A DNS user identification system and method

Abstract

The present application discloses a DNS user identification system and method. When a user registers, an authentication server generates authentication identification information and key information for the user; the authentication identification information and key information are sent to a gateway device and a DNS server, respectively. When the gateway device sends a DNS request to the DNS server, the authentication identification information is encrypted using the key information sent by the authentication server to the gateway device, and the obtained ciphertext data is carried in the DNS request. The ciphertext data carried in the DNS request is obtained; the ciphertext data is decrypted using the key information sent by the authentication server to the DNS server to obtain the authentication identification information. If the authentication identification information decrypted by the DNS server is consistent with the authentication identification information of the user sent by the authentication server to the DNS server, the user is determined to be a DNS user, thereby improving the accuracy of DNS user identification.

Description

Technical Field

[0001] The present application relates to the field of DNS network technology, and in particular to a DNS user identification system and method. Background Art

[0002] Operator networks include IoT networks, broadband fixed networks, and dedicated lines according to usage scenarios. Dedicated lines will allocate private public IP addresses to enterprise users, while the other three networks will not allocate private public IP addresses to users. Internet access is performed through network address translation NAT. In this context, there are two situations. One is to use static NAT, which will result in the same public network IP for multiple users. Another situation is that the operator configures dynamic NAT for users and uses an address pool for NAT Internet access. In this scenario, the IP address of users can change dynamically when they go online.

[0003] With the rise of commercial secure domain name system DNS services, DNS services are more likely to provide DNS resolution only to users who register for services and provide users with personalized services. Due to the above two situations, users cannot be accurately identified, and DNS requests can be forged arbitrarily, which cannot meet the needs of DNS services. This makes the accuracy of DNS user identification in the prior art poor. Summary of the invention

[0004] The present application provides a DNS user identification system and method to solve the problem of poor accuracy of DNS user identification in the prior art.

[0005] In a first aspect, the present application provides a DNS user identification system, the system comprising: a gateway device, a DNS server and an authentication server;

[0006] The authentication server is used to generate authentication identification information and key information of the user when the user registers; and send the authentication identification information and the key information to the gateway device and the DNS server respectively;

[0007] The gateway device is used to send a DNS request to the DNS server, wherein the DNS request carries ciphertext data corresponding to the authentication identification information of the user; wherein the ciphertext data is obtained by encrypting the authentication identification information according to the key information;

[0008] The DNS server is used to obtain the ciphertext data carried in the DNS request; decrypt the ciphertext data according to the key information, and if the authentication identification information obtained by decryption is consistent with the authentication identification information of the user sent by the authentication server to the DNS server, it is determined that the user is a DNS user.

[0009] In a second aspect, the present application provides a DNS user identification method, which is applied to a gateway device, and the method includes:

[0010] A DNS request is sent to the DNS server, wherein the DNS request carries ciphertext data corresponding to the authentication identification information of the user; wherein the ciphertext data is obtained by encrypting the authentication identification information according to the key information; the DNS server obtains the ciphertext data carried in the DNS request; the ciphertext data is decrypted according to the key information, and if the authentication identification information obtained by decryption is consistent with the authentication identification information of the user sent to the DNS server by the authentication server, the user is determined to be a DNS user; wherein the authentication server generates the authentication identification information and key information of the user when the user registers; and the authentication identification information and the key information are sent to the gateway device and the DNS server respectively.

[0011] In a third aspect, the present application provides a DNS user identification method, which is applied to a DNS server, and the method includes:

[0012] Receive a DNS request sent by a gateway device; the DNS request carries ciphertext data corresponding to the authentication identification information of the user; wherein the ciphertext data is obtained by encrypting the authentication identification information by the gateway device according to the key information;

[0013] Obtaining the ciphertext data carried in the DNS request; decrypting the ciphertext data according to the key information, and if the authentication identification information obtained by decryption is consistent with the authentication identification information of the user sent by the authentication server to the DNS server, determining that the user is a DNS user;

[0014] Wherein, the authentication server generates authentication identification information and key information of the user when the user registers; and sends the authentication identification information and the key information to the gateway device and the DNS server respectively.

[0015] In a fourth aspect, the present application provides a DNS user identification method, which is applied to an authentication server, and the method includes:

[0016] When a user registers, the user's authentication identification information and key information are generated; the authentication identification information and the key information are sent to the gateway device and the DNS server respectively;

[0017] The gateway device sends a DNS request to the DNS server, wherein the DNS request carries ciphertext data corresponding to the authentication identification information of the user; wherein the ciphertext data is obtained by encrypting the authentication identification information according to the key information;

[0018] The DNS server obtains the ciphertext data carried in the DNS request; decrypts the ciphertext data according to the key information, and if the authentication identification information obtained by decryption is consistent with the authentication identification information of the user sent by the authentication server to the DNS server, the user is determined to be a DNS user.

[0019] In a fifth aspect, the present application provides a DNS user identification device, applied to a gateway device, the device comprising:

[0020] An encryption module, used to encrypt the authentication identification information of the user sent by the authentication server according to the key information of the user sent by the authentication server to obtain ciphertext data;

[0021] A first sending module, configured to send a DNS request to a DNS server, wherein the DNS request carries ciphertext data corresponding to the authentication identification information of the user;

[0022] The DNS server obtains the ciphertext data carried in the DNS request; decrypts the ciphertext data according to the key information, and if the authentication identification information obtained by decryption is consistent with the authentication identification information of the user sent by the authentication server to the DNS server, the user is determined to be a DNS user; wherein, the authentication server generates the authentication identification information and key information of the user when the user registers; and sends the authentication identification information and the key information to the gateway device and the DNS server respectively.

[0023] In a sixth aspect, the present application provides a DNS user identification device, applied to a DNS server, the device comprising:

[0024] A receiving module, used to receive a DNS request sent by a gateway device; the DNS request carries ciphertext data corresponding to the authentication identification information of the user; wherein the ciphertext data is obtained by the gateway device encrypting the authentication identification information according to the key information;

[0025] an identification module, configured to obtain the ciphertext data carried in the DNS request; decrypt the ciphertext data according to the key information, and if the authentication identification information obtained by decryption is consistent with the authentication identification information of the user sent by the authentication server to the DNS server, determine that the user is a DNS user;

[0026] Wherein, the authentication server generates authentication identification information and key information of the user when the user registers; and sends the authentication identification information and the key information to the gateway device and the DNS server respectively.

[0027] In a seventh aspect, the present application provides a DNS user identification device, applied to an authentication server, the device comprising:

[0028] A generation module, used to generate the user's authentication identification information and key information when the user registers;

[0029] A second sending module, used to send the authentication identification information and the key information to the gateway device and the DNS server respectively;

[0030] The gateway device sends a DNS request to the DNS server, wherein the DNS request carries ciphertext data corresponding to the authentication identification information of the user; wherein the ciphertext data is obtained by encrypting the authentication identification information according to the key information;

[0031] The DNS server obtains the ciphertext data carried in the DNS request; decrypts the ciphertext data according to the key information, and if the authentication identification information obtained by decryption is consistent with the authentication identification information of the user sent by the authentication server to the DNS server, the user is determined to be a DNS user.

[0032] In an eighth aspect, the present application provides a gateway device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0033] Memory, used to store computer programs;

[0034] The processor is used to implement the DNS user identification method applied to the gateway device when executing the program stored in the memory.

[0035] In a ninth aspect, the present application provides a DNS server, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0036] Memory, used to store computer programs;

[0037] The processor is used to implement the DNS user identification method applied to the DNS server when executing the program stored in the memory.

[0038] In a tenth aspect, the present application provides an authentication server, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0039] Memory, used to store computer programs;

[0040] The processor is used to implement the DNS user identification method applied to the authentication server when executing the program stored in the memory.

[0041] In an eleventh aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the DNS user identification method is implemented.

[0042] In a twelfth aspect, the present application provides a computer program product, which, when called by a computer, enables the computer to execute the DNS user identification method.

[0043] The above technical solution has the following advantages or beneficial effects:

[0044] In this application, when a user registers, the authentication server generates the user's authentication identification information and key information; the authentication identification information and key information are sent to the gateway device and the DNS server respectively. When the gateway device sends a DNS request to the DNS server, the authentication identification information is encrypted using the key information sent by the authentication server to the gateway device, and the obtained ciphertext data is carried in the DNS request. After receiving the DNS request, the DNS server obtains the ciphertext data carried in the DNS request; the ciphertext data is decrypted using the key information sent by the authentication server to the DNS server to obtain the authentication identification information. Then, the DNS server makes a consistency judgment between the decrypted authentication identification information and the authentication identification information of the user sent by the authentication server to the DNS server. If they are consistent, it means that the user is a user registered with the authentication server, and the user is determined to be a DNS user at this time. This application generates authentication identification information and key information when the user is authenticated, carries the ciphertext data obtained by encrypting the authentication identification information using the key information in the DNS request, and then the DNS server decrypts the authentication identification information, and finally obtains the DNS user identification result by making a consistency judgment with the authentication identification information of the user sent by the authentication server to the DNS server. Compared with the existing method of performing user identification through static NAT or dynamic NAT, the accuracy of DNS user identification is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0046] Figure 1 Schematic diagram of the DNS user identification system provided for this application;

[0047] Figure 2 A schematic diagram of the first DNS user identification process provided for this application;

[0048] Figure 3 A schematic diagram of the second DNS user identification process provided for this application;

[0049] Figure 4 A schematic diagram of the third DNS user identification process provided for this application;

[0050] Figure 5 Flowchart of key information and random number issuance management provided for this application;

[0051] Figure 6 Flowchart of the use of key information and random numbers on the gateway device side provided for this application;

[0052] Figure 7 DNS server side key information and random number usage flow chart provided for this application;

[0053] Figure 8 A schematic diagram of the format of the authentication information provided for this application in the DNS data table;

[0054] Fig. 9 A flowchart for handling DNS server errors provided for this application;

[0055] Fig.10 The business process flow chart of the DNS user identification process provided for this application;

[0056] Fig.11 Schematic diagram of the DNS user identification application scenario provided for this application;

[0057] Fig.12 A schematic diagram of the structure of the first DNS user identification device provided in this application;

[0058] Fig.13 A schematic diagram of the structure of the second DNS user identification device provided in this application;

[0059] Fig.14 A schematic diagram of the structure of the third DNS user identification device provided in this application;

[0060] Fig.15 This is a schematic diagram of the electronic device structure provided in this application. DETAILED DESCRIPTION

[0061] In order to make the purpose and implementation method of the present application clearer, the exemplary implementation method of the present application will be clearly and completely described below in conjunction with the drawings in the exemplary embodiments of the present application. Obviously, the described exemplary embodiments are only part of the embodiments of the present application, rather than all the embodiments.

[0062] It should be noted that the brief description of terms in this application is only for the convenience of understanding the embodiments described below, and is not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their common and usual meanings.

[0063] The terms "first", "second", "third", etc. in the specification and claims of this application and the above drawings are used to distinguish similar or similar objects or entities, and do not necessarily mean to limit a specific order or sequence, unless otherwise noted. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances.

[0064] The terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover but not exclude inclusion, for example, a product or device comprising a list of components is not necessarily limited to all the components expressly listed but may include other components not expressly listed or inherent to such product or device.

[0065] The term "module" refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code that is capable of performing the functions associated with that element.

[0066] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0067] For the convenience of explanation, the above description has been made in conjunction with specific embodiments. However, the above exemplary discussion is not intended to be exhaustive or limit the embodiments to the specific forms disclosed above. Based on the above teachings, various modifications and variations can be obtained. The selection and description of the above embodiments are to better explain the principles and practical applications, so that those skilled in the art can better use the embodiments and various different variations of the embodiments suitable for specific use considerations.

[0068] The DNS user identification method provided in this application can be applied in the Internet of Things scenario. The terms involved in this application are explained as follows:

[0069] DNS (Domain Name System) is a distributed database on the Internet that maps domain names and IP addresses to each other, allowing users to access the Internet more conveniently without having to remember IP number strings that can be directly read by machines.

[0070] EDNS (Extension Mechanisms for DNS) is a DNS extension protocol that allows DNS servers and clients to transmit more information in DNS queries and responses. EDNS is usually used for two purposes: to ensure data non-repudiation (DNSSEC) and to ensure optimal resolution results.

[0071] UUID is the abbreviation of Universally Unique Identifier. The authentication identification information of the user in this application is UUID.

[0072] NAT (Network Address Translation) is an IETF (Internet Engineering Task Force) standard that allows an entire organization to appear on the Internet with a public IP (Internet Protocol) address. When some hosts inside a private network have been assigned local IP addresses but now want to communicate with hosts on the Internet, the NAT method can be used. As the name suggests, it is a technology that translates internal private network addresses (IP addresses) into legal network IP addresses. NAT not only solves the problem of insufficient IP addresses, but also effectively avoids attacks from outside the network, hiding and protecting computers inside the network.

[0073] Figure 1 A schematic diagram of a DNS user identification system provided for this application includes a gateway device 11, a DNS server 12 and an authentication server 13;

[0074] The authentication server 13 is used to generate authentication identification information and key information of the user when the user registers; and send the authentication identification information and the key information to the gateway device 11 and the DNS server 12 respectively;

[0075] The gateway device 11 is used to send a DNS request to the DNS server 12, wherein the DNS request carries ciphertext data corresponding to the authentication identification information of the user; wherein the ciphertext data is obtained by encrypting the authentication identification information according to the key information;

[0076] The DNS server 12 is used to obtain the ciphertext data carried in the DNS request; decrypt the ciphertext data according to the key information, and if the authentication identification information obtained by decryption is consistent with the authentication identification information of the user sent by the authentication server 13 to the DNS server, the user is determined to be a DNS user.

[0077] The gateway device sends a registration request to the authentication server, which carries the user's identification information. When the authentication server receives the registration request, it generates the user's authentication identification information (UUID) and key information based on the user's identification information. The authentication identification information and key information are sent to the gateway device and the DNS server respectively.

[0078] Optionally, the key information may be an encryption / decryption key pair, which includes encryption information and decryption information. The gateway device uses the encryption information in the encryption / decryption key pair to encrypt the authentication identification information to obtain ciphertext data. The DNS server uses the decryption information in the encryption / decryption key pair to decrypt the ciphertext data to obtain the authentication identification information carried in the DNS request. Optionally, the key information may also be a key value, and the gateway device uses the key value to encrypt the authentication identification information to obtain the ciphertext data. The DNS server uses the key value to decrypt the ciphertext data to obtain the authentication identification information carried in the DNS request.

[0079] When the gateway device sends a DNS request to the DNS server, the user client first sends a request carrying user identification information to the gateway device. The client determines the key information and authentication identification information of the user of the user identification information sent by the authentication server to the gateway device based on the user identification information in the request. The authentication identification information is then encrypted using the key information to obtain ciphertext data. The ciphertext data is carried in the DNS request, and the DNS request is sent to the DNS server. After receiving the DNS request, the DNS server obtains the ciphertext data carried in the DNS request; then the ciphertext data is decrypted based on the key information of the user sent by the authentication server to the DNS server to obtain the authentication identification information in the DNS request. If the authentication identification information obtained by decryption is consistent with the authentication identification information of the user sent by the authentication server to the DNS server, it is determined that the user corresponding to the user identification information is a DNS user.

[0080] In this application, when a user registers, the authentication server generates the user's authentication identification information and key information; the authentication identification information and key information are sent to the gateway device and the DNS server respectively. When the gateway device sends a DNS request to the DNS server, the authentication identification information is encrypted using the key information sent by the authentication server to the gateway device, and the obtained ciphertext data is carried in the DNS request. After receiving the DNS request, the DNS server obtains the ciphertext data carried in the DNS request; the ciphertext data is decrypted using the key information sent by the authentication server to the DNS server to obtain the authentication identification information. Then, the DNS server makes a consistency judgment between the decrypted authentication identification information and the authentication identification information of the user sent by the authentication server to the DNS server. If they are consistent, it means that the user is a user registered with the authentication server, and the user is determined to be a DNS user at this time. This application generates authentication identification information and key information when the user is authenticated, carries the ciphertext data obtained by encrypting the authentication identification information using the key information in the DNS request, and then the DNS server decrypts the authentication identification information, and finally obtains the DNS user identification result by making a consistency judgment with the authentication identification information of the user sent by the authentication server to the DNS server. Compared with the existing method of performing user identification through static NAT or dynamic NAT, the accuracy of DNS user identification is improved.

[0081] It should be noted that for PC-side devices, such as mobile phones and tablets, the corresponding DNS request interception proxy function can be configured on the PC-side device; for PC-side devices configured with the DNS request interception proxy function, it can be used as a gateway device to communicate with the DNS server and the authentication server. Taking the PC-side device as a mobile phone as an example, if the corresponding DNS request interception proxy function is configured in the mobile phone, the authentication server generates the user's authentication identification information and key information when the user registers; the authentication identification information and key information are sent to the mobile phone and the DNS server respectively; the mobile phone sends a DNS request to the DNS server, and the DNS request carries the ciphertext data corresponding to the user's authentication identification information; wherein the ciphertext data is obtained by encrypting the authentication identification information according to the key information; the DNS server obtains the ciphertext data carried in the DNS request; the ciphertext data is decrypted according to the key information, and if the decrypted authentication identification information is consistent with the authentication identification information of the user sent by the authentication server to the DNS server, the user is determined to be a DNS user.

[0082] In order to further ensure the security of data, in the present application, the authentication server is specifically used to, when receiving a registration request, obtain the user identification information carried in the registration request, determine a first authentication time period, and determine each sub-authentication time period within the first authentication time period according to a preset time interval; for each sub-authentication time period, generate the authentication identification information and key information of the sub-authentication time period of the user according to the user identification information; and send the authentication identification information and key information of each sub-authentication time period to the gateway device and the DNS server, respectively.

[0083] In the present application, the authentication server can generate the authentication identification information and key information required for the next day on the same day. For example, if the day is October 1, the first authentication time period can be a 24-hour time period on October 2. The various sub-authentication time periods within the first authentication time period are determined according to a preset time interval. The preset time interval is, for example, a time interval of 5 minutes, 10 minutes, etc. Taking the preset time interval of 10 minutes as an example, from zero o'clock on October 2, every 10 minutes within 24 hours is regarded as a sub-authentication time period. For each sub-authentication time period, the authentication identification information and key information of the sub-authentication time period of the user are generated according to the user identification information; the authentication identification information and key information of each sub-authentication time period are sent to the gateway device and the DNS server respectively. It should be noted that the authentication identification information of each sub-authentication time period can be the same, that is, the user corresponds to a unique authentication identification information. Of course, the authentication identification information of each sub-authentication time period can also be different. Considering data security, the key information of each sub-authentication time period can be different.

[0084] In the present application, the gateway device is specifically used to determine the first sub-authentication time period to which the current moment belongs when sending a DNS request to the DNS server, and encrypt the authentication identification information of the first sub-authentication time period of the user according to the key information of the first sub-authentication time period of the user to obtain the ciphertext data;

[0085] The DNS server is specifically used to, when receiving the DNS request, determine the second sub-authentication time period to which the current moment belongs, and decrypt the ciphertext data according to the key information of the second sub-authentication time period of the user.

[0086] When the gateway device sends a DNS request to the DNS server, it first determines the first sub-authentication time period to which the current moment belongs, and then determines the key information and authentication identification information of the first sub-authentication time period of the user according to the authentication identification information and key information of each sub-authentication time period sent by the authentication server. The authentication identification information of the first sub-authentication time period of the user is encrypted according to the key information of the first sub-authentication time period of the user to obtain ciphertext data, and the ciphertext data is carried in the DNS request and sent to the DNS server.

[0087] When the DNS server receives the DNS request, it determines the second sub-authentication time period to which the current moment belongs, and then determines the key information and authentication identification information of the user's second sub-authentication time period based on the authentication identification information and key information of each sub-authentication time period sent by the authentication server. The ciphertext data is decrypted according to the key information of the user's second sub-authentication time period to obtain the authentication identification information. Then, it is determined whether the authentication identification information obtained by decryption is consistent with the authentication identification information of the second sub-authentication time period. If they are consistent, the user is determined to be a DNS user. After determining that the user is a DNS user, DNS resolution is performed, and the DNS resolution result is returned to the user's client.

[0088] In the present application, the authentication server is also used to determine a second authentication time period when it is determined that all authentication identification information and key information are invalid after a preset first time period, and determine each sub-authentication time period within the second authentication time period according to a preset time interval; for each sub-authentication time period, generate the authentication identification information and key information of the sub-authentication time period of the user according to the user identification information; and send the authentication identification information and the key information of each sub-authentication time period to the gateway device and the DNS server, respectively.

[0089] The preset first duration is, for example, 30 minutes, 60 minutes, etc. Taking the key information and authentication identification information generated for each sub-authentication time period on October 2 as an example, if the preset first duration is 60 minutes, then at 11 o'clock in the evening of October 2, it is determined that all authentication identification information and key information are invalid after the preset first duration. At this time, the second authentication time period is determined, and each sub-authentication time period within the second authentication time period is determined according to the preset time interval; for each sub-authentication time period, the authentication identification information and key information of the user's sub-authentication time period are generated according to the user identification information; the authentication identification information and key information of each sub-authentication time period are sent to the gateway device and the DNS server respectively. If the first authentication time period is a 24-hour time period on October 2, the second authentication time period can be a 24-hour time period on October 3. By analogy, the authentication identification information and key information of each sub-authentication time period of the next day can be dynamically determined. The security of the data is further guaranteed.

[0090] In the present application, the key information includes encryption information, decryption information and random numbers. Optionally, the encryption information, decryption information and random numbers of each sub-authentication time period are different. In the same key information, there is a corresponding relationship between the random number and the encryption information and decryption information therein. The DNS request sent by the gateway device to the DNS server can carry the ciphertext data obtained by encrypting the authentication identification information based on the encryption information and the random number corresponding to the current moment. The subsequent DNS server can determine the encryption information and decryption information corresponding to the random number sent by the authentication server to the DNS server based on the random number in the DNS request.

[0091] The gateway device sends a DNS request to the DNS server, where the DNS request carries ciphertext data corresponding to the authentication identification information of the user in the first sub-authentication time period to which the current moment belongs, and a random number in the key information of the first sub-authentication time period; wherein the ciphertext data is obtained by encrypting the authentication identification information of the user in the first sub-authentication time period based on the encryption information in the key information of the first sub-authentication time period;

[0092] When the DNS server receives a DNS request, it obtains the random number carried in the DNS request, and then determines the effective time of the key information corresponding to the random number based on the random number; the effective time refers to the start time of the second sub-authentication time period corresponding to the key information. It determines whether the effective time belongs to the second sub-authentication time period to which the current moment belongs. If so, it decrypts the ciphertext data based on the decryption information in the key information of the user's second sub-authentication time period. Then, it performs the process of judging the consistency of the authentication identification information.

[0093] The DNS server is specifically configured to decrypt the ciphertext data according to the decryption information in the key information of the previous sub-authentication time period of the user if the effective time belongs to the previous sub-authentication time period of the second sub-authentication time period to which the current moment belongs;

[0094] The DNS server is specifically used to decrypt the ciphertext data according to the decryption information in the key information of the next sub-authentication time period of the user if the effective time belongs to the next sub-authentication time period of the second sub-authentication time period to which the current moment belongs.

[0095] Optionally, the DNS server is specifically configured to obtain a clock error between the gateway device and the DNS server if the effective time belongs to a previous sub-authentication time period of the second sub-authentication time period to which the current moment belongs, and if the clock error is less than a preset second time period, decrypt the ciphertext data according to the decryption information in the key information of the previous sub-authentication time period of the user;

[0096] The DNS server is specifically used to obtain the clock error between the gateway device and the DNS server if the effective time belongs to the next sub-authentication time period of the second sub-authentication time period to which the current time belongs, and if the clock error is less than the preset second time period, decrypt the ciphertext data according to the decryption information in the key information of the next sub-authentication time period of the user.

[0097] The preset second time length is, for example, 3 minutes, 4 minutes, etc. If the clock error is not less than the preset second time length, the DNS request may be directly discarded.

[0098] Figure 2 The first DNS user identification process diagram provided for this application includes the following steps:

[0099] S101: The gateway device sends a DNS request to the DNS server, wherein the DNS request carries ciphertext data corresponding to the authentication identification information of the user; wherein the ciphertext data is obtained by encrypting the authentication identification information according to the key information;

[0100] S102: The DNS server obtains the ciphertext data carried in the DNS request; decrypts the ciphertext data according to the key information, and if the authentication identification information obtained by decryption is consistent with the authentication identification information of the user sent by the authentication server to the DNS server, the user is determined to be a DNS user; wherein, when the user registers, the authentication server generates the authentication identification information and key information of the user; and sends the authentication identification information and the key information to the gateway device and the DNS server respectively.

[0101] Figure 3 The second DNS user identification process diagram provided for this application includes the following steps:

[0102] S201: The DNS server receives a DNS request sent by a gateway device; the DNS request carries ciphertext data corresponding to the authentication identification information of the user; wherein the ciphertext data is obtained by the gateway device encrypting the authentication identification information according to the key information;

[0103] S202: The DNS server obtains the ciphertext data carried in the DNS request; decrypts the ciphertext data according to the key information, and if the authentication identification information obtained by decryption is consistent with the authentication identification information of the user sent by the authentication server to the DNS server, the user is determined to be a DNS user; wherein, the authentication server generates the authentication identification information and key information of the user when the user registers; and sends the authentication identification information and the key information to the gateway device and the DNS server respectively.

[0104] Figure 4 The third DNS user identification process diagram provided for this application includes the following steps:

[0105] S301: When a user registers, the authentication server generates authentication identification information and key information of the user; and sends the authentication identification information and the key information to the gateway device and the DNS server respectively;

[0106] S302: The gateway device sends a DNS request to the DNS server, wherein the DNS request carries ciphertext data corresponding to the authentication identification information of the user; wherein the ciphertext data is obtained by encrypting the authentication identification information according to the key information;

[0107] S303: The DNS server obtains the ciphertext data carried in the DNS request; decrypts the ciphertext data according to the key information, and if the authentication identification information obtained by decryption is consistent with the authentication identification information of the user sent by the authentication server to the DNS server, it is determined that the user is a DNS user.

[0108] The DNS user identification process provided in this application is mainly divided into user registration, key information and random number update, DNS user request communication and error processing.

[0109] User registration is when a user activates a service, and the DNS address that provides the service is assigned to the user, and the corresponding user UUID, that is, the user's authentication identification information, is generated at the same time. In addition, the user's key information and random number are also generated. The purpose of issuing key information and random numbers is to ensure that the DNS server and gateway device use the same random number and key information to encrypt key information, ensuring data identification and data encryption. Key information includes but is not limited to authentication identification information.

[0110] The DNS request is divided into the end-side part and the service-side part. The end-side part uses the assigned key information to encrypt the user's UUID and other key information, and the service side uses the same key information to decrypt the data and match it with the user's UUID, thereby identifying whether the user is a DNS user.

[0111] The user registration process is as follows:

[0112] The Internet access gateway device uses https request to carry user identification information and user client identification information, etc., to initiate a user registration request to the authentication server.

[0113] After receiving the request, the authentication server generates a user UUID, key information, and random number, and sends the generated user UUID, key information, and random number to the DNS server and gateway device synchronously using https.

[0114] The DNS server receives the user UUID, key information, and random number for storage, and replies with a relevant response from the authentication server.

[0115] After receiving the DNS request, the authentication server sends the generated UUID to the Internet access gateway device.

[0116] Use https requests to ensure that user UUID, key information, and random numbers are encrypted when issued to users and synchronized to DNS servers, ensuring that related keys are not stolen.

[0117] The key information and random number update process is as follows:

[0118] The authentication server generates key information and random numbers for the next day at 23:00 every day. When the authentication server generates key information and random numbers, it uses https requests to promptly send the key information and random numbers to the DNS server for storage.

[0119] The DNS server stores the received key information and random number and returns the result to the authentication server.

[0120] After the DNS client-side gateway device receives all the key information and random numbers sent by the authentication server, it uses https requests to query the authentication server every 5 minutes from 23:00 whether there is new key information and random numbers. If the authentication server has re-issued the relevant key information and random numbers, the new key information and random numbers will be sent to the DNS client-side gateway device through the established https channel to ensure the confidentiality of the key information and random numbers during transmission.

[0121] The DNS client-side request process is as follows:

[0122] The gateway device obtains the current time, and queries the key information and random number corresponding to the current time according to the time;

[0123] Use the key information to encrypt the UUID, and concatenate the random number and the encrypted UUID into DNS authentication information;

[0124] The DNS authentication information is added to the DNS extended protocol field OPT (EDNS) and the request is sent out.

[0125] The process on the DNS service side is as follows:

[0126] Resolve OPT in DNS requests;

[0127] OPT does not carry DNS authentication information, so the request is considered illegal and the DNS request is discarded;

[0128] OPT carries authentication information and obtains the random number and encrypted UUID of the authentication information;

[0129] Use a random number to query the user's key information. If the key information does not exist, the DNS request will be discarded;

[0130] If the key information exists, use the key information to decode the UUID, and continue to use the UUID to query the user;

[0131] If the UUID query fails, the DNS request is discarded;

[0132] If the UUID query is successful, the user's custom configuration is obtained, DNS resolution is performed based on the user's custom configuration, and the resolution result is returned to the user.

[0133] The delay processing process is as follows:

[0134] Because there may be a clock asynchronization problem on the network, the solution to this problem is that the DNS service side uses the key information of the current time, the key information of the previous 10 minutes, and the key information of the next 10 minutes to work. The specific method is as follows:

[0135] The DNS server queries the key information based on the random number in the user's DNS request;

[0136] The time when the queried key information takes effect;

[0137] If the key information takes effect within 10 minutes of the current system time of the DNS server, the current key information is used for decryption;

[0138] If the key information takes effect within the last 10 minutes of the current system time of the DNS server, determine whether the clock error between the gateway device and the DNS server is less than 3 minutes. If the clock error is less than three minutes, the resolution is normal. If it exceeds three minutes, the DNS request is discarded.

[0139] If the key information takes effect within the next 10 minutes of the current system time of the DNS server, it is determined whether the clock error between the gateway device and the DNS server is less than 3 minutes. If the clock error is less than three minutes, the resolution is normal. If it exceeds three minutes, the DNS request is discarded.

[0140] If the key information takes effect within the current, previous, or next 10 minutes, the DNS request will be discarded directly.

[0141] Server-side time delay processing can effectively ensure the continuity of DNS services and prevent DNS request failures caused by clock asynchrony.

[0142] The DNS user identification solution provided in this application solves the problem that the current DNS traffic cannot directly identify DNS users in the NAT scenario, and solves the problem that DNS user information is easily leaked and forged.

[0143] Through this application, DNS users can be directly identified in DNS traffic to provide personalized services to users. Through this application, attack traffic can be directly filtered to reduce the risk of service anomalies caused by DDOS of the DNS system. Through this application, the possibility of DNS requests being forged can be effectively prevented to provide security for user DNS requests. Compared with DOH / DOT, TCP-based DNS servers usually have low performance. DOH / DOT uses TCP protocol + SSL protocol, which puts a lot of pressure on DNS servers. This solution uses UDP protocol transmission and only encrypts key user information. While ensuring that user information is not leaked, the impact on the overall DNS server performance is relatively small, which can ensure the high performance of the DNS server.

[0144] When a user accesses the Internet through a gateway device on a mobile phone or PC, and when the user's organization has purchased a SASE-based DNS security service for Internet security, the user's DNS traffic needs to be forwarded to a secure DNS server to discover the DNS request. In this scenario, in order for the DNS server to accurately identify the user, the solution provided in this application must be used.

[0145] The DNS user identification process provided by this application is described in detail below with reference to the accompanying drawings.

[0146] Figure 5 The key information and random number issuance management flow chart provided for this application. Figure 5 As shown in the figure, when a user registers for the first time, an https request is used. The authentication server generates the user's UUID, key information, and random number. Usually, one day's key information and random number can be generated at a time, with one set of key information and random number every 10 minutes. The authentication server sends the user's UUID, key information, and random number to the DNS server. After receiving the response from the DNS server, the authentication server sends the user's UUID, key information, and random number to the DNS end-side gateway device. The authentication server monitors the timeliness of multiple sets of key information and random numbers of the user. Before all key information expires, for example, it can be defined as 1 hour before expiration, it will regenerate one day's worth of key information and random numbers, and send the new key information and random number to the DNS server. The DNS user gateway device periodically obtains key information and random numbers from the authentication server. The periodic time can be defined as 5 minutes. When the authentication server finds that the user has new key information and random number generated, it issues the new key information and random number to the DNS user gateway device.

[0147] Figure 6 This is a flowchart of the gateway device side key information and random number usage provided by this application. Figure 6 As shown, the gateway device obtains the current time; based on the current time, a set of key information and random numbers are selected from multiple sets of key information and random numbers generated by the authentication server; the user UUID is encrypting using the selected key information to obtain ciphertext data; the ciphertext data, random numbers, etc. are concatenated into authentication information, and the authentication information format is, for example, random number-UUID ciphertext; the authentication information is added to the OPT of EDNS; and a DNS request is sent.

[0148] Figure 7 The DNS server side key information and random number usage flow chart provided for this application is as follows Figure 7As shown, the DNS server receives the DNS request; parses the authentication information in the DNS request; determines whether there is authentication information, if not, denies the service; if there is authentication information, uses a random number to query the user key information; determines whether the key information is found, if not, denies the service; if the key information is found, uses the key information to decrypt the encrypted UUID; determines whether the decrypted UUID is valid, if not, denies the service; if valid, performs DNS resolution, and returns the DNS resolution result to the user.

[0149] Figure 8 The format diagram of the authentication information provided for this application in the DNS data table is as follows: Figure 8 As shown, the format of the authentication information in the DNS data table includes a two-byte type, a two-byte length, an issued random number, a 1-byte separator, and an encrypted UUID.

[0150] Fig. 9 The DNS server error processing flow chart provided for this application is as follows Fig. 9 As shown, the DNS server queries the key information according to the random number in the user's DNS request; obtains the effective time of the queried key information; if the effective time of the key information is within 10 minutes of the current system time of the DNS server, the current key information is used for decryption; if the effective time of the key information is within the previous 10 minutes of the current system time of the DNS server, it is determined whether the clock error between the gateway device and the DNS server is less than 3 minutes. If the clock error is less than three minutes, the resolution is normal. If it exceeds three minutes, the DNS request is discarded. If the effective time of the key information is within the next 10 minutes of the current system time of the DNS server, it is determined whether the clock error between the gateway device and the DNS server is less than 3 minutes. If the clock error is less than three minutes, the resolution is normal. If it exceeds three minutes, the DNS request is discarded. If the effective time of the key information is not in the current, previous, or next 10 minutes, the DNS request is directly discarded.

[0151] In this application, during the key information and random number issuance management process, the user requests the key information and issues the key information to the DNS server during issuance, both of which are requested using https to ensure that the key information is not leaked during the issuance process;

[0152] During the key management process, each key information and random number pair is valid for 10 minutes to prevent the key information from being cracked. This also prevents network middlemen from obtaining network packets and forging DNS requests.

[0153] The DNS server uses random numbers and UUID for two-level filtering, which can quickly remove illegal DNS requests.

[0154] The DNS server uses UUID to query users. Compared with the traditional method of identifying users by their source IP addresses, it can identify users more accurately when NAT is present in the network.

[0155] In this application, the user's random number and encrypted UUID are added to the OPT of the DNS request, which can protect the user's UUID from being leaked, and at the same time avoid the problem that the user cannot be accurately identified by the source IP address in the presence of NAT. The plaintext random number and the encrypted UUID are combined, and the plaintext random number can quickly filter out requests that do not meet the specifications, reduce the decryption performance consumption of the DNS request, and perform a secondary accurate match through the decoded UUID to ensure the accuracy of user matching. The process of issuing key information and random numbers is a necessary condition to ensure that the user's UUID and random number are not leaked. The key information is issued and the user's random number and encrypted UUID are added to the OPT of the DNS request. These two steps jointly ensure the security of the data and the accurate identification of the user.

[0156] Fig.10 The service processing flow chart of the DNS user identification process provided for this application is as follows: Fig.10 As shown, the authentication server sends key information and random numbers to the DNS server; the DNS server sends response information to the authentication server to indicate successful acquisition of key information and random numbers; the gateway device sends a registration request to the authentication server; the authentication server generates a UUID of the user, and sends the UUID to the DNS server, and the DNS server sends a response information to the authentication server to indicate successful acquisition of the UUID; at this time, the user registration is successful; the gateway device requests multiple groups of key information and random numbers from the authentication server; the authentication server sends multiple groups of key information and random numbers to the gateway device; the gateway device selects a group of key information and random numbers, uses the group of key information and random numbers, and makes a DNS request to the DNS server; the DNS server selects a group of key information and random numbers, uses the group of key information and random numbers to identify the user, and returns a DNS response to the gateway device.

[0157] Fig.11 A schematic diagram of the DNS user identification application scenario provided for this application, such as Fig.11 As shown, home broadband routers, gateway routers, Internet terminals, IoT terminals and other gateway devices are connected to mobile phone 1, mobile phone 2, PC1, PC2, authentication server, secure DNS server and other Internet services respectively. The secure DNS server is also connected to the public DNS service. The authentication server is, for example, a broadband activation center or a user authentication center.

[0158] The format of the DNS request involved in this application is as follows:

[0159] v Additional records

[0160] v <root>: type OPT

[0161] Mame: <root>

[0162] Type: OPT(41)

[0163] UDP payload size: 1232

[0164] Higher bits in extended RCODE: 0x00

[0165] EDNS0 version:0

[0166] Z: 0x0000

[0167] 0... ...=Do bit:Cannot handle DNssEc security RRs

[0168] .000 0000 0000 0000=Reserved:0x0000

[0169] Data length; 46

[0170] Option:COOKIE

[0171] v Option: Unknown(65500)

[0172] Option Code: Unknown(65500)

[0173] Option Length: 30

[0174] OptionData:

[0175] [Response In:2]

[0176] Fig.12 The first DNS user identification device provided in this application is applied to a gateway device, and the device includes:

[0177] The encryption module 121 is used to encrypt the authentication identification information of the user sent by the authentication server according to the key information of the user sent by the authentication server to obtain ciphertext data;

[0178] A first sending module 122, configured to send a DNS request to a DNS server, wherein the DNS request carries ciphertext data corresponding to the user's authentication identification information;

[0179] The DNS server obtains the ciphertext data carried in the DNS request; decrypts the ciphertext data according to the key information, and if the authentication identification information obtained by decryption is consistent with the authentication identification information of the user sent by the authentication server to the DNS server, the user is determined to be a DNS user; wherein, the authentication server generates the authentication identification information and key information of the user when the user registers; and sends the authentication identification information and the key information to the gateway device and the DNS server respectively.

[0180] Fig.13 A schematic diagram of the structure of a second DNS user identification device provided in this application, which is applied to a DNS server, includes:

[0181] The receiving module 131 is used to receive a DNS request sent by a gateway device; the DNS request carries ciphertext data corresponding to the authentication identification information of the user; wherein the ciphertext data is obtained by the gateway device encrypting the authentication identification information according to the key information;

[0182] The identification module 132 is used to obtain the ciphertext data carried in the DNS request; decrypt the ciphertext data according to the key information, and if the authentication identification information obtained by decryption is consistent with the authentication identification information of the user sent by the authentication server to the DNS server, determine that the user is a DNS user;

[0183] Wherein, the authentication server generates authentication identification information and key information of the user when the user registers; and sends the authentication identification information and the key information to the gateway device and the DNS server respectively.

[0184] Fig.14 The third DNS user identification device provided in this application is applied to the authentication server, and the device includes:

[0185] The generating module 141 is used to generate the authentication identification information and key information of the user when the user registers;

[0186] The second sending module 142 is used to send the authentication identification information and the key information to the gateway device and the DNS server respectively;

[0187] The gateway device sends a DNS request to the DNS server, wherein the DNS request carries ciphertext data corresponding to the authentication identification information of the user; wherein the ciphertext data is obtained by encrypting the authentication identification information according to the key information;

[0188] The DNS server obtains the ciphertext data carried in the DNS request; decrypts the ciphertext data according to the key information, and if the authentication identification information obtained by decryption is consistent with the authentication identification information of the user sent by the authentication server to the DNS server, the user is determined to be a DNS user.

[0189] The present application also provides an electronic device, which may be a gateway device, a DNS server, or an authentication server. Fig.15 As shown, it includes: a processor 151, a communication interface 152, a memory 153 and a communication bus 154, wherein the processor 151, the communication interface 152, and the memory 153 communicate with each other through the communication bus 154;

[0190] The memory 153 stores a computer program, and when the program is executed by the processor 151, the processor 151 executes any one of the above method steps.

[0191] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0192] The communication interface 152 is used for communication between the above electronic device and other devices.

[0193] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0194] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0195] The present application also provides a computer storage readable storage medium, wherein the computer readable storage medium stores a computer program executable by an electronic device, and when the program runs on the electronic device, the electronic device implements any of the above method steps when executing.

[0196] The present application provides a computer program product, which, when called by a computer, enables the computer to execute the DNS user identification method.

[0197] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0198] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.< / root> < / root>

Claims

1. A DNS user identification system, characterized in that: The system comprises: a gateway device, a DNS server and an authentication server; The authentication server is used to generate authentication identification information and key information of the user when the user registers; and send the authentication identification information and the key information to the gateway device and the DNS server respectively; The gateway device is used to send a DNS request to the DNS server, wherein the DNS request carries ciphertext data corresponding to the authentication identification information of the user; wherein the ciphertext data is obtained by encrypting the authentication identification information according to the key information; The DNS server is configured to obtain the ciphertext data carried in the DNS request; decrypt the ciphertext data according to the key information, and if the authentication identification information obtained by decryption is consistent with the authentication identification information of the user sent by the authentication server to the DNS server, determine that the user is a DNS user; The authentication server is specifically configured to, upon receiving a registration request, obtain user identification information carried in the registration request, determine a first authentication time period, and determine each sub-authentication time period within the first authentication time period according to a preset time interval; for each sub-authentication time period, generate authentication identification information and key information of the sub-authentication time period of the user according to the user identification information; and send the authentication identification information and key information of each sub-authentication time period to the gateway device and the DNS server, respectively; The key information includes encryption information, decryption information and random numbers; The gateway device is specifically configured to send a DNS request to the DNS server, wherein the DNS request carries ciphertext data corresponding to the authentication identification information of the user in the first sub-authentication time period to which the current moment belongs, and a random number in the key information of the first sub-authentication time period; wherein the ciphertext data is obtained by encrypting the authentication identification information of the user based on the encryption information in the key information; The DNS server is specifically used to, when receiving the DNS request; determine the effective time of the key information corresponding to the random number according to the random number carried in the DNS request; the effective time refers to the starting time of the second sub-authentication time period corresponding to the key information; if the effective time belongs to the second sub-authentication time period to which the current moment belongs, decrypt the ciphertext data according to the decryption information in the key information of the second sub-authentication time period of the user.

2. The system according to claim 1, characterized in that The gateway device is specifically configured to, when sending a DNS request to the DNS server, determine the first sub-authentication time period to which the current moment belongs, and encrypt the authentication identification information of the first sub-authentication time period of the user according to the key information of the first sub-authentication time period of the user to obtain the ciphertext data; The DNS server is specifically used for receiving the DNS request; The second sub-authentication time period to which the current moment belongs is determined, and the ciphertext data is decrypted according to the key information of the second sub-authentication time period of the user.

3. The system according to claim 1, characterized in that The authentication server is also used to determine a second authentication time period when it is determined that all authentication identification information and key information are invalid after a preset first time period, and determine each sub-authentication time period within the second authentication time period according to a preset time interval; for each sub-authentication time period, generate the authentication identification information and key information of the sub-authentication time period of the user according to the user identification information; and send the authentication identification information and the key information of each sub-authentication time period to the gateway device and the DNS server, respectively.

4. The system according to claim 1, characterized in that The DNS server is specifically configured to decrypt the ciphertext data according to the decryption information in the key information of the previous sub-authentication time period of the user if the effective time belongs to the previous sub-authentication time period of the second sub-authentication time period to which the current moment belongs; The DNS server is specifically used to decrypt the ciphertext data according to the decryption information in the key information of the next sub-authentication time period of the user if the effective time belongs to the next sub-authentication time period of the second sub-authentication time period to which the current moment belongs.

5. The system according to claim 4, characterized in that The DNS server is specifically configured to obtain a clock error between the gateway device and the DNS server if the effective time belongs to a previous sub-authentication time period of the second sub-authentication time period to which the current moment belongs, and if the clock error is less than a preset second time period, decrypt the ciphertext data according to the decryption information in the key information of the previous sub-authentication time period of the user; The DNS server is specifically used to obtain the clock error between the gateway device and the DNS server if the effective time belongs to the next sub-authentication time period of the second sub-authentication time period to which the current time belongs, and if the clock error is less than the preset second time period, decrypt the ciphertext data according to the decryption information in the key information of the next sub-authentication time period of the user.

6. A DNS user identification method, characterized in that: Applied to a gateway device, the method comprises: Sending a DNS request to a DNS server, wherein the DNS request carries ciphertext data corresponding to the authentication identification information of the user; wherein the ciphertext data is obtained by encrypting the authentication identification information according to the key information; the DNS server obtains the ciphertext data carried in the DNS request; decrypts the ciphertext data according to the key information, and if the decrypted authentication identification information is consistent with the authentication identification information of the user sent by the authentication server to the DNS server, the user is determined to be a DNS user; wherein the authentication server generates the authentication identification information and key information of the user when the user registers; and sends the authentication identification information and the key information to the gateway device and the DNS server respectively; When receiving a registration request, the authentication server obtains the user identification information carried in the registration request, determines a first authentication time period, and determines each sub-authentication time period within the first authentication time period according to a preset time interval; for each sub-authentication time period, generates authentication identification information and key information of the sub-authentication time period of the user according to the user identification information; and sends the authentication identification information and key information of each sub-authentication time period to the gateway device and the DNS server respectively; The key information includes encryption information, decryption information and random numbers; The gateway device sends a DNS request to the DNS server, wherein the DNS request carries ciphertext data corresponding to the authentication identification information of the user in the first sub-authentication time period to which the current moment belongs, and a random number in the key information of the first sub-authentication time period; wherein the ciphertext data is obtained by encrypting the authentication identification information of the user based on the encryption information in the key information; When the DNS server receives the DNS request, it determines the effective time of the key information corresponding to the random number based on the random number carried in the DNS request; the effective time refers to the starting time of the second sub-authentication time period corresponding to the key information; if the effective time belongs to the second sub-authentication time period to which the current moment belongs, the ciphertext data is decrypted according to the decryption information in the key information of the second sub-authentication time period of the user.

7. A DNS user identification method, characterized in that: Applied to a DNS server, the method comprises: Receive a DNS request sent by a gateway device; the DNS request carries ciphertext data corresponding to the authentication identification information of the user; wherein the ciphertext data is obtained by encrypting the authentication identification information by the gateway device according to the key information; Obtain the ciphertext data carried in the DNS request; decrypt the ciphertext data according to the key information, and if the authentication identification information obtained by decryption is consistent with the authentication identification information of the user sent by the authentication server to the DNS server, determine that the user is a DNS user; wherein the authentication server generates the authentication identification information and key information of the user when the user registers; and sends the authentication identification information and the key information to the gateway device and the DNS server respectively; When receiving a registration request, the authentication server obtains the user identification information carried in the registration request, determines a first authentication time period, and determines each sub-authentication time period within the first authentication time period according to a preset time interval; for each sub-authentication time period, generates authentication identification information and key information of the sub-authentication time period of the user according to the user identification information; and sends the authentication identification information and key information of each sub-authentication time period to the gateway device and the DNS server respectively; The key information includes encryption information, decryption information and random numbers; The gateway device sends a DNS request to the DNS server, wherein the DNS request carries ciphertext data corresponding to the authentication identification information of the user in the first sub-authentication time period to which the current moment belongs, and a random number in the key information of the first sub-authentication time period; wherein the ciphertext data is obtained by encrypting the authentication identification information of the user based on the encryption information in the key information; When the DNS server receives the DNS request, it determines the effective time of the key information corresponding to the random number based on the random number carried in the DNS request; the effective time refers to the starting time of the second sub-authentication time period corresponding to the key information; if the effective time belongs to the second sub-authentication time period to which the current moment belongs, the ciphertext data is decrypted according to the decryption information in the key information of the second sub-authentication time period of the user.

8. A DNS user identification method, characterized in that: Applied to an authentication server, the method comprises: When a user registers, the user's authentication identification information and key information are generated; the authentication identification information and the key information are sent to the gateway device and the DNS server respectively; The gateway device sends a DNS request to the DNS server, wherein the DNS request carries ciphertext data corresponding to the authentication identification information of the user; wherein the ciphertext data is obtained by encrypting the authentication identification information according to the key information; The DNS server obtains the ciphertext data carried in the DNS request; decrypts the ciphertext data according to the key information, and if the authentication identification information obtained by decryption is consistent with the authentication identification information of the user sent by the authentication server to the DNS server, determines that the user is a DNS user; When receiving a registration request, the authentication server obtains the user identification information carried in the registration request, determines a first authentication time period, and determines each sub-authentication time period within the first authentication time period according to a preset time interval; for each sub-authentication time period, generates authentication identification information and key information of the sub-authentication time period of the user according to the user identification information; and sends the authentication identification information and key information of each sub-authentication time period to the gateway device and the DNS server respectively; The key information includes encryption information, decryption information and random numbers; The gateway device sends a DNS request to the DNS server, wherein the DNS request carries ciphertext data corresponding to the authentication identification information of the user in the first sub-authentication time period to which the current moment belongs, and a random number in the key information of the first sub-authentication time period; wherein the ciphertext data is obtained by encrypting the authentication identification information of the user based on the encryption information in the key information; When the DNS server receives the DNS request, it determines the effective time of the key information corresponding to the random number based on the random number carried in the DNS request; the effective time refers to the starting time of the second sub-authentication time period corresponding to the key information; if the effective time belongs to the second sub-authentication time period to which the current moment belongs, the ciphertext data is decrypted according to the decryption information in the key information of the second sub-authentication time period of the user.

Images