A blockchain-based DoH system and DNS query method

Abstract

This application discloses a blockchain-based Domain Name Query (DoH) system and DNS query method. The system includes a controller, DoH clients, and a blockchain network composed of multiple DoH server nodes. The controller verifies the DoH clients and then sends client information to the DoH server nodes. The server nodes only provide domain name query services to qualified DoH clients, solving the problem of secure access for domain name queries. The controller allocates servers for requesting domain name data to clients based on location distance and network congestion, improving the domain name resource access rate and solving the problems of high latency and slow speed in domain name queries caused by long-distance access. Synchronizing domain name data through the blockchain network prevents illegal tampering of domain name data and enhances the credibility of the domain name data.

Description

Technical Field

[0001] This application relates to the field of domain name query technology, and in particular to a DoH system and DNS query method. Background Technology

[0002] DNS over HTTPS (DoH) is a security mechanism that encapsulates traditional DNS (Domain Name System) queries within HTTPS for transmission. The client encapsulates the traditional DNS query request within the HTTPS protocol. This process involves placing the data portion of the DNS query into the payload of the HTTPS request and encrypting the entire request. The encrypted DNS query request is transmitted via TLS (Transport Layer Security) using the standard HTTPS port (443). Upon reaching the target server, the server parses the DNS query request and encapsulates the corresponding DNS records in an HTTPS response, returning it to the client. Therefore, compared to traditional, unencrypted, and insecure DNS based on UDP, DNS data encrypted using the DoH mechanism prevents eavesdroppers from directly obtaining user privacy information through listening or other means, thus providing confidentiality guarantees for domain name resolution.

[0003] However, the DoH mechanism also has some shortcomings:

[0004] 1. DoH uses the default port 443 for HTTPS, which hides data packets in ordinary HTTPS traffic. DNS requests are not easily identified, which poses an HTTP attack risk.

[0005] 2. Users who are far from the DoH server usually face longer resolution paths and higher latency.

[0006] 3. DoH servers have low trustworthiness and are susceptible to illegal data tampering. Because DoH servers are usually operated by third parties, clients need to trust these servers to accept the DNS resolution results they return. If clients do not know or trust the identity and trustworthiness of the server, they may be attacked by malicious servers, resulting in the return of false or tampered DNS resolution results. Furthermore, if a malicious operator controls the DoH server to modify the domain name data, it will also return false DNS resolution results, leading users to visit incorrect websites or launching phishing attacks. Summary of the Invention

[0007] This application provides a blockchain-based DoH system and DNS query method to solve the problem that existing query requests may be vulnerable to HTTP attacks, preventing secure access and normal queries, as data packets are hidden in ordinary HTTPS traffic.

[0008] The solution proposed in this application is as follows:

[0009] Firstly, a blockchain-based DoH system includes a controller, a DoH client, and a blockchain network consisting of multiple DoH server nodes;

[0010] The controller is used to respond to the query server node request initiated by the DoH client, verify the DoH client, assign DoH server node information to the DoH client, and send the verified DoH client information to the DoH server.

[0011] The DoH client obtains DoH server node information by sending a query server node request to the controller, and then sends a domain name query request to the corresponding DoH server node.

[0012] The multiple DoH server nodes synchronize domain name data according to the blockchain network; the DoH server nodes are used to verify the validity of the DoH client that initiates the domain name query request based on the verified DoH client information to be connected issued by the controller. If the verification is successful, the domain name data requested by the current DoH client is returned.

[0013] Optionally, the controller verifies the DoH client based on the client signature; the controller assigns DoH server node information to the DoH client, the information including: DoH server node IP, validity period, and access token; the assignment is based on the distance between the DoH client and the DoH server node and the network congestion situation.

[0014] Optionally, the DoH client also caches the obtained DoH server node information and domain name data locally; when the DoH server node information is not found in the cache or the DoH server node of the domain name query request does not respond, it re-initiates a query server node request to the controller to obtain the DoH server node information.

[0015] Optionally, the DoH system further includes a domain name detection module and a DNS authoritative server; for domain names not present in the DoH server nodes, the domain name detection module queries the DNS authoritative server for the domain name, and then synchronizes the detected domain name in the blockchain network while returning it to the DoH client.

[0016] Secondly, a DNS query method for DoH based on blockchain is provided, applied to a DoH client, wherein the DoH client is connected to both a controller and a blockchain network composed of multiple DoH server nodes; the method includes:

[0017] A query server node request is sent to the controller; the controller is used to verify the DoH client, assign DoH server node information to the DoH client, and send the verified DoH client information to the DoH server.

[0018] If the current DoH client is verified by the controller, it will receive the DoH server node information returned by the controller.

[0019] Based on the DoH server node information returned by the controller, initiate a domain name query request to the corresponding DoH server node;

[0020] Received domain name data returned by the DoH server node.

[0021] Optionally, the controller verifies the DoH client based on the client signature; the controller assigns DoH server node information to the DoH client, the information including: DoH server node IP, validity period, and access token; the assignment is based on the distance between the DoH client and the DoH server node and the network congestion situation.

[0022] Optionally, the DoH client can also cache the obtained DoH server node information and domain name data locally. The next time a DNS query is needed, the client will first retrieve the required domain name data and DoH server node information from the local cache.

[0023] Optionally, the DoH client caches DoH server node information using the TTL algorithm; the DoH client caches domain name data using the LFU-K algorithm.

[0024] Thirdly, a DNS query method for DoH based on blockchain is applied to a DoH server node, wherein the DoH server node forms a blockchain network with at least two other DoH server nodes, and synchronizes domain name data according to the blockchain network; the blockchain network is connected to a controller and at least one DoH client; the method includes:

[0025] Receive DoH client information to be connected from the controller; all DoH clients to be connected have been verified by the controller.

[0026] A domain name query request is received from the DoH client, and the domain name query request also includes verification information provided by the controller;

[0027] Verify the validity of the current DoH client. If the verification passes, return the domain name data requested by the DoH client; if the verification fails, discard the packet directly.

[0028] Optionally, if the DoH server node does not record the domain name that the DoH client wants to query, a query command is sent to the domain name detection module outside the blockchain network. The domain name detection module queries the domain name from the authoritative DNS server, and then returns the obtained domain name data to the DoH client, while synchronizing it in the blockchain network.

[0029] Optionally, the DoH client information to be accessed issued by the controller includes: the source IP, validity period, and access token of the DoH client access; the verification information includes: the request source IP and access token.

[0030] Optionally, the DoH server also caches the DoH client information to be connected, and deletes expired DoH client information directly.

[0031] This application has at least the following beneficial effects:

[0032] First, the DoH client is verified by the controller, and then the client information to be connected is sent to the DoH server node. The server node only provides domain name query service to qualified DoH clients, thus solving the problem of secure access for domain name query.

[0033] The controller assigns servers for requesting domain name data to clients based on location distance and network congestion, thereby improving the access speed of domain name resources and solving the problems of high latency and slow speed of domain name query caused by long-distance access.

[0034] By synchronizing domain name data through a blockchain network, illegal tampering of domain name data is prevented, thus enhancing the credibility of the domain name data. For example, when a malicious operator modifies domain name data, the consistency of the data can be ensured because the DoH server nodes synchronize data through the blockchain network; in addition, the data is stored in the form of blocks, which itself has tamper-proof functionality. Attached Figure Description

[0035] Figure 1 A schematic diagram illustrating the principle of a blockchain-based DoH system provided in one embodiment of this application;

[0036] Figure 2 This is a general structural diagram of one embodiment of this application;

[0037] Figure 3 This is a sequence diagram (flowchart) for domain name information query according to one embodiment of this application. Detailed Implementation

[0038] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0039] In the description of this application: unless otherwise stated, "multiple" means two or more. Expressions such as "including," "comprising," and "having" also mean "not limited to" (certain units, components, steps, etc.).

[0040] In one embodiment, such as Figure 1 As shown, a blockchain-based DoH system includes a controller, a DoH client, and a blockchain network consisting of multiple DoH server nodes.

[0041] The controller is used to respond to the query server node request initiated by the DoH client, verify the DoH client, assign DoH server node information to the DoH client, and send the verified DoH client information to the DoH server.

[0042] The DoH client obtains DoH server node information by sending a query request to the controller and then sends a domain name query request to the corresponding DoH server node.

[0043] Multiple DoH server nodes synchronize domain name data based on the blockchain network. The DoH server nodes are used to verify the validity of the DoH client that is currently initiating a domain name query request, based on the verified DoH client information to be connected issued by the controller. If the verification is successful, the domain name data requested by the current DoH client is returned.

[0044] This blockchain-based DoH system uses a controller to coordinate DoH client access to server nodes, preventing unauthorized users from making requests to the DoH server. The controller allocates server nodes with better link conditions to clients based on factors such as link distance and network status, solving the problems of long resolution paths and high latency. Domain name data is synchronized through the blockchain network, giving it tamper-proof characteristics and high data reliability.

[0045] DoH client load balancing relies on the controller (clients need to go to the controller for identity verification, DoH server node allocation, etc.), so the controller should be deployed on a server with good network bandwidth (in reality, network traffic first passes through the firewall before reaching the server).

[0046] In addition, DoH clients access the controller via IP (not domain name), and the IP address used by DoH clients to access the controller is configurable.

[0047] like Figure 1 , Figure 2 As shown, the DoH server (a blockchain network composed of multiple DoH server nodes) also communicates with authoritative DNS servers. For domain names not present in the DoH server nodes, the domain name detection module queries the authoritative DNS server for the domain name. The detected domain name is then returned to the DoH client and simultaneously synchronized in the blockchain network. Domain names synchronized to the blockchain network have a limited validity period; after this period expires, the corresponding domain name is deleted.

[0048] like Figure 3 As shown, the process for querying domain information is as follows:

[0049] 1. The DoH client sends a query request to the controller for the server node;

[0050] 2. The controller verifies the DoH client and assigns DoH server node information to the DoH client. The information includes: DoH server node IP, validity period, access token, etc. The allocation of nodes is based on the distance between the DoH client and the server, network congestion, etc. The controller verifies the DoH client based on the client signature.

[0051] 3. The DoH client caches server node information based on timeliness, and the cache eviction method is the TTL (Time To Live) algorithm;

[0052] 4. The controller sends the DoH client information to the DoH server, which includes: the source IP, time limit, access token, etc. of the DoH client access;

[0053] 5. The DoH server caches DoH clients waiting to be connected, and deletes expired DoH client information directly;

[0054] 6. The DoH client initiates a domain name query request to the DoH server node. The DoH server node verifies the validity of the DoH client. If the verification is successful, the DoH server node returns the domain name requested by the DoH client. The node verification information includes: the request source IP, access token, etc. First, the client's request source IP is verified, then the token is verified. For invalid IPs, the packet is discarded directly.

[0055] 7. For domain names not present in the DoH server nodes, the domain name detection module queries the authoritative DNS server for the domain name. The detected domain name is then returned to the DoH client and simultaneously synchronized in the blockchain network composed of DoH server nodes. The domain names synchronized to the blockchain network have a certain time limit. After the time limit expires, the corresponding domain name will be deleted.

[0056] For DoH clients, domain names are not requested from the DoH server every time. The domain names are stored in the DoH client in a cached form. The DoH client's cached domain name eviction policy is as follows: initialize a certain cache size. The data stored in the cache are key-value pairs of domain names and IP addresses. If the key-value pairs of domain names and IP addresses exceed 85% of the cache size, the cache will be evicted. The eviction method is the LFU-K algorithm.

[0057] For DoH clients, DoH server node information is not retrieved from the controller every time. It is only retrieved from the controller when the DoH server node information is not found in the cache or when the DoH server node for the domain name query request does not respond.

[0058] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0059] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A blockchain-based DoH system, characterized in that, This includes the controller, DoH client, and a blockchain network consisting of multiple DoH server nodes; The controller is used to respond to the query server node request initiated by the DoH client, verify the DoH client, assign DoH server node information to the DoH client, and send the verified DoH client information to the DoH server. The DoH client obtains DoH server node information by sending a query server node request to the controller, and then sends a domain name query request to the corresponding DoH server node. The multiple DoH server nodes synchronize domain name data according to the blockchain network; the DoH server nodes are used to verify the validity of the DoH client that initiates the domain name query request based on the verified DoH client information to be connected issued by the controller. If the verification is successful, the domain name data requested by the current DoH client is returned. The controller verifies the DoH client based on the client signature; the controller assigns DoH server node information to the DoH client, including: DoH server node IP, validity period, and access token; The allocation is based on the distance between the DoH client and the DoH server node and the network congestion situation.

2. The blockchain-based DoH system of claim 1, wherein, The DoH client also caches the obtained DoH server node information and domain name data locally. When the DoH server node information is not found in the cache or the DoH server node of the domain name query request does not respond, it re-initiates a query server node request to the controller to obtain the DoH server node information.

3. The blockchain-based DoH system of claim 1, wherein, The DoH system also includes a domain name detection module and a DNS authoritative server. For domain names that are not present in the DoH server nodes, the domain name detection module queries the DNS authoritative server for the domain name, and then synchronizes the detected domain name in the blockchain network while returning it to the DoH client.

4. A DNS query method for DoH based on blockchain, applied to a DoH client, characterized in that, The DoH client connects to both the controller and a blockchain network consisting of multiple DoH server nodes; the method includes: A query server node request is sent to the controller; the controller is used to verify the DoH client, assign DoH server node information to the DoH client, and send the verified DoH client information to the DoH server. If the current DoH client is verified by the controller, it will receive the DoH server node information returned by the controller. Based on the DoH server node information returned by the controller, initiate a domain name query request to the corresponding DoH server node; Received domain name data returned by the DoH server node; The controller verifies the DoH client based on the client signature; the controller assigns DoH server node information to the DoH client, including: DoH server node IP, validity period, and access token; the assignment is based on the distance between the DoH client and the DoH server node and the network congestion situation.

5. The DNS query method for blockchain-based DoH according to claim 4, characterized in that, The DoH client currently caches the DoH server node information and domain name data locally. The next time a DNS query is needed, it will first retrieve the required domain name data and DoH server node information from the local cache.

6. The DNS query method for blockchain-based DoH according to claim 5, characterized in that, The DoH client uses the TTL algorithm to evict DoH server node information cached on its cached data; the DoH client uses the LFU-K algorithm to evict domain name data cached on its cached data.

7. A DNS query method for DoH based on blockchain, applied to DoH server nodes, characterized in that, The DoH server node, together with at least two other DoH server nodes, forms a blockchain network to synchronize domain name data based on the blockchain network; the blockchain network is connected to the controller and at least one DoH client; the method includes: Receive DoH client information to be connected from the controller; all DoH clients to be connected have been verified by the controller. A domain name query request is received from the DoH client, and the domain name query request also includes verification information provided by the controller; Verify the validity of the current DoH client. If the verification passes, return the domain name data requested by the DoH client; if the verification fails, discard the packet directly. The DoH client information sent by the controller includes: the source IP, validity period, and access token of the DoH client access; the verification information includes: the request source IP and access token.

8. The DNS query method for blockchain-based DoH according to claim 7, characterized in that, If the DoH server node does not record the domain name that the DoH client wants to query, it sends a query command to the domain name detection module outside the blockchain network. The domain name detection module queries the DNS authoritative server for the domain name, and then returns the obtained domain name data to the DoH client, while synchronizing it in the blockchain network.

9. The DNS query method for blockchain-based DoH according to claim 7, characterized in that, The DoH server also caches the information of DoH clients to be connected, and deletes expired DoH client information directly.

Images