DNS server security parameter black box test method and system based on double-end measurement mode

Abstract

The invention relates to a DNS server security parameter black box test method and system based on a double-end measurement mode. The method comprises the following steps: determining parameters to be measured and modeling; registering a domain name and setting a test client and a test authority end; the test client initiates a test to the target resolver and triggers a domain name resolution behavior of the target resolver; the target resolver interacts with the test authority end, the state of the target resolver is influenced through the dynamic response of the test authority end, and the behavior of the target resolver is triggered; collecting behavior information of the target resolver from the test client and the test authority end, and estimating a safety parameter range corresponding to the actual behavior performance of the target resolver according to the to-be-tested parameter test model. According to the method, the security parameters of the target resolver are deduced only through the communication behavior of the target resolver in the domain name resolution process, additional information such as a source code or a configuration file of the target resolver is not needed, and the target security can be evaluated in a simple and efficient mode.

Description

Technical Field

[0001] The invention relates to the field of computers and designs a black box testing method and system for inferring relevant security parameters of a DNS server through its external communication behavior characteristics. Background Art

[0002] The Domain Name System (DNS) is an important part of the Internet. It is responsible for resolving domain names into IP addresses. Internet users' various network behaviors rely on the DNS infrastructure. The DNS infrastructure mainly includes two parts: authoritative domain name servers and resolvers. The authoritative domain name servers store domain name-related data and return the corresponding DNS records when receiving DNS queries. The resolvers are responsible for querying the authoritative domain name servers for domain name information on behalf of users and returning the query results to users. Resolvers in actual environments face a variety of DNS-related threats, which may cause resolver data pollution or denial of service.

[0003] In order to deal with these threats, the resolver implementation uses a variety of defense measures to protect its own security, and the application of defense measures varies in different resolvers. In the specific implementation of the resolver, specific security parameters are set for resource management or exception handling to ensure the safe and normal operation of the resolver. The resolver's security parameters are closely related to the defense measures against DNS threats, reflecting the resolver's ability to deal with actual DNS threats, and can be used as an important indicator for DNS resolver security testing. Usually, the resolver under test is a black box with unknown internal processing logic for the tester, so a test method is needed to infer its security parameters using the resolver's external behavior information. Summary of the invention

[0004] In order to infer the relevant security parameters of the DNS server through its external communication behavior characteristics, the present invention designs a method and system for black-box testing of DNS server security parameters based on a two-end measurement mode, which collects target behavior information from the client and the authoritative end and infers security parameters.

[0005] The technical solution adopted by the present invention is as follows:

[0006] A DNS server security parameter black box testing method based on a dual-end measurement mode includes the following steps:

[0007] Determine the security parameters of the target parser to be tested, model the parameters according to the relevant security measures to obtain the test model of the parameters to be tested;

[0008] Register a domain name for testing, and set up a test client and a test authority;

[0009] The test client uses the registered domain name to initiate a test to the target resolver, triggering the domain name resolution behavior of the target resolver;

[0010] The triggered target parser interacts with the test authority, and the test authority dynamically responds to the target parser's request, generates a response message containing a specific parsing result and a message header, and returns it to the target parser. The dynamic response of the test authority affects the state of the target parser and triggers the behavior of the target parser.

[0011] Collect the behavior information of the target parser from the test client and the test authority;

[0012] In combination with the behavior information of the target parser collected by the test client and the test authority, the security parameter range corresponding to the actual behavior performance of the target parser is estimated according to the parameter test model to be tested.

[0013] Furthermore, the setting of the test client and the test authority includes:

[0014] Build an authoritative server as the test authority, which can dynamically return responses to the query requests of the target resolver according to the test purpose, then modify the authoritative server address corresponding to the domain name to the address of the test authority, and use a server as the test client;

[0015] A processing method for testing security parameters of a target parser is loaded in a test client and a test authority, namely, a request message generation method for testing a client and a request response method for testing an authority.

[0016] Furthermore, the test client uses the registered domain name to initiate a test to the target resolver, triggering the domain name resolution behavior of the target resolver, including:

[0017] A test is initiated to the target resolver through the test client. The test method of the test client is called according to the different parameters to be tested. One or more requests are sent to the target resolver using a DNS message containing a specific request domain name and a message header. The name of the parameter to be tested is encoded and embedded in the request domain name as part of the subdomain name. The domain name resolution process of the target resolver is triggered by the request initiated by the test client, causing the target resolver to communicate with the external network host.

[0018] Furthermore, the collection of behavior information of the target parser from the test client and the test authority includes:

[0019] The target resolver returns a DNS response to the test client, and the test client collects the flag bit and response code in the message header of the DNS response, the number of responses, and the resolution result in the response;

[0020] The target resolver initiates a query request to the test authority, which collects the requested domain name, message header information, and request quantity in the query request, and records the status change information during the target domain name resolution process.

[0021] Furthermore, the security parameters of the target resolver to be tested are determined and modeled according to the principles of relevant security measures for the parameters to be tested, wherein the security parameter is a redirection upper limit parameter. First, the behavior of the target resolver corresponding to the redirection upper limit parameter is modeled. The maximum value of the request rounds for redirection queries performed by the target resolver during a domain name resolution process is the redirection upper limit parameter value.

[0022] Furthermore, after receiving the query sent by the target resolver, the test authority first extracts the name of the parameter to be tested from the subdomain name, and after determining that the parameter to be tested is the redirection upper limit, dynamically generates a response, and each response contains a CNAME record; after receiving the response, the target resolver redirects the domain name currently being queried to the new domain name contained in the CNAME, and initiates a query to the test authority again; the redirection process is repeated until the redirection round triggers the redirection upper limit of the target resolver. After the redirection upper limit is triggered, the target resolver terminates the domain name resolution process, no longer queries the test authority, and returns a SERVFAIL response to the test client.

[0023] A DNS server security parameter black box testing system based on a dual-end measurement mode comprises a test client, a test authority and a target resolver: the test client initiates a test to the target resolver to trigger the domain name resolution behavior of the target resolver; the triggered target resolver interacts with the test authority, the test authority dynamically responds to the request of the target resolver, generates a response message including a specific resolution result and a message header and returns it to the target resolver, and the state of the target resolver is affected and the behavior of the target resolver is triggered by the dynamic response of the test authority; the behavior information of the target resolver is collected from the test client and the test authority; and the security parameter range corresponding to the actual behavior performance of the target resolver is estimated according to the parameter test model to be tested in combination with the behavior information of the target resolver collected by the test client and the test authority.

[0024] The advantages and beneficial effects of the present invention are as follows:

[0025] 1) The black box testing method in the present invention only infers the security parameters of the target resolver through its communication behavior during the domain name resolution process, and does not require additional information such as the source code or configuration file of the target resolver. It can evaluate the target security in a simple and efficient manner with fewer restrictions.

[0026] 2) The present invention adopts a controlled domain name for testing, and builds an authoritative server of the domain name by itself, so as to collect the communication behavior information between the target resolver and the authoritative server, and test the security parameters related to this part of the communication behavior. Compared with the method of testing only from the client's perspective, the information obtained is more comprehensive, the test coverage is wider, and it can more accurately reflect the target's ability to deal with DNS-related threats.

[0027] 3) In the test method of the present invention, a dynamic response is made to the request of the target resolver, a corresponding response is generated according to the state of the target resolver, and the state changes of the target resolver during the domain name resolution process are recorded through multiple request-response interactions. Compared with the method of using a single request-response process for testing, more information can be collected, thereby being able to test security parameters involving complex mechanisms. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 It is a flow chart of the DNS server security parameter black box testing method based on the dual-end measurement mode of the present invention.

[0029] Figure 2 It is a schematic diagram of a DNS server security parameter black box testing method based on a dual-end measurement mode of the present invention. DETAILED DESCRIPTION

[0030] In order to make the purpose, principle, technical solution and advantages of the present invention more clearly understood, the present invention will be described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0031] The present invention provides a DNS server security parameter black box testing method based on a dual-end measurement mode, such as Figure 1 As shown, the following steps are included:

[0032] 1) Determine the security parameters of the parser to be tested, i.e., the target parser, and build a model based on the relevant security measures of the parameters to be tested. Determine the specific performance of the target parser corresponding to the security parameters in the domain name resolution process and the mathematical relationship between the two, so as to obtain a test model for the parameters to be tested.

[0033] 2) Register a domain name from a domain name registrar as the domain name used in the test method, and build an authoritative server that can dynamically return responses to the resolver's query requests according to the test purpose, as a test authority. After the authoritative server is built, change the authoritative server address corresponding to the domain name to the self-built authoritative server address. In addition, use a server as a test client. Load the processing method for testing the security parameters of the target resolver in the test client and the test authority, that is, the request message generation method for the test client and the request response method for the test authority.

[0034] 3) Initiate a test to the target resolver through the test client, call the test method of the test client according to the different parameters to be tested, design a DNS message containing a specific request domain name and message header, send one or more requests to the target resolver, and the name of the parameter to be tested is encoded and embedded in the request domain name as part of the subdomain name. The request initiated by the test client will trigger the domain name resolution process of the target resolver, causing the target resolver to communicate with the external network host.

[0035] 4) The triggered target resolver will interact with the self-built authoritative server, namely the test authority, to try to obtain the resolution result of the domain name. After receiving the query request from the target resolver, the test authority first reads the subdomain of the requested domain name in the query request message, extracts and decodes it to obtain the name of the parameter to be tested. Then the test authority calls the corresponding processing function according to the parameter to be tested, dynamically responds to the request of the target resolver (i.e., the request message generation method and request response method in step 2), generates a response message containing a specific resolution result and a message header, and returns it to the target resolver. The dynamic response of the test authority will affect the state of the target resolver and further trigger the behavior of the target resolver.

[0036] 5) During the test, the behavior information of the target resolver is collected from the perspectives of the test client and the test authority. The target resolver returns a DNS response to the test client, and the test client collects the flags and response codes in the message header, the number of responses, and the resolution results in the response. The target resolver initiates a query request to the test authority, and the test authority collects the requested domain name, message header information, and the number of requests in the request, and records the status change information during the target domain name resolution process, such as the response status, message header flags, request frequency, total number of requests, and other information.

[0037] 6) Based on the behavior information of the target parser collected by the test client and the test authority during the test process, the security parameter range corresponding to the actual behavior performance is estimated according to the parameter test model to be tested in step 1).

[0038] Taking the parameter test of the upper limit of the resolver redirection as an example, the method of the present invention can be used to perform parameter testing. The redirection process is implemented through the CNAME record during the domain name resolution process. When the resolver receives the CNAME response, it redirects the currently queried domain name to the new domain name contained in the CNAME record and queries again. In order to prevent CNAME loops or overlong CNAME chains, the redirection upper limit is set in the resolver to terminate the abnormal domain name resolution process.

[0039] 1) First, the behavior of the resolver corresponding to the redirection upper limit parameter is modeled. The maximum number of request rounds for the resolver to perform redirection queries during a domain name resolution process is the redirection upper limit parameter value. The inference of the redirection upper limit parameter only requires the test authority to collect queries initiated by the target resolver during the test.

[0040] 2) Register a dedicated test domain name dns-test.xyz from the domain name registrar, configure the test client and the test authority at the same time, load the redirection upper limit test method, and set the authoritative server address of the dns-test.xyz domain to the test authority address.

[0041] 3) The test is initiated by the client, which only needs to send a request to the target resolver once. The domain name queried in the request is in the form of 0-cname.dns-test.xyz, and the name of the parameter to be tested is embedded in the subdomain. After receiving the request from the test client, the target resolver continues to initiate a query to the test authority.

[0042] 4) After the test authority receives the query sent by the target resolver, it first extracts the name of the parameter to be tested from the subdomain name. After determining that the parameter to be tested is the redirection upper limit, it calls the corresponding processing method to dynamically generate a response. Each response contains a CNAME record. The redirection domain name in the CNAME record is similar to the original domain name. The difference is that the number in the subdomain name prefix is ​​increased by 1, indicating the current redirection round, in the form of 1-cname.dns-test.xyz. After receiving the response, the target resolver redirects the currently queried domain name to the new domain name contained in the CNAME, and initiates a query to the test authority again. This redirection process will be repeated until the redirection round triggers the redirection upper limit of the target resolver. After the redirection upper limit is triggered, the target resolver will terminate the domain name resolution process, no longer query the test authority, and return a SERVFAIL (resolution failure) response to the test client.

[0043] 5) During the test, the test authority collects query requests initiated by the target resolver, extracts the request domain name, and records the redirection rounds in the subdomain name. When the test client receives a SERVFAIL response from the resolver, the test authority stops recording. The maximum redirection round recorded at this time is the redirection upper limit of the target resolver.

[0044] Another embodiment of the present invention provides a DNS server security parameter black box test system based on a dual-end measurement mode, which includes a test client, a test authority, and a target resolver: the test client initiates a test to the target resolver, triggering the domain name resolution behavior of the target resolver; the triggered target resolver interacts with the test authority, and the test authority dynamically responds to the target resolver's request, generates a response message containing a specific resolution result and a message header, and returns it to the target resolver, and affects the state of the target resolver and triggers the behavior of the target resolver through the dynamic response of the test authority; collects the behavior information of the target resolver from the test client and the test authority; combines the behavior information of the target resolver collected by the test client and the test authority, and estimates the security parameter range corresponding to the actual behavior performance of the target resolver according to the parameter test model to be tested. The specific operation steps and implementation process of the test client, the test authority, and the target resolver refer to the description of the method of the present invention above.

[0045] The specific embodiments of the present invention disclosed above are intended to help understand the content of the present invention and implement it accordingly. It can be understood by those skilled in the art that various replacements, changes and modifications are possible without departing from the spirit and scope of the present invention. The present invention should not be limited to the contents disclosed in the embodiments of this specification, and the scope of protection of the present invention shall be subject to the scope defined in the claims.

Claims

1. A DNS server security parameter black box testing method based on a dual-end measurement mode, characterized in that: The following steps are involved: Determine the security parameters of the target parser to be tested, model the parameters according to the relevant security measures to obtain the test model of the parameters to be tested; Register a domain name for testing, and set up a test client and a test authority; The test client uses the registered domain name to initiate a test to the target resolver, triggering the domain name resolution behavior of the target resolver; The triggered target parser interacts with the test authority, and the test authority dynamically responds to the target parser's request, generates a response message containing a specific parsing result and a message header, and returns it to the target parser. The dynamic response of the test authority affects the state of the target parser and triggers the behavior of the target parser. Collect the behavior information of the target parser from the test client and the test authority; In combination with the behavior information of the target parser collected by the test client and the test authority, the security parameter range corresponding to the actual behavior performance of the target parser is estimated according to the parameter test model to be tested.

2. The method according to claim 1, characterized in that The setting of the test client and the test authority includes: Build an authoritative server as the test authority, which can dynamically return responses to the query requests of the target resolver according to the test purpose, then modify the authoritative server address corresponding to the domain name to the address of the test authority, and use a server as the test client; A processing method for testing security parameters of a target parser is loaded in a test client and a test authority, namely, a request message generation method for testing a client and a request response method for testing an authority.

3. The method according to claim 1, characterized in that The test client uses the registered domain name to initiate a test to the target resolver, triggering the domain name resolution behavior of the target resolver, including: A test is initiated to the target resolver through the test client. The test method of the test client is called according to the different parameters to be tested. One or more requests are sent to the target resolver using a DNS message containing a specific request domain name and a message header. The name of the parameter to be tested is encoded and embedded in the request domain name as part of the subdomain name. The domain name resolution process of the target resolver is triggered by the request initiated by the test client, causing the target resolver to communicate with the external network host.

4. The method according to claim 1, characterized in that: The collection of behavior information of the target parser from the test client and the test authority includes: The target resolver returns a DNS response to the test client, and the test client collects the flag bit and response code in the message header of the DNS response, the number of responses, and the resolution result in the response; The target resolver initiates a query request to the test authority, which collects the requested domain name, message header information, and request quantity in the query request, and records the status change information during the target domain name resolution process.

5. The method according to claim 1, characterized in that The state change information includes response status, message header flag, request frequency, and total number of requests.

6. The method according to claim 1, characterized in that The security parameters of the target resolver to be tested are determined and modeled according to the relevant security measures principles of the parameters to be tested, wherein the security parameter is a redirection upper limit parameter. First, the behavior of the target resolver corresponding to the redirection upper limit parameter is modeled. The maximum value of the request rounds for redirection queries performed by the target resolver during a domain name resolution process is the redirection upper limit parameter value.

7. The method according to claim 6, characterized in that After receiving the query sent by the target resolver, the test authority first extracts the name of the parameter to be tested from the subdomain name, determines that the parameter to be tested is the redirection upper limit, and dynamically generates a response, each response containing a CNAME record; after receiving the response, the target resolver redirects the domain name currently being queried to the new domain name contained in the CNAME, and initiates a query to the test authority again; The redirection process is repeated until the redirection round triggers the redirection limit of the target resolver. After the redirection limit is triggered, the target resolver terminates the domain name resolution process, no longer queries the test authority, and returns a SERVFAIL response to the test client.

8. A DNS server security parameter black box testing system based on a dual-end measurement mode, characterized in that: It includes the test client, the test authority, and the target resolver: the test client initiates a test to the target resolver, triggering the domain name resolution behavior of the target resolver; The triggered target parser interacts with the test authority, and the test authority dynamically responds to the target parser's request, generates a response message containing a specific parsing result and a message header, and returns it to the target parser. The dynamic response of the test authority affects the state of the target parser and triggers the behavior of the target parser. Collect the behavior information of the target parser from the test client and the test authority; In combination with the behavior information of the target parser collected by the test client and the test authority, the security parameter range corresponding to the actual behavior performance of the target parser is estimated according to the parameter test model to be tested.

Images