Domain name filtering method and device, electronic equipment and storage medium

Abstract

The application relates to the network field and provides a domain name filtering method and device, electronic equipment and a storage medium. The method comprises the following steps: analyzing a DNS server return data packet to obtain a DNS server IP and a mapping relationship between a destination domain name and an IP address, and then calculating hash values of the mapping relationships; when the DNS server IP is a trusted address, comparing each hash value with a prestored hash value respectively; if the hash value does not match the prestored hash value, storing the mapping relationship corresponding to the hash value, replacing the destination domain name in a firewall filtering rule with an IP address associated with the destination domain name, and then performing domain name filtering based on the associated IP address. The domain name filtering provided by the application realizes dynamic filtering of a service domain name based on a network firewall, and according to the analysis result of the DNS server return data packet, the mapping relationship between the destination domain name and the IP address is used to realize real-time dynamic adjustment of the network firewall filtering rule.

Description

Technical Field

[0001] This application relates to the field of network technology, specifically to a domain name filtering method, apparatus, electronic device, and storage medium. Background Technology

[0002] With the acceleration of enterprise digital transformation and the large-scale application of cloud-native technologies, the number of application services within enterprise data centers is rapidly increasing. Typically, application services provide external access via domain names. These domain names, acting as logical addresses, shield visitors from the physical IP addresses of the application services, making changes to the application service's IP address transparent to visitors. When applications located in the isolated area of ​​the data center access applications located on the internal network, or access public network services, they need to pass through a firewall.

[0003] Currently, network firewalls based on the network and transport layers filter data packets by IP address and port number. When the destination IP changes, the firewall policy cannot be updated in real time, making it difficult to adapt to the frequent changes in business IP caused by real-time application scheduling under cloud-native technology conditions. Summary of the Invention

[0004] This invention provides a domain name filtering method, apparatus, electronic device, and storage medium to solve the technical problem that existing network firewalls are unable to adapt to frequent changes in business IPs.

[0005] This invention provides a domain name filtering method, comprising:

[0006] After resolving the data packets returned by the DNS server to obtain the DNS server IP and the mapping relationship between one or more destination domain names and IP addresses, the hash value of each mapping relationship is calculated.

[0007] When the DNS server IP is a trusted address, each hash value is compared with a pre-stored hash value, which includes one or more hash values ​​corresponding to mapping relationships associated with the destination domain name.

[0008] If the hash value does not match the pre-stored hash value, the mapping relationship corresponding to the hash value is stored, and the destination domain name in the firewall filtering rule is replaced with the IP address associated with the destination domain name. Then, domain name filtering is performed based on the associated IP address.

[0009] According to a domain name filtering method provided by the present invention, storing the mapping relationship corresponding to the hash value includes storing the mapping relationship between the destination domain name and the IP address corresponding to the hash value, storing the hash value, and updating the time-to-live of the mapping relationship corresponding to the hash value to the current time;

[0010] After comparing each of the aforementioned hash values ​​with the pre-stored hash values, the process also includes:

[0011] If the hash value matches the pre-stored hash value, the time-to-live (TTL) of the mapping relationship corresponding to the hash value is updated to the current time.

[0012] According to a domain name filtering method provided by the present invention, the domain name filtering method further includes:

[0013] When the lifespan of the mapping relationship exceeds a preset time limit threshold, the mapping relationship is deleted, and the destination domain name in the firewall filtering rule is replaced with an IP address associated with the destination domain name. Then, domain name filtering is performed based on the associated IP address.

[0014] According to a domain name filtering method provided by the present invention, before the DNS server returns a data packet to obtain the DNS server IP and the mapping relationship between one or more destination domain names and IP addresses, the method further includes:

[0015] Obtain CPU information queue and network card information queue, wherein the CPU information queue includes CPU unique identifiers of multiple CPUs and the network card information queue includes network card unique identifiers of multiple network cards.

[0016] Multiple parsing threads are each bound to the CPU information queue;

[0017] The multiple CPUs are grouped to obtain multiple CPU groups, and each CPU group is associated with one network interface card.

[0018] Based on the protocol and target receiving port recorded in the data packet, after filtering out the data packets returned by the DNS server, the DNS server return data packets are forwarded to the corresponding resolution thread.

[0019] According to a domain name filtering method provided by the present invention, the DNS server returns data packets based on the following steps:

[0020] The protocol and target receiving port of the received data packet are used as input tuples to perform hash calculation and obtain the hash value;

[0021] If the hash value matches the pre-stored hash value, then the received data packet is determined to be a data packet returned by the DNS server.

[0022] According to a domain name filtering method provided by the present invention, the DNS server returns a data packet to obtain the DNS server IP and a mapping relationship between one or more destination domain names and IP addresses, including:

[0023] Read the three-layer data packet returned by the DNS server;

[0024] Use the source IP information in the three-layer data packets as the DNS server IP;

[0025] The data portion of the three-layer data packet is parsed to obtain one or more mapping relationships between the destination domain name and IP address.

[0026] The present invention also provides a domain name filtering device, comprising:

[0027] The calculation module is used to: parse the data packets returned by the DNS server, obtain the DNS server IP and the mapping relationship between one or more destination domain names and IP addresses, and then calculate the hash value of each mapping relationship;

[0028] The comparison module is used to: when the DNS server IP is a trusted address, compare each of the hash values ​​with a pre-stored hash value, wherein the pre-stored hash value includes one or more hash values ​​corresponding to a mapping relationship associated with the destination domain name;

[0029] The filtering module is used to: if the hash value does not match the pre-stored hash value, store the mapping relationship corresponding to the hash value, replace the destination domain name in the firewall filtering rules with the IP address associated with the destination domain name, and then perform domain name filtering based on the associated IP address.

[0030] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement any of the domain name filtering methods described above.

[0031] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the domain name filtering method as described above.

[0032] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements any of the domain name filtering methods described above.

[0033] The domain name filtering method, apparatus, electronic device, and storage medium provided by this invention parse the data packets returned by a DNS server to obtain the DNS server IP and one or more mapping relationships between destination domain names and IP addresses. Then, the hash value of each mapping relationship is calculated. When the DNS server IP is a trusted address, each hash value is compared with a pre-stored hash value, which includes hash values ​​corresponding to one or more mapping relationships associated with the destination domain name. If the hash value does not match the pre-stored hash value, the mapping relationship corresponding to the hash value is stored. The destination domain name in the firewall filtering rules is replaced with the IP address associated with the destination domain name, and domain name filtering is performed based on the associated IP address. This enables dynamic filtering of business domain names based on a network firewall. By utilizing the mapping relationship between destination domain names and IP addresses based on the parsing results of the data packets returned by the DNS server, the network firewall filtering rules can be dynamically adjusted in real time. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 This is a flowchart illustrating the domain name filtering method provided in an embodiment of this application;

[0036] Figure 2 This is one of the schematic diagrams of the domain name filtering method provided in the embodiments of this application;

[0037] Figure 3 This is the second schematic diagram of the architecture of the domain name filtering method provided in the embodiments of this application;

[0038] Figure 4 This is a schematic diagram of the data packet processing module initialization process provided in an embodiment of this application;

[0039] Figure 5 This is a schematic diagram of the structure of the data packet returned by the DNS server according to an embodiment of this application;

[0040] Figure 6 This is a schematic diagram of the DNS server returning data packet resolution process provided in the embodiments of this application;

[0041] Figure 7 This is a schematic diagram of the strategy management plane domain workflow provided in an embodiment of this application;

[0042] Figure 8This is a schematic diagram of the domain name filtering device provided in the embodiments of this application;

[0043] Figure 9 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0045] With the acceleration of enterprise digital transformation and the large-scale application of cloud-native technologies, the number of application services within enterprise data centers is rapidly increasing. Typically, application services provide access to the outside world through domain names. The domain name, as a logical address, shields the physical IP of the application service from the visitor, making changes to the application service's IP transparent to the visitor.

[0046] When applications located in the Demilitarized Zone (DMZ) within a data center access applications on the internal network or access public network services, they need to pass through a firewall. Currently, firewalls widely used in data centers are mainly divided into two types: First, network firewalls, which operate at the network and transport layers of the OSI model, filtering and forwarding TCP / IP protocol packets based on their IP addresses and port numbers. Second, application firewalls, which operate at the application layer of the OSI model, capable of identifying and filtering packets from various application protocols, such as HTTP, FTP, and SMTP. In a cloud-native environment, the IP address of the accessed service (destination) changes with frequent elastic scaling and resource scheduling, and the domain name resolution also changes accordingly. Existing firewall policies based on the network and transport layers become inapplicable due to changes in the destination IP, requiring reconfiguration of firewall policies based on the changed destination IP. Application firewalls based on the application layer can obtain service domain name information by parsing data packets and filter according to the configured policy information.

[0047] Current domain-based firewall filtering solutions have the following problems:

[0048] Network firewalls based on the network and transport layers can only filter the IP address and port number of data packets, and cannot directly filter domain names. When the destination IP changes, the firewall policy cannot be updated in real time, making it difficult to adapt to the characteristics of frequent changes in business IP caused by real-time application scheduling under cloud-native technology conditions.

[0049] Application-layer firewalls can filter data packets based on domain name information, but they require parsing and analyzing the application layer information of each business data according to the OSI protocol model. This results in high performance overhead, low filtering efficiency, high hardware costs, and complex configuration rules, making them unsuitable for the characteristics of current data centers with numerous business operations and high network traffic.

[0050] To address the above problems, the present invention proposes the following embodiments. Figure 1 This is a flowchart illustrating the domain name filtering method provided in an embodiment of this application. (Refer to...) Figure 1 This application provides a domain name filtering method, which may include:

[0051] S110. After resolving the data packets returned by the DNS server and obtaining the DNS server IP and the mapping relationship between one or more destination domain names and IP addresses, calculate the hash value of each mapping relationship.

[0052] In this embodiment of the invention, the executing entity of the domain name filtering method can be a domain name filtering device, which may include, but is not limited to, servers, desktop computers, etc. The executing entity of the domain name filtering method can also be a domain name filtering system, which is subordinate to the domain name filtering device.

[0053] Here, a DNS server is a server used to resolve domain names and return the corresponding IP addresses. It uses a request / response model. The client sends a request data packet, the DNS server resolves it and returns a response data packet. The data packet returned by the DNS server is the response data packet returned by the DNS server after performing domain name resolution.

[0054] Here, the destination domain name is the domain name that needs to be resolved. One domain name usually corresponds to multiple IP addresses. The DNS server returns a data packet containing multiple records, each containing a mapping relationship between a destination domain name and an IP address.

[0055] Here, the hash value F represents the mapping between a destination domain name and an IP address. n =Hash(Domain_name, IP), where Domain_name represents the destination domain name and IP represents the IP address. The hash function Hash() can be used.

[0056] S120. When the DNS server IP is a trusted address, each hash value is compared with a pre-stored hash value, wherein the pre-stored hash value includes one or more hash values ​​corresponding to a mapping relationship associated with the destination domain name.

[0057] Here, when the DNS server IP is not a trusted address, the data corresponding to that DNS server IP is discarded to ensure that the data comes from a legitimate DNS server.

[0058] S130. If the hash value does not match the pre-stored hash value, then store the mapping relationship corresponding to the hash value, replace the destination domain name in the firewall filtering rule with the IP address associated with the destination domain name, and then perform domain name filtering based on the associated IP address.

[0059] Here, the domain name in the configured firewall filtering rule is replaced with the IP address, converting the domain name-based filtering rule into an IP-based filtering rule that can be recognized by the network firewall.

[0060] The domain name filtering method provided in this application involves parsing the data packets returned by the DNS server to obtain the DNS server IP and one or more mapping relationships between destination domain names and IP addresses. Then, the hash value of each mapping relationship is calculated. When the DNS server IP is a trusted address, each hash value is compared with a pre-stored hash value, which includes hash values ​​corresponding to one or more mapping relationships associated with the destination domain name. If the hash value does not match the pre-stored hash value, the mapping relationship corresponding to the hash value is stored. The destination domain name in the firewall filtering rules is replaced with the IP address associated with the destination domain name, and domain name filtering is performed based on the associated IP address. This method achieves dynamic filtering of business domain names based on the network firewall. By utilizing the mapping relationship between destination domain names and IP addresses and the parsing results of the data packets returned by the DNS server, the network firewall filtering rules are dynamically adjusted in real time.

[0061] Figure 2 This is one of the architectural schematic diagrams of the domain name filtering method provided in the embodiments of this application. (Refer to...) Figure 2 In an optional embodiment, the overall architecture of the domain name filtering method involved in this invention consists of a data processing plane and a policy management plane.

[0062] The data processing plane includes a packet processing module, which uses a multi-threaded parallel processing mode based on DPDK technology to bypass the operating system kernel and directly perform high-speed processing of data center switch mirror traffic in user space. This includes obtaining and filtering packets returned by the DNS server, resolving DNS return information from the packets, and forwarding the resolution results. Figure 3 This is the second schematic diagram of the architecture of the domain name filtering method provided in the embodiments of this application. The data packet processing module uses, as shown in the diagram... Figure 3 The architecture shown completes the initialization of the server's hardware, such as the CPU and network card, as well as the reception, processing, and transmission of traffic data packets.

[0063] Reference Figure 2 The policy management plane includes a data verification module, a policy management module, a cache database, and a policy distribution module.

[0064] The data verification module verifies the validity of the returned data packets based on the resolution results of the DNS server on the data processing plane, and determines whether the mapping relationship between the destination domain name and IP address has changed.

[0065] The policy management module dynamically generates and updates firewall policies based on the real-time mapping relationship between destination domain names and IP addresses, while providing an interactive entry point to meet the policy configuration needs of data center security administrators.

[0066] The policy delivery module interfaces with specific firewall APIs or command-line tools to deliver policies.

[0067] The cache database is used to store critical data such as firewall policy information and the mapping relationship between domain names and IP addresses, providing fast access to this data.

[0068] For ease of understanding, the following embodiments are described based on this architecture.

[0069] In an optional embodiment, storing the mapping relationship corresponding to the hash value includes storing the mapping relationship between the destination domain name and the IP address corresponding to the hash value, storing the hash value, and updating the time-to-live (TTL) of the mapping relationship corresponding to the hash value to the current time.

[0070] After comparing each of the aforementioned hash values ​​with the pre-stored hash values, the process also includes:

[0071] If the hash value matches the pre-stored hash value, the time-to-live (TTL) of the mapping relationship corresponding to the hash value is updated to the current time.

[0072] The domain name filtering method provided in this application updates the lifetime of the mapping relationship after resolving the mapping relationship between the destination domain name and the IP address, regardless of whether the mapping relationship has been updated, so as to provide a basis for subsequent changes to the mapping relationship.

[0073] Furthermore, the domain name filtering method also includes:

[0074] When the lifespan of the mapping relationship exceeds a preset time limit threshold, the mapping relationship is deleted, and the destination domain name in the firewall filtering rule is replaced with an IP address associated with the destination domain name. Then, domain name filtering is performed based on the associated IP address.

[0075] Here, when the lifespan of a mapping relationship exceeds the set time limit, the mapping relationship record is deleted, and the destination domain name in the configured firewall filtering rule is replaced with an IP address, thus converting the domain name-based filtering rule into an IP-based filtering rule that can be recognized by the network firewall.

[0076] Here, you can set the maximum time that a mapping relationship has not been updated. For example, if the maximum time that has not been updated is set to 30 days, then if the current date is November 15, 2023, the corresponding deadline is October 15, 2023. If the lifespan of a certain mapping relationship is October 14, 2023, then after deleting the mapping relationship, you can query other mapping relationships for the corresponding destination domain name, and use the queried IP addresses to replace the domain names in the firewall filtering rules, and perform domain name filtering based on these IP addresses.

[0077] The domain name filtering method provided in this application deletes mapping relationships that have exceeded the specified period and converts domain name-based filtering rules into IP-based filtering rules, thereby enabling real-time dynamic updates of network firewall policies when the destination IP changes.

[0078] Based on any of the above embodiments, before the DNS server returns a data packet to obtain the DNS server IP and the mapping relationship between one or more destination domain names and IP addresses, the method further includes:

[0079] Obtain CPU information queue and network card information queue, wherein the CPU information queue includes CPU unique identifiers of multiple CPUs and the network card information queue includes network card unique identifiers of multiple network cards.

[0080] Multiple parsing threads are each bound to the CPU information queue;

[0081] The multiple CPUs are grouped to obtain multiple CPU groups, and each CPU group is associated with one network interface card.

[0082] Based on the protocol and target receiving port recorded in the data packet, after filtering out the data packets returned by the DNS server, the DNS server return data packets are forwarded to the corresponding resolution thread.

[0083] Figure 4 This is a schematic diagram of the data packet processing module initialization process provided in an embodiment of this application, as shown below. Figure 4 As shown, the hardware initialization process of the data packet processing module is as follows:

[0084] Connect multiple network cards of the server where the high-speed data packet processing module is located to the switch via link aggregation, configure the switch port mirroring, and forward data packets entering the firewall evenly to the multiple network cards of the server.

[0085] The physical device of the server is obtained through the basic environment abstraction layer functions of DPDK (Data Plane Development Kit), including: the number of physical CPU cores N of the server. cpu With CPU_ID information queue (CPU information queue) Q cpu =(Cpu0,Cpu1,...,Cpu N Number of network cards N nic With the network interface card (NIC) ID information queue (NIC information queue) Q nic =(Nic0,Nic1,...,Nic N );

[0086] Initialize the main thread of the data processing module, and then bind the main thread and the resolution thread (used to resolve data packets returned by the DNS server) to the CPU queue Q in sequence. cpu ;

[0087] Enable and configure large pages of operating system memory reserved for the CPU. Obtain information related to large pages through DPDK, initialize the memory management system, and establish a memory circular buffer management entry point;

[0088] N of the server cpu Each CPU is divided into Groups, each group has 100 CPUs. One CPU group is associated with one network interface card (NIC);

[0089] By establishing a circular buffer, the packet receive queue Rx and packet send queue Tx of each network interface card are initialized. (Nic) i Zhang's network card settings M i Each Rx queue and Tx queue is used to receive and send data packets, and each Rx queue and Tx queue is bound to one CPU in one CPU group.

[0090] Initialize the RSS (Receive Side Scaling) load balancing mechanism for the network interface card (NIC), and configure a RETA (Redirection Table) index queue Q for each NIC. reta = (0,1,...,k-1), the network card can load balance data packets to the Rx receive queue according to the RETA index;

[0091] By configuring the API through the DPDK network card, a data filtering thread can be set up to filter the data packets returned by the DNS server. The DNS server returns data packets using the UDP protocol and a fixed port. The protocol and port DEST_Port (target receiving port) of the received data packets are used as input tuples for hash calculation and comparison. Data packets with the same result are retained to filter out the data packets returned by the DNS server.

[0092] The network card is started, and the polling driver API provided by PDM (Poll Mode Driver) is used to read the Rx queue data in a loop and forward it to the parsing thread of the corresponding CPU. Initialization is complete.

[0093] The domain name filtering method provided in this application embodiment is based on DPDK technology. It makes full use of the characteristics of current servers with multiple cores and multiple network cards, reasonably groups and binds CPUs and network cards, and sets the affinity of the resolution thread to the CPU. It optimizes the resource configuration when the thread is executed, improves the thread execution efficiency, and thus effectively copes with the scenario of multiple application services and large network traffic in the data center.

[0094] In an optional embodiment, the DNS server returns data packets based on the following steps:

[0095] The protocol and target receiving port of the received data packet are used as input tuples to perform hash calculation and obtain the hash value;

[0096] If the hash value matches the pre-stored hash value, then the received data packet is determined to be a data packet returned by the DNS server.

[0097] The domain name filtering method provided in this application, based on the protocol and port of the data packets, filters out the data packets returned by the DNS server so that subsequent resolution of data packets without reports can be performed and the mapping relationship information can be updated.

[0098] Based on any of the above embodiments, the DNS server returns a data packet to obtain the DNS server IP and the mapping relationship between one or more destination domain names and IP addresses, including:

[0099] Read the three-layer data packet returned by the DNS server;

[0100] Use the source IP information in the three-layer data packets as the DNS server IP;

[0101] The data portion of the three-layer data packet is parsed to obtain one or more mapping relationships between the destination domain name and IP address.

[0102] Figure 5 This is a schematic diagram of the structure of the DNS server returned by the embodiment of this application, as shown below. Figure 5 As shown, according to the layered model of network protocols, data packets are typically divided into a header and a data portion. Based on the TCP / IP model, the data packets returned by the DNS server are resolved layer by layer. The application layer contains the DNS server's resolution information for the destination domain name, and this information allows us to obtain the real-time mapping relationship between the destination domain name and its IP address.

[0103] Figure 6 This is a schematic diagram of the DNS server returning data packet resolution process provided in the embodiments of this application, such as... Figure 6 As shown, based on the data packet returned by the DNS server, a buffer function pointer is set, and the pointer offset is initialized to the fixed field length of the Layer 2 data packet (MAC frame) header. The pointer is then moved to the data portion based on the offset, and the MAC frame data portion, i.e., the Layer 3 data packet (IP packet), is read.

[0104] Based on the obtained IP data packet, the source IP information SRC_IP in the header is obtained as the DNS server IP, and the data part of the IP data packet is read. The source IP information in the header can be obtained through DPDK functions.

[0105] Based on the data portion (DNS data) of the obtained IP packet, the DNS message is parsed to determine the starting position of the Answer section in the response header and read the records in the Answer section. Each record contains a mapping relationship between a destination domain name and an IP address.

[0106] Based on the resolved data, the mapping relationship between DNS server IP, destination domain name and IP address is standardized, such as by standardizing it according to JSON format;

[0107] The formatted data is sent to the Tx queue and forwarded to the data verification module in the policy management plane via the network card.

[0108] The domain name filtering method provided in this application embodiment has a data packet parsing program that runs in the user space of the operating system, bypassing the kernel protocol stack and improving processing efficiency, thereby effectively dealing with scenarios with many data center application services and large network traffic.

[0109] Figure 7 This is a schematic diagram of the strategy management plane domain workflow provided in the embodiments of this application, such as... Figure 7 As shown, the data validation module is used to perform data validation, and mainly includes the following three sub-processes:

[0110] (1) Parse the received JSON data and calculate the hash value F of the mapping relationship between each destination domain name and IP address. n =Hash(Domain_name,IP);

[0111] (2) Read the list of trusted DNS server IPs in the cache database and compare it with the DNS server IPs resolved in (1). If the comparison is successful, proceed to the next process; otherwise, discard the data to ensure that the data comes from a legitimate DNS server.

[0112] (3) Read the hash value from the destination domain name and IP address mapping data information in the cache database, and compare it with the F in (1). n Compare and determine whether the Hash value has changed. If it has not changed, refresh the lifespan of the corresponding mapping relationship to the current time. Otherwise, add the mapping relationship between the destination domain name and IP address in (1) and refresh the lifespan of the corresponding mapping relationship to the current time.

[0113] The cache database primarily comprises three data structures for storing: a list of trusted DNS servers, firewall policy information, and a real-time mapping between destination domain names and IP addresses.

[0114] The list of trusted DNS servers is a list of legitimate DNS servers defined by the administrator;

[0115] Firewall policy information consists of domain-based firewall filtering policies defined by the data center administrator, including but not limited to policy ID, source IP, source port, destination domain name, destination port, and policy behavior.

[0116] The mapping relationship between the destination domain name and the IP address includes the mapping relationship between the destination domain name and the corresponding application service IP address, the lifespan of the mapping relationship, and the hash value of the mapping relationship.

[0117] The policy management module is used for policy configuration management. The policy configuration management process includes:

[0118] (1) Policy configuration: Configure a list of trusted DNS servers and domain-based firewall filtering rules;

[0119] (2) Policy conversion: Query the mapping relationship between the destination domain name and IP address, replace the domain name in the firewall filtering rule configured in (1) with the IP address, and convert the domain name-based filtering rule into an IP-based filtering rule that can be recognized by the network firewall.

[0120] (3) Policy Update: Monitor changes in firewall policy information and domain name and IP address mapping information in the cache database. When firewall policy information changes or new domain name and IP address mapping records are added, the policy conversion process is invoked to generate and distribute IP-based filtering rules. The time-to-live (TTL) of the domain name and IP address mapping relationship information is checked. If the TTL exceeds the set time limit, the mapping relationship record is deleted, and the policy conversion process is invoked to generate and distribute IP-based filtering rules.

[0121] The policy distribution module distributes updated IP-based firewall policies to specific network firewalls.

[0122] In summary, this invention solves the problems of network firewalls being unable to directly filter domain names and application firewalls having low filtering efficiency in high-traffic data center scenarios by dynamically generating and distributing network firewall policies through capturing client DNS resolution information. Through a reasonable hardware initialization method, it fully utilizes the multi-core, multi-NIC hardware of the server to achieve rapid acquisition, filtering, and resolution of all DNS server return packets passing through the firewall. By converting domain name-based firewall policies to IP-based firewall policies, it achieves real-time dynamic updates of network firewall policies when the destination IP changes. Furthermore, this invention implements dynamic security filtering of domain names based on the network firewall. Compared to application-layer firewalls that decapsulate and analyze application-layer information of all data packets, this method is more efficient, lower in cost, and less complex. Simultaneously, by employing a port mirroring bypass mode, it does not affect the operation of existing specific services when execution exceptions occur, ensuring the independence and availability of the data center network.

[0123] The domain name filtering device provided in the embodiments of this application is described below. The domain name filtering device described below can be referred to in correspondence with the domain name filtering method described above.

[0124] Figure 8 This is a schematic diagram of the domain name filtering device provided in the embodiments of this application, as shown below. Figure 8 As shown, the domain name filtering device includes:

[0125] The calculation module 810 is used to: parse the data packets returned by the DNS server, obtain the DNS server IP and the mapping relationship between one or more destination domain names and IP addresses, and then calculate the hash value of each mapping relationship;

[0126] The comparison module 820 is used to: when the DNS server IP is a trusted address, compare each of the hash values ​​with a pre-stored hash value, wherein the pre-stored hash value includes one or more hash values ​​corresponding to a mapping relationship associated with the destination domain name;

[0127] The filtering module 830 is used to: if the hash value does not match the pre-stored hash value, store the mapping relationship corresponding to the hash value, replace the destination domain name in the firewall filtering rules with the IP address associated with the destination domain name, and then perform domain name filtering based on the associated IP address.

[0128] The domain name filtering device provided by this invention parses the data packets returned by the DNS server to obtain the DNS server IP and one or more mapping relationships between destination domain names and IP addresses, and then calculates the hash value of each mapping relationship. When the DNS server IP is a trusted address, each hash value is compared with a pre-stored hash value, which includes hash values ​​corresponding to one or more mapping relationships associated with the destination domain name. If the hash value does not match the pre-stored hash value, the mapping relationship corresponding to the hash value is stored, and the destination domain name in the firewall filtering rules is replaced with the IP address associated with the destination domain name. Domain name filtering is then performed based on the associated IP address. This device enables dynamic filtering of business domain names based on a network firewall. By utilizing the mapping relationship between destination domain names and IP addresses based on the parsing results of the data packets returned by the DNS server, the network firewall filtering rules are dynamically adjusted in real time.

[0129] Figure 9 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 9 As shown, the electronic device may include a processor 910, a communication interface 920, a memory 930, and a communication bus 940, wherein the processor 910, the communication interface 920, and the memory 930 communicate with each other via the communication bus 940. The processor 910 can call a computer program in the memory 930 to execute the steps of a domain name filtering method, such as: resolving data packets returned by a DNS server to obtain the DNS server IP and one or more mappings between destination domain names and IP addresses, and calculating the hash value of each mapping; when the DNS server IP is a trusted address, comparing each hash value with a pre-stored hash value, the pre-stored hash value including hash values ​​corresponding to one or more mappings associated with the destination domain name; if the hash value does not match the pre-stored hash value, storing the mapping relationship corresponding to the hash value, replacing the destination domain name in the firewall filtering rules with the IP address associated with the destination domain name, and then performing domain name filtering based on the associated IP address.

[0130] Furthermore, the logical instructions in the aforementioned memory 930 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0131] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the domain name filtering method provided by the above methods. The method includes: resolving the data packets returned by the DNS server to obtain the DNS server IP and one or more mapping relationships between destination domain names and IP addresses, and calculating the hash value of each mapping relationship; when the DNS server IP is a trusted address, comparing each hash value with a pre-stored hash value, the pre-stored hash value including hash values ​​corresponding to one or more mapping relationships associated with the destination domain name; if the hash value does not match the pre-stored hash value, storing the mapping relationship corresponding to the hash value, replacing the destination domain name in the firewall filtering rules with the IP address associated with the destination domain name, and performing domain name filtering based on the associated IP address.

[0132] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the domain name filtering method provided by the above methods. The method includes: parsing a data packet returned by a DNS server to obtain a DNS server IP and a mapping relationship between one or more destination domain names and IP addresses, and calculating a hash value for each mapping relationship; when the DNS server IP is a trusted address, comparing each hash value with a pre-stored hash value, the pre-stored hash value including hash values ​​corresponding to one or more mapping relationships associated with the destination domain name; if the hash value does not match the pre-stored hash value, storing the mapping relationship corresponding to the hash value, replacing the destination domain name in the firewall filtering rules with an IP address associated with the destination domain name, and performing domain name filtering based on the associated IP address.

[0133] The non-transitory computer-readable storage medium can be any available medium or data storage device that the processor can access, including but not limited to magnetic memory (e.g., floppy disk, hard disk, magnetic tape, magneto-optical disk (MO)), optical memory (e.g., CD, DVD, BD, HVD), and semiconductor memory (e.g., ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)).

[0134] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0135] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0136] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A domain name filtering method, characterized in that, include: After resolving the data packets returned by the DNS server to obtain the DNS server IP and the mapping relationship between one or more destination domain names and IP addresses, the hash value of each mapping relationship is calculated. When the DNS server IP is a trusted address, each hash value is compared with a pre-stored hash value, which includes one or more hash values ​​corresponding to mapping relationships associated with the destination domain name. If the hash value does not match the pre-stored hash value, the mapping relationship corresponding to the hash value is stored, and the destination domain name in the firewall filtering rule is replaced with the IP address associated with the destination domain name. Then, domain name filtering is performed based on the associated IP address.

2. The domain name filtering method according to claim 1, characterized in that, The storage of the mapping relationship corresponding to the hash value includes storing the mapping relationship between the destination domain name and the IP address corresponding to the hash value, storing the hash value, and updating the time-to-live of the mapping relationship corresponding to the hash value to the current time; After comparing each of the aforementioned hash values ​​with the pre-stored hash values, the process also includes: If the hash value matches the pre-stored hash value, the time-to-live (TTL) of the mapping relationship corresponding to the hash value is updated to the current time.

3. The domain name filtering method according to claim 2, characterized in that, The domain name filtering method also includes: When the lifespan of the mapping relationship exceeds a preset time limit threshold, the mapping relationship is deleted, and the destination domain name in the firewall filtering rule is replaced with an IP address associated with the destination domain name. Then, domain name filtering is performed based on the associated IP address.

4. The domain name filtering method according to any one of claims 1-3, characterized in that, Before the DNS server returns a data packet containing the DNS server IP address and the mapping relationship between one or more destination domain names and IP addresses, the following steps are also included: Obtain CPU information queue and network card information queue, wherein the CPU information queue includes CPU unique identifiers of multiple CPUs and the network card information queue includes network card unique identifiers of multiple network cards. Multiple parsing threads are each bound to the CPU information queue; The multiple CPUs are grouped to obtain multiple CPU groups, and each CPU group is associated with one network interface card. Based on the protocol and target receiving port recorded in the data packet, after filtering out the data packets returned by the DNS server, the DNS server return data packets are forwarded to the corresponding resolution thread.

5. The domain name filtering method according to claim 4, characterized in that, The DNS server returns data packets based on the following steps: The protocol and target receiving port of the received data packet are used as input tuples to perform hash calculation and obtain the hash value; If the hash value matches the pre-stored hash value, then the received data packet is determined to be a data packet returned by the DNS server.

6. The domain name filtering method according to any one of claims 1-3, characterized in that, The DNS server returns a data packet containing the DNS server's IP address and a mapping relationship between one or more destination domain names and their IP addresses, including: Read the three-layer data packet returned by the DNS server; Use the source IP information in the three-layer data packets as the DNS server IP; The data portion of the three-layer data packet is parsed to obtain one or more mapping relationships between the destination domain name and IP address.

7. A domain name filtering device, characterized in that, include: The calculation module is used to: parse the data packets returned by the DNS server, obtain the DNS server IP and the mapping relationship between one or more destination domain names and IP addresses, and then calculate the hash value of each mapping relationship; The comparison module is used to: when the DNS server IP is a trusted address, compare each of the hash values ​​with a pre-stored hash value, wherein the pre-stored hash value includes one or more hash values ​​corresponding to a mapping relationship associated with the destination domain name; The filtering module is used to: if the hash value does not match the pre-stored hash value, store the mapping relationship corresponding to the hash value, replace the destination domain name in the firewall filtering rules with the IP address associated with the destination domain name, and then perform domain name filtering based on the associated IP address.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the domain name filtering method as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the domain name filtering method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the domain name filtering method as described in any one of claims 1 to 6.

Images