Method and system for preventing diffusion and theft of ipv6 external chain under cdn architecture

Abstract

The application relates to the network and security technical field, and is a method and system for preventing diffusion and theft of IPV6 external chain rewriting under a CDN architecture. The specific method comprises the following steps: a client requests DNS resolution from a CDN dual-stack edge node; the CDN dual-stack edge node performs external chain resolution restoration on an upgraded domain name source station and an external chain source station; through the response of the upgraded domain name source station and the external chain source station, external chain domain name requests are rewritten into upgraded domain name traffic through external chain detection rewriting technology and are led to the CDN dual-stack edge node; and the CDN dual-stack edge node detects and rewrites the external chain and returns the client. The application solves the problem that, in the prior art, the rewriting range, rewriting depth and rewriting mode lack limitation, external chain rewriting diffusion easily causes external website misuse, and the external chain rewriting function is easily stolen by malicious websites.

Description

Technical Field

[0001] This invention relates to the field of network and security technology, and is a method and system for preventing the spread and theft of IPv6 external link rewriting under CDN architecture. Background Technology

[0002] Currently, the first batch of websites worldwide are undergoing upgrades from IPv4 to IPv6. However, due to the large number of IPv4 users, the upgrade process is extremely lengthy. Websites often link to each other; even if a website supports IPv6, links to other websites that don't support IPv6 can cause issues like slow page refresh rates, incomplete content display, and unusable functions. External link rewriting technology addresses this by rewriting external website links as internal website links, redirecting traffic from the external website to the internal site before returning to the external origin site. This allows clients to access the internal site via IPv6 and then return to the origin site via IPv4, thus resolving the IPv6 "window of opportunity" problem.

[0003] Among the existing publicly disclosed inventions, such as the patent application with publication number CN112600949A, a method and system for rewriting external links while retaining the original domain name is disclosed. The external link rewriting steps include: when entering the external link rewriting step, adding an identifier string to the external link domain name; then adding a security verification code and a wildcard domain name supporting IPv6 resolution to the external link domain name after adding the identifier string; obtaining the rewritten external link domain name; the format of the rewritten external link domain name is: external link domain name after replacing the separator + security verification code + identifier string + wildcard domain name. The system includes a CDN edge caching device, an IPv6 window transformation device, an external link origin server, and a client origin server, wherein: the CDN edge caching device is used to receive or forward user requests, and cache or return corresponding response content to the user; the IPv6 window transformation device is used to receive forwarded user requests or retrieve responses from the origin server, and rewrite the external link resources in the response content; the client origin server is used to respond to the resources of the corresponding client domain name; the external link origin server is used to respond to the resources of the corresponding external link domain name.

[0004] For example, patent application publication number CN111416862A discloses a CDN platform access method and system based on IPv6 and IPv4, including: a user terminal sending a request to a DNS server, the DNS server sending a DNS response back to the user based on the request; the user terminal sending a request to a CDN edge node server based on the DNS response, the CDN edge node server sending the obtained response content to a skylight modification device; the skylight modification device determining whether the user is an IPv6 user based on the response content, if so, determining whether the response content has an external link, and if so, rewriting the response content with an external link before sending it back to the user terminal.

[0005] The aforementioned patent describes a technology that rewrites all external links under the upgraded domain. Rewriting redirecting external links can easily lead to the spread of external link rewriting. Since the technology rewrites all external links under the upgraded domain, if a thief embeds the stolen domain into the customer's upgraded domain code by hijacking or tampering with the source site, the external link rewriting function will be misused. Summary of the Invention

[0006] The purpose of this section is to outline some aspects of embodiments of the present invention and to briefly describe some preferred embodiments. Simplifications or omissions may be made in this section, as well as in the abstract and title of this application, to avoid obscuring the purpose of these documents; however, such simplifications or omissions should not be construed as limiting the scope of the invention.

[0007] The technical problem this invention aims to solve is the issues of link rewriting proliferation and theft that exist with existing IPv6 external link rewriting methods. This invention proposes a method and system for preventing the proliferation and theft of IPv6 external link rewriting under a CDN architecture. This method uses original external link rewriting technology, limiting rewriting depth, adjusting rewriting methods, and setting rewriting scope to ensure that external link rewriting is confined to the upgraded domain name accessed by the client, preventing it from spreading to other external domains and preventing malicious websites from stealing the external link rewriting function, thus avoiding economic losses to the client's website. This invention provides a method and system for preventing the proliferation and theft of IPv6 external link rewriting under a CDN architecture.

[0008] To achieve the above objectives, the technical solution of the present invention, a method for preventing the proliferation and theft of IPv6 external link rewriting under a CDN architecture, includes the following steps:

[0009] S1: The client resolves the request to the CDN dual-stack edge node via DNS;

[0010] S2: After passing through the CDN dual-stack edge node and restoring the external link, it returns to the upgrade domain origin site or the external link origin site;

[0011] S3: By upgrading the response of the domain origin site and the external link origin site, the external link domain request is rewritten into upgraded domain traffic through external link detection and rewriting technology and driven to the CDN dual-stack edge node;

[0012] S4: Detect and rewrite external links through CDN dual-stack edge nodes and return the results to the client.

[0013] Specifically, in S1, the DNS resolution includes: dual-stack DNS resolution supporting IPv4 and IPv6.

[0014] Specifically, the IPv6 DNS resolution includes: focusing on the client initiating an IPv6 request in a pure IPv6 environment. The IPv6 request is first resolved to the CDN dual-stack edge node through DNS dual-stack. The CDN dual-stack edge node supports IPv4 / IPv6 dual-stack link communication. The upgraded domain name DNS resolution is accessed to the CDN through the initial CNAME method.

[0015] Specifically, in S2, the external link resolution and restoration includes: during the request phase, rewriting the external link domain name to the upgrade domain name and resolving all external link requests to the CDN dual-stack edge node.

[0016] The external link parsing and restoration includes the following specific steps:

[0017] S21: After decrypting the content-encryption, verify the signature sig to prevent forged external link requests from abnormally returning to the origin, causing amplification or bypass attacks.

[0018] S22: After the signature verification is successful, the original external link domain name, request protocol, rewrite depth, redirection identifier, port and other information are parsed out and returned to the external link origin site through the IPv4 link. After the resources are successfully retrieved, the response is sent to the client.

[0019] S23: For external links that do not contain external link information, send an upgrade domain request back to the upgrade domain origin site.

[0020] Specifically, in S3, the external link rewriting technology is used to ensure that all text-type resources from the upgraded domain name source site and the external link domain name source site response to the CND dual-stack edge node are subject to external link detection during the resource response phase, and all external links contained in the text resources are rewritten.

[0021] Specifically, the external link rewriting includes: preventing the spread of external link rewriting and preventing theft of external link rewriting. For resource external links and redirect external links, the original external link protocol information, external link domain information, external link port information, rewriting depth information and signature characters are encrypted together into a signature string and concatenated at the beginning of the path.

[0022] Specifically, the external link rewriting anti-proliferation includes:

[0023] S41: In the original information of the external link, the depth identifier is the external link rewriting depth. The external link rewriting depth embedded under the homepage of the customer's upgraded domain is 1. The other external link domains embedded in these external link resources with a depth of 1 have a depth of depth+1=2.

[0024] S42: Depth is validated. When the depth exceeds the threshold n configured by the customer, the external link is not rewritten. When the external link is detected to be a redirect external link, a unique redirect identifier href=1 is added to the external link information, and the depth is set to the larger value between depth+1 and the threshold -1 configured by the customer.

[0025] Specifically, the external link rewriting anti-theft includes: not rewriting when the external link domain is not within the configured external link rewriting domain range, and crawling all external link domain services embedded under the customer's domain. This includes: when the customer first accesses the external link rewriting service, the rewriting range can be left blank and all domains will be rewritten by default; during the rewriting process, all rewritten external links are recorded in the log and aggregated in the customer's console interface, allowing the customer to perform batch operations.

[0026] In addition, the system for preventing the spread and theft of IPv6 external link rewriting under CDN architecture according to the present invention includes the following modules:

[0027] Client request module, dual-stack edge node module, origin server detection and response module, and external link rewriting module;

[0028] The client request module is used to request the CDN dual-stack edge node through DNS resolution by the client;

[0029] The dual-stack edge node module returns to the upgrade domain origin site or external link origin site after being restored through the CDN dual-stack edge node and external link resolution.

[0030] The origin server detection and response module upgrades the responses of the domain name origin server and the external link origin server. External link domain name requests are rewritten into upgraded domain name traffic through external link detection and rewriting technology and directed to CDN dual-stack edge nodes.

[0031] The external link rewriting module detects and rewrites external links through CDN dual-stack edge nodes and returns the results to the client.

[0032] Compared with the prior art, the technical effects of the present invention are as follows:

[0033] 1. This invention employs an original method for rewriting external links, which limits the depth of external link rewriting and makes special handling to the link depth that redirects to external websites, ensuring that the external link rewriting of redirected external links will not cause the spread of external link rewriting without affecting the redirection to the embedded external domain.

[0034] 2. This invention provides a configurable range of external link rewriting domains, and also provides a service to crawl all external link domains embedded under the customer's domain, so as to help customers configure the rewriting range in batches and prevent external link rewriting from being stolen. Attached Figure Description

[0035] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] in:

[0037] Figure 1 This is a flowchart illustrating a method for preventing the spread and theft of IPv6 external links under a CDN architecture according to the present invention.

[0038] Figure 2 This is a schematic diagram of a system for preventing the spread and theft of IPv6 external link rewriting under a CDN architecture according to the present invention;

[0039] Figure 3 This is a schematic diagram of an external chain anti-diffusion method according to the present invention;

[0040] Figure 4 This is a schematic diagram of an external link anti-theft method according to the present invention;

[0041] Figure 5 This is a schematic diagram illustrating the access process of a client accessing an external link source site according to the present invention. Detailed Implementation

[0042] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0043] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0044] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0045] Example 1:

[0046] like Figure 1 As shown in the figure, an embodiment of the present invention provides a method for preventing the spread and theft of IPv6 external link rewriting under a CDN architecture, such as... Figure 1 As shown, the specific steps include the following:

[0047] S1: The client resolves the request to the CDN dual-stack edge node via DNS;

[0048] In S1, the DNS resolution includes: dual-stack DNS resolution supporting IPv4 and IPv6.

[0049] The IPv6 DNS resolution includes: focusing on the client initiating an IPv6 request in a pure IPv6 environment. The IPv6 request is first resolved to the CDN dual-stack edge node through DNS dual-stack. The CDN dual-stack edge node supports IPv4 / IPv6 dual-stack link communication. Among them, the DNS resolution of the upgraded domain name is accessed to the CDN through the initial CNAME method.

[0050] S2: After passing through the CDN dual-stack edge node and restoring the external link, it returns to the upgrade domain origin site or the external link origin site;

[0051] In S2, the external link resolution and restoration includes: during the request phase, rewriting the external link domain name to the upgrade domain name and resolving all external link requests to the CDN dual-stack edge node.

[0052] The external link parsing and restoration includes the following specific steps:

[0053] S21: After decrypting the content-encryption, verify the signature sig to prevent forged external link requests from abnormally returning to the origin, causing amplification or bypass attacks.

[0054] S22: After the signature verification is successful, the original external link domain name, request protocol, rewrite depth, redirection identifier, port and other information are parsed out and returned to the external link origin site through the IPv4 link. After the resources are successfully retrieved, the response is sent to the client.

[0055] S23: For external links that do not contain external link information, send an upgrade domain request back to the upgrade domain origin site.

[0056] S3: By upgrading the response of the domain origin site and the external link origin site, the external link domain request is rewritten into upgraded domain traffic through external link detection and rewriting technology and driven to the CDN dual-stack edge node;

[0057] In S3, the external link rewriting technology is used to ensure that all text-type resources from the upgraded domain name source site and the external link domain name source site response to the CND dual-stack edge node are subject to external link detection during the resource response phase, and all external links contained in the text resources are rewritten.

[0058] The external link rewriting includes: preventing the spread of external link rewriting and preventing theft of external link rewriting. For resource external links and redirect external links, the original external link protocol information, external link domain information, external link port information, rewriting depth information and signature characters are encrypted together into a signature string and concatenated at the beginning of the path.

[0059] For example, after upgrading the homepage HTML page of the domain www.test.com, an external link check revealed that it contains the external link: http: / / www.ipv4.com / test / login.php. The original protocol of the external link is HTTP, the domain name is www.ipv4.com, the port is the default port 80, and the signature string is in the form of domain=www.ipv4.com&depth=1&port=80&scheme=http&sig=c202dec244984cd4da7acbc1f41b86ec. The signature string is encrypted as content-encryption, therefore the rewritten external link is:

[0060] www.test.com / ipv4_outlink=content-encryption / test / login.php.

[0061] S4: Detect and rewrite external links through CDN dual-stack edge nodes and return the results to the client.

[0062] The external link rewriting anti-diffusion measures include:

[0063] S41: In the original information of the external link, the depth identifier is the external link rewriting depth. The external link rewriting depth embedded under the homepage of the customer's upgraded domain is 1. The other external link domains embedded in these external link resources with a depth of 1 have a depth of depth+1=2.

[0064] S42: Depth is validated. When the depth exceeds the threshold n configured by the customer, the external link is not rewritten. When the external link is detected to be a redirect external link, a unique redirect identifier href=1 is added to the external link information, and the depth is set to the larger value between depth+1 and the threshold -1 configured by the customer.

[0065] The external link rewriting anti-theft measures include: not rewriting when the external link domain is not within the configured external link rewriting domain range, and crawling all external link domain services embedded under the customer's domain. This includes: when a customer first connects to the external link rewriting service, the rewriting range can be left blank and all domains will be rewritten by default; during the rewriting process, all rewritten external links are recorded in the log and aggregated in the customer's console interface, allowing the customer to perform batch operations.

[0066] The upgraded domain names include: customer domain names that have already been connected to CDN and need to be upgraded to IPv6.

[0067] The external links include: links embedded in the resources of the upgraded domain website that can make requests to the non-upgraded domain, collectively referred to as external links.

[0068] The said jumping external links include links that are referenced under the upgraded domain name and directly jump to external websites, which are usually friendly links pointing to pages of other websites and require users to click to trigger the jump. According to the characteristics of HTML language, the present invention regards external links embedded in the form of <ahref="jump external link"> as jumping external links.

[0069] The said resource external links include all external resource link domain names that are not upgraded domain names and referenced under the upgraded domain name. Usually, these resource links will automatically initiate loading requests when the home page of the upgraded domain name is accessed. The present invention regards all other external links that are not jumping external links as resource external links.

[0070] The said external link rewriting refers to rewriting the request link pointing to the external link domain name through a specific method. In WEB applications, there are a large number of scenarios where websites reference each other. The content of the upgraded domain name website www.test.com references the relevant link of the external link domain name www.ipv4.com. If the external link domain name does not support IPv6 access, it will cause the empty window problem. Through the external link rewriting technology, the external link domain name www.ipv4.com is rewritten into www.test.com / xxx or www.ipv4.test.com (corresponding to different rewriting methods). The DNS resolution result of the rewritten domain name is the same as that of the upgraded domain name www.test.com, so the external link domain name request is pulled to the CDN dual-stack edge node. After the CDN dual-stack edge node normally pulls the resources of the external link origin site, it responds to the client and solves the empty window problem.

[0071] The said external link rewriting diffusion refers to that the jumping external links embedded in the customer's upgraded domain name are rewritten into links of the customer's upgraded domain name. If no special treatment is carried out, when the user clicks to jump to an external website, the external website domain name is still the customer's upgraded domain name, and all other external links referenced under the jumping external link domain name resource will be rewritten into links of the upgraded domain name. More jumping external link domain names will be referenced under the jumping external link domain name website, which results in that all external links that can be traversed from the customer's upgraded domain name are rewritten, and the depth and number of the traversed external links can be theoretically infinite.

[0072] For example, the domain name www.a.com can be searched on the customer's upgraded domain name www.sogou.com, and the user can jump to www.a.com. www.a.com has a friendly link to the domain name of www.baidu.com, and the link can be extended infinitely to other domain names. If there is no restriction on the rewriting method, these external websites will all be rewritten into [sub-domain of] www.sogou.com, which results in that all jumping external link websites initiated from the customer's upgraded domain name website will use the external link rewriting function of the customer's upgraded domain name, causing external link rewriting diffusion.

[0073] The aforementioned external link rewriting and theft includes: thieves hijacking or tampering with the origin website to embed stolen domain names into the customer's upgrade domain, disguising them as resource external links or redirect external links. Therefore, without restrictions, the external link rewriting function of the customer's upgrade domain can be maliciously stolen.

[0074] Example 2:

[0075] like Figure 2 , 3 As shown in Figures 4 and 5, an embodiment of the present invention provides a system for preventing the spread and theft of IPv6 external link rewriting under a CDN architecture, as follows: Figure 2 As shown, it includes the following modules:

[0076] Client request module, dual-stack edge node module, origin server detection and response module, and external link rewriting module;

[0077] The client request module is used to request the CDN dual-stack edge node through DNS resolution by the client;

[0078] The dual-stack edge node module returns to the upgrade domain origin site or external link origin site after being restored through the CDN dual-stack edge node and external link resolution.

[0079] The origin server detection and response module upgrades the responses of the domain name origin server and the external link origin server. External link domain name requests are rewritten into upgraded domain name traffic through external link detection and rewriting technology and directed to CDN dual-stack edge nodes.

[0080] The external link rewriting module detects and rewrites external links through CDN dual-stack edge nodes and returns the results to the client.

[0081] Example 3:

[0082] This embodiment provides an electronic device, including: a processor and a memory, wherein the memory stores a computer program that can be called by the processor;

[0083] The processor executes the aforementioned method for preventing the spread and theft of IPv6 external links under a CDN architecture by calling computer programs stored in memory.

[0084] This electronic device can vary considerably depending on its configuration or performance. It may include one or more Central Processing Units (CPUs) and one or more memories, wherein the memory stores at least one computer program, which is loaded and executed by the processor to implement the method for preventing the proliferation and theft of IPv6 external links under a CDN architecture provided in the above-described embodiment. The electronic device may also include other components for implementing its functions; for example, it may have wired or wireless network interfaces and input / output interfaces for data input and output. Details will not be elaborated upon in this embodiment.

[0085] Example 4:

[0086] This embodiment proposes a computer-readable storage medium on which an erasable and rewritable computer program is stored.

[0087] When a computer program runs on a computer device, it causes the computer device to execute the aforementioned method for preventing the spread and theft of IPv6 external links under a CDN architecture.

[0088] For example, computer-readable storage media can be read-only memory (ROM), random access memory (RAM), compact disc read-only memory (CD-ROM), magnetic tape, floppy disk, and optical data storage devices.

[0089] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0090] It should be understood that determining B based on A does not mean determining B solely based on A; it also means determining B based on A and / or other information.

[0091] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the flow or function according to the embodiments of the present invention is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired network and / or wireless network. A computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. Available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media. Semiconductor media can be solid-state drives.

[0092] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0093] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0094] In the several embodiments provided by this invention, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only one method, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0095] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0096] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0097] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0098] In summary, compared with the prior art, the technical effects of the present invention are as follows:

[0099] 1. This invention employs an original method for rewriting external links, which limits the depth of external link rewriting and performs special processing on the link depth that redirects to external websites, ensuring that the external link rewriting of redirected external links will not cause the spread of external link rewriting without affecting the redirection to the embedded external domain.

[0100] 2. This invention provides a configurable range of external link rewriting domains, and also provides a service to crawl all external link domains embedded under the customer's domain, so as to help customers configure the rewriting range in batches and prevent external link rewriting from being stolen.

[0101] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A method for preventing the spread and theft of IPv6 external link rewriting under a CDN architecture, characterized in that: The method includes the following specific steps: S1: The client resolves the request to the CDN dual-stack edge node via DNS; S2: After the CDN dual-stack edge nodes are restored through external link resolution, they return to the upgrade domain origin site or external link origin site; S3: By upgrading the response of the domain origin site and the external link origin site, the external link domain request is rewritten into upgraded domain traffic through external link detection and rewriting technology and driven to the CDN dual-stack edge node; S4: Detect and rewrite external links through CDN dual-stack edge nodes and return the results to the client; The external link rewriting anti-diffusion measures include: S41: In the original information of the external link, the depth identifier is the external link rewriting depth. The external link rewriting depth embedded in the homepage of the customer's upgraded domain is 1. The other external link domains embedded in these external link resources with a depth of 1 have a depth of depth+1=2. S42: Depth is validated. When the depth exceeds the threshold n configured by the customer, the external link is not rewritten. When the external link is detected to be a redirect external link, a unique redirect identifier href=1 is added to the external link information, and the depth is set to the larger value between depth+1 and the threshold -1 configured by the customer.

2. The method for preventing the spread and theft of IPv6 external link rewriting under a CDN architecture according to claim 1, characterized in that, In S1, the DNS resolution includes: dual-stack DNS resolution supporting IPv4 and IPv6.

3. The method for preventing the spread and theft of IPv6 external link rewriting under a CDN architecture according to claim 2, characterized in that, The IPv6 DNS resolution includes: focusing on the client initiating an IPv6 request in a pure IPv6 environment. The IPv6 request is first resolved to the CDN dual-stack edge node through DNS dual-stack. The CDN dual-stack edge node supports IPv4 / IPv6 dual-stack link communication. Among them, the DNS resolution of the upgraded domain name is accessed to the CDN through the initial CNAME method.

4. The method for preventing the spread and theft of IPv6 external link rewriting under a CDN architecture according to claim 1, characterized in that, In S2, the external link resolution and restoration includes: during the request phase, rewriting the external link domain name to the upgrade domain name and resolving all external link requests to the CDN dual-stack edge node.

5. The method for preventing the spread and theft of IPv6 external link rewriting under a CDN architecture according to claim 4, characterized in that, The external link parsing and restoration includes the following specific steps: S21: After decrypting the content-encryption, verify the signature sig to prevent forged external link requests from abnormally returning to the origin, causing amplification or bypass attacks. S22: After the signature verification is successful, the original external link domain name, request protocol, rewrite depth, redirection identifier, and port information are parsed out and the external link origin server is retrieved through the IPv4 link. After the resources are successfully retrieved, the response is sent to the client. S23: For external links that do not contain external link information, send an upgrade domain request back to the upgrade domain origin site.

6. The method for preventing the spread and theft of IPv6 external link rewriting under a CDN architecture according to claim 1, characterized in that, In S3, the external link rewriting technology is used to ensure that all text-type resources from the upgraded domain name source site and the external link domain name source site response to the CND dual-stack edge node are subject to external link detection during the resource response phase, and all external links contained in the text resources are rewritten.

7. The method for preventing the spread and theft of IPv6 external link rewriting under a CDN architecture according to claim 6, characterized in that, The external link rewriting includes: preventing the spread of external link rewriting and preventing theft of external link rewriting. For resource external links and redirect external links, the original external link protocol information, external link domain information, external link port information, rewriting depth information and signature characters are encrypted together into a signature string and concatenated at the beginning of the path.

8. The method for preventing the spread and theft of IPv6 external link rewriting under a CDN architecture according to claim 7, characterized in that, The external link rewriting anti-theft measures include: not rewriting when the external link domain is not within the configured external link rewriting domain range, and crawling all external link domain services embedded under the customer's domain. This includes: when a customer first connects to the external link rewriting service, the rewriting range can be left blank and all domains will be rewritten by default; during the rewriting process, all rewritten external links are recorded in the log and aggregated in the customer's console interface, allowing the customer to perform batch operations.

9. A system for preventing the proliferation and theft of IPv6 external links under a CDN architecture, implemented based on the method for preventing the proliferation and theft of IPv6 external links under a CDN architecture as described in any one of claims 1-8, characterized in that, The system includes the following modules: Client request module, dual-stack edge node module, origin server detection and response module, and external link rewriting module; The client request module is used to request the CDN dual-stack edge node through DNS resolution by the client; The dual-stack edge node module returns to the upgrade domain origin site or external link origin site after being restored through the CDN dual-stack edge node and external link resolution. The origin server detection and response module upgrades the responses of the domain name origin server and the external link origin server. External link domain name requests are rewritten into upgraded domain name traffic through external link detection and rewriting technology and directed to CDN dual-stack edge nodes. The external link rewriting module detects and rewrites external links through CDN dual-stack edge nodes and returns the results to the client.

Images