustration and explanation and are not intended to limit this application. Furthermore, the embodiments of this application and the features thereof can be combined with each other without conflict.

[0065] See Figure 1 The diagram shown is a schematic representation of a system architecture provided in an embodiment of this application. This system architecture includes a target terminal 101 and a server 102 (including server 1021, server 1022, server 1023…server 102n). The target terminal 101 and the server 102 can interact via a communication network. The communication network can utilize both wireless and wired communication methods.

[0066] For example, the target terminal 101 can access the network and communicate with the server 102 through cellular mobile communication technology, wherein the cellular mobile communication technology includes, for example, 5th Generation Mobile Networks (5G) technology.

[0067] Optionally, the target terminal can access the network and communicate with the server 102 via short-range wireless communication, wherein the short-range wireless communication method includes, for example, Wireless Fidelity (Wi-Fi) technology.

[0068] This application embodiment does not impose any limitation on the number of communication devices involved in the above system architecture. For example, there may be more target terminals, or no target terminals, or other network devices may be included, such as... Figure 1 As shown, only the target terminal 101 and server 102 are described as examples. The following is a brief introduction to each of the above devices and their respective functions.

[0069] The target terminal 101 is a device that can provide users with voice and / or data connectivity and can support wired and / or wireless connection methods.

[0070] For example, the target terminal 101 includes, but is not limited to: mobile phones, tablets, laptops, handheld computers, mobile internet devices (MID), wearable devices, virtual reality (VR) devices, augmented reality (AR) devices, etc.

[0071] Furthermore, the target terminal 101 may have a related client installed. This client can be software, such as an application (APP), browser, short video software, or a webpage, mini-program, etc. In this embodiment, the target terminal 101 can use the aforementioned client related to the front-end page to send a DNS domain name resolution request to the server 102.

[0072] Server 102 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0073] It should be noted that, in the embodiments of this application, server 102 includes, but is not limited to: a DNS resolution server, a root server, first-level sub-servers of the root server, and second-level sub-servers of the root server. The DNS domain name resolution method provided in the embodiments of this application will be described below in conjunction with the above system architecture and with reference to the accompanying drawings. It should be noted that the above system architecture is only shown to facilitate understanding of the spirit and principles of this application, and the implementation of this application is not limited in any way in this respect.

[0074] See Figure 2 The diagram shown illustrates the implementation flow of a DNS domain name resolution method provided in this application embodiment. The specific implementation flow of this method is as follows:

[0075] S1: The root server receives the domain name query request sent by the DNS server and obtains multiple cipher suites supported by the DNS server from the domain name query request.

[0076] In this embodiment, a post-quantum signature algorithm that is resistant to quantum computing is used to enhance DNSSEC. Depending on the specific implementation of DNSSEC, the best signature algorithm is selected in the form of a cryptographic suite to ensure the security and integrity of the data.

[0077] Specifically, the root server receives the domain name query request sent by the DNS server through the communication network. In the domain name query request sent by the DNS server, the root server can obtain multiple cipher suites supported by the DNS server.

[0078] In this embodiment, each cryptographic suite represents either a conventional signature algorithm or a post-quantum signature algorithm supported by the parsing server. For example, cryptographic suite A includes only the conventional signature algorithm: RSA_SHA256, and cryptographic suite B includes only the post-quantum signature algorithm: FALCON_SHA256.

[0079] It should be noted that the signature algorithms in the above-mentioned cryptographic suite are merely illustrative examples. Other signature algorithms may also be included in the cryptographic suite. This application does not specifically limit the signature algorithm used for encryption.

[0080] For example, the root server receives a domain name query request for www.example.com from the DNS server. The DNS server includes multiple cipher suites it supports in the address query request, such as a combination of cipher suites A and B. Thus, the root server can obtain information about the multiple cipher suites supported by the DNS server.

[0081] S2: The root server selects the target cipher suite from multiple cipher suites based on the signature algorithms it supports.

[0082] In one alternative implementation, see [reference] Figure 3 As shown, the root server selects a target cipher suite from multiple cipher suites based on the signature algorithms it supports, including the following steps:

[0083] For each of the multiple cipher suites, perform the following operations:

[0084] S21: The root server obtains the public key hashes of the multiple signature algorithms contained in a cipher suite, as well as the public key hashes of each signature algorithm.

[0085] S22: If the public key hash values ​​of multiple signature algorithms each contain the public key hash values ​​of each signature algorithm, then a cipher suite is used as the target cipher suite.

[0086] Specifically, DNSSEC stores DS records (Delegation Signer, DS): these records are used to store the public key hash of the DNSSEC signature algorithm.

[0087] Furthermore, the cryptographic suite includes multiple signature algorithms, each corresponding to a public key hash value. For example, the public key hash value corresponding to the FALCON signature algorithm is: 900111111cd24fb0d1111f1d11e11f11, the public key hash value corresponding to the RSA signature algorithm is: 900222222cd36fb0d2222f2d22e22f22, and the public key hash value corresponding to the SHA256 signature algorithm is: 900333333cd48fb0d3333f3d33e33f33.

[0088] Furthermore, for example, if the public key hash values ​​corresponding to the various signature algorithms supported by the root server are 900111111cd24fb0d1111f1d11e11f11 and 900222222cd36fb0d2222f2d22e22f22, then the signature algorithms supported by the root server are the FALCON signature algorithm and the RSA signature algorithm.

[0089] The root server compares the public key hash values ​​of each signature algorithm it supports with the hash values ​​of the signature algorithms in a cipher suite it has obtained. If the public key hash value of a signature algorithm in a cipher suite contains the public key hash values ​​of each signature algorithm supported by the root server, then that cipher suite is selected as the target cipher suite.

[0090] It should be noted that in this embodiment of the application, the priority of the post-quantum signature algorithm is higher than that of the traditional signature algorithm. Therefore, when a certain cryptographic suite contains the post-quantum signature algorithm and the root server also supports the corresponding post-quantum signature algorithm, the cryptographic suite containing the post-quantum signature algorithm is taken as the target cryptographic suite.

[0091] For example, a cipher suite A supported by the parsing server includes both the FALCON and SHA256 signature algorithms, and the root server also supports both FALCON and SHA256 signature algorithms. By comparing the public key hash values ​​of each signature algorithm, if it is determined that cipher suite A supported by the parsing server includes the signature algorithms supported by the root server, then cipher suite A is selected as the target cipher suite.

[0092] S3: The root server selects the target signature algorithm that meets the priority conditions from the target cipher suite, and performs digital signature on the first-level domain obtained from the domain name query request according to the target signature algorithm to obtain the signed first-level domain.

[0093] In this embodiment of the application, after determining the target cryptographic suite of the root server, the target signature algorithm for digital signature is selected according to the priority of the signature algorithm.

[0094] Specifically, in the embodiments of this application, the priority of the post-quantum signature algorithm is the first priority, the priority of the traditional signature algorithm is the second priority, and the first priority is higher than the second priority.

[0095] For example, the target cipher suite of the root server includes both post-quantum signature algorithms and traditional signature algorithms. The target signature algorithm used for encryption is determined based on the priority of each signature algorithm in the target cipher suite. Since the post-quantum signature algorithm has a higher priority than the traditional signature algorithm, the post-quantum signature algorithm in the target cipher suite is directly selected.

[0096] Furthermore, after obtaining the target signature algorithm used by the root server to digitally sign domain name information, the target signature algorithm is used to digitally sign the first-level domain name obtained based on the domain name query request, resulting in the signed first-level domain name.

[0097] For example, after receiving a domain name query request for www.example.com from a DNS server, the root server retrieves the top-level domain (.com) from the DNS server's query request. The query request includes cipher suites supported by the DNS server, such as the aforementioned combination of cipher suites A and B. The root server compares its supported cipher suites with those supported by the DNS server, and uses the public key hash value of the signature algorithm to select cipher suites supported by both the root server and the DNS server. Then, based on the priority of the signature algorithm within the corresponding cipher suites, the target signature algorithm for encryption is determined.

[0098] For example, if both the root server and the DNS server support cipher suite A and cipher suite B, where cipher suite A includes the FALCON post-quantum signature algorithm and cipher suite B includes the RSA traditional signature algorithm, and the FALCON post-quantum signature algorithm has a higher priority than the RSA traditional signature algorithm, then the FALCON post-quantum signature algorithm from cipher suite A is selected as the target signature algorithm. Furthermore, the FALCON post-quantum signature algorithm is used to digitally sign the queried top-level domain name.

[0099] In the embodiments of this application, the method of encryption using a signature algorithm is not specifically described.

[0100] S4: The root server sends the signed top-level domain name and the target cipher suite to the resolution server, so that the resolution server can perform digital signature verification on the signed top-level domain name based on the target signature algorithm in the target cipher suite, and obtain the top-level domain name after successful signature verification.

[0101] In this embodiment, the root server digitally signs the queried top-level domain using the target signature algorithm in the target cipher suite, obtaining a signed top-level domain. Then, the root server sends the signed top-level domain and the target suite to the resolution server, enabling the resolution server to digitally verify the encrypted top-level domain using the target signature algorithm in the target cipher suite, thus obtaining a successfully verified top-level domain.

[0102] For example, when the root server retrieves a top-level domain, it selects cipher suite A as the target cipher suite and chooses the FALCON post-quantum signature algorithm as the target signature algorithm based on the priority of signature algorithms. It then uses the FALCON post-quantum signature algorithm to digitally sign the retrieved top-level domain. The signed top-level domain and the target cipher suite are then sent to the resolution server. Since digital signing and verification of the top-level domain require the same signature algorithm, the resolution server verifies the signed top-level domain using the target signature algorithm selected by the root server from the target cipher suite.

[0103] In other words, when the root server selects the FALCON post-quantum signature algorithm in cryptographic suite A to digitally sign the top-level domain name, the corresponding resolution server also selects the FALCON post-quantum signature algorithm in cryptographic suite A to verify the digital signature, thus obtaining the top-level domain name after successful verification.

[0104] In one optional implementation, the root server sends the signed domain name and target cipher suite to the resolution server, performs digital signature verification on the signed top-level domain name, and after obtaining the successfully verified top-level domain name, further includes:

[0105] Specifically, the root server sends the encrypted top-level domain name to the resolution server, and the resolution server verifies the digital signature of the received digitally signed top-level domain name using the corresponding signature algorithm to obtain the domain name after successful verification.

[0106] Furthermore, the root server instructs the DNS server to send a domain name query request for www.example.com to the root server's first-level sub-server, so that the DNS server receives the encrypted second-level domain name and the cipher suite supported by the root server's first-level sub-server based on the domain name query request.

[0107] Then, the resolution server uses the target signature algorithm from the target cipher suite supported by the root server's first-level sub-server to digitally verify the signature of the second-level domain, obtaining the successfully verified second-level domain. In this embodiment, the domain information completeness of the successfully verified second-level domain is greater than that of the successfully verified first-level domain. For example, the successfully verified first-level domain is .com, while the successfully verified second-level domain is example.com.

[0108] In one optional implementation, after instructing the DNS server to send a domain name query request to a first-level sub-server of the root server, so that the DNS server receives the second-level domain name digitally signed by the first-level sub-server based on the domain name query request, and performs digital signature verification on the signed second-level domain name to obtain the successfully verified second-level domain name, the method further includes:

[0109] First, the root server instructs the DNS server to send a third-level domain name query request to the second-level sub-server of the root server, so that the DNS server can receive the query request based on the www.example.com domain name from the second-level sub-server, and receive the digitally signed third-level domain name and the cipher suite supported by the second-level sub-server of the root server.

[0110] Furthermore, the resolution server uses the target signature algorithm from the target cipher suite supported by the second-level sub-server of the root server to digitally verify the digital signature of the third-level domain name, obtaining the successfully verified second-level domain name. In this embodiment, the domain name information completeness corresponding to the successfully verified third-level domain name is greater than that corresponding to the successfully verified second-level domain name. For example, the successfully verified second-level domain name is example.com, while the successfully verified third-level domain name is www.example.com.

[0111] See Figure 4 The diagram illustrates an interactive DNS domain name resolution process according to an embodiment of this application. In this embodiment, the root server receives a domain name query request from the resolution server and sends a digitally signed first-level domain name and a target cipher suite to the resolution server. Then, the root server instructs the resolution server to send a domain name query request to its first-level sub-servers, so that the resolution server receives the digitally signed second-level domain name and the target cipher suite supported by the second-level sub-server. Finally, the root server instructs the resolution server to send a domain name query request to its second-level sub-servers, so that the resolution server receives the digitally signed second-level domain name and the target cipher suite supported by the second-level sub-server. The final DNS domain name resolution result is obtained through this step-by-step query process.

[0112] In the aforementioned DNS domain name resolution and digital signature verification process, DNSSEC employs a cryptographic suite to ensure that, when a post-quantum signature algorithm is available, it is selected based on the priority between the post-quantum signature algorithm and the traditional signature algorithm, thereby ensuring the security of the data source throughout the entire resolution path of the domain name www.example.com.

[0113] Based on the same inventive concept, this application also includes a DNS domain name resolution device in its embodiments, see below. Figure 5As shown, the device includes: a receiving module 501, a selection module 502, a first processing module 503, and a second processing module 504; wherein,

[0114] The receiving module 501 is used for the root server to receive the domain name query sent by the resolution server, and to obtain multiple cipher suites supported by the resolution server from the domain name query request; wherein each cipher suite represents: the traditional signature algorithm and / or the post-quantum signature algorithm supported by the resolution server;

[0115] Selection module 502 is used by the root server to select a target cipher suite from multiple cipher suites based on the signature algorithms it supports; wherein the target cipher suite includes: traditional signature algorithms or post-quantum signature algorithms supported by the root server;

[0116] The first processing module 503 is used by the root server to filter out target signature algorithms that meet the priority conditions from the target cipher suite, and to digitally sign the first-level domain name obtained based on the domain name query request according to the target signature algorithm, so as to obtain the signed first-level domain name.

[0117] The second processing module 504 is used by the root server to send the signed first-level domain name and the target cipher suite to the parsing server, so that the parsing server performs digital signature verification on the signed first-level domain name based on the target signature algorithm in the target cipher suite, and obtains the first-level domain name after successful verification.

[0118] In one alternative implementation, the post-quantum signature algorithm has a first priority, and the traditional signature algorithm has a second priority; wherein the first priority is higher than the second priority.

[0119] In one optional implementation, the root server selects a target cipher suite from the plurality of cipher suites based on the signature algorithms it supports, wherein the selection module 502 is specifically used for:

[0120] For each of the multiple cipher suites, perform the following operations:

[0121] The root server obtains the public key hashes of the multiple signature algorithms contained in a cipher suite, as well as the public key hashes corresponding to each signature algorithm; where each public key hash represents the type of the corresponding signature algorithm.

[0122] If the public key hash values ​​of multiple signature algorithms each contain the public key hash values ​​of each signature algorithm, then one cipher suite is selected as the target cipher suite.

[0123] In an optional implementation, the root server sends the signed top-level domain name and the target cipher suite to the resolution server, so that the resolution server performs digital signature verification on the signed top-level domain name based on the target signature algorithm in the target cipher suite. After obtaining the successfully verified top-level domain name, the second processing module 504 is further configured to:

[0124] The root server instructs the DNS server to send a domain name query request to the root server's first-level sub-servers. This allows the DNS server to receive the second-level domain name digitally signed by the first-level sub-server based on the domain name query request, and to verify the digital signature of the second-level domain name to obtain the verified second-level domain name. The domain name information completeness of the verified second-level domain name is greater than that of the verified first-level domain name.

[0125] In one optional implementation, the DNS server is instructed to send a domain name query request to a first-level sub-server of the root server, so that the DNS server receives the second-level domain name digitally signed by the first-level sub-server based on the domain name query request, and performs digital signature verification on the digitally signed second-level domain name. After obtaining the verified second-level domain name, the second processing module 504 is further configured to:

[0126] The root server instructs the DNS server to send a third-level domain name query request to the second-level sub-server of the root server. This allows the DNS server to receive the third-level domain name after the second-level server has digitally signed the domain name query request. The DNS server then performs digital signature verification on the second-level domain name after successful signature verification to obtain the third-level domain name after successful signature verification. The domain name information completeness of the third-level domain name after successful signature verification is greater than that of the domain name information completeness of the second-level domain name after successful signature verification.

[0127] It should be noted that the apparatus provided in this application embodiment can implement all the method steps in the above DNS domain name resolution method embodiment and achieve the same technical effect. Here, the parts and beneficial effects that are the same as those in the method embodiment will not be described in detail.

[0128] Based on the same inventive concept, this application also provides an electronic device that can implement the functions of the aforementioned DNS domain name resolution method, see reference. Figure 6 As shown, the electronic device includes:

[0129] At least one processor 601 and a memory 602 connected to at least one processor 601. In this embodiment, the specific connection medium between the processor 601 and the memory 602 is not limited. Figure 6 The example shown is the connection between processor 601 and memory 602 via bus 600. Bus 600 is... Figure 6The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. The 600 bus can be divided into address bus, data bus, control bus, etc., for ease of representation. Figure 6 The term is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, the processor 601 can also be called a controller; there is no restriction on the name.

[0130] In this embodiment, memory 602 stores instructions executable by at least one processor 601. By executing the instructions stored in memory 602, at least one processor 601 can perform the DNS domain name resolution method discussed above. Processor 601 can implement... Figure 5 The functions of each module in the device shown.

[0131] The processor 601 is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory 602 and calling data stored in memory 602, the processor can perform various functions and process data, thereby monitoring the device as a whole.

[0132] In one possible design, processor 601 may include one or more processing units. Processor 601 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into processor 601. In some embodiments, processor 601 and memory 602 may be implemented on the same chip; in some embodiments, they may also be implemented on separate chips.

[0133] Processor 601 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the DNS domain name resolution method disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0134] Memory 602, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 602 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 602 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 602 may also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0135] By designing and programming the processor 601, the code corresponding to the DNS domain name resolution method described in the foregoing embodiments can be embedded into the chip, enabling the chip to execute it during operation. Figure 2 The steps of the DNS domain name resolution method in the illustrated embodiment are as follows. How to design and program the processor 601 is a technique well-known to those skilled in the art and will not be described further here.

[0136] Based on the same inventive concept, embodiments of this application also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform the DNS domain name resolution method described above.

[0137] In some possible implementations, various aspects of the DNS domain name resolution method provided in this application can also be implemented in the form of a program product, which includes program code that, when the program product is run on a device, causes the control device to perform the steps in the DNS domain name resolution method according to the various exemplary embodiments of this application described above.

[0138] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0139] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0140] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0141] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0142] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A Domain Name System (DNS) domain name resolution method, characterized in that, The method includes: The root server receives a domain name query request sent by the DNS server, and obtains multiple cipher suites supported by the DNS server from the domain name query request; wherein each cipher suite represents: a traditional signature algorithm or a post-quantum signature algorithm supported by the DNS server; The root server selects a target cryptographic suite from the plurality of cryptographic suites based on the signature algorithms it supports; wherein the target cryptographic suite includes: traditional signature algorithms and / or post-quantum signature algorithms supported by the root server; The root server selects target signature algorithms that meet priority conditions from the target cryptographic suite, and performs digital signature on the first-level domain name obtained based on the domain name query request according to the target signature algorithm to obtain the signed first-level domain name. The root server sends the signed top-level domain name and the target cipher suite to the resolution server, so that the resolution server performs digital signature verification on the signed top-level domain name based on the target signature algorithm in the target cipher suite, and obtains the top-level domain name after successful signature verification.

2. The method as described in claim 1, characterized in that, The post-quantum signature algorithm has a first priority, and the traditional signature algorithm has a second priority; wherein the first priority is higher than the second priority.

3. The method as described in claim 1, characterized in that, The root server selects a target cipher suite from the plurality of cipher suites based on the signature algorithms it supports, including: For each of the aforementioned cipher suites, perform the following operations respectively: The root server obtains the public key hash values ​​of each of the multiple signature algorithms contained in a cryptographic suite, as well as the public key hash value corresponding to each signature algorithm; wherein, each public key hash value represents: the type of the corresponding signature algorithm; If the public key hash value of each of the multiple signature algorithms contains the public key hash value of each signature algorithm, then the one cipher suite is used as the target cipher suite.

4. The method as described in claim 1, characterized in that, The root server sends the signed top-level domain name and the target cipher suite to the resolution server, so that the resolution server performs digital signature verification on the signed top-level domain name based on the target signature algorithm in the target cipher suite. After obtaining the successfully verified top-level domain name, the process further includes: The root server instructs the DNS server to send a domain name query request to the first-level sub-server of the root server, so that the DNS server receives the second-level domain name digitally signed by the first-level sub-server based on the domain name query request, and performs digital signature verification on the digitally signed second-level domain name to obtain the second-level domain name after successful verification; wherein, the domain name information completeness corresponding to the second-level domain name after successful verification is greater than the domain name information completeness corresponding to the first-level domain name after successful verification.

5. The method as described in claim 4, characterized in that, The DNS server is instructed to send a domain name query request to a first-level sub-server of the root server, so that the DNS server receives the second-level domain name digitally signed by the first-level sub-server based on the domain name query request, and performs digital signature verification on the digitally signed second-level domain name. After obtaining the successfully verified second-level domain name, the DNS server further includes: The root server instructs the DNS server to send a third-level domain name query request to the second-level sub-server of the root server, so that the DNS server receives the third-level domain name after digitally signing the domain name query request based on the second-level server, and performs digital signature verification on the digitally signed second-level domain name to obtain the third-level domain name after successful verification; wherein, the domain name information completeness corresponding to the successfully verified third-level domain name is greater than the domain name information completeness corresponding to the successfully verified second-level domain name.

6. A Domain Name System (DNS) domain name resolution device, characterized in that, The device includes: The receiving module is used for the root server to receive a domain name query request sent by the resolution server, and to obtain multiple cryptographic suites supported by the resolution server from the domain name query request; wherein each cryptographic suite represents: a traditional signature algorithm or a post-quantum signature algorithm supported by the resolution server; The selection module is used by the root server to select a target cryptographic suite from the plurality of cryptographic suites based on the signature algorithms it supports; wherein the target cryptographic suite includes: a traditional signature algorithm or a post-quantum signature algorithm supported by the root server; The first processing module is used for the root server to filter out target signature algorithms that meet priority conditions from the target cryptographic suite, and to digitally sign the first-level domain name obtained based on the domain name query request according to the target signature algorithm, so as to obtain the signed first-level domain name. The second processing module is used by the root server to send the signed top-level domain name and the target cipher suite to the parsing server, so that the parsing server performs digital signature verification on the signed top-level domain name based on the target signature algorithm in the target cipher suite, and obtains the top-level domain name after successful verification.

7. The apparatus as claimed in claim 6, characterized in that, The post-quantum signature algorithm has a first priority, and the traditional signature algorithm has a second priority; wherein the first priority is higher than the second priority.

8. The apparatus as claimed in claim 6, characterized in that, The root server selects a target cipher suite from the plurality of cipher suites based on the signature algorithms it supports. The selection module is specifically used for: For each of the aforementioned cipher suites, perform the following operations respectively: The root server obtains the public key hash values ​​of each of the multiple signature algorithms contained in a cryptographic suite, as well as the public key hash values ​​corresponding to each signature algorithm; wherein, each public key hash value represents: the type of the corresponding signature algorithm; If the public key hash value of each of the multiple signature algorithms contains the public key hash value of each signature algorithm, then the one cipher suite is used as the target cipher suite.

9. The apparatus as claimed in claim 6, characterized in that, The root server sends the signed top-level domain name and the target cipher suite to the parsing server, so that the parsing server performs digital signature verification on the signed top-level domain name based on the target signature algorithm in the target cipher suite. After obtaining the successfully verified top-level domain name, the second processing module is further configured to: The root server instructs the DNS server to send a domain name query request to the first-level sub-server of the root server, so that the DNS server receives the second-level domain name digitally signed by the first-level sub-server based on the domain name query request, and performs digital signature verification on the digitally signed second-level domain name to obtain the second-level domain name after successful verification; wherein, the domain name information completeness corresponding to the second-level domain name after successful verification is greater than the domain name information completeness corresponding to the first-level domain name after successful verification.

10. The apparatus as claimed in claim 6, characterized in that, The second processing module instructs the DNS server to send a domain name query request to a first-level sub-server of the root server, so that the DNS server receives the second-level domain name digitally signed by the first-level sub-server based on the domain name query request, and performs digital signature verification on the digitally signed second-level domain name. After obtaining the successfully verified second-level domain name, the second processing module is further configured to: The root server instructs the DNS server to send a third-level domain name query request to the second-level sub-server of the root server, so that the DNS server receives the third-level domain name after digitally signing the domain name query request based on the second-level server, and performs digital signature verification on the digitally signed second-level domain name to obtain the third-level domain name after successful verification; wherein, the domain name information completeness corresponding to the successfully verified third-level domain name is greater than the domain name information completeness corresponding to the successfully verified second-level domain name.

11. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, when executing a computer program stored in the memory, implements the steps of the method according to any one of claims 1-5.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 1-5.

Images