Domain name encryption and decryption method, device, equipment and medium based on CDN

Abstract

The present disclosure relates to the field of computer technology, and discloses a domain name encryption and decryption method, device, equipment and medium based on CDN, the method comprising: receiving an access request sent by a terminal to access a first server; in the case where the access request needs to be redirected to a second server, determining the binary data corresponding to the target IP address of the second server, and performing encryption encoding to generate encrypted encoded data; the number of characters corresponding to the encrypted encoded data does not exceed the domain name length limit; generating an encrypted synthetic domain name according to the encrypted encoded data and the target domain name; sending the encrypted synthetic domain name to the terminal; the encrypted synthetic domain name is used to instruct the terminal to send the encrypted synthetic domain name to a domain name system server, so as to instruct the domain name system server to decode and decrypt the encrypted synthetic domain name. The present disclosure can ensure the security of the synthetic domain name, and the number of characters of the generated encrypted encoded data does not exceed the domain name length limit, and the encrypted synthetic domain name can match the wildcard domain name certificate.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a CDN-based domain name encryption and decryption method, device, equipment and medium. Background Art

[0002] In a CDN (Content Delivery Network) scenario, when a terminal accesses an edge node, the edge node may redirect the accessed resources to another node. In this case, the address of the target node needs to be returned to the terminal.

[0003] If the IP address of the target node is directly returned to the terminal, there will be a certificate problem; and if the domain name of the target node is returned to the terminal, it will occupy too many resources of the Domain Name System (DNS) server. Summary of the invention

[0004] In view of this, the present disclosure provides a CDN-based domain name encryption and decryption method, device, equipment and medium to solve the problem of redirection.

[0005] In a first aspect, the present disclosure provides a domain name encryption method, which is applied to a first server of a content distribution network, comprising:

[0006] receiving an access request for accessing the first server sent by a terminal;

[0007] In case the access request needs to be redirected to a second server, determining a target IP address and a corresponding target domain name of the second server;

[0008] Determine binary data corresponding to the target IP address, and encrypt the binary data to generate encrypted data corresponding to the target IP address; the number of characters corresponding to the encrypted data does not exceed the domain name length limit;

[0009] Generate a corresponding encrypted synthetic domain name according to the encrypted coded data and the target domain name;

[0010] The encrypted composite domain name is sent to the terminal; the encrypted composite domain name is used to instruct the terminal to send the encrypted composite domain name to a domain name system server, so as to instruct the domain name system server to decode and decrypt the encrypted composite domain name.

[0011] In a second aspect, the present disclosure provides a domain name decryption method, which is applied to a domain name system server, and the method includes:

[0012] A domain name resolution request sent by a receiving terminal; the domain name resolution request includes an encrypted synthetic domain name, the encrypted synthetic domain name is generated by the first server by encrypting and encoding binary data corresponding to a target IP address of the second server, generating encrypted coded data corresponding to the target IP address, and generating a synthetic domain name based on the encrypted coded data and the target domain name of the second server;

[0013] Decoding and decrypting the encrypted synthetic domain name to generate a domain name resolution result; the domain name resolution result includes a target IP address of the second server;

[0014] The domain name resolution result is sent to the terminal.

[0015] In a third aspect, the present disclosure provides a domain name decryption method, characterized in that it is applied to a terminal, and the method includes:

[0016] Initiate an access request to a first server of the content distribution network;

[0017] receiving an encrypted synthetic domain name returned by the first server; the encrypted synthetic domain name is a synthetic domain name generated by encrypting and encoding binary data corresponding to a target IP address of the second server to generate encrypted coded data corresponding to the target IP address, and based on the encrypted coded data and the target domain name of the second server;

[0018] Sending a domain name resolution request to a domain name system server; the domain name resolution request includes the encrypted synthetic domain name;

[0019] receiving a domain name resolution result returned by the domain name system server; the domain name resolution result includes a target IP address of the second server;

[0020] An access request is initiated to the second server according to the domain name resolution result.

[0021] In a fourth aspect, the present disclosure provides a domain name encryption device, which is applied to a first server of a content distribution network, and the device includes:

[0022] An access request receiving module, used to receive an access request sent by a terminal to access the first server;

[0023] A determination module, configured to determine a target IP address and a corresponding target domain name of the second server when the access request needs to be redirected to the second server;

[0024] An encryption coding module, used for determining binary data corresponding to the target IP address, and encrypting the binary data to generate encrypted coded data corresponding to the target IP address; the number of characters corresponding to the encrypted coded data does not exceed the domain name length limit;

[0025] A synthesis module, used to generate a corresponding encrypted synthetic domain name according to the encrypted coded data and the target domain name;

[0026] The encrypted composite domain name sending module is used to send the encrypted composite domain name to the terminal; the encrypted composite domain name is used to instruct the terminal to send the encrypted composite domain name to the domain name system server, so as to instruct the domain name system server to decode and decrypt the encrypted composite domain name.

[0027] In a fifth aspect, the present disclosure provides a domain name decryption device, which is applied to a domain name system server, and the device includes:

[0028] A resolution request receiving module, configured to receive a domain name resolution request sent by a terminal; the domain name resolution request includes an encrypted synthetic domain name, the encrypted synthetic domain name is generated by the first server by encrypting and encoding binary data corresponding to a target IP address of a second server, generating encrypted coded data corresponding to the target IP address, and generating a synthetic domain name based on the encrypted coded data and the target domain name of the second server;

[0029] A decoding and decryption module, used to decode and decrypt the encrypted synthetic domain name to generate a domain name resolution result; the domain name resolution result includes a target IP address of the second server;

[0030] The resolution result sending module is used to send the domain name resolution result to the terminal.

[0031] In a sixth aspect, the present disclosure provides a domain name decryption device, applied to a terminal, the device comprising:

[0032] An access request sending module, used to initiate an access request to a first server of a content distribution network;

[0033] an encrypted synthetic domain name receiving module, configured to receive the encrypted synthetic domain name returned by the first server; the encrypted synthetic domain name is a synthetic domain name generated by encrypting and encoding binary data corresponding to the target IP address of the second server to generate encrypted coded data corresponding to the target IP address, and based on the encrypted coded data and the target domain name of the second server;

[0034] A resolution request module, used for sending a domain name resolution request to a domain name system server; the domain name resolution request includes the encrypted synthetic domain name;

[0035] A resolution result receiving module, used to receive the domain name resolution result returned by the domain name system server; the domain name resolution result includes the target IP address of the second server;

[0036] The access request sending module is further used to initiate an access request to the second server according to the domain name resolution result.

[0037] In a seventh aspect, the present disclosure provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the method of the first aspect, the second aspect, the third aspect or any corresponding embodiment thereof by executing the computer instructions.

[0038] In an eighth aspect, the present disclosure provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the method of the above-mentioned first aspect, second aspect, third aspect or any corresponding embodiment thereof.

[0039] In a ninth aspect, the present disclosure provides a computer program product, comprising computer instructions for causing a computer to execute the method of the first aspect, the second aspect, the third aspect or any corresponding embodiment thereof.

[0040] The present disclosure utilizes the first server to return an encrypted composite domain name to the terminal, which can ensure the security of the composite domain name; and, converts the target IP address into corresponding binary data, and performs encryption encoding based on the binary data, so that the number of characters in the generated encrypted encoded data does not exceed the domain name length limit. Therefore, in the encrypted composite domain name, a separate first-level domain name can be used to represent the encrypted encoded data, and the encrypted composite domain name can match the wildcard domain name certificate, thereby achieving normal access. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the specific embodiments of the present disclosure or the technical solutions in the related technologies, the drawings required for use in the specific embodiments or the related technical descriptions will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0042] Figure 1 is a schematic diagram of a process of a terminal accessing resources according to an embodiment of the present disclosure;

[0043] Figure 2 is a flowchart of a domain name encryption method according to an embodiment of the present disclosure;

[0044] Figure 3is a flowchart of another domain name encryption method according to an embodiment of the present disclosure;

[0045] Figure 4 is a schematic diagram of generating an encrypted synthetic domain name according to an embodiment of the present disclosure;

[0046] Figure 5 It is a flowchart of a method for decrypting a domain name on a DNS server side according to an embodiment of the present disclosure;

[0047] Figure 6 is a flowchart of a method for decrypting a domain name on a terminal side according to an embodiment of the present disclosure;

[0048] Figure 7 It is a schematic diagram of a process for redirecting a terminal access request according to an embodiment of the present disclosure;

[0049] Figure 8 is a structural block diagram of a domain name encryption device according to an embodiment of the present disclosure;

[0050] Fig. 9 is a structural block diagram of a domain name decryption device on a DNS server side according to an embodiment of the present disclosure;

[0051] Fig.10 is a structural block diagram of a terminal-side domain name decryption device according to an embodiment of the present disclosure;

[0052] Fig.11 It is a schematic diagram of the hardware structure of the computer device of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present disclosure.

[0054] Figure 1 A schematic diagram of a process of terminal accessing resources is shown. Figure 1 As shown, when a user needs to access a certain network resource (for example, text, picture, audio, video, etc.), he can initiate a corresponding access request to the first edge server in the CDN (step ①); the first edge server will determine whether it has the network resource requested by the terminal. If so, it will directly return the network resource to the terminal. If not, the first edge server will redirect the access request to another server, which will be referred to as the second edge server later, and return the address of the second edge server to the terminal (step ②), which is generally a domain name.

[0055] Based on the address of the second edge server, the terminal initiates a domain name resolution request to the DNS server (step ③), and the DNS server then returns the domain name resolution result to the terminal (step ④). After that, the terminal can initiate an access request to the second edge server again (step ⑤).

[0056] The first edge server generally uses 302 scheduling to redirect the scheduling of the first edge server to the second edge server. This redirection is generally to dynamically access a node based on the optimal scheduling decision. For example, if the terminal currently needs to access a certain image resource abc.jpg, if the first edge server determines that the IP (Internet Protocol) address of the second edge server to be redirected is 1.1.1.1, the first edge server can rewrite https: / / 1.1.1.1 / abc.jpg.

[0057] Since the redirection of 302 scheduling is based on security considerations, HTTPS (Hypertext Transfer Protocol Secure) access method is often used. This access method can directly reach the target domain name. Because when 1.1.1.1 is used as a domain name, it is generally not convenient to issue a certificate, resulting in the need for an HTTPS certificate.

[0058] The CDN scheduling system can also write the domain name mapping relationship into the DNS server. For example, www.example.com is resolved to 1.1.1.1. Then the first edge server can directly use the domain name for resolution, that is, rewrite https: / / www.example.com / abc.jpg. This can solve the certificate problem, but because the number of edge servers to be rescheduled is large, often measured in hundreds of thousands or even millions, this leads to too many records for DNS server resolution, which will occupy too many DNS system resources.

[0059] In addition, DNS servers generally support a "synthetic record", which is a synthetic domain name. This synthetic record requires that when the terminal requests DNS resolution, the domain name resolution result is hidden in the requested domain name, and the DNS server then extracts the domain name resolution result from the synthetic domain name for these special synthetic domain names.

[0060] For example, the first edge server returns the synthetic domain name: 1-1-1-1.example.com / abc.jpg to the terminal. After that, the terminal can request the A record (Address Record) of 1-1-1-1.example.com from the DNS server. The DNS server uses the record separated by "-" in its prefix as the record information to be extracted based on the characteristics of the synthetic domain name, converts it into the IP address 1.1.1.1, and uses it as the resolution result of example.com, so that the A record of 1.1.1.1 can be responded to the terminal.

[0061] Alternatively, the terminal requests the AAAA record of fec0--1-1.example.com from the DNS server. The DNS server uses the records separated by "-" in its prefix as the record information to be extracted based on the characteristics of the synthetic domain name, where the ':' of IPv6 is replaced by '-' and '::' is replaced by '--'), so that the AAAA record of fec0::1:1 can be responded to the terminal.

[0062] However, the above solution has security issues: if the synthetic domain name is intercepted by an illegal user, the illegal user can resolve his own illegal domain name based on the characteristics of the example.com domain. For example, there is a resource 2.2.2.2 server corresponding to an illegal URL, and the illegal user will disguise the service as the URL 2-2-2-2.example.com. In this way, the entire illegal URL has a legal domain name resolution and does not need to be filed. To address this issue, a whitelist mechanism can be added, and only the whitelist of specific network segments can be legally resolved. However, since the network segments of CDN edge nodes are relatively discrete in practice, this results in a large number of network segments to be configured in the CDN system, and the processing method is complicated, which brings inconvenience to the implementation of the system.

[0063] According to an embodiment of the present disclosure, an embodiment of a domain name encryption and decryption method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0064] In this embodiment, a domain name encryption method is provided, which can be applied to a first server of a CDN (content distribution network), where the first server is a scheduling server in a CDN scheduling system, for example Figure 1 The first edge server shown, etc. Figure 2 is a flowchart of a domain name encryption method according to an embodiment of the present disclosure. Figure 2 As shown, the process includes the following steps.

[0065] Step S201: receiving an access request for accessing a first server sent by a terminal.

[0066] In this embodiment, when the terminal needs to access a certain network resource, it may initiate a corresponding access request to the CDN, and the access request may be sent to the first server of the CDN.

[0067] For example, when a user uses a terminal and clicks on a content URL (Uniform Resource Location) on a page displayed by the terminal, the content URL can be resolved based on a DNS server, and then the IP address of the first server corresponding to the content URL is returned to the terminal, so that the terminal can initiate an access request corresponding to the content URL to the first server.

[0068] Step S202: When the access request needs to be redirected to the second server, determine the target IP address and the corresponding target domain name of the second server.

[0069] In this embodiment, after receiving the access request, the first server determines whether redirection is required; for example, it determines whether the network resource requested by the terminal exists locally, or whether it is the optimal server. If the access request needs to be redirected, it determines another server to which it needs to be redirected, that is, the second server; the second server is also a server in the CDN, such as Figure 1 The second edge server is shown.

[0070] Furthermore, the first server may determine the IP address of the second server, ie, the target IP address, and the domain name of the second server, ie, the target domain name.

[0071] Step S203, determine the binary data corresponding to the target IP address, and encrypt the binary data to generate encrypted data corresponding to the target IP address; the number of characters corresponding to the encrypted data does not exceed the domain name length limit.

[0072] In this embodiment, the first server returns the address of the second server to the terminal by means of a synthetic domain name. In order to avoid the problem that the synthetic domain name is intercepted by an illegal user and the illegal website is resolved, in this embodiment, the IP address (i.e., the target IP address) to be returned to the terminal is encrypted to ensure the security of the IP address.

[0073] Among them, the target IP address is an IP address, which is generally in character form; and the IP address includes an IPv4 address and an IPv6 address. If the target IP address is encrypted directly, the character length of the encryption result will be larger, especially for the IPv6 address, which will cause the character length of the encryption result to exceed the domain name length limit.

[0074] For example, if the target IP address is an IPv6 address, and "-" is used to represent ":", assuming the target IP address is: AD80-0000- - - - -00C2-0002, of which is a masked character, which indicates a character in the IPv6 address. After the target IP address is encrypted using the Advanced Encryption Standard (AES) encryption algorithm, the encryption result is: R7ZEDSPI63PLWBNRYHKBKU7I7V2KUN3DBYJJLHGPHBFIXXAD7HLEPLESFEOIT2RMLNHBWYJD7WVFM. The character length of the encryption result exceeds 63 characters, while the domain name length limit specified by the domain name system is 63 characters. In this case, the encryption result needs to be segmented to meet the domain name length limit. For example, if the domain name of the second server is example.com, the encrypted composite domain name can be expressed as: R7ZEDSPI63PLWBNRYHKBKU7I7V2KUN3DBYJJLHGPHBFIXXAD7HLEPLESFEOI.T2RMLNHBWYJD7WVFM.example.com.

[0075] However, since CDN certificates are generally in the form of For the second-level wildcard domain name certificate of .example.com, the encrypted synthetic domain name corresponding to the above IPv6 address is a multi-level domain name, which makes the current second-level wildcard domain name certificate unable to match such multi-level domain names, which in turn causes problems with HTTPS access in IPv6 scenarios.

[0076] In this embodiment, the IP address in character form is not directly encrypted, but converted into binary data and then encrypted, thereby ensuring that the number of characters corresponding to the encryption result does not exceed the domain name length limit.

[0077] Specifically, after the first server determines the target IP address of the second server, it first converts the target IP address in character form into data in binary form, i.e., binary data, and then encrypts the binary data, and encodes the encrypted data after encryption to obtain encrypted coded data in character form, which corresponds to the target IP address one by one. Since the characters in the IP address can be represented by a 4-bit binary number, the target IP address can be represented by binary data with fewer digits, so that the encrypted coded data generated after encryption has fewer characters, and the number of characters corresponding to the encrypted coded data does not exceed the domain name length limit, for example, the number of characters corresponding to the encrypted coded data does not exceed 63.

[0078] For example, taking an IPv6 address as an example, since an IPv6 address includes at least 32 characters, and a 4-bit binary number represents the IPv6 address, it can be converted into 128-bit binary data, that is, the binary data is 16 bytes. Encryption based on 16-byte binary data can effectively ensure that the number of characters corresponding to the generated encrypted data does not exceed 63. In addition, since the number of characters corresponding to an IPv4 address is relatively small, the number of characters in the encrypted data generated after encrypting the IPv4 address will not exceed 63.

[0079] Step S204: Generate a corresponding encrypted composite domain name according to the encrypted coded data and the target domain name.

[0080] In this embodiment, the encrypted synthetic domain name, i.e., the encrypted synthetic domain name, can be generated by combining the encrypted coded data and the target domain name in a manner of generating a synthetic domain name. For example, the encrypted coded data can be used as a prefix of the target domain name to generate the encrypted synthetic domain name. Furthermore, since the number of characters in the encrypted coded data does not exceed the domain name length limit, the encrypted coded data can be used as a separate first-level domain name (e.g., a third-level domain name), so that the encrypted synthetic domain name can match a wildcard domain name certificate, such as a second-level wildcard domain name certificate.

[0081] Step S205, sending the encrypted synthetic domain name to the terminal; the encrypted synthetic domain name is used to instruct the terminal to send the encrypted synthetic domain name to the DNS server, so as to instruct the DNS server to decode and decrypt the encrypted synthetic domain name.

[0082] In this embodiment, after the first server generates an encrypted synthetic domain name, it can send the encrypted synthetic domain name to the terminal. The terminal can send the encrypted synthetic domain name to the DNS server for resolution, and the DNS server can perform corresponding decoding and decryption processing on the encrypted synthetic domain name to obtain the target IP address of the second server, and then return the domain name resolution result including the target IP address to the terminal, so that the terminal can access the second server and realize the redirection of the terminal access request.

[0083] In the domain name encryption method provided in this embodiment, the first server returns an encrypted synthetic domain name to the terminal, which can ensure the security of the synthetic domain name; and, the target IP address is converted into corresponding binary data, and encryption encoding is performed based on the binary data, so that the number of characters in the generated encrypted encoded data does not exceed the domain name length limit. Therefore, in the encrypted synthetic domain name, a separate first-level domain name can be used to represent the encrypted encoded data, and the encrypted synthetic domain name can match the wildcard domain name certificate, thereby achieving normal access.

[0084] In this embodiment, a domain name encryption method is provided, which can be applied to a first server of a CDN (content distribution network), where the first server is a scheduling server in a CDN scheduling system, for example Figure 1 The first edge server shown, etc. Figure 3 is a flowchart of a domain name encryption method according to an embodiment of the present disclosure. Figure 3 As shown, the process includes the following steps.

[0085] Step S301: receiving an access request for accessing a first server sent by a terminal.

[0086] For details, please see Figure 2 Step S201 of the illustrated embodiment will not be described in detail here.

[0087] Step S302: When the access request needs to be redirected to the second server, determine the target IP address and the corresponding target domain name of the second server.

[0088] For details, please see Figure 2 Step S202 of the illustrated embodiment will not be described in detail here.

[0089] Step S303, determine the binary data corresponding to the target IP address, and encrypt the binary data to generate encrypted data corresponding to the target IP address; the number of characters corresponding to the encrypted data does not exceed the domain name length limit.

[0090] Specifically, the process of the above step S303 "determining the binary data corresponding to the target IP address" may include the following step S3031.

[0091] Step S3031, convert the target IP address into binary data of fixed length.

[0092] When a traditional encryption algorithm encrypts plaintext, it first pads the plaintext to ensure that the length of the plaintext after padding meets the encryption algorithm's requirements for the plaintext length. If the existing encryption algorithm is used directly to encrypt the binary data (i.e., plaintext) corresponding to the target IP address, the binary data needs to be padded. This padding method will cause the length of the data to be encrypted to increase further, and there is a risk that the encrypted encoded data exceeds the domain name length limit. In particular, when the encrypted synthetic domain name contains other data (such as subsequent target offset values, etc.), the encrypted synthetic domain name generated in the end will be a domain name with more levels, which is difficult to match the wildcard domain name certificate.

[0093] Since one purpose of padding the plaintext is that the decryption side can know the length of the original data, that is, the length of the plaintext; therefore, in this embodiment, the target IP address is converted into binary data of a fixed length, that is, for any IP address (including IPv4 address and IPv6 address), it is converted into fixed-length binary data, so that when the binary data is encrypted, it is not necessary to pad the binary data; accordingly, since the binary data is of fixed length, the decryption side (that is, the DNS server) does not need to unpadding, and since the data length of the plaintext is known in advance, for example, the length of the binary data is pre-agreed with the DNS server, the decryption side can also implement decryption normally.

[0094] Optionally, for an IPv6 address, at least 16 bytes of binary data are required, so the length of the binary data is not less than 16 bytes; for example, the length of the binary data is equal to 16 bytes.

[0095] In addition, since the plaintext is generally encrypted in data blocks of a certain length, if the length of the plaintext is different from that of the minimum encrypted data block (or is not an integer multiple), the plaintext also needs to be padded; therefore, in this embodiment, the length of the binary data is set to be consistent with the length of the minimum encrypted data block, ensuring that the binary data does not need to be padded.

[0096] For example, if the AES encryption algorithm is used to encrypt binary data, since the length of the minimum encrypted data block corresponding to the AES encryption algorithm is 16 bytes, the length of the binary data can be set to a fixed length of 16 bytes. When the AES encryption algorithm is subsequently used for encryption, the binary data is directly encrypted, that is, the padding operation in the AES encryption algorithm is not performed.

[0097] It can be understood that if the length of binary data is 16 bytes, the IPv6 address can be directly converted into 16-byte binary data; and for an IPv4 address with fewer characters, it can be padded (for example, padded with zeros) to make it 16 bytes. For example, after the IPv4 address is padded with zeros, its corresponding binary data can be expressed as {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff}.

[0098] In this embodiment, by converting the target IP address into binary data of a fixed length, the binary data can be directly encrypted during subsequent encryption without the need to perform a padding operation, thereby further reducing the number of characters in the encrypted encoded data, effectively ensuring that the encrypted encoded data does not exceed the domain name length limit, and generating a fewer level of encrypted synthetic domain names.

[0099] In addition, the process of the above step S303 "encrypting and encoding the binary data to generate encrypted encoded data corresponding to the target IP address" may include the following steps S3032 to S3034.

[0100] Step S3032, determine the target key and determine the target offset value.

[0101] Step S3033, encrypt the binary data according to the target key and the target offset value to generate encrypted data.

[0102] Step S3034, performing character encoding processing on the encrypted data to generate encrypted coded data in character form.

[0103] In this embodiment, when encrypting binary data, it is necessary to be based on the corresponding key, that is, the target key; and, in order to further improve security, a corresponding offset value (IV, InitializationVector), that is, a target offset value, can be generated, and the target offset value can be randomly generated. After determining the target key and the target offset value, the binary data can be encrypted based on the target key and the target offset value to generate corresponding encrypted data. Among them, the encrypted data is also a binary form of data, and, in general, the length of the encrypted data is consistent with the length of the original binary data.

[0104] Since the domain name is represented in character form, it is necessary to perform character encoding processing on the encrypted data in binary form to convert it into character data, that is, encrypted encoded data. Among them, since the domain name is case-insensitive, a case-insensitive character encoding method can be used for character encoding processing. For example, base32 encoding can be used to perform character encoding processing on the encrypted data.

[0105] Step S304: Generate a corresponding encrypted composite domain name according to the encrypted coded data and the target domain name.

[0106] For details, please see Figure 2 Step S204 of the illustrated embodiment will not be described in detail here.

[0107] In some optional implementations, if the binary data is generated based on the target key and the target offset value, in order for the DNS server to be able to decrypt normally, the DNS server needs to be able to determine the corresponding target key and the target offset value, for example, the DNS server and the CDN pre-agreed on the target key and the target offset value to be used. Alternatively, the encrypted synthetic domain name generated by the first server may itself have information related to the target key and the target offset value, and the DNS server may restore the corresponding target key and the target offset value based on the encrypted synthetic domain name.

[0108] Specifically, the above step S304 "generating a corresponding encrypted composite domain name according to the encrypted coded data and the target domain name" may include: generating an encrypted composite domain name including the target offset value, the encrypted coded data and the target domain name.

[0109] In this embodiment, the target offset value used in the encryption process is directly embedded in the encrypted composite domain name, so that when the encrypted composite domain name is decrypted, the DNS server can directly extract the target offset value therefrom and perform decryption based on the target offset value.

[0110] Alternatively, in the process of "determining the target key" in step S3032, in addition to determining the target key, a key identifier of the target key may also be determined, and the key identifier may be, for example, a serial number or a name of the target key. In this case, step S304 "generating a corresponding encrypted synthetic domain name according to the encrypted coded data and the target domain name" may include: generating an encrypted synthetic domain name including the key identifier, the target offset value, the encrypted coded data, and the target domain name.

[0111] Among them, multiple keys can be pre-agreed between the CDN and the DNS server, and each key is provided with a corresponding key identifier. After the DNS server obtains the encrypted synthetic domain name, it can determine the corresponding target key based on the key identifier therein, and can extract the target offset value from the encrypted synthetic domain name, and then can decrypt the encrypted synthetic domain name based on the target key and the target offset value.

[0112] It can be understood that in the encrypted composite domain name, the key identifier and the target offset value can be two independent characters, or the key identifier is a part of the target offset value. For example, the key identifier is the first character or the last character in the target offset value, etc. It is only necessary to ensure that the encrypted composite domain name contains the key identifier and the target offset value.

[0113] In this embodiment, if the encrypted composite domain name contains a key identifier, a target offset value, etc., it is also necessary that the total character length of the target offset value and the encrypted encoded data, or the total character length of the key identifier, the target offset value and the encrypted encoded data, does not exceed the domain name length limit, that is, does not exceed 63 characters, so that these characters can also share the domain name of the same level.

[0114] For example, if the AES encryption algorithm is used for encryption and Base32 encoding is used for character encoding, the length of the binary data is fixed at 16 bytes. Then, for any IP address, after AES encryption (without performing padding operations), 16 bytes of encrypted data can be generated; then the encrypted data is encoded based on Base32 encoding to generate encrypted encoded data with a character length of 26.

[0115] If a 16-byte target offset value is used during encryption, the target offset value can be represented by 16 characters; if the key identifier of the target key is represented by one character, the total character length of the key identifier, the target offset value and the encrypted encoded data is 26+16+1=43, which is less than 63.

[0116] Alternatively, since the edge scheduling nodes (edge ​​servers) in CDN change very quickly, after the unused scheduling nodes are cleared and taken offline, they may be deployed by other businesses / other companies for some services. However, since the synthetic domain name can still be resolved to these offline scheduling nodes, there are security risks. Although the domain name itself has a TTL (Time To Live), when the TTL expires, the local DNS server can still obtain the latest resolution results from the authoritative DNS again, which still poses a security risk.

[0117] In this embodiment, the target offset value is generated based on the timestamp, so that the DNS server can determine whether the encrypted composite record is valid based on the timestamp. Specifically, the above step S3032 "determine the target offset value" may include the following steps a1, or the following steps a2 to a3.

[0118] Step a1: take the current timestamp as the target timestamp and generate a target offset value according to the target timestamp.

[0119] Step a2, determining whether the time difference between the historical timestamp corresponding to the historical offset value generated previously and the current timestamp exceeds a time threshold; the time threshold does not exceed the domain name validity period.

[0120] Step a3: If the time threshold is not exceeded, the historical offset value is used as the target offset value; if the time threshold is exceeded, the current timestamp is used as the target timestamp, and the target offset value is generated according to the target timestamp.

[0121] In this embodiment, when it is necessary to redirect the access request of the terminal to the second server, the first server can determine the current timestamp and generate an offset value used for encryption based on the current timestamp, that is, a target offset value. For the sake of uniform description, the timestamp used to generate the target offset value is referred to as a target timestamp; that is, in step a1, the target timestamp is the current timestamp.

[0122] In addition, if an encrypted synthetic domain name is generated with the latest current timestamp every time an access request needs to be redirected to a second server, encryption computing power will be wasted; and each new domain name will cause a cache miss in the local DNS server, and a large number of domain name resolution requests will be transmitted to the authoritative DNS, which will bring unnecessary load increase.

[0123] In this embodiment, a domain name validity period, such as 12 hours, can be set, and a time threshold that does not exceed the domain name validity period can be set, and the time threshold can be, for example, 5 hours, 10 hours, 12 hours, etc. The first server generates an offset value corresponding to the second server at a previous moment, that is, a historical offset value, and a timestamp corresponding to the historical offset value is a historical timestamp, and generates encrypted coded data based on the historical offset value; at the current moment, if it is necessary to redirect to the second server again, it can be determined whether the time difference between the current timestamp corresponding to the current moment and the historical timestamp exceeds the preset time threshold.

[0124] If the time difference between the two does not exceed the time threshold, it means that the historical offset value is still valid, and the encrypted data generated based on the historical offset value is also valid, so the encrypted data can be used directly to generate the encrypted synthetic domain name without the need for re-encryption. On the contrary, if the time difference between the two does not exceed the time threshold, it means that the historical offset value has expired. At this time, the first server needs to regenerate the target offset value based on the latest current timestamp, that is, the target timestamp corresponding to the target offset value is the current timestamp. In general, it can be generated once or twice before the expiration time of the encrypted data expires. In addition, a domain name monitoring system for the external network can also be set up in the CDN to ensure that the encrypted synthetic domain name can generate the latest encrypted synthetic domain name with the latest current timestamp before the set timeout expires, so as to avoid the problem of domain name resolution failure when the scheduling node is online.

[0125] In addition, even if the same encryption algorithm is used, multiple different encryption methods can be used for encryption; for example, the target offset value used is randomly generated or generated based on a timestamp. In order to distinguish different encryption methods, an encryption method identifier is also provided. Specifically, the above step S3032 "determine the target offset value" can include the following steps b1 to b2.

[0126] Step b1, determine the encryption method identifier; the encryption method identifier is used to indicate whether the plaintext to be encrypted is binary data, and / or whether the offset value is generated according to the timestamp.

[0127] Step b2, generating a target offset value including an encryption method identifier.

[0128] In this embodiment, a character at a fixed position in the offset value may represent the encryption method identifier. The first server determines the corresponding encryption method identifier based on the encryption method used, and then generates a target offset value including the encryption method identifier.

[0129] For example, if the plaintext to be encrypted is binary data, that is, the first server converts the target IP address into binary data, and the target offset value used is generated based on the timestamp, the encryption method identifier can be set to the first character, such as "F"; if the plaintext to be encrypted is binary data, and the target offset value used is randomly generated, the encryption method identifier can be set to the second character, such as "B"; if the plaintext to be encrypted is not binary data, for example, the target IP address in character form is directly encrypted, the encryption method identifier can be set to the third character, such as "A". Accordingly, the first server can determine whether it is currently necessary to use binary data for encryption, and if necessary, execute the subsequent step S303.

[0130] For example, the first character of the offset value can be used to indicate the encryption method identifier, followed by any hexadecimal numeric characters. If the target offset value is ABBBDC3949BA59AB, the first character is "A", indicating that the target IP address in character form is directly encrypted; if the target offset value is BBBBDC3949BA59AB, the first character is "B", indicating that the target IP address needs to be converted into binary data; if the target offset value is F000001673082950, ​​the first character is "F", indicating that the target IP address needs to be converted into binary data, and the offset value is generated based on the timestamp, and "1673082950" is the timestamp.

[0131] Figure 4 A schematic diagram of generating an encrypted composite domain name is shown. Figure 4As shown, the target IP address of the second server can be converted into 16-byte binary data; based on the timestamp (for example, the current timestamp) and the encryption method identifier used, a target offset value is generated, and the binary data is encrypted and encoded using the corresponding target key and target offset value to generate encrypted encoded data. In addition, the encrypted encoded data, the target offset value and the key identifier are spliced ​​into a whole as a domain name prefix, and the target domain name is used as a domain name suffix, and finally an encrypted composite domain name can be generated.

[0132] Step S305, sending the encrypted synthetic domain name to the terminal; the encrypted synthetic domain name is used to instruct the terminal to send the encrypted synthetic domain name to the DNS server, so as to instruct the DNS server to decode and decrypt the encrypted synthetic domain name.

[0133] For details, please see Figure 2 Step S205 of the illustrated embodiment will not be described in detail here.

[0134] The domain name encryption method provided in this embodiment can ensure the security of the synthetic domain name; and the target IP address is converted into binary data of fixed length, which can effectively ensure that the number of characters of the generated encrypted encoded data does not exceed the domain name length limit. Even if characters such as key identifiers and target offset values ​​are added to the encrypted synthetic domain name, these characters can share the same level of domain name and match the wildcard domain name certificate. In addition, the target offset value is generated based on the timestamp, which facilitates the DNS server to detect whether the encrypted synthetic domain name is valid, thereby preventing it from being illegally used after the scheduling node in the CDN goes offline.

[0135] In this embodiment, a domain name decryption method is provided, which can be applied to a DNS server of a domain name system, such as Figure 1 The DNS servers shown. Figure 5 is a flowchart of a domain name decryption method according to an embodiment of the present disclosure. Figure 5 As shown, the process includes the following steps.

[0136] Step S501, receiving a domain name resolution request sent by a terminal; the domain name resolution request includes an encrypted synthetic domain name, which is obtained by encrypting and encoding binary data corresponding to a target IP address of a second server by a first server to generate encrypted coded data corresponding to the target IP address, and generating a synthetic domain name based on the encrypted coded data and the target domain name of the second server.

[0137] In this embodiment, refer to the above Figure 2 or Figure 3In the embodiment shown, when redirection is required, the first server of the CDN will determine the target IP address and target domain name of the second server, and encrypt the binary data corresponding to the target IP address of the second server to generate encrypted data corresponding to the target IP address, and finally generate an encrypted composite domain name based on the encrypted data and the target domain name of the second server, which will not be described in detail here. In addition, after receiving the encrypted composite domain name, the terminal can initiate a domain name resolution request containing the encrypted composite domain name to the DNS server.

[0138] Step S502, decoding and decrypting the encrypted synthetic domain name to generate a domain name resolution result; the domain name resolution result includes a target IP address of the second server.

[0139] In this embodiment, after receiving the encrypted composite domain name, the DNS server can perform a decoding and decryption operation opposite to the encryption encoding on the encrypted coded data in the encrypted composite domain name, thereby restoring the target IP address of the second server and generating a corresponding domain name resolution result.

[0140] In some optional implementations, the above step S502 "decoding and decrypting the encrypted synthetic domain name to generate a domain name resolution result" includes the following steps c1 to c4.

[0141] Step c1, performing character decoding processing on the encrypted coded data in character form in the encrypted composite domain name to generate binary decoded data.

[0142] Step c2, determining the target key and target offset value corresponding to the encrypted synthetic domain name.

[0143] Step c3, decrypting the decoded data according to the target key and the target offset value to generate corresponding binary data.

[0144] Step c4, determining the target IP address corresponding to the binary data.

[0145] In this embodiment, the encrypted data can be extracted from the prefix part of the encrypted composite domain name, and then the encrypted data is subjected to character decoding processing opposite to the character encoding processing. For example, if the character encoding processing is base32 encoding, the character decoding processing is base32 decoding, thereby obtaining decoded data in binary form. Further, the target key and target offset value required for decryption can be determined, and then the decoded data can be decrypted according to the target key and target offset value, and finally the corresponding binary data can be obtained, and the target IP address corresponding to the binary data can be determined.

[0146] Optionally, the encrypted composite domain name may include information related to a target key and / or a target offset value.

[0147] For example, the encrypted composite domain name includes: encrypted coded data, target domain name and target offset value corresponding to the encrypted composite domain name. Accordingly, the above step c2 "determining the target key and target offset value corresponding to the encrypted composite domain name" may include: extracting the target offset value from the encrypted composite domain name.

[0148] Alternatively, the encrypted composite domain name includes: encrypted coded data, target domain name, key identifier and target offset value corresponding to the encrypted composite domain name. Accordingly, the above step c2 "determining the target key and target offset value corresponding to the encrypted composite domain name" may include: determining the corresponding target key according to the key identifier, and extracting the target offset value from the encrypted composite domain name.

[0149] In addition, optionally, the target offset value in the encrypted synthetic domain name is generated according to the target timestamp; the process of the target offset value can be specifically referred to the above steps a1 to a3, which will not be repeated here.

[0150] Accordingly, the DNS server may also determine whether the encrypted composite domain name is valid based on the target offset value. Specifically, the process may include the following steps d1 to d3.

[0151] Step d1, determining a target timestamp corresponding to a target offset value.

[0152] Step d2, determining whether the target timestamp exceeds the domain name validity period.

[0153] Step d3, when the target timestamp exceeds the domain name validity period, the domain name resolution is terminated.

[0154] In this embodiment, the DNS server can pre-set a certain domain name validity period, such as 12 hours. If the target timestamp corresponding to the target offset value exceeds the domain name validity period, that is, the time difference between the current timestamp of the DNS server and the target timestamp exceeds the domain name validity period, it can be determined that the encrypted synthetic domain name has expired, and there is no need to perform the subsequent decryption process, and the domain name resolution can be terminated; for example, an empty resolution of the NXDOMAIN type can be directly returned to the terminal.

[0155] Optionally, the target offset value may include an encryption method identifier, which is used to indicate whether the plaintext to be encrypted is binary data, and / or whether the offset value is generated based on a timestamp; the process of generating the target offset value can be referred to steps b1 to b2 above, which will not be repeated here.

[0156] Furthermore, the above step c3 "decrypting the decoded data according to the target key and the target offset value to generate corresponding binary data" may include the following steps c31 to c32.

[0157] Step c31, when the encryption method identifier indicates that the plaintext to be encrypted is binary data, the decoded data is decrypted according to the target key and the target offset value to generate corresponding binary data.

[0158] Step c32, when the encryption method identifier indicates that the offset value is generated according to the timestamp, determine whether the target timestamp corresponding to the target offset value exceeds the validity period of the domain name, and when the target timestamp does not exceed the validity period of the domain name, decrypt the decoded data according to the target key and the target offset value to generate corresponding binary data.

[0159] In addition, if the encryption method identifier indicates that the plaintext to be encrypted is not binary data, a traditional method may be used for decryption, such as unpadding the decoded data, which will not be described in detail here.

[0160] Step S503: Send the domain name resolution result to the terminal.

[0161] After the DNS server completes the resolution, it can send the domain name resolution result including the target IP address of the second server to the terminal, so that the terminal can normally access the second server.

[0162] The domain name decryption method provided in this embodiment supports decoding and decrypting the encrypted synthetic domain name sent by the terminal by the DNS server, thereby ensuring the security of domain name transmission and ensuring that the encrypted synthetic domain name can match the wildcard domain name certificate; and, by using the target offset value generated based on the timestamp in the encrypted synthetic domain name, it is possible to detect whether the encrypted synthetic domain name is valid, thereby preventing it from being illegally used after the scheduling node in the CDN goes offline.

[0163] In this embodiment, a domain name decryption method is provided, which can be applied to a terminal, for example Figure 1 Terminal shown. Figure 6 is a flowchart of a domain name decryption method according to an embodiment of the present disclosure. Figure 6 As shown, the process includes the following steps.

[0164] Step S601: Initiate an access request to a first server of a content distribution network.

[0165] Step S602, receiving the encrypted synthetic domain name returned by the first server; the encrypted synthetic domain name is to encrypt and encode the binary data corresponding to the target IP address of the second server, generate encrypted coded data corresponding to the target IP address, and generate a synthetic domain name based on the encrypted coded data and the target domain name of the second server.

[0166] Step S603, sending a domain name resolution request to a DNS server; the domain name resolution request includes an encrypted synthetic domain name.

[0167] Step S604, receiving the domain name resolution result returned by the DNS server; the domain name resolution result includes the target IP address of the second server.

[0168] Step S605: Initiate an access request to the second server according to the domain name resolution result.

[0169] In this embodiment, the terminal can receive the encrypted composite domain name returned by the first server. The prefix in the encrypted composite domain name does not exceed the domain name length limit, so that it can match the wildcard domain name certificate to ensure that the terminal can perform HTTPS access normally.

[0170] Figure 7 A schematic diagram of a process for redirecting a terminal access request is shown in FIG. Figure 7 As shown, the process includes the following steps.

[0171] Step S701: A terminal initiates an access request to a first server of a content distribution network.

[0172] Step S702, when it is necessary to redirect the access request to the second server, the first server determines the binary data corresponding to the target IP address, encrypts the binary data, and generates encrypted data corresponding to the target IP address; based on the encrypted data and the target domain name, generates a corresponding encrypted synthetic domain name.

[0173] Step S703: The first server returns the encrypted composite domain name to the terminal.

[0174] Among them, a target offset can be generated based on the timestamp, and an encrypted synthetic domain name including a key identifier, a target offset value, encrypted encoded data and a target domain name is generated.

[0175] For example, the target IP address of the second server is an IPv6 address, which is fe80::216: : :3e66, convert the target IP address into binary data: fe8000000000000000216 3e66 (in hexadecimal), the binary data is 16 bytes in total.

[0176] If the target offset is generated by the timestamp, the encryption mode identifier is set to "F"; and the current timestamp of the first server is 1709895501, then a 16-character target offset can be generated: F000001709895501. In addition, the target key used this time can also be determined; among them, if the target key used for encryption is the first key, the key identifier can be set to "1".

[0177] The 16-byte binary data is encrypted according to the target offset and the target key to generate 16-byte encrypted data, which is then encoded using base32 encoding. The encoding result is: IICTTSTFSUOMVF3OIHJVQYUD3Y======. Among them, "=" is a padding character of base32 encoding; since the length of the encrypted data is fixed, which is 16 bytes, the number of padding characters "=" is also fixed, which is 6. In this embodiment, the padding character "=" after base32 encoding is removed to generate the required encrypted encoded data, i.e., IICTTSTFSUOMVF3OIHJVQYUD3Y, a total of 26 characters.

[0178] The key identifier "1", the target offset F000001709895501 and the encrypted data IICTTSTFSUOMVF3OIHJVQYUD3Y are concatenated as the domain name prefix, and the target domain name of the second server is used as the domain name suffix. For example, if the target domain name is example.com, a new encrypted synthetic domain name can be generated: 1f000001709895501iicttstfsuomvf3oihjvqyud3y.example.com (domain names are not case-sensitive). After that, the first server can return the encrypted synthetic domain name to the terminal.

[0179] Step S704: The terminal sends a domain name resolution request to the DNS server.

[0180] Step S705: The DNS server decodes and decrypts the encrypted composite domain name in the domain name resolution request, determines the target IP address of the second server, and forms a corresponding domain name resolution result.

[0181] Step S706: The DNS server sends the domain name resolution result to the terminal.

[0182] For example, the encrypted synthetic domain name received by the DNS server is as shown above, that is, the encrypted synthetic domain name is: 1f000001709895501iicttstfsuomvf3oihjvqyud3y.example.com. Afterwards, the DNS server can match the configuration corresponding to example.com for decoding and decrypting the encrypted synthetic domain name, so as to be able to decode and decrypt the encrypted synthetic domain name and implement domain name resolution.

[0183] Among them, the DNS server can determine the first 17 characters in the domain name prefix 1f000001709895501, the first character of which is "1", that is, the key identifier is 1, so the DNS server can use the first key pre-agreed with the CDN as the target key required for decryption; and the second character is "f", then the DNS server can extract the subsequent target timestamp, that is, 1709895501, and determine whether the target timestamp has expired. If the timestamp in the correct format cannot be extracted from the first 17 characters, or the target timestamp has expired, an empty resolution (NXDOMAIN) is returned to the terminal; if the target timestamp is legal and has not expired, the target offset value can be extracted: F000001709895501 (lowercase to uppercase).

[0184] In addition, except for the first 17 characters in the domain name prefix, the remaining characters correspond to the encrypted encoded data, which are converted to uppercase to obtain: IICTTSTFSUOMVF3OIHJVQYUD3Y. It is base32 decoded (filled with the padding character "=" first), and then the decoded data can be decrypted based on the target key and target offset value, and finally the original target IP address is obtained, realizing the resolution of the encrypted synthetic domain name.

[0185] Step S707: The terminal initiates an access request to the second server according to the domain name resolution result.

[0186] In this embodiment, the use of an encrypted synthetic domain name for redirection can ensure the security of domain name transmission, and the domain name prefix can be a separate first-level domain name, thereby ensuring that the encrypted synthetic domain name can match the wildcard domain name certificate; and, using the target offset value generated based on the timestamp in the encrypted synthetic domain name, it is possible to detect whether the encrypted synthetic domain name is valid, thereby preventing it from being illegally used after the scheduling node in the CDN goes offline.

[0187] In this embodiment, a domain name encryption and decryption device is also provided, which is used to implement the above embodiments and preferred implementations, and will not be repeated here. As used below, the term "module" may be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0188] This embodiment provides a domain name encryption device, which is applied to a first server of a content distribution network, such as Figure 8 As shown, including:

[0189] An access request receiving module 801 is used to receive an access request sent by a terminal to access the first server;

[0190] A determination module 802 is used to determine a target IP address and a corresponding target domain name of the second server when the access request needs to be redirected to the second server;

[0191] The encryption module 803 is used to determine the binary data corresponding to the target IP address, and encrypt the binary data to generate encrypted data corresponding to the target IP address; the number of characters corresponding to the encrypted data does not exceed the domain name length limit;

[0192] A synthesis module 804, configured to generate a corresponding encrypted synthesized domain name according to the encrypted coded data and the target domain name;

[0193] The encrypted composite domain name sending module 805 is used to send the encrypted composite domain name to the terminal; the encrypted composite domain name is used to instruct the terminal to send the encrypted composite domain name to the domain name system server, so as to instruct the domain name system server to decode and decrypt the encrypted composite domain name.

[0194] In some optional implementations, the encryption encoding module 803 determines the binary data corresponding to the target IP address, including:

[0195] The target IP address is converted into binary data of fixed length.

[0196] In some optional implementations, the length of the binary data is consistent with the length of a minimum encrypted data block and is not less than 16 bytes.

[0197] In some optional implementations, the encryption and coding module 803 encrypts and codes the binary data to generate encrypted and coded data corresponding to the target IP address, including:

[0198] Determine the target key and determine the target offset value;

[0199] Encrypting the binary data according to the target key and the target offset value to generate encrypted data;

[0200] The encrypted data is subjected to character encoding processing to generate encrypted coded data in character form.

[0201] In some optional implementations, the synthesis module 804 generates a corresponding encrypted synthesized domain name according to the encrypted coded data and the target domain name, including:

[0202] An encrypted composite domain name is generated including the target offset value, the encrypted encoded data and the target domain name.

[0203] In some optional implementations, the encryption encoding module 803 determines the target offset value, including:

[0204] Taking the current timestamp as the target timestamp, and generating a target offset value according to the target timestamp;

[0205] or,

[0206] Determine whether the time difference between the historical timestamp corresponding to the historical offset value generated previously and the current timestamp exceeds a time threshold; the time threshold does not exceed the domain name validity period;

[0207] If the time threshold is not exceeded, the historical offset value is used as the target offset value; if the time threshold is exceeded, the current timestamp is used as the target timestamp, and the target offset value is generated according to the target timestamp.

[0208] In some optional implementations, the encryption encoding module 803 determines the target offset value, including:

[0209] Determine an encryption mode identifier; the encryption mode identifier is used to indicate whether the plaintext to be encrypted is binary data, and / or whether an offset value is generated according to a timestamp;

[0210] A target offset value including the encryption method identifier is generated.

[0211] In some optional implementations, the encryption encoding module 803 determines the target key, including:

[0212] Determining a target key and a key identifier of the target key;

[0213] The synthesis module 804 generates a corresponding encrypted synthesized domain name according to the encrypted coded data and the target domain name, including:

[0214] An encrypted composite domain name is generated that includes the key identifier, the target offset value, the encrypted encoded data, and the target domain name.

[0215] This embodiment provides a domain name decryption device, which is applied to a domain name system server, such as Fig. 9 As shown, the device comprises:

[0216] The resolution request receiving module 901 is used to receive a domain name resolution request sent by a terminal; the domain name resolution request includes an encrypted synthetic domain name, the encrypted synthetic domain name is generated by the first server by encrypting and encoding binary data corresponding to the target IP address of the second server, generating encrypted coded data corresponding to the target IP address, and generating a synthetic domain name based on the encrypted coded data and the target domain name of the second server;

[0217] A decoding and decryption module 902 is used to decode and decrypt the encrypted synthetic domain name to generate a domain name resolution result; the domain name resolution result includes a target IP address of the second server;

[0218] The resolution result sending module 903 is used to send the domain name resolution result to the terminal.

[0219] In some optional implementations, the decoding and decryption module 902 decodes and decrypts the encrypted synthetic domain name to generate a domain name resolution result, including:

[0220] Performing character decoding processing on the encrypted coded data in character form in the encrypted composite domain name to generate binary decoded data;

[0221] Determine a target key and a target offset value corresponding to the encrypted synthetic domain name;

[0222] Decrypting the decoded data according to the target key and the target offset value to generate corresponding binary data;

[0223] Determine the target IP address corresponding to the binary data.

[0224] In some optional implementations, the encrypted synthetic domain name includes: the encrypted coded data, the target domain name, and a target offset value corresponding to the encrypted synthetic domain name;

[0225] The decoding and decryption module 902 determines the target key and target offset value corresponding to the encrypted composite domain name, including: extracting the target offset value from the encrypted composite domain name;

[0226] Alternatively, the encrypted composite domain name includes: the encrypted coded data, the target domain name, a key identifier corresponding to the encrypted composite domain name, and a target offset value;

[0227] The decoding and decryption module 902 determines the target key and target offset value corresponding to the encrypted composite domain name, including: determining the corresponding target key according to the key identifier, and extracting the target offset value from the encrypted composite domain name.

[0228] In some optional embodiments, the target offset value is generated based on a target timestamp;

[0229] The device also includes a judging module, which is used to:

[0230] Determining the target timestamp corresponding to the target offset value;

[0231] Determine whether the target timestamp exceeds the domain name validity period;

[0232] When the target timestamp exceeds the domain name validity period, the domain name resolution is terminated.

[0233] In some optional implementations, the target offset value includes an encryption mode identifier, and the encryption mode identifier is used to indicate whether the plaintext to be encrypted is binary data, and / or whether the offset value is generated according to a timestamp;

[0234] The decoding and decryption module 902 performs decryption processing on the decoded data according to the target key and the target offset value to generate corresponding binary data, including:

[0235] In the case where the encryption mode identifier indicates that the plaintext to be encrypted is binary data, decrypting the decoded data according to the target key and the target offset value to generate corresponding binary data;

[0236] When the encryption method identifier indicates that the offset value is generated according to the timestamp, determine whether the target timestamp corresponding to the target offset value exceeds the validity period of the domain name, and when the target timestamp does not exceed the validity period of the domain name, decrypt the decoded data according to the target key and the target offset value to generate corresponding binary data.

[0237] This embodiment provides a domain name decryption device, which is applied to a terminal, such as Fig.10 As shown, the device comprises:

[0238] An access request sending module 1001, configured to initiate an access request to a first server of a content distribution network;

[0239] The encrypted synthetic domain name receiving module 1002 is used to receive the encrypted synthetic domain name returned by the first server; the encrypted synthetic domain name is a synthetic domain name generated by encrypting and encoding binary data corresponding to the target IP address of the second server to generate encrypted coded data corresponding to the target IP address, and based on the encrypted coded data and the target domain name of the second server;

[0240] A resolution request module 1003 is used to send a domain name resolution request to a domain name system server; the domain name resolution request includes the encrypted synthetic domain name;

[0241] The resolution result receiving module 1004 is used to receive the domain name resolution result returned by the domain name system server; the domain name resolution result includes the target IP address of the second server;

[0242] The access request sending module 1001 is further used to initiate an access request to the second server according to the domain name resolution result.

[0243] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0244] The domain name encryption and decryption device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, including a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0245] The disclosed embodiment also provides a computer device having the domain name encryption and decryption device shown above.

[0246] See also Fig.11 , Fig.11 is a schematic diagram of a computer device provided by an optional embodiment of the present disclosure, such as Fig.11 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Fig.11 A processor 10 is taken as an example.

[0247] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0248] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0249] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0250] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0251] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0252] The embodiments of the present disclosure also provide a computer-readable storage medium. The above-mentioned method according to the embodiments of the present disclosure can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium and downloaded through a network, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0253] A part of the present disclosure may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present disclosure through the operation of the computer. Those skilled in the art should understand that the existence of computer program instructions in computer-readable media includes, but is not limited to, source files, executable files, installation package files, etc., and accordingly, the way in which computer program instructions are executed by a computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to the computer.

[0254] Although the embodiments of the present disclosure have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A domain name encryption method based on CDN, characterized in that: Applied to a first server of a content distribution network, the method comprises: receiving an access request for accessing the first server sent by a terminal; In case the access request needs to be redirected to a second server, determining a target IP address and a corresponding target domain name of the second server; Determine binary data corresponding to the target IP address, and encrypt the binary data to generate encrypted data corresponding to the target IP address; the number of characters corresponding to the encrypted data does not exceed the domain name length limit; Generate a corresponding encrypted synthetic domain name according to the encrypted coded data and the target domain name; Sending the encrypted synthetic domain name to the terminal; the encrypted synthetic domain name is used to instruct the terminal to send the encrypted synthetic domain name to a domain name system server, so as to instruct the domain name system server to decode and decrypt the encrypted synthetic domain name; Wherein, the determining of the binary data corresponding to the target IP address includes: Convert the target IP address into binary data of fixed length; the target IP address is an IPv6 address; the length of the binary data is consistent with the length of the minimum encrypted data block and is not less than 16 bytes; The step of generating a corresponding encrypted composite domain name according to the encrypted coded data and the target domain name includes: Generate an encrypted composite domain name including a target offset value, the encrypted coded data and the target domain name; the target offset value is an offset value used to encrypt the binary data; the encrypted coded data is located in a domain name at a separate level in the encrypted composite domain name, and the target offset value and the encrypted coded data share a domain name at the same level; The process of determining the target offset value includes: Taking the current timestamp as the target timestamp, and generating a target offset value according to the target timestamp; or, Determine whether the time difference between the historical timestamp corresponding to the historical offset value generated previously and the current timestamp exceeds a time threshold; the time threshold does not exceed the domain name validity period; If the time threshold is not exceeded, the historical offset value is used as the target offset value; if the time threshold is exceeded, the current timestamp is used as the target timestamp, and the target offset value is generated according to the target timestamp.

2. The method according to claim 1, characterized in that The step of encrypting and encoding the binary data to generate encrypted coded data corresponding to the target IP address includes: Determine the target key and determine the target offset value; Encrypting the binary data according to the target key and the target offset value to generate encrypted data; The encrypted data is subjected to character encoding processing to generate encrypted coded data in character form.

3. The method according to claim 2, characterized in that The determining of the target offset value comprises: Determine an encryption mode identifier; the encryption mode identifier is used to indicate whether the plaintext to be encrypted is binary data, and / or whether an offset value is generated according to a timestamp; A target offset value including the encryption method identifier is generated.

4. The method according to claim 2, characterized in that: The determining of the target key comprises: Determining a target key and a key identifier of the target key; The step of generating a corresponding encrypted composite domain name according to the encrypted coded data and the target domain name includes: An encrypted composite domain name is generated that includes the key identifier, the target offset value, the encrypted encoded data, and the target domain name.

5. A domain name decryption method based on CDN, characterized in that: Applied to a domain name system server, the method comprises: A domain name resolution request sent by a receiving terminal; the domain name resolution request includes an encrypted synthetic domain name, the encrypted synthetic domain name is generated by the first server encrypting and encoding fixed-length binary data corresponding to the target IP address of the second server, generating encrypted coded data corresponding to the target IP address, and generating a synthetic domain name based on the encrypted coded data and the target domain name of the second server; the target IP address is an IPv6 address, and the length of the binary data is consistent with the length of a minimum encrypted data block and is not less than 16 bytes; Decoding and decrypting the encrypted synthetic domain name to generate a domain name resolution result; the domain name resolution result includes a target IP address of the second server; Sending the domain name resolution result to the terminal; The encrypted composite domain name includes: the encrypted coded data, the target domain name and the target offset value corresponding to the encrypted composite domain name; the target offset value is an offset value used to encrypt the binary data; the encrypted coded data is located in a domain name at a separate level in the encrypted composite domain name, and the target offset value and the encrypted coded data share a domain name at the same level; The target offset value is generated according to the target timestamp; The method further comprises: Determining the target timestamp corresponding to the target offset value; Determine whether the target timestamp exceeds the domain name validity period; When the target timestamp exceeds the domain name validity period, the domain name resolution is terminated.

6. The method according to claim 5, characterized in that The step of decoding and decrypting the encrypted synthetic domain name to generate a domain name resolution result includes: Performing character decoding processing on the encrypted coded data in character form in the encrypted composite domain name to generate binary decoded data; Determine a target key and a target offset value corresponding to the encrypted synthetic domain name; Decrypting the decoded data according to the target key and the target offset value to generate corresponding binary data; Determine the target IP address corresponding to the binary data.

7. The method according to claim 6, characterized in that The encrypted composite domain name also includes: a key identifier and a target offset value corresponding to the encrypted composite domain name; The determining of the target key and the target offset value corresponding to the encrypted composite domain name includes: determining the corresponding target key according to the key identifier, and extracting the target offset value from the encrypted composite domain name.

8. The method according to claim 7, characterized in that The target offset value includes an encryption mode identifier, and the encryption mode identifier is used to indicate whether the plaintext to be encrypted is binary data and / or whether the offset value is generated according to a timestamp; The decrypting the decoded data according to the target key and the target offset value to generate corresponding binary data includes: In the case where the encryption mode identifier indicates that the plaintext to be encrypted is binary data, decrypting the decoded data according to the target key and the target offset value to generate corresponding binary data; When the encryption method identifier indicates that the offset value is generated according to the timestamp, determine whether the target timestamp corresponding to the target offset value exceeds the validity period of the domain name, and when the target timestamp does not exceed the validity period of the domain name, decrypt the decoded data according to the target key and the target offset value to generate corresponding binary data.

9. A domain name decryption method based on CDN, characterized in that: Applied to a terminal, the method comprises: Initiate an access request to a first server of the content distribution network; receiving an encrypted synthetic domain name returned by the first server; the encrypted synthetic domain name is obtained by encrypting and encoding binary data of a fixed length corresponding to a target IP address of the second server to generate encrypted coded data corresponding to the target IP address, and generating a synthetic domain name based on the encrypted coded data and the target domain name of the second server; the target IP address is an IPv6 address, and the length of the binary data is consistent with the length of a minimum encrypted data block and is not less than 16 bytes; Sending a domain name resolution request to a domain name system server; the domain name resolution request includes the encrypted synthetic domain name; receiving a domain name resolution result returned by the domain name system server; the domain name resolution result includes a target IP address of the second server; Initiate an access request to the second server according to the domain name resolution result; The encrypted composite domain name includes: the encrypted coded data, the target domain name and the target offset value corresponding to the encrypted composite domain name; the target offset value is an offset value used to encrypt the binary data; the target offset value is used to instruct the domain name system server to determine whether the target timestamp exceeds the domain name validity period; when the target timestamp exceeds the domain name validity period, the domain name resolution is terminated; the encrypted coded data is located in a separate level domain name in the encrypted composite domain name, and the target offset value and the encrypted coded data share the same level domain name.

10. A domain name encryption device based on CDN, characterized in that: Applied to a first server of a content distribution network, the device comprises: An access request receiving module, used to receive an access request sent by a terminal to access the first server; A determination module, configured to determine a target IP address and a corresponding target domain name of the second server when the access request needs to be redirected to the second server; An encryption coding module, used for determining binary data corresponding to the target IP address, and encrypting the binary data to generate encrypted coded data corresponding to the target IP address; the number of characters corresponding to the encrypted coded data does not exceed the domain name length limit; A synthesis module, used to generate a corresponding encrypted synthetic domain name according to the encrypted coded data and the target domain name; An encrypted synthetic domain name sending module is used to send the encrypted synthetic domain name to the terminal; the encrypted synthetic domain name is used to instruct the terminal to send the encrypted synthetic domain name to a domain name system server, so as to instruct the domain name system server to decode and decrypt the encrypted synthetic domain name; The encryption coding module determines the binary data corresponding to the target IP address, including: converting the target IP address into binary data of fixed length; the target IP address is an IPv6 address; the length of the binary data is consistent with the length of the minimum encryption data block and is not less than 16 bytes; The step of generating a corresponding encrypted composite domain name according to the encrypted coded data and the target domain name includes: Generate an encrypted composite domain name including a target offset value, the encrypted coded data and the target domain name; the target offset value is an offset value used to encrypt the binary data; the encrypted coded data is located in a domain name at a separate level in the encrypted composite domain name, and the target offset value and the encrypted coded data share a domain name at the same level; The process of determining the target offset value includes: Taking the current timestamp as the target timestamp, and generating a target offset value according to the target timestamp; or, Determine whether the time difference between the historical timestamp corresponding to the historical offset value generated previously and the current timestamp exceeds a time threshold; the time threshold does not exceed the domain name validity period; If the time threshold is not exceeded, the historical offset value is used as the target offset value; if the time threshold is exceeded, the current timestamp is used as the target timestamp, and the target offset value is generated according to the target timestamp.

11. A domain name decryption device based on CDN, characterized in that: Applied to a domain name system server, the device comprises: a resolution request receiving module, configured to receive a domain name resolution request sent by a terminal; the domain name resolution request includes an encrypted synthetic domain name, the encrypted synthetic domain name is generated by the first server encrypting and encoding binary data of a fixed length corresponding to a target IP address of a second server, generating encrypted coded data corresponding to the target IP address, and generating a synthetic domain name based on the encrypted coded data and the target domain name of the second server; the target IP address is an IPv6 address, and the length of the binary data is consistent with the length of a minimum encrypted data block and is not less than 16 bytes; A decoding and decryption module, used to decode and decrypt the encrypted synthetic domain name to generate a domain name resolution result; the domain name resolution result includes a target IP address of the second server; A resolution result sending module, used for sending the domain name resolution result to the terminal; The encrypted composite domain name includes: the encrypted coded data, the target domain name and the target offset value corresponding to the encrypted composite domain name; the target offset value is an offset value used to encrypt the binary data; the encrypted coded data is located in a domain name at a separate level in the encrypted composite domain name, and the target offset value and the encrypted coded data share a domain name at the same level; The target offset value is generated according to the target timestamp; The device also includes a judging module, which is used to: Determining the target timestamp corresponding to the target offset value; Determine whether the target timestamp exceeds the domain name validity period; When the target timestamp exceeds the domain name validity period, the domain name resolution is terminated.

12. A domain name decryption device based on CDN, characterized in that: Applied to a terminal, the device comprises: An access request sending module, used to initiate an access request to a first server of a content distribution network; an encrypted synthetic domain name receiving module, configured to receive the encrypted synthetic domain name returned by the first server; the encrypted synthetic domain name is obtained by encrypting and encoding binary data corresponding to a target IP address of the second server, generating encrypted coded data of a fixed length corresponding to the target IP address, and generating a synthetic domain name based on the encrypted coded data and the target domain name of the second server; the target IP address is an IPv6 address, and the length of the binary data is consistent with the length of a minimum encrypted data block and is not less than 16 bytes; A resolution request module, used for sending a domain name resolution request to a domain name system server; the domain name resolution request includes the encrypted synthetic domain name; A resolution result receiving module, used to receive the domain name resolution result returned by the domain name system server; the domain name resolution result includes the target IP address of the second server; The access request sending module is further used to initiate an access request to the second server according to the domain name resolution result; The encrypted composite domain name includes: the encrypted coded data, the target domain name and the target offset value corresponding to the encrypted composite domain name; the target offset value is an offset value used to encrypt the binary data; the target offset value is used to instruct the domain name system server to determine whether the target timestamp exceeds the domain name validity period; when the target timestamp exceeds the domain name validity period, the domain name resolution is terminated; the encrypted coded data is located in a separate level domain name in the encrypted composite domain name, and the target offset value and the encrypted coded data share the same level domain name.

13. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method according to any one of claims 1 to 9 by executing the computer instructions.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 9.

15. A computer program product, characterized in that The method comprises computer instructions for causing a computer to execute the method according to any one of claims 1 to 9.

Images