A DNS server security parameter black box testing method and system based on a double-end measurement mode

Abstract

The application relates to a DNS server security parameter black box testing method and system based on a double-end measurement mode. The method comprises the following steps: determining a to-be-tested parameter and modeling; registering a domain name and setting a test client and a test authority end; the test client initiates a test to a target resolver, triggers a domain name resolution behavior of the target resolver; the target resolver interacts with the test authority end, influences a state of the target resolver through a dynamic response of the test authority end, triggers a behavior of the target resolver, collects behavior information of the target resolver from the test client and the test authority end, and estimates a corresponding security parameter range of an actual behavior performance of the target resolver according to a to-be-tested parameter test model. The application can evaluate the target security in a simple and efficient manner by inferring the security parameter of the target resolver only through the communication behavior of the target resolver in the domain name resolution process, without additional information such as the source code or configuration file of the target resolver.

Description

Technical Field

[0001] This invention relates to the field of computers and designs a black-box testing method and system for inferring relevant security parameters of a DNS server by analyzing its external communication behavior. Background Technology

[0002] The Domain Name System (DNS) is a crucial component of the Internet, responsible for resolving domain names into IP addresses. All internet user activities rely on the DNS infrastructure. The DNS infrastructure primarily consists of two parts: authoritative name servers and resolvers. Authoritative name servers store domain name-related data and return the corresponding DNS records when they receive DNS queries. Resolvers, on the other hand, are responsible for retrieving domain name information from authoritative name servers on behalf of users and returning the results. In real-world environments, resolvers face various DNS-related threats, which can lead to resolver data corruption or denial-of-service attacks.

[0003] To address these threats, DNS resolvers employ various defensive measures to protect their security, with different measures applied in different resolvers. Specific security parameters are set in the resolver implementation for resource management or exception handling to ensure the resolver's secure and normal operation. These security parameters are closely related to the defenses against DNS threats, reflecting the resolver's ability to cope with actual DNS threats and serving as important indicators for DNS resolver security testing. Typically, the resolver under test is a black box to the tester, with its internal processing logic unknown; therefore, testing methods that infer its security parameters from external behavioral information are necessary. Summary of the Invention

[0004] In order to infer the relevant security parameters of DNS servers by observing their external communication behavior, this invention designs a method and system for black-box testing of DNS server security parameters based on a dual-end measurement mode, which collects target behavior information from both the client and the authoritative end and infers security parameters.

[0005] The technical solution adopted in this invention is as follows:

[0006] A black-box testing method for DNS server security parameters based on a two-end measurement mode includes the following steps:

[0007] Determine the security parameters of the target parser to be tested, and model it according to the relevant security measures principles of the parameters to be tested to obtain the test model of the parameters to be tested;

[0008] Register a domain name for testing and set up the test client and test authority;

[0009] The test client initiates a test to the target resolver with a registered domain name, triggering the domain name resolution behavior of the target resolver;

[0010] The triggered target resolver interacts with the test authority, the test authority dynamically responds to the request of the target resolver, generates a response message containing a specific resolution result and a message header, and returns it to the target resolver, thereby affecting the state of the target resolver and triggering the behavior of the target resolver through the dynamic response of the test authority;

[0011] Collecting behavior information of the target resolver from the test client and the test authority;

[0012] Combining the behavior information of the target resolver collected by the test client and the test authority, estimating the actual behavior performance of the target resolver corresponding to the security parameter range according to the test model of the to-be-tested parameter.

[0013] Further, the test client and the test authority are set up, including:

[0014] Setting up an authoritative server as a test authority, which can dynamically return a response to the query request of the target resolver according to the test purpose, then modifying the address of the domain name corresponding to the authoritative server to the address of the test authority, and using a server as a test client;

[0015] Loading a processing method for testing the security parameters of the target resolver in the test client and the test authority, i.e. a request message generation method for the test client and a request response method for the test authority.

[0016] Further, the test client initiates a test to the target resolver with a registered domain name, triggering the domain name resolution behavior of the target resolver, including:

[0017] The test client initiates a test to the target resolver, calls the test method of the test client according to the different to-be-tested parameters, sends one or more requests to the target resolver with a DNS message containing a specific request domain name and a message header, encodes the name of the to-be-tested parameter as part of the subdomain name embedded in the request domain name, triggers the domain name resolution process of the target resolver through the request initiated by the test client, and makes the target resolver produce a communication behavior with an external network host.

[0018] Further, the behavior information of the target resolver is collected from the test client and the test authority, including:

[0019] The target resolver returns a DNS response to the test client, and the test client collects the flag bit and response code of the message header in the DNS response, the number of responses, and the resolution result in the response;

[0020] The target resolver initiates a query request to a test authority end, the test authority end collects the request domain name, message header information and request quantity in the query request, and records the state change information in the target domain name resolution process.

[0021] Further, the security parameter of the target resolver to be tested is determined according to the modeling of the related security measure principle of the to-be-tested parameter, wherein the security parameter is a redirection upper limit parameter, the behavior performance of the target resolver corresponding to the redirection upper limit parameter is modeled first, and the maximum value of the request round of the redirection query in one domain name resolution process of the target resolver is the value of the redirection upper limit parameter.

[0022] Further, after the test authority end receives the query sent by the target resolver, the to-be-tested parameter name is extracted from the subdomain name first, the to-be-tested parameter is judged to be a redirection upper limit, a response is dynamically generated, and each response contains a CNAME record; after the target resolver receives the response, the domain name of the current query is redirected to the new domain name contained in the CNAME, and the test authority end is initiated again; the redirection process is repeated until the redirection round triggers the redirection upper limit of the target resolver, after the redirection upper limit is triggered, the target resolver terminates the domain name resolution process, does not query the test authority end any more, and returns a SERVFAIL response to the test client.

[0023] A DNS server security parameter black box test system based on a double-end measurement mode, which comprises a test client, a test authority end and a target resolver: the test client initiates a test to the target resolver, triggers the domain name resolution behavior of the target resolver; the triggered target resolver interacts with the test authority end, the test authority end dynamically responds to the request of the target resolver, generates a response message containing a specific resolution result and a message header and returns the response message to the target resolver, the state of the target resolver is influenced through the dynamic response of the test authority end, and the behavior of the target resolver is triggered; the behavior information of the target resolver is collected from the test client and the test authority end; the behavior information of the target resolver collected by the test client and the test authority end is combined, and the security parameter range corresponding to the actual behavior performance of the target resolver is estimated according to the to-be-tested parameter test model.

[0024] The advantages and beneficial effects of the present application are as follows:

[0025] 1) In the present application, the security parameter of the target resolver is inferred only through the communication behavior of the target resolver in the domain name resolution process by the method of black box test, without additional information such as the source code or configuration file of the target resolver, the target security can be evaluated in a simple and efficient way, and the limitation condition is less.

[0026] 2) The application uses controlled domain names for testing, and at the same time, an authoritative server of the domain name is built, so that the communication behavior information between the target resolver and the authoritative server can be collected, the security parameters related to the communication behavior can be tested, the information obtained by the method of testing from the client side only is more comprehensive, the test coverage is wider, and the ability of the target to cope with DNS related threats can be more accurately reflected.

[0027] 3) The request of the target resolver in the test method is dynamically responded, the corresponding response is generated according to the state of the target resolver, the state change of the target resolver in the domain name resolution process is recorded through the interaction process of multiple request-response, compared with the method of testing by using single request-response process, more information can be collected, so that the security parameters related to complex mechanism can be tested. BRIEF DESCRIPTION OF DRAWINGS

[0028] Figure 1 is a DNS server security parameter black box test method flow chart based on a double-end measurement mode of the application.

[0029] Figure 2 is a DNS server security parameter black box test method schematic diagram based on a double-end measurement mode of the application. DETAILED DESCRIPTION

[0030] In order to make the purpose, principle, technical scheme and advantages of the application clearer and more clear, the following will combine specific embodiments, and refer to the drawings to make detailed description of the application.

[0031] A DNS server security parameter black box test method based on a double-end measurement mode of the application, as shown in Figure 1 , specifically contains the following steps:

[0032] 1) Determine the security parameters of the target resolver, that is, the resolver to be tested, model according to the related security measures principle of the tested parameter, determine the specific performance of the target resolver in the domain name resolution process corresponding to the security parameter and the mathematical relationship between them, so as to obtain the test model of the tested parameter.

[0033] 2) Register a domain name from a domain name registrar as a domain name used in the test method, build an authoritative server, the authoritative server can dynamically return response according to the query request of the resolver as the test authoritative end. After completing the construction of the authoritative server, modify the address of the authoritative server corresponding to the domain name to the address of the self-built authoritative server. In addition, use a server as a test client. Load the processing method for testing the security parameters of the target resolver in the test client and the test authoritative end, that is, the request message generation method for the test client and the request response method for the test authoritative end.

[0034] 3) The test client initiates a test to the target resolver, according to different test parameters, the test method of the test client is called, a DNS message containing a specific request domain name and a message header is designed, and one or more requests are sent to the target resolver, the name of the test parameter is embedded in the request domain name as part of the subdomain name after encoding. The request initiated by the test client will trigger the domain name resolution process of the target resolver, and make the target resolver generate communication behavior with the external network host.

[0035] 4) The triggered target resolver will interact with the self-built authoritative server, that is, the test authoritative end, to try to obtain the resolution result of the domain name. After receiving the query request of the target resolver, the test authoritative end first reads the subdomain name of the request domain name in the query request message, extracts and decodes the name of the test parameter from the subdomain name. Then the test authoritative end calls the corresponding processing function according to the test parameter, dynamically responds to the request message generation method and request response method in the request (i.e. step 2) of the target resolver, generates a response message containing a specific resolution result and a message header, and returns it to the target resolver. The dynamic response of the test authoritative end will affect the state of the target resolver and further trigger the behavior of the target resolver.

[0036] 5) During the test, the behavior information of the target resolver is collected from two angles of the test client and the test authoritative end. The target resolver returns a DNS response to the test client, and the test client collects the flag bit and response code in the response message header, the number of responses, and the resolution result in the response. The target resolver initiates a query request to the test authoritative end, and the test authoritative end collects the request domain name, message header information and request quantity in the request, records the state change information in the target domain name resolution process, such as response, message header flag bit, request frequency, request total amount and other information.

[0037] 6) The behavior information of the target resolver collected by the test client and the test authoritative end during the test is combined, and the security parameter range corresponding to the actual behavior performance is estimated according to the test parameter model of step 1).

[0038] Taking the test of the upper limit parameter of the resolver redirection as an example, the method in the present application can be used for parameter test. The redirection process is realized by CNAME record in the domain name resolution process. When the resolver receives the CNAME response, the domain name of the current query is redirected to the new domain name contained in the CNAME record, and the query is performed again. In order to prevent the occurrence of CNAME cycle or long CNAME chain, the upper limit of redirection is set in the resolver to terminate the abnormal domain name resolution process.

[0039] 1) First, the redirect upper limit parameter corresponding to the resolver behavior performance is modeled, and the maximum value of the request round of the redirect query in the domain name resolution process is the redirect upper limit parameter value of the resolver. The inference of the redirect upper limit parameter only needs to test the authority end to collect the queries initiated by the target resolver in the test process.

[0040] 2) A test-specific domain name dns-test.xyz is registered from the domain name registrar, and a test client and a test authority end are configured, a redirect upper limit test method is loaded, and the authoritative server address of the dns-test.xyz domain is set to the test authority end address.

[0041] 3) The test is initiated by the client, and only one request needs to be sent to the target resolver, and the domain name queried in the request is in the form of 0-cname.dns-test.xyz, and the parameter name to be tested is embedded in the subdomain name. After receiving the request of the test client, the target resolver continues to initiate a query to the test authority end.

[0042] 4) After receiving the query sent by the target resolver, the test authority end first extracts the parameter name to be tested from the subdomain name, judges that the parameter to be tested is the redirect upper limit, and then calls the corresponding processing method to dynamically generate a response. Each response contains a CNAME record, and the redirect domain name in the CNAME record is similar to the original domain name, the difference is that the number in the subdomain name prefix is increased by 1, indicating the current redirect round, in the form of 1-cname.dns-test.xyz. After receiving the response, the target resolver redirects the domain name of the current query to the new domain name contained in the CNAME, and initiates a query to the test authority end again. The redirect process will be repeated until the redirect round triggers the redirect upper limit of the target resolver, and after triggering the redirect upper limit, the target resolver will terminate the domain name resolution process and will not query the test authority end, and returns a SERVFAIL (resolution failure) response to the test client.

[0043] 5) The test authority end collects the query requests initiated by the target resolver during the test process, extracts the request domain name, and records the redirect round in the subdomain name. When the test client receives the resolver SERVFAIL response, the test authority end stops recording, and the maximum redirect round recorded at this time is the redirect upper limit of the target resolver.

[0044] Another embodiment of the present application provides a DNS server security parameter black box test system based on a double-end measurement mode, which comprises a test client, a test authority and a target resolver: the test client initiates a test to the target resolver, triggering the domain name resolution behavior of the target resolver; the triggered target resolver interacts with the test authority, the test authority dynamically responds to the request of the target resolver, generates a response message containing a specific resolution result and a message header and returns it to the target resolver, and the dynamic response of the test authority affects the state of the target resolver and triggers the behavior of the target resolver; the behavior information of the target resolver is collected from the test client and the test authority; the behavior information of the target resolver collected by the test client and the test authority is combined, and the actual behavior performance of the target resolver corresponding to the security parameter range is estimated according to the to-be-tested parameter test model. The specific operation steps and implementation process of the test client, the test authority and the target resolver are described in the foregoing description of the method of the present application.

[0045] The specific embodiments of the present application disclosed above are intended to help understand the content of the present application and to implement the same, and those skilled in the art can understand that various replacements, changes and modifications are possible without departing from the spirit and scope of the present application. The present application should not be limited to the content disclosed by the embodiments of the present application, and the protection scope of the present application is defined by the scope of the claims.

Claims

1. A DNS server security parameter black-box testing method based on a double-end measurement mode, characterized in that, The method comprises the following steps: determining the security parameters of the target resolver to be tested, modeling the related security measures principles of the to-be-tested parameters to obtain a to-be-tested parameter test model; registering a domain name for testing, and setting a test client and a test authority end; the test client initiates a test to the target resolver using the registered domain name, triggering the domain name resolution behavior of the target resolver; the triggered target resolver interacts with the test authority end, the test authority end dynamically responds to the request of the target resolver, generates a response message containing a specific resolution result and a message header, and returns it to the target resolver, thereby affecting the state of the target resolver and triggering the behavior of the target resolver; collecting the behavior information of the target resolver from the test client and the test authority end; combining the behavior information of the target resolver collected by the test client and the test authority end, estimating the security parameter range corresponding to the actual behavior performance of the target resolver according to the to-be-tested parameter test model; the setting of the test client and the test authority end comprises: building an authority server as the test authority end, which can dynamically return a response to the query request of the target resolver according to the test purpose, then modifying the address of the domain name corresponding to the authority server to the address of the test authority end, and using a server as the test client; loading the processing method for testing the security parameters of the target resolver in the test client and the test authority end, i.e. the request message generation method for the test client and the request response method for the test authority end; the test client initiates a test to the target resolver using the registered domain name, triggering the domain name resolution behavior of the target resolver, which comprises: initiating a test to the target resolver through the test client, calling the test method of the test client according to different to-be-tested parameters, sending one or more requests to the target resolver using a DNS message containing a specific request domain name and a message header, the name of the to-be-tested parameter being embedded in the request domain name as part of the subdomain name, triggering the domain name resolution process of the target resolver through the request initiated by the test client, so that the target resolver generates a communication behavior with an external network host; the determination of the security parameters of the target resolver to be tested according to the related security measures principles of the to-be-tested parameters, wherein the security parameters are redirection upper limit parameters, first modeling the behavior performance of the target resolver corresponding to the redirection upper limit parameters, the maximum value of the request rounds of the target resolver in a domain name resolution process is the value of the redirection upper limit parameter; The test authority receives the query sent by the target resolver, first extracts the parameter name to be tested from the subdomain name, judges that the parameter to be tested is the redirection upper limit, dynamically generates a response, and each response contains a CNAME record; the target resolver receives the response, redirects the domain name of the current query to the new domain name contained in the CNAME, and initiates a query to the test authority again; the redirection process is repeated until the redirection round triggers the redirection upper limit of the target resolver, after triggering the redirection upper limit, the target resolver terminates the domain name resolution process, no longer queries the test authority, and returns a SERVFAIL response to the test client.

2. The method of claim 1, wherein, The collection of the behavior information of the target resolver from the test client and the test authority includes: The target resolver returns a DNS response to the test client, the test client collects the flag bit and response code in the message header of the DNS response, the number of responses, and the resolution result in the response; The target resolver initiates a query request to the test authority, the test authority collects the request domain name, message header information and request quantity in the query request, and records the state change information in the target domain name resolution process.

3. The method of claim 2, wherein, The state change information includes response, message header flag bit, request frequency and request total amount.

4. A DNS server security parameter black-box testing system based on a double-ended measurement mode using the method of any one of claims 1-3, characterized in that, It includes a test client, a test authority and a target resolver: the test client initiates a test to the target resolver, triggering the domain name resolution behavior of the target resolver; The triggered target resolver interacts with the test authority, the test authority dynamically responds to the request of the target resolver, generates a response message containing a specific resolution result and a message header, and returns it to the target resolver, which affects the state of the target resolver and triggers the behavior of the target resolver through the dynamic response of the test authority; The collection of the behavior information of the target resolver from the test client and the test authority; Combined with the behavior information of the target resolver collected by the test client and the test authority, the actual behavior performance of the target resolver corresponding to the security parameter range is estimated according to the parameter to be tested model.

Images