Domain name system authorization verification method and device, equipment and medium

Abstract

The invention provides a domain name system authorization verification method, device and equipment and a medium, and the method comprises the steps: obtaining message information with a target query field, and generating response message information based on the message information, the target query field being used for querying record information in a target region; according to the target query field and pre-stored authorization information, querying record information corresponding to the target query field in the target area; and adding the record information into the response message information, and sending the added response message information to a recursive server. The method is used for solving the problem that the DNS resolution efficiency and the service availability are affected due to serious overload or invalid query of a recursive server caused by hostile attack due to lack of a DNS authorization verification mode in related technologies, supports effective verification of authorization information by a bonding area, can reduce the occurrence of invalid query, and improves the user experience. The method and the system have relatively high implementability and low performance loss, and further improve the security and the efficiency of domain name system resolution.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet and server information verification, and in particular to a domain name system authorization verification method, device, equipment and medium. Background Art

[0002] The Domain Name System (DNS) service is the core infrastructure of the Internet, responsible for converting domain names into Internet Protocol (IP) addresses and providing access portals for Internet applications. As the scale of the Internet continues to expand, DNS services are also facing major challenges in security and stability, and are a key factor affecting network security.

[0003] In related technologies, domain name authorization is achieved by unidirectionally configuring domain name server (NS) records and associated glue records in the authorization zone, but the glue zone can only passively accept recursive query traffic caused by this configuration, and lacks an effective verification mechanism for the authorization information of the NS records in the authorization zone. This vulnerability may be exploited by attackers to trigger a large number of recursive queries and traffic attacks by maliciously configuring authorization records. Existing preventive measures usually limit the number of times a recursive server queries glue records, but cannot completely solve the problems caused by configuration errors, resulting in invalid queries issued by the recursive server, affecting DNS resolution efficiency and service availability. Summary of the invention

[0004] The present invention provides a domain name system authorization verification method, device, equipment and medium, which are used to solve the problem that the related technology lacks a DNS authorization verification method, which may lead to malicious attacks, causing serious overload or invalid queries of recursive servers, and affecting DNS resolution efficiency and service availability.

[0005] The present invention provides a domain name system authorization verification method, which is applied to an authoritative server and includes the following steps.

[0006] Obtain message information with target query fields, and generate response message information based on the message information; According to the target query field and the pre-stored authorization information, query the record information corresponding to the target query field in the target area; The record information is added to the response message information, and the added response message information is sent to the recursive server.

[0007] According to a domain name system authorization verification method provided by the present invention, the target area includes an authorization area and a bonding area, the authorization information includes a designated area field and a data field, the designated area field is used to indicate the authorization area and the bonding area corresponding to the target query field, and the data field is used to associate the domain name server record of the bonding area record with the authorization area, then according to the target query field and the pre-stored authorization information, querying the record information corresponding to the target query field in the target area includes: Determine the target authorization area corresponding to the target query field based on the specified area field; The target bonding area corresponding to the target query field is determined according to the data field, and the record information is obtained from the target bonding area.

[0008] According to a domain name system authorization verification method provided by the present invention, according to the target query field and pre-stored authorization information, querying the record information corresponding to the target query field in the target area includes: If the record information corresponding to the target query field is not found in the target area, the corresponding target record information is generated for the target query field, and the target record information is used to indicate that the message information authorization verification fails.

[0009] The present invention provides another domain name system authorization verification method, which is applied to a recursive server and includes the following steps.

[0010] In response to a domain name system authorization verification instruction, send a message with a target query field to an authoritative server; Receive response message information corresponding to the message information, where the response message information includes record information corresponding to the target query field; The result of the authorization verification is determined based on the recorded information.

[0011] According to a domain name system authorization verification method provided by the present invention, determining the result of authorization verification according to record information includes: Comparing the recorded information with the pre-stored server information to obtain a comparison result; If the comparison result indicates that the comparison is consistent, it is confirmed that the authorization information is correct; If the comparison result indicates that the comparison is inconsistent, the server information is updated according to the comparison result.

[0012] According to a method for verifying domain name system authorization provided by the present invention, the method further includes: If the response message does not contain the record information corresponding to the target query field, no authorization verification is performed.

[0013] The present invention also provides a domain name system authorization verification device, comprising the following modules: A first acquisition module, used to acquire message information with a target query field, and generate response message information based on the message information; A query module, used to query the record information corresponding to the target query field in the target area according to the target query field and the pre-stored authorization information; The first sending module is used to add the record information to the response message information, and send the added response message information to the recursive server.

[0014] According to a domain name system authorization verification device provided by the present invention, the target area includes an authorization area and a bonding area, the authorization information includes a designated area field and a data field, the designated area field is used to indicate the authorization area and the bonding area corresponding to the target query field, and the data field is used to associate the domain name server record of the bonding area record with the authorization area, and the query module is specifically used to: Determine the target authorization area corresponding to the target query field based on the specified area field; The target bonding area corresponding to the target query field is determined according to the data field, and the record information is obtained from the target bonding area.

[0015] According to a domain name system authorization verification device provided by the present invention, the query module is specifically used for: If the record information corresponding to the target query field is not found in the target area, the corresponding target record information is generated for the target query field, and the target record information is used to indicate that the message information authorization verification fails.

[0016] The present invention also provides another domain name system authorization verification device, comprising the following modules: A second sending module, configured to send a message with a target query field to an authoritative server in response to an instruction of a domain name system authorization verification; A second receiving module is used to receive response message information corresponding to the message information, wherein the response message information includes record information corresponding to the target query field; The processing module is used to determine the result of the authorization verification according to the recorded information.

[0017] According to a domain name system authorization verification device provided by the present invention, the processing module is specifically used for: Comparing the recorded information with the pre-stored server information to obtain a comparison result; If the comparison result indicates that the comparison is consistent, it is confirmed that the authorization information is correct; If the comparison result indicates that the comparison is inconsistent, the server information is updated according to the comparison result.

[0018] According to a domain name system authorization verification device provided by the present invention, the processing module is also used for: If the response message does not contain the record information corresponding to the target query field, no authorization verification is performed.

[0019] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, any of the above-mentioned methods for verifying the authorization of a domain name system is implemented.

[0020] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the domain name system authorization verification method as described in any one of the above is implemented.

[0021] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method for verifying the authorization of a domain name system as described above is implemented.

[0022] The domain name system authorization verification method provided by the present invention first obtains message information with a target query field, and generates response message information based on the message information, the target query field is used to query authorization information in a target area, and then according to the target query field and pre-stored authorization information, the target area queries the record information corresponding to the target query field, and finally adds the record information to the response message information, and sends the added response message information to the recursive server. The domain name system authorization verification method provided by the present invention supports the effective verification of authorization information by the bonding area, can reduce the occurrence of invalid queries, has strong feasibility and low performance loss, and thus improves the security and efficiency of domain name system resolution. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1 It is a schematic diagram of the principle of a server being attacked provided by the background technology of an embodiment of the present disclosure.

[0025] Figure 2 It is a flow chart of a domain name system authorization verification method provided by the present invention.

[0026] Figure 3 It is a structural schematic diagram of an AOD response field provided by the present invention.

[0027] Figure 4It is a flow chart of another domain name system authorization verification method provided by the present invention.

[0028] Figure 5 It is a structural schematic diagram of an AOD query field provided by the present invention.

[0029] Figure 6 It is a specific flow chart of a domain name system authorization verification method provided by the present invention.

[0030] Figure 7 It is a schematic diagram of the principle of the authorization verification mechanism provided by the present invention.

[0031] Figure 8 It is a structural diagram of a domain name system authorization verification device provided by the present invention.

[0032] Fig. 9 It is a structural schematic diagram of another domain name system authorization verification device provided by the present invention.

[0033] Fig.10 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0035] Before describing in detail the domain name system authorization verification method provided by the present disclosure, the key terms involved are introduced first, including: DNS, or Domain Name System (DNS), is a service of the Internet. As a distributed database that maps domain names and IP addresses to each other, it enables people to access the Internet more conveniently.

[0036] NS record, or Name Server (NS) record, is a domain name server record used to specify which DNS server is used to resolve the domain name.

[0037] DNS service is the core infrastructure of the Internet, responsible for converting domain names into IP addresses and providing access to Internet applications. As the scale of the Internet continues to expand, DNS services are also facing major challenges in security and stability, and are a key factor affecting network security.

[0038] The DNS service is an architecture based on the authorization mechanism. The DNS data is distributed and managed by authoritative DNS servers with "zones" as the basic unit. A zone is authorized to an authoritative DNS server with a specified name through NS records. The A / AAAA record of the DNS server name specifies the IP address of the server, which is called a glue record. The zone to be authorized is referred to as the "authorized zone" below, and the zone where the glue record is located is called the "glue zone". If the authorization record and the glue record belong to the same zone, then the zone is both an authorized zone and a glue zone. The authorization zone and the glue zone are associated with each other through the authorization information configured by the NS record. Figure 1 As shown, the NS record "a.com.NS ns1.b.net." authorizes the "a.com." sub-zone to the authoritative DNS server of "ns1.b.net.", and the glue A record "ns1.b.net. A 1.1.1.1" in the "b.net" zone configures the IP address "1.1.1.1" for the authoritative DNS server "ns1.b.net.", where "a.com." is the authoritative zone and "b.net." is the glue zone.

[0039] Currently, domain name authorization is achieved through unidirectional configuration of NS records and associated glue records in the authorization zone. The glue zone where the glue record is located can only passively accept the recursive query traffic caused by it, and lacks a verification mechanism for the authorization information of the NS record in the authorization zone. This problem can be exploited by attackers to attack by maliciously configuring carefully set authorization records, which will not only trigger a large number of invalid outbound queries of the recursive resolution software, but also cause traffic attacks on the glue zone. Figure 1 As shown in the figure, if a large number of NS records are configured in the authorization zone and associated with the victim zone, the recursive server will be triggered to send a large amount of query traffic to the victim zone, triggering a NXNSATTACK attack. The current means of preventing such attack risks is usually to limit the number of times the recursive server queries the glue record. However, it is impossible to completely avoid the problem of incorrect authorization information configuration. Incorrect configuration will still trigger invalid outbound queries from the recursive server. In addition, it will affect the acquisition of the IP address of the DNS server in the authorization zone. If the number of restrictions is unreasonable, it will cause the failure to obtain the address of the DNS server in some authorization zones, and the service cannot be enabled.

[0040] Therefore, a domain name system authorization verification method is urgently needed to solve the above problems.

[0041] Combine the following Figure 2-Figure 10 The invention describes a method, device, equipment and medium for verifying the authorization of a domain name system.

[0042] Figure 2 It is one of the flow charts of the domain name system authorization verification method provided by the present invention, such as Figure 2 As shown, the method includes the following: Step 201: Acquire message information with a target query field, and generate response message information based on the message information.

[0043] In specific implementation, after receiving the message information, the authoritative server first ignores the target query field and generates response message information for the message information.

[0044] In the embodiment of the present disclosure, a new AOD record is defined to store NS record information that associates the authorization area with the bonding area for verifying the authorization. The specific format is as follows: Name field: the value is "authorization zone name" and "bonding zone name"; RDATA field: The value is the NS record information that associates the current zone (glue zone) with the specified authorized zone (specified by the Name field), including the number of NS records and the name of the DNS server in the authorized zone to which all NS records point. Figure 1 The AOD record should be configured in the middle glue area: "a.com.b.net. TTL IN AOD 2 ns1.b.net.;ns2.b.net.".

[0045] When a recursive server supporting the authorization information verification mechanism sends a message for querying A / AAAA glue records to an authoritative server, the message carries a target query field, namely, an AOD query field, to notify the authoritative server being queried to query the authorization information of the specified authorization zone.

[0046] The target query field is used to query authorization information in the target area. In this embodiment, the target query field is the AOD query field, which is used to query record information according to the AOD record.

[0047] Step 202: According to the target query field and pre-stored authorization information, query the target area for record information corresponding to the target query field.

[0048] In the specific implementation, the target query field, that is, the AOD query field is used to query the AOD record corresponding to the authorization area name in this area. Specifically, the target authorization area recorded in this field is used to find its corresponding bonding area according to the RDATA field in the authorization information, and the NS information of the corresponding bonding record in the bonding area is used as the record information.

[0049] Of course, in this step, the format of the AOD query field can also be determined. If the authorization zone name is missing or the format is incorrect, or the query record type is not an A / AAAA record, no verification is performed and the response message information is directly returned.

[0050] Step 203: Add the record information to the response message information, and send the added response message information to the recursive server.

[0051] In specific implementation, if corresponding record information exists, the record information is added to the response message information and sent back to the recursive server.

[0052] Preferably, the record information is used to generate an AOD response field and fill it into the response message information. Specifically, after the authoritative server receives the query message with the AOD query extension field, if it supports the authorization verification mechanism, it fills the custom AOD response field in the response message according to the DNS extension protocol, such as Figure 3 As shown, the field content is the AOD record of the specified authorization area.

[0053] In this step, if the query finds that there is no corresponding AOD record, a record information is generated, the NAME field of the record is "authorization zone name" and "bonding zone name", the RDATA field is "0", and then the record is added to the response message information and then sent back to the recursive server.

[0054] It should be noted that the method provided in the embodiment of the present invention can perform verification when there are AOD query fields and AOD records, and can also respond normally to messages that do not have such content, which does not conflict with the sending and receiving of messages in the prior art.

[0055] Figure 4 It is one of the flow charts of the domain name system authorization verification method provided by the present invention, such as Figure 4 As shown, the method includes the following: Step 401, in response to a domain name system authorization verification instruction, a message information with a target query field is sent to an authoritative server.

[0056] In specific implementation, the embodiment of the present disclosure defines a new AOD record to store the NS record authorization information associated with the authorization zone and the bonding zone. The specific format of the resource record is as follows: Name field: the value is "authorization zone name" and "bonding zone name"; RDATA field: The value is the NS record information that associates the current zone (glue zone) with the specified authorized zone (specified by the Name field), including the number of NS records and the name of the DNS server in the authorized zone to which all NS records point. Figure 1 The AOD record should be configured in the middle glue area: "a.com.b.net. TTL IN AOD 2 ns1.b.net.;ns2.b.net.".

[0057] In this step, in response to the instruction of the domain name system authorization verification, a message is sent to the authoritative server, and the message contains a target query field for querying the authorization information in the target zone, that is, for querying the glue A / AAAA record. Specifically, when the recursive server supporting the authorization verification mechanism sends the message information to the glue zone authoritative server, according to the DNS extension protocol, the custom AOD query field is filled in the query message extension field. The format of the AOD query field is as follows: Figure 5 As shown, this field includes the name of the authorization zone, indicating that the query is to obtain the bonding record of the specified authorization zone, and notifying the authoritative server to return the AOD record of the specified authorization zone.

[0058] Step 402: Receive response message information corresponding to the message information.

[0059] In specific implementation, if the response message information does not contain the record information corresponding to the target query field, or the server does not support the authorization information verification mechanism, the recursive server processes it as a normal response message without performing authorization information verification. If the response message information contains the record information corresponding to the target query field, step 403 is performed.

[0060] Step 403: Determine the result of the authorization verification according to the recorded information.

[0061] In specific implementation, extract the DNS server name of the authorization zone stored in the AOD record and compare it with the DNS server name specified for the authorization zone in the NS record in its cache. If they are consistent, it means that the cached authorization information is correct. If they are inconsistent, take the union of the two as the DNS server name of the authorization zone. In this step, after receiving the response message information, you can first complete the processing flow in the same way as the ordinary response message information, and then analyze the AOD response field, which can minimize the performance impact caused by the domain name system authorization verification and ensure the overall communication quality.

[0062] According to the following Figure 6 , combined with the interaction between the recursive server and the authoritative server, the domain name system authorization verification method provided by the present invention is described in detail.

[0063] Step 601: The recursive server sends a message with a target query field to the authoritative server in response to a domain name system authorization verification instruction.

[0064] Step 602: The authoritative server obtains message information with the target query field, and generates response message information based on the message information.

[0065] Step 603: Search the target area for record information corresponding to the target query field.

[0066] Step 604: Add the record information to the response message information, and send the added response message information to the recursive server.

[0067] Step 605: The recursive server receives response message information corresponding to the message information.

[0068] Step 606: Determine the result of the authorization verification according to the recorded information.

[0069] In one embodiment, if Figure 7 Build the test environment as shown below and construct the following test data: The com zone configures the authorization information of a.com: a.com. NS ns1.b.net.; a.com. NS ns2.b.net.

[0070] Authorization zone: a.com zone configures a.com's NS record authorization information: a.com.NS ns1.b.net.

[0071] a.com.NS ns2.b.net.

[0072] …

[0073] a.com.NS xxx.b.net.

[0074] Glue area: b.net area configures a.com's NS record glue record and AOD authorization information: ns1.b.net. A1.1.1.1

[0075] ns2.b.net. A2.2.2.2

[0076] a.com.b.net.AOD2 ns1.b.net.; ns2.b.net.

[0077] Then send a query to the recursive resolution DNS: "www.a.com A", triggering the recursive resolution DNS to send the query to the authoritative DNS of the "com" zone.

[0078] If the authoritative DNS for the "com" zone returns the NS record authorization information for the "a.com" zone, the recursive DNS sends a query to the authoritative DNS for the "a.com" zone: "a.com NS".

[0079] If the NS record authorization information returned by the authoritative DNS of the "a.com" zone is inconsistent with the NS authorization information returned by the authoritative DNS of the "com" zone, including an additional record: "a.com NSxxx.b.net.", then in order to obtain the glue A / AAAA record of "a.com.NSxxx.b.net.", the recursive resolution DNS sends a query to the authoritative DNS of the glue zone "b.net.": "xxx.b.net. A". The query message carries the AOD query field, and the content of the field authorization zone name is "a.com.", notifying the authoritative DNS to query the authorization information of the authorization zone "a.com.".

[0080] If the authoritative DNS of "b.net." returns an NXDOMAIN response message indicating that the record does not exist, and adds an AOD response field to the response message based on the AOD record content stored in this zone, the recursive DNS returns the NS authorization information of "a.com.". Finally, after the recursive DNS receives the response message, it determines that "a.com.NS xxx.b.net." is an incorrect record based on the AOD response field, and avoids other additional invalid glue record queries.

[0081] The domain name system authorization verification method provided by the present invention is fully compatible with the existing DNS protocol, reduces the difficulty of implementation, is easy to promote, has good practicality, and improves the security of domain name resolution. By implementing the verification of authorization information in the bonding area, it can not only prevent traffic attacks on authoritative servers caused by incorrect configuration of authorization information, but also avoid the invalid outbound query of bonding records by the recursive resolution server, thereby improving its resolution fault tolerance. In addition, the on-path detection is performed based on the DNS message extension field, and no additional communication process is introduced, which has no impact on the overall resolution performance and has low performance loss.

[0082] The domain name system authorization verification device provided by the present invention is described below. The domain name system authorization verification device described below and the domain name system authorization verification method described above can be referenced to each other.

[0083] like Figure 8 As shown, a domain name system authorization verification device provided by the present invention includes the following modules: The first acquisition module 801 is used to acquire message information with a target query field and generate response message information based on the message information; A query module 802 is used to query the record information corresponding to the target query field in the target area according to the target query field and the pre-stored authorization information; The first sending module 803 is used to add the record information to the response message information, and send the added response message information to the recursive server.

[0084] According to a domain name system authorization verification device provided by the present invention, the target area includes an authorization area and a glue area, and the authorization information includes a designated area field and a data field. The designated area field is used to indicate the authorization area and the glue area corresponding to the target query field, and the data field is used to associate the domain name server record of the glue area record with the authorization area. Then, the query module 802 is specifically used to: Determine the target authorization area corresponding to the target query field based on the specified area field; The target bonding area corresponding to the target query field is determined according to the data field, and the record information is obtained from the target bonding area.

[0085] According to a domain name system authorization verification device provided by the present invention, the query module 802 is specifically used for: If the record information corresponding to the target query field is not found in the target area, the corresponding target record information is generated for the target query field, and the target record information is used to indicate that the message information authorization verification fails.

[0086] like Fig. 9 As shown, another domain name system authorization verification device provided by the present invention includes the following modules: The second sending module 901 is used to send a message with a target query field to the authoritative server in response to the instruction of the domain name system authorization verification; The second receiving module 902 is used to receive response message information corresponding to the message information, where the response message information includes record information corresponding to the target query field; The processing module 903 is used to determine the result of the authorization verification according to the record information.

[0087] According to a domain name system authorization verification device provided by the present invention, the processing module 903 is specifically used for: Comparing the recorded information with the pre-stored server information to obtain a comparison result; If the comparison result indicates that the comparison is consistent, it is confirmed that the authorization information is correct; If the comparison result indicates that the comparison is inconsistent, the server information is updated according to the comparison result.

[0088] According to a domain name system authorization verification device provided by the present invention, the processing module 903 is further used for: If the response message does not contain the record information corresponding to the target query field, no authorization verification is performed.

[0089] Fig.10 An example of a physical structure diagram of an electronic device is shown in FIG. Fig.10As shown, the electronic device may include: a processor 1010, a communications interface 1020, a memory 1030 and a communication bus 1040, wherein the processor 1010, the communications interface 1020 and the memory 1030 communicate with each other through the communication bus 1040. The processor 1010 may call the logic instructions in the memory 1030 to execute the domain name system authorization verification method, which includes: Obtain message information with target query fields, and generate response message information based on the message information; According to the target query field and the pre-stored authorization information, query the record information corresponding to the target query field in the target area; Add the record information to the response message information, and send the added response message information to the recursive server. / or

[0090] In response to a domain name system authorization verification instruction, send a message with a target query field to an authoritative server; Receive response message information corresponding to the message information, where the response message information includes record information corresponding to the target query field; The result of the authorization verification is determined based on the recorded information.

[0091] In addition, the logic instructions in the above-mentioned memory 1030 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0092] On the other hand, the present invention further provides a computer program product, the computer program product includes a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, when the computer program is executed by a processor, the computer can execute the domain name system authorization verification method provided by the above methods, the method includes: Obtain message information with target query fields, and generate response message information based on the message information; According to the target query field and the pre-stored authorization information, query the record information corresponding to the target query field in the target area; Add the record information to the response message information, and send the added response message information to the recursive server. / or

[0093] In response to a domain name system authorization verification instruction, send a message with a target query field to an authoritative server; Receive response message information corresponding to the message information, where the response message information includes record information corresponding to the target query field; The result of the authorization verification is determined based on the recorded information.

[0094] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method for verifying the authorization of a domain name system provided by the above methods is implemented, and the method includes: Obtain message information with target query fields, and generate response message information based on the message information; According to the target query field and the pre-stored authorization information, query the record information corresponding to the target query field in the target area; Add the record information to the response message information, and send the added response message information to the recursive server. / or

[0095] In response to a domain name system authorization verification instruction, send a message with a target query field to an authoritative server; Receive response message information corresponding to the message information, where the response message information includes record information corresponding to the target query field; The result of the authorization verification is determined based on the recorded information.

[0096] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0097] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0098] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for verifying the authorization of a domain name system, applied to an authoritative server, characterized in that: The method comprises: Acquire message information with a target query field, and generate response message information based on the message information; According to the target query field and pre-stored authorization information, query the record information corresponding to the target query field in the target area; The record information is added to the response message information, and the added response message information is sent to the recursive server.

2. The method for verifying the domain name system authorization according to claim 1, characterized in that: The target area includes an authorization area and a bonding area, the authorization information includes a designated area field and a data field, the designated area field is used to indicate the authorization area and bonding area corresponding to the target query field, and the data field is used to associate the domain name server record of the bonding area record with the authorization area, then querying the record information corresponding to the target query field in the target area according to the target query field and the pre-stored authorization information includes: Determine the target authorization area corresponding to the target query field based on the designated area field; The target bonding area corresponding to the target query field is determined according to the data field, and the record information is obtained from the target bonding area.

3. The method for verifying the domain name system authorization according to claim 1, characterized in that: The step of searching the target area for record information corresponding to the target query field according to the target query field and pre-stored authorization information includes: If the record information corresponding to the target query field is not found in the target area, corresponding target record information is generated for the target query field, and the target record information is used to indicate that the message information authorization verification fails.

4. A method for verifying the authorization of a domain name system, applied to a recursive server, characterized in that: The method comprises: In response to a domain name system authorization verification instruction, sending a message information with a target query field to an authoritative server, wherein the target query field is used to query record information in a target zone; Receiving response message information corresponding to the message information, wherein the response message information includes record information corresponding to the target query field; The result of the authorization verification is determined according to the recorded information.

5. The method for verifying the domain name system authorization according to claim 4, characterized in that: The determining the result of the authorization verification according to the record information includes: Comparing the recorded information with pre-stored server information to obtain a comparison result; If the comparison result indicates that the comparison is consistent, then it is confirmed that the authorization information is correct; If the comparison result indicates that the comparison is inconsistent, the server information is updated according to the comparison result.

6. The method for verifying the domain name system authorization according to claim 4, characterized in that: The method further comprises: If the response message information does not include the record information corresponding to the target query field, no authorization verification is performed.

7. A domain name system authorization verification device, characterized in that: include: A first acquisition module, used to acquire message information with a target query field, and generate response message information based on the message information; A query module, used to query the record information corresponding to the target query field in the target area according to the target query field and pre-stored authorization information; The first sending module is used to add the record information to the response message information, and send the added response message information to the recursive server.

8. A domain name system authorization verification device, characterized in that: include: A second sending module, configured to send a message with a target query field to an authoritative server in response to an instruction of a domain name system authorization verification; A second receiving module, used to receive response message information corresponding to the message information, wherein the response message information includes record information corresponding to the target query field; A processing module is used to determine the result of the authorization verification according to the record information.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the domain name system authorization verification method as described in any one of claims 1 to 3 or 4 to 6 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for verifying the authorization of the domain name system as claimed in any one of claims 1 to 3 or 4 to 6 is implemented.

Images