DNSSEC server recursive query method, DNSSEC server and product

Abstract

The invention discloses a DNSSEC server recursive query method, a DNSSEC server and a product, and aims to solve the problem that network and hardware resources are consumed due to the fact that illegal response data cannot be recognized in time when a DNSSEC server is attacked in the prior art, A record information of a target domain name is obtained through iteration of the DNSSCE server, and a signature is verified step by step; for the step-by-step verification signature, a data transmission process of requesting to obtain DS record information of each level of domain name is encrypted by using an encryption protocol; obtaining and analyzing DS record information encrypted by using the encryption protocol, and verifying the received KSK signature; if verification of the signature is passed, continuing to use the encryption protocol to encrypt an upper-level DNS authoritative server to obtain DS record information; and if the signature verification fails, stopping the DNSSEC recursive request, and no longer continuing to request DS record information for an upper-level DNS authoritative server, so that illegal response is found in time, and resource occupation is reduced.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a DNSSEC server recursive query method. Background Art

[0002] The traditional DNS protocol is based on UDP+plain text for data transmission. This method improves the speed of domain name resolution, but is vulnerable to external attacks such as deception or tampering with data record values, causing DNS cache data pollution and destroying the integrity and security of DNS data.

[0003] DNSSEC is a protocol extension that enhances the security and reliability of DNS. It signs DNS data through digital signatures. While DNSSEC ensures the security and reliability of DNS data, it also increases the possibility of DDOS attacks. Currently, the protection against DDOS attacks against DNSSEC is mainly achieved by filtering or limiting the attack source IP.

[0004] And when DNSSEC is attacked by DDOS, due to the characteristics of its own query process, that is, the complex signature verification process, the DNSSEC server needs to always request the upper-level DNS server to verify the legitimacy of the authoritative response and DS record signature. It will not be realized until it encounters the root zone public trust certificate or the trust anchor point configured by itself that the response data is illegal. However, at this time, a large amount of hardware and network resources have been occupied, affecting normal DNS resolution requests. Summary of the invention

[0005] The present application provides a DNSSEC server recursive query method, a DNSSEC server and a product, aiming to solve the problem in the prior art that when a DNSSEC server is attacked, illegal response data cannot be identified in time, resulting in consumption of network and hardware resources.

[0006] In a first aspect, a DNSSEC server recursive query method includes: the DNSSEC server iteratively obtains A record information of a target domain name and verifies signatures level by level; the method includes:

[0007] For the step-by-step verification signature, the data transmission process of requesting to obtain the DS record information of each level of domain name is encrypted using an encryption protocol;

[0008] Obtain and parse the DS record information encrypted using the decryption protocol, and verify the received KSK signature;

[0009] If the verification signature is passed, the encryption protocol is continued to be used to encrypt and obtain the DS record information from the upper-level DNS authoritative server;

[0010] If the signature verification fails, the DNSSEC recursive request is stopped and the DS record information is no longer requested from the next-level DNS authoritative server.

[0011] In the above solution, further optionally, the encryption protocol is the TLS protocol.

[0012] In the above scheme, optionally, the received KSK signature is verified. If the signature verification fails, the DNSSEC recursive request is stopped and an error or exception is reported at the same time.

[0013] In the above solution, optionally, the step of encrypting the DS request transmission process using the encryption protocol includes:

[0014] Initiate a handshake request to the DNS authoritative server, and complete the exchange of protocol versions, negotiation of shared keys, identity authentication, certificate verification, and key exchange with the DNS authoritative server during the handshake phase;

[0015] After the encryption protocol connection is established, data is transmitted with the DNS authoritative server through the encryption protocol.

[0016] In a second aspect, a DNSSEC server comprises a memory, a processor and a computer program stored in the memory, wherein the DNSSEC server executes the computer program to implement the steps of the above method.

[0017] In a third aspect, a computer-readable storage medium stores a computer program, which implements the steps of the above method when executed by a processor.

[0018] In a fourth aspect, a computer program product comprises a computer program / instruction, wherein the computer program / instruction implements the steps of the above method when executed by a processor.

[0019] Compared with the prior art, this application has at least the following beneficial effects:

[0020] Based on further analysis and research on the existing technical problems, this application recognizes that although DNSSEC is a good way to improve the security of DNS data, it does not encrypt the transmission process and still uses UDP+plain text for data transmission, but adds a complex signature verification process. In addition, when the DNSSEC server in the existing technology is attacked, it cannot identify illegal response data in time, which will lead to the problem of consuming network and hardware resources. By improving the data transmission process of the DNS server obtaining DS records to encrypt by using an encryption protocol, when the DNSSEC server receives a forged DNS response, it can avoid the process of obtaining DS records from the upper-level DNS server from being forged or tampered with; and timely discover illegal responses through DS to reduce resource usage.

[0021] The DNSSEC recursive process of this application is divided into two stages: request and signature authentication. Although a large amount of calculation is required in the signature authentication stage, this application can allow the DNSSEC server to identify attack behaviors earlier and reduce system resource usage by at least 50%. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 A schematic diagram of a flow chart of a DNSSEC server recursive query method provided in one embodiment of the present application;

[0023] Figure 2 A schematic diagram of a scenario in which a DNSSEC server normally iterates to obtain an A record of abcom. and verifies a signature, provided in an embodiment of the present application;

[0024] Figure 3 A schematic diagram of a scenario in which a DNSSEC server obtains an A record of abcom. and verifies a signature and is attacked, provided in one embodiment of the present application;

[0025] Figure 4 A specific protection logic diagram of a DNSSEC server recursive query method during a DNSSEC DDOS attack provided by an embodiment of the present application;

[0026] Figure 5 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0028] In the description of the present application: unless otherwise specified, expressions such as “include”, “comprising”, “having”, etc. also mean “not limited to” (certain units, components, materials, steps, etc.).

[0029] In one embodiment, reference Figure 1 , provides a DNSSEC server recursive query method, including: the DNSSEC server iteratively obtains the A record information of the target domain name and verifies the signature level by level;

[0030] For the level-by-level verification signature, the data transmission process of requesting the DS record information of each level of domain name is encrypted using the encryption protocol;

[0031] Obtain and parse the DS record information encrypted using the encryption protocol, and verify the received KSK signature;

[0032] If the verification signature is passed, the encryption protocol is used to encrypt the DS record information from the upper-level DNS authoritative server;

[0033] If the signature verification fails, the DNSSEC recursive request is stopped and the DS record information is no longer requested from the next-level DNS authoritative server.

[0034] In one embodiment, the encryption protocol uses the TLS protocol.

[0035] This embodiment proposes a DNSSEC server recursive query method, the purpose of which is to prevent the process of obtaining DS records from being forged or tampered with when the DNSSEC server receives a forged DNS response; and to timely discover illegal responses through DS to reduce resource usage.

[0036] The traditional DNS protocol is based on UDP+plain text for data transmission. This method improves the speed of domain name resolution, but is vulnerable to external attacks such as deception or tampering with data record values, causing DNS cache data pollution and destroying the integrity and security of DNS data.

[0037] DNSSEC is a protocol extension that enhances the security and reliability of DNS. It signs DNS data through digital signatures. It still uses UDP+plaintext for data transmission, so it may still be subject to (or even amplify) DDOS attacks. Currently, the protection against DDOS attacks against DNSSEC is mainly achieved by filtering or limiting the attack source IP. While DNSSEC ensures the security and reliability of DNS data, it also increases the possibility of DDOS attacks.

[0038] Although DNSSEC is a good way to improve the security of DNS data, it does not encrypt the transmission process and still uses UDP+plaintext for data transmission, but adds a complex signature verification process. The DNSSEC signature verification process for data is more complicated, and it is necessary to obtain DS records from the upper-level DNS server to verify whether the signature of the data at this level is legal, which consumes a lot of network and hardware resources.

[0039] If the authoritative response and DS record are forged during the recursive recording process of the DNSSEC server, the DNSSEC server needs to request the upper-level DNS server to verify the legitimacy of the authoritative response and DS record signature. It will not be until it encounters the root zone public trust certificate or the trust anchor point configured by itself that it realizes that the response data is illegal. However, at this time, a large amount of hardware resources have been occupied, affecting normal DNS resolution requests.

[0040] The following examples show the DNSSEC server operating normally and under attack.

[0041] 1. The DNSSEC server normally iterates to obtain the A record of abcom. and verify the signature. Figure 2 .

[0042] Process 1: The DNSSEC server iteratively obtains the A record of abcom.

[0043] ① Request the root service to obtain the NS information of the com zone (i.e. the authoritative server information of the com zone).

[0044] ② Obtain NS information of b.com zone from the com authoritative server.

[0045] ③ Obtain the A record information of abcom from the authoritative server of b.com.

[0046] At this time: the b.com authoritative server will not only return the A record information of abcom, but also return the DNSKEY, ZSK and KSK information to verify the legitimacy of the A record. Among them, KSK needs to be verified by the upper-level DNS server.

[0047] Process 2: The DNSSEC server verifies the legitimacy of the KSK step by step.

[0048] ④ Obtain b.com’s DS record information from the com server, and use the DS record to verify whether the KSK signature returned by b.com is legal.

[0049] ⑤ Obtain com’s DS record information from the root server, and use the DS record to verify whether the KSK returned by the com server is legal.

[0050] ⑥ Use the key data disclosed by the root server to verify whether the KSK returned by the root server is legal.

[0051] 2. DNSSEC server obtains abcom.'s A record and verifies the signature process under attack, see Figure 3 .

[0052] Process 1: The DNSSEC server iteratively obtains the A record of abcom.

[0053] ① Request the root service to obtain the NS information of the com zone. (i.e. the authoritative server information of the com zone)

[0054] ② Obtain NS information of b.com zone from the com authoritative server.

[0055] ③ Obtain the A record information of abcom from the authoritative server of b.com.

[0056] At this point: the attack server intercepts the request, forges or tampers with the DNS response data; and responds to the DNSSEC server first.

[0057] Process 2: The DNSSEC server verifies the legitimacy of the KSK step by step.

[0058] ④ Obtain the DS record information of b.com from the com server.

[0059] At this point: the attacking server intercepts the request, forges or tampers with the DS record data; and responds to the DNSSEC server first.

[0060] Verify the KSK signature returned by b.com using the forged or tampered DS record.

[0061] ⑤ Obtain DS record information of com from the root server.

[0062] Same as ④, attack the server to intercept, forge, and preemptively respond.

[0063] Verify the KSK returned by the com server using a forged or tampered DS record.

[0064] ⑥Use the public key data of the root server to verify that the KSK returned by the root server is illegal! This iteration process fails.

[0065] During the whole process, DNSSEC needs to make multiple requests and complex calculations until it encounters a trusted root server public key or other trust anchor point, and then it realizes that the data is illegal and incomplete. However, a lot of hardware resources have been wasted. If there are many such attacks, the DNSSEC server will run out of resources and be unable to respond to normal requests.

[0066] This embodiment strengthens the DDOS attack of DNSSEC; the iterative process of obtaining records is still consistent with the existing process; the data transmission process of obtaining DS records from the upper-level DNS server is improved to encrypt by using TLS.

[0067] Taking the DDOS attack of DNSSEC as an example, the specific protection logic and description are as follows: Figure 4 .

[0068] Process 1: The DNSSEC server iteratively obtains the A record of abcom.

[0069] ① Request the root server to obtain the NS information of the com zone (i.e. the authoritative server information of the com zone).

[0070] ② Obtain NS information of b.com zone from the com authoritative server.

[0071] ③ Obtain the A record information of abcom from the authoritative server of b.com.

[0072] At this point: the attack server intercepts the request, forges or tampers with the DNS response data; and responds to the DNSSEC server first.

[0073] Process 2: The DNSSEC server verifies the legitimacy of the KSK step by step.

[0074] ④ Obtain the DS record information of b.com from the com server and use TLS to encrypt the data transmission process.

[0075] At this point: the attack server cannot intercept the request, and cannot respond to the DNS request first.

[0076] Using the correct DS record, verification of the KSK returned by the attacking server for b.com fails.

[0077] ⑤ Stop the current DNSSEC recursive request and stop requesting DS records from the next-level DNS server; reduce resource usage.

[0078] If the DS verification signature is successful, TLS is used to obtain the DS record from the upper-level DNS authoritative server.

[0079] In one embodiment, it includes: verifying the received KSK signature, if the signature verification fails, stopping the current DNSSEC recursive request, and reporting an error or exception at the same time.

[0080] In one embodiment, the steps of encrypting the DS request transmission process using the TLS protocol include:

[0081] Initiate a handshake request to the DNS authoritative server, and complete the exchange of protocol versions, negotiation of shared keys, identity authentication, certificate verification, and key exchange with the DNS authoritative server during the handshake phase;

[0082] After the TLS connection is established, data is transmitted with the DNS authoritative server through the TLS protocol.

[0083] In this embodiment, TLS (Transport Layer Security) is a security protocol built on the transport layer to protect the confidentiality and data integrity of communications. Steps for encrypting the DS request transmission process using TLS:

[0084] Handshake phase: The DNSSEC server actively initiates a handshake request to the authoritative server; similar to the TLS standard protocol, this phase requires the exchange of protocol versions, negotiation of shared keys, identity authentication, certificate verification, and key exchange.

[0085] Data transmission: After the TLS connection is established, the DNSSEC server and the DNS authoritative server begin secure data transmission through the TLS protocol.

[0086] In addition, TLS can also use methods such as public key infrastructure (PKI), regular certificate updates, and two-way authentication to prevent man-in-the-middle attacks, which is not the focus of this application.

[0087] In this embodiment, TLS encryption is performed on the transmission process of DS data, and the integrity and reliability of DS data transmission are guaranteed through the security mechanism of the TLS protocol itself. When the verification signature fails, the DNSSEC recursive request is stopped, and the DS record information is no longer requested from the next-level DNS authoritative server, so that the DNSSEC server can promptly discover illegal data responses, reduce system resource usage, and avoid DDOS attacks. During the whole process, the DNS client does not need to do special configuration and processing, only the DNSSEC server and the DNS authoritative server need to do TLS encryption adaptation.

[0088] The method provided by the embodiment of the present application is applied in a DNSSEC device or module, which has the following advantages: the DNSSEC recursive process is divided into two stages: request and signature authentication. Although a large amount of calculation is required in the signature authentication stage, the DNSSEC server can identify attack behaviors earlier and reduce system resource usage by at least 50%.

[0089] In one embodiment, a computer device is provided. The computer device may be a DNSSEC server, and its internal structure diagram may be as follows: Figure 5 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. The processor of the computer device is used to provide computing and control capabilities, and the network interface is used to communicate with an external terminal through a network connection. The computer device implements the above-mentioned DNSSEC server recursive query method by loading and running a computer program.

[0090] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0091] In one embodiment, a computer-readable storage medium is further provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method in the above embodiment are implemented.

[0092] In one embodiment, a computer program product is also provided, including a computer program / instruction, which implements the steps of the above-mentioned embodiment method when executed by a processor.

[0093] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

Claims

1. A DNSSEC server recursive query method, comprising: The DNSSCE server iteratively obtains the A record information of the target domain name and verifies the signature level by level; its characteristics are: For the step-by-step verification signature, the data transmission process of requesting to obtain the DS record information of each level of domain name is encrypted using an encryption protocol; Obtain and parse the DS record information encrypted using the encryption protocol, and verify the received KSK signature; If the verification signature is passed, the encryption protocol is continued to be used to encrypt and obtain the DS record information from the upper-level DNS authoritative server; If the signature verification fails, the DNSSEC recursive request is stopped and the DS record information is no longer requested from the next-level DNS authoritative server.

2. The DNSSEC server recursive query method according to claim 1, characterized in that: include: The encryption protocol is the TLS protocol.

3. The DNSSEC server recursive query method according to claim 1, characterized in that: include: Verify the received KSK signature. If the signature verification fails, stop the DNSSEC recursive request and report the error or exception.

4. The DNSSEC server recursive query method according to claim 1, characterized in that: The steps of encrypting the DS request transmission process using the encryption protocol include: Initiate a handshake request to the DNS authoritative server, and complete the exchange of protocol versions, negotiation of shared keys, identity authentication, certificate verification, and key exchange with the DNS authoritative server during the handshake phase; After the encrypted connection is established, data is transmitted with the DNS authoritative server through the encryption protocol.

5. A DNSSEC server, comprising a memory, a processor, and a computer program stored in the memory, characterized in that: The DNSSEC server executes the computer program to implement the steps of the method of claim 1.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to claim 1 are implemented.

7. A computer program product comprising a computer program / instructions, characterized in that The computer program / instructions implement the steps of the method of claim 1 when executed by a processor.

Images