Encryption method and system for protecting TSIG key of DNS

Abstract

The invention discloses an encryption method and system for protecting a TSIG key of a DNS, and the method comprises the steps: generating a random key and a random initialization vector IV through employing openssl, and carrying out the encryption of the TSIG key through employing the random key and the IV; generating an encrypted TSIG key character string, and splicing the encrypted key character string with the random key and the IV to form a target key character string; configuring the target key character string in a configuration file of a DNS server, and loading the target key character string when the DNS server is restarted; when the DNS server is started or restarted, the key character string is analyzed, the random key and the IV are extracted, and the integrity of the TSIG key is verified; and storing the decrypted TSIG key in a memory for data integrity verification in subsequent DNS service query and update. According to the scheme, the security problem caused by TSIG leakage can be solved, and the service processing of the DNS is not influenced at all.

Description

Technical Field

[0001] The present application relates to the field of key encryption technology, and in particular to an encryption method and system for protecting a TSIG key of a DNS. Background Art

[0002] DNS (Domain Name System) is one of the core services of the Internet. It mainly implements access to network resources by resolving domain names into IP addresses or other types of records (such as A, AAAA, TXT, CNAME, NAPTR, etc.). In order to ensure the security and reliability of DNS communication, the industry widely adopts the TSIG (Transaction Signature) mechanism to authenticate and protect the integrity of DNS messages.

[0003] TSIG is a shared key-based mechanism that allows DNS clients and servers to use cryptographic signatures during communication to verify each other's identity and ensure the integrity of data during transmission. The main functions of TSIG include:

[0004] Message integrity: TSIG ensures that the received message has not been tampered with by appending a message digest based on a shared key to the DNS message. After receiving the message, the DNS server recalculates the message digest using the same key and compares it with the MAC (message authentication code) in the TSIG record to ensure the integrity of the message.

[0005] Message authentication: TSIG uses a pre-assigned shared key to generate and verify message digests by both communicating parties, thereby ensuring the source of the DNS message is credible and preventing man-in-the-middle attacks or unauthorized hosts from forging DNS messages.

[0006] Prevent replay attacks: TSIG records contain timestamps that can be used to defend against replay attacks and ensure that messages are valid within a predetermined time window. Messages that exceed the time window will be rejected.

[0007] However, the TSIG mechanism commonly used in the prior art has some security risks. When configuring TSIG keys, most DNS servers store them in plain text in the configuration file. This plain text storage method leads to the following security risks:

[0008] DNS data tampering: If an attacker obtains the plaintext TSIG key, he can tamper with the DNS response and modify the IP address or other information, causing user requests to be redirected to malicious servers, thereby implementing phishing attacks, traffic hijacking, and other behaviors.

[0009] DNS data hijacking: TSIG keys stored in plain text may be used by attackers to hijack DNS communications, steal users' DNS query requests and responses, and then obtain sensitive information or monitor users' network behavior.

[0010] Forged DNS responses: If an attacker has the plaintext TSIG key, they can forge DNS responses to deceive users or other DNS servers into thinking that the forged responses come from a trusted DNS source.

[0011] Denial of Service (DDoS) attack: An attacker can use the plaintext TSIG key to send a large number of malicious requests to the target DNS server, exhausting server resources and causing the DNS service to become unavailable.

[0012] The existing method of storing TSIG keys in plain text poses a threat to the security of DNS services and may damage the availability, integrity and confidentiality of DNS services. Therefore, how to safely protect TSIG keys to avoid potential security risks is an urgent problem to be solved in the field of DNS security. Summary of the invention

[0013] The present application provides an encryption method, system, computer device and storage medium for protecting the TSIG key of DNS, aiming to solve the problem that the method of storing TSIG keys in plain text in the prior art poses a threat to the security of DNS services and may cause damage to the availability, integrity and confidentiality of DNS services.

[0014] In a first aspect, an encryption method for protecting a TSIG key of a DNS, the method comprising:

[0015] Generate a random key and a random initialization vector IV using openssl, and encrypt the TSIG key using the random key and IV;

[0016] Generate an encrypted TSIG key string, and concatenate the encrypted key string with the random key and IV to form a target key string;

[0017] Configuring the target key string in a configuration file of the DNS server, and loading the target key string when the DNS server is restarted;

[0018] When the DNS server is started or restarted, the key string is parsed, the random key and IV are extracted, and the integrity of the TSIG key is verified;

[0019] The decrypted TSIG key is stored in memory for data integrity verification in subsequent DNS service queries and updates.

[0020] In the above scheme, optionally, the symmetric encryption algorithm is an AES algorithm, and the TSIG key is encrypted in CBC mode to ensure the randomness and security of the encrypted data.

[0021] In the above scheme, optionally, the random key and initialization vector IV are generated by a random number generator, and the generated key and IV are converted into a hexadecimal format.

[0022] In the above solution, optionally, the DNS server generates a plain text TSIG key, and then uses the random key and IV to encrypt the generated TSIG key.

[0023] In the above scheme, optionally, the key concatenation step includes concatenating the encrypted key string with the random key and IV to form a string of fixed length, thereby ensuring the integrity of the key during storage and transmission and ensuring that the format is easy to parse.

[0024] In the above scheme, optionally, the key verification step includes the DNS server parsing the key string when restarting, separating the random key and IV, and decrypting through the AES algorithm to generate the original TSIG key, and loading it into the memory.

[0025] In the above solution, optionally, the decrypted TSIG key is only stored in the DNS server memory for DNS query and update integrity verification, and is automatically deleted when the server is shut down or restarted to ensure key security.

[0026] In a second aspect, an encryption system for protecting a TSIG key of a DNS, the system comprising:

[0027] A key generation module, used to generate random symmetric encryption keys and initialization vectors IV;

[0028] A key encryption module, used to encrypt the generated TSIG key using the random key and IV, and concatenate and generate a target key string;

[0029] A configuration module, used to configure the target key string in the configuration file of the DNS server;

[0030] The key verification module is used to parse the key string when the DNS server restarts, extract the random key and IV, and verify the integrity of the TSIG key;

[0031] The business module is used to call the TSIG key in the memory during DNS business processing to implement integrity verification of DNS messages.

[0032] In the above scheme, optionally, the key generation module generates a random key and an initialization vector IV through a random number generator, and converts the generated key and IV into a hexadecimal format.

[0033] In the above scheme, optionally, the key encryption module uses the AES algorithm to encrypt the TSIG key, and concatenates the encryption result with the random key and IV to form a key string of fixed length to ensure the security and integrity of the key.

[0034] Compared with the prior art, this application has at least the following beneficial effects:

[0035] Based on further analysis and research of the existing technical problems, this application recognizes that the method of storing TSIG keys in plain text in the existing technology will pose a threat to the security of DNS services, and may cause the availability, integrity and confidentiality of DNS services to be compromised. By using openssl to generate a random key and a random initialization vector IV, and using the random key and IV to encrypt the TSIG key; generating an encrypted TSIG key string, splicing the encrypted key string with the random key and IV to form a target key string; configuring the target key string in the configuration file of the DNS server, and loading the target key string when the DNS server is restarted; when the DNS server is started or restarted, parsing the key string, extracting the random key and IV, and verifying the integrity of the TSIG key; storing the decrypted TSIG key in the memory for subsequent DNS service query and update data integrity verification. It can effectively solve the problems of DNS data tampering, data hijacking, forged response and denial of service attack mentioned in the background technology, and ensure the security of TSIG keys through key encryption and memory storage. This solution can solve the security problems caused by TSIG leakage and has no impact on DNS service processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A flowchart of an encryption method for protecting a TSIG key of a DNS provided by an embodiment of the present application;

[0037] Figure 2 A schematic diagram of the protection and verification process of an encryption method for protecting a TSIG key of a DNS provided in one embodiment of the present application. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0039] In one embodiment, Figure 1 As shown, an encryption method for protecting a TSIG key of a DNS is provided, comprising the following steps:

[0040] Generate a random key and a random initialization vector IV using openssl, and encrypt the TSIG key using the random key and IV;

[0041] Generate an encrypted TSIG key string, and concatenate the encrypted key string with the random key and IV to form a target key string;

[0042] Configuring the target key string in a configuration file of the DNS server, and loading the target key string when the DNS server is restarted;

[0043] When the DNS server is started or restarted, the key string is parsed, the random key and IV are extracted, and the integrity of the TSIG key is verified;

[0044] The decrypted TSIG key is stored in memory for data integrity verification in subsequent DNS service queries and updates.

[0045] This embodiment proposes an encryption method for protecting the TSIG key of the DNS, which includes five steps to ensure the security of the TSIG key during storage and transmission. The core of this method is to encrypt the TSIG key using a symmetric encryption algorithm (AES algorithm) and use a randomly generated key and initialization vector (IV) to ensure the unpredictability of the encrypted data. The specific implementation is as follows:

[0046] Key and IV generation: First, generate a random key and initialization vector (IV) through `openssl` or other secure random number generator to ensure that the key and IV values ​​generated each time are different, making the encryption process highly unpredictable and resistant to cracking.

[0047] TSIG key encryption: After the key and IV are generated, the AES algorithm is used to encrypt the TSIG key in combination with the generated key and IV. During the encryption process, the AES algorithm converts the TSIG key into an encrypted key string, ensuring that even if an attacker obtains the key string, he cannot easily decrypt the original TSIG key.

[0048] Key string concatenation: The encrypted key string is concatenated with the generated random key and IV values ​​to form a final key string. This string structure contains all the necessary information so that the DNS server can extract the key and IV and restore the original TSIG key when decrypting.

[0049] Key string configuration and loading: The concatenated key string is stored in the configuration file of the DNS server. When the DNS server is restarted, the key string is loaded and subsequent parsing and decryption operations are performed.

[0050] Decryption and memory storage: When the DNS server is started or restarted, the random key and IV are extracted by parsing the key string, and the original TSIG key is decrypted using the AES algorithm. The decrypted TSIG key is no longer stored in a file, but is directly loaded into the memory to ensure that it will not be tampered with or leaked during operation.

[0051] The implementation of this embodiment effectively solves the security risks brought by the plain text storage of TSIG keys in the prior art. The specific technical effects are as follows:

[0052] Data integrity and security: AES encryption and randomly generated keys and IVs are used to ensure the security of TSIG keys in storage and transmission. Even if an attacker obtains the key string, due to the complexity of the AES algorithm and the protection of the randomly generated keys and IVs, it is difficult for the attacker to decrypt and restore the original TSIG key, thus ensuring data integrity.

[0053] Prevent DNS data tampering and hijacking: Since TSIG keys are no longer stored in plain text, attackers cannot directly obtain the keys and use them to forge or tamper with DNS data, which greatly reduces the possibility of DNS data tampering and hijacking, ensuring the authenticity and security of DNS data.

[0054] Anti-replay attack: The key string contains a randomly generated IV value. The randomness of this value makes the key string different each time it is encrypted, which can effectively prevent replay attacks. Even if an attacker intercepts a key string after a certain encryption, he cannot reuse it to forge an attack.

[0055] Improved security and privacy: Since the decrypted TSIG key is only stored in memory, it avoids exposing the key in the file, further improving the security of the TSIG key and preventing physical access attacks and malicious reading.

[0056] This embodiment can effectively solve the problems of DNS data tampering, data hijacking, forged response and denial of service attack mentioned in the background technology, and ensure the security of TSIG keys through key encryption and memory storage.

[0057] In this embodiment, the symmetric encryption algorithm is the AES algorithm, and the TSIG key is encrypted in CBC mode to ensure the randomness and security of the encrypted data.

[0058] In this embodiment, during the TSIG key transmission process between DNS servers, the ciphertext encrypted by AES-CBC is difficult to be decrypted. Even if the ciphertext is intercepted, it is difficult for an attacker to extract the plaintext TSIG key from it, thereby ensuring the security of the data transmission process. Since the generation of each ciphertext block in the AES-CBC mode depends on the previous ciphertext block, it has the ability to resist pattern analysis attacks. Even if an attacker obtains part of the ciphertext information, it is difficult to analyze the overall encryption mode or restore the original key, further ensuring the reliability of encryption.

[0059] The specific implementation of this embodiment ensures high-strength encryption of the TSIG key through the AES-CBC mode, solves the potential security risks brought by the plaintext storage and transmission of the key, and enhances the key's anti-attack and data integrity protection capabilities.

[0060] In this embodiment, the random key and initialization vector IV are generated by a random number generator, and the generated key and IV are converted into a hexadecimal format.

[0061] This embodiment generates a key and IV through a random number generator and converts them into hexadecimal format for easy storage and use. The specific implementation steps are as follows:

[0062] Random number generator usage: Use `openssl` or other secure random number generator to generate keys and IVs, ensuring the randomness and unpredictability of the generated key and IV values.

[0063] Hexadecimal format conversion: Convert the generated key and IV values ​​to hexadecimal format for easy storage and reading in the DNS server configuration file. The hexadecimal format storage method is concise and efficient, and is convenient for subsequent parsing and decryption operations.

[0064] Security of keys and IVs: The keys and IVs generated by the random number generator can ensure that different keys and IVs are used for encryption each time, avoiding the security risks brought by fixed keys while ensuring the universality of keys in different environments.

[0065] The technical effects of this embodiment are mainly reflected in the following aspects:

[0066] Enhanced randomness and security of keys: Generating keys and IVs through a random number generator ensures that the values ​​generated each time are different, which enhances the security of the keys and makes the encryption process more unpredictable, thereby effectively preventing key leakage and replay attacks.

[0067] Easy to store and parse: The hexadecimal format of the key and IV is convenient for storage in the configuration file and easy to read and parse when the DNS server is started or restarted, avoiding complex key conversion steps and improving the efficiency and operability of encryption and decryption.

[0068] Prevent duplicate key usage: Randomly generated keys and IVs ensure that different keys are used in each encryption operation, avoiding security vulnerabilities caused by key reuse and improving the overall security of the DNS server.

[0069] In this embodiment, the DNS server generates a plain text TSIG key, and then encrypts the generated TSIG key using the random key and IV.

[0070] This embodiment converts the plaintext TSIG key into ciphertext storage, which can effectively prevent the TSIG key from being illegally accessed or tampered with due to plaintext storage. Even if the configuration file is accessed, it is difficult for an attacker to decipher the original TSIG key from the ciphertext. Since the plaintext of the TSIG key is not directly stored in the configuration file, an attacker cannot directly use the TSIG key to tamper with DNS data or forge a DNS response, thereby protecting the integrity and security of DNS communications. By configuring the encrypted TSIG key string in the DNS server, the administrator only needs to manage the encrypted key string, which reduces the complexity of directly managing the plaintext key and improves the convenience and security of key management.

[0071] This embodiment effectively avoids the plain text storage risk in the prior art by encrypting and storing the TSIG key, and significantly enhances the security of the TSIG key and the credibility of DNS communication.

[0072] In this embodiment, the key concatenation step includes concatenating the encrypted key string with the random key and IV to form a string of fixed length, thereby ensuring the integrity of the key during storage and transmission and ensuring that the format is easy to parse.

[0073] This embodiment forms a key string of fixed length by concatenating the encrypted key string, random key and IV value for easy storage and parsing. The specific implementation is as follows:

[0074] Key string construction: The encrypted TSIG key, the generated random key, and the IV value are concatenated according to a predetermined structure to ensure that the concatenated key string has a fixed length and format. This concatenation format facilitates accurate extraction of the key and IV value during subsequent parsing.

[0075] Fixed-length string: A fixed-length key string is not only easy to store and read, but also can quickly detect the integrity of the key string when reading through the length check mechanism.

[0076] Formatted concatenation: Concatenate the key string in a specific order and format. For example, place the key first and then the IV value during concatenation, and use a specific delimiter to separate the parts to ensure that the parsing process can accurately identify each element.

[0077] This embodiment ensures the consistency of the key storage format by splicing the encrypted key string, key and IV value into a fixed-length string, which is convenient for maintaining a unified storage method in different environments and preventing format errors and data loss during the storage process. Fixed-length and structured key strings can simplify the parsing process. When the DNS server is started or restarted, it only needs to parse the string in a predetermined format to accurately extract the encryption information and key information, ensuring that the key verification process is efficient and accurate. During the parsing process, the characteristics of the fixed-length string can be used to detect the integrity of the string. Once an abnormal string length is detected, the system can identify that the key string may be tampered with or incomplete, and thus refuse to load it.

[0078] Through this step, the present embodiment realizes the standardization and security of key storage, improves the efficiency of key verification by the DNS server, and further enhances the security of DNS communication.

[0079] In this embodiment, the key verification step includes the DNS server parsing the key string when restarting, separating the random key and IV, and decrypting the original TSIG key through the AES algorithm, and loading it into the memory.

[0080] This embodiment extracts the random key and IV by parsing the key string, verifies and decrypts the original TSIG key. The specific implementation is as follows:

[0081] Key string parsing: When the DNS server is started or restarted, it reads the key string in the configuration file and parses the random key, IV value, and encrypted TSIG key contained therein according to a fixed format.

[0082] Decryption process: The extracted random key and IV value will be used to decrypt the encrypted TSIG key in the key string. The DNS server decrypts it using the AES algorithm to obtain the original TSIG key.

[0083] Key verification: After decryption, the system will perform a validity check on the decrypted TSIG key to ensure that the key has not been tampered with and can be used for subsequent DNS communications.

[0084] In this embodiment, key parsing and decryption are performed at each startup or restart to ensure that the loaded key is a complete and untampered key, thereby ensuring the validity of the TSIG key and the reliability of DNS communication. The fixed format and structured key string make the parsing process fast and reliable, and the DNS server can efficiently verify the integrity of the key at startup to ensure that invalid or tampered keys are not loaded. During the startup process, if it is found that the parsing of the key string fails or the key verification fails, the system can automatically refuse to load the key, thereby protecting the DNS server from incomplete or malicious keys and improving the security of the system. The automation and reliability of key verification are achieved, ensuring that the TSIG key is a verified and valid key each time it is loaded, solving the problem that the key may be tampered with or invalid in traditional methods.

[0085] In this embodiment, the decrypted TSIG key is only stored in the DNS server memory for DNS query and update integrity verification, and is automatically deleted when the server is shut down or restarted to ensure key security. This embodiment ensures that the TSIG key will not be exposed to an unsafe storage environment during use, thereby improving the security protection level of the key.

[0086] In one embodiment, a method for protecting and verifying a TSIG key of a DNS is provided. The method includes implementing an encryption component for encrypting and decrypting TSIG related configurations. When configuring and generating the TSIG key, the TSIG key is encrypted by the encryption component and securely stored in a configuration file. When the DNS server uses the TSIG key, the TSIG key is decrypted and carried in a DNS request, thereby achieving encrypted storage of the TSIG key without affecting its functionality.

[0087] like Figure 2 As shown, this embodiment uses a symmetric encryption mechanism, uses a random initialization vector and a key to encrypt and decrypt the TSIG key, and combines the generation and use process of the TSIG key of the DNS to protect the security of the TSIG key.

[0088] Key generation: Use openssl to generate random key and IV values ​​required for symmetric encryption (AES algorithm), and use the generated key and IV values ​​and the selected encryption mode to encrypt the TSIG key.

[0089] Key concatenation: concatenate the encrypted string generated in the previous step with the key and IV value in the algorithm to form a final key value. Since the AES algorithm key and IV value are fixed lengths, the final string can be decrypted.

[0090] Create TSIG key: When the domain administrator generates TSIG key through tools (such as using dnssec-keygen tool in bind), the original plaintext key is no longer returned, but the encrypted key generated in the first two steps is returned. After the administrator configures the generated TSIG key to the configuration file of the resolution server, restarting the resolution service will take effect.

[0091] Key verification: After the parsing server is started or restarted, it automatically loads the TSIG-related configuration in the configuration file. Since the generated key is decomposable, the AES algorithm key and IV value contained in the key string can be retrieved through the features. If the original TSIG key can be successfully generated, it means that the configured TSIG key is valid and has not been tampered with.

[0092] Use key: When the resolution server performs external DNS service query or dynamic update, the resolution server carries the original key to sign the DNS message, and the peer server performs data validity verification after receiving the DNS message. If the verification passes, it proves that the received DNS message has not been tampered with.

[0093] The above embodiments can realize the storage of TSIG key ciphertext, which greatly ensures its security. The following is an example of how to generate and use it in the bind resolution server to supplement the steps:

[0094] Use OpenSSL's RAND_bytes to generate a 128-bit secure random key and a 64-bit secure random initialization vector (IV value). Convert them to hexadecimal strings for use in subsequent steps.

[0095] When the administrator configures a new TSIG key, bind generates a plaintext key according to the original logic when using the dnssec-keygen tool to generate the original key, such as "ZZdmDxDlfo / +c1kK33sbjN1SHOQGZ6qwUicUmBp4X4Y=". This key is plaintext and has great security risks after being stored after configuration. At this time, the random key and IV value in the previous step are used to symmetric encrypt the string. If the CBC mode of AES is selected, the encrypted result is "wFl / u7QInrcLZMJD4C8wiZgDzO8av977Is / ucXZXb5F+RABB48RUj80G1hjj0znx". Concatenate the AES algorithm key, IV value and the generated string to generate the final encrypted TSIG key: "059494343f7228ecc2c06514325cd40892b73ec628b7d958747468856643c47021cd9846de742fc4c7ad85ef224e948dwFl / u7QInrcLZMJD4C8wiZgDzO8av977Is / ucX ZXb5F+RABB48RUj80G1hjj0znx".

[0096] The administrator configures the encrypted TSIG key generated in the end to the named.conf file of Bind and restarts the service.

[0097] When Bind restarts the process, it loads the configured TSIG key, takes the first 128 bits and 64 bits as the key and IV value of the AES algorithm, and the rest is the original key after encryption. Through AES algorithm verification, the original TSIG key can be obtained as "ZZdmDxDlfo / +c1kK33sbjN1SHOQGZ6qwUicUmBp4X4Y=", and then loads the original key into the memory. When it is used later, it is directly loaded from the memory without having to repeat the above steps every time.

[0098] When Bind is working, it uses the TSIG key in the memory to complete the related DNS business. So far, the encryption, storage and decryption steps of the TSIG key have been completed.

[0099] The key technical points of this embodiment are: symmetric encryption and random keys and initialization vectors ensure the security and randomness of the data, so that the generated data cannot be tampered with or reversely decrypted; TSIG key ciphertext storage prevents various security issues caused by TSIG leakage; it has no impact on the DNS service, and the TSIG original key is only loaded into the memory when the service is initialized, and then obtained from the memory.

[0100] The method of this embodiment is applied in a DNS server, which has the following advantages: it can solve the security problems caused by TSIG leakage (such as DNS data tampering, data hijacking, data counterfeiting, etc.) and has no impact on the business processing of DNS.

[0101] In one embodiment, there is provided an encryption system for protecting a TSIG key of a DNS, comprising:

[0102] A key generation module, used to generate random symmetric encryption keys and initialization vectors IV;

[0103] A key encryption module, used to encrypt the generated TSIG key using the random key and IV, and concatenate and generate a target key string;

[0104] A configuration module, used to configure the target key string in the configuration file of the DNS server;

[0105] The key verification module is used to parse the key string when the DNS server restarts, extract the random key and IV, and verify the integrity of the TSIG key;

[0106] The business module is used to call the TSIG key in the memory during DNS business processing to implement integrity verification of DNS messages.

[0107] In this embodiment, the key generation module generates a random key and an initialization vector IV through a random number generator, and converts the generated key and IV into a hexadecimal format.

[0108] In this embodiment, the key encryption module uses the AES algorithm to encrypt the TSIG key, and concatenates the encryption result with the random key and IV to form a key string of fixed length to ensure the security and integrity of the key.

[0109] The specific implementation content of each module can be found in the above definition of the encryption method for protecting the TSIG key of DNS, which will not be repeated here.

[0110] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

Claims

1. An encryption method for protecting a TSIG key of a DNS, characterized in that: The method comprises: Generate a random key and a random initialization vector IV using openssl, and encrypt the TSIG key using the random key and IV; Generate an encrypted TSIG key string, and concatenate the encrypted key string with the random key and IV to form a target key string; Configuring the target key string in a configuration file of the DNS server, and loading the target key string when the DNS server is restarted; When the DNS server is started or restarted, the key string is parsed, the random key and IV are extracted, and the integrity of the TSIG key is verified; The decrypted TSIG key is stored in memory for data integrity verification in subsequent DNS service queries and updates.

2. The method according to claim 1, characterized in that The method of using openssl to generate a random key and a random initialization vector IV includes using a symmetric encryption algorithm AES algorithm and adopting a CBC mode to encrypt the TSIG key to ensure the randomness and security of the encrypted data.

3. The method according to claim 1, characterized in that The random key and initialization vector IV are generated by a random number generator, and the generated key and IV are converted into a hexadecimal format.

4. The method according to claim 1, characterized in that: The DNS server generates a plain text TSIG key, and then encrypts the generated TSIG key using the random key and IV.

5. The method according to claim 1, characterized in that: The key concatenation step includes concatenating the encrypted key string with the random key and IV to form a fixed-length string, thereby ensuring the integrity of the key during storage and transmission and ensuring that the format is easy to parse.

6. The method according to claim 1, characterized in that The key verification step includes the DNS server parsing the key string when restarting, separating the random key and IV, and decrypting the original TSIG key through the AES algorithm, and loading it into the memory.

7. The method according to claim 1, characterized in that The decrypted TSIG key is only stored in the DNS server memory for DNS query and update integrity verification, and is automatically deleted when the server is shut down or restarted to ensure key security.

8. An encryption system for protecting a TSIG key of a DNS, characterized in that: The system comprises: A key generation module, used to generate random symmetric encryption keys and initialization vectors IV; A key encryption module, used to encrypt the generated TSIG key using the random key and IV, and concatenate and generate a target key string; A configuration module, used to configure the target key string in the configuration file of the DNS server; The key verification module is used to parse the key string when the DNS server restarts, extract the random key and IV, and verify the integrity of the TSIG key; The business module is used to call the TSIG key in the memory during DNS business processing to implement integrity verification of DNS messages.

9. The system according to claim 8, characterized in that The key generation module generates a random key and an initialization vector IV through a random number generator, and converts the generated key and IV into a hexadecimal format.

10. The system according to claim 8, characterized in that The key encryption module uses the AES algorithm to encrypt the TSIG key, and concatenates the encryption result with the random key and IV to form a key string of fixed length to ensure the security and integrity of the key.

Images