Network access request processing method and device, electronic equipment and storage medium

Abstract

The invention relates to the field of data request processing, and discloses a network access request processing method, which comprises the following steps of: calculating first response time of domain name resolution of an access request by a client, calculating second response time of domain name resolution of the access request by a second server, and when the first response time is less than or equal to the second response time, executing the domain name resolution on the access request by the second server; and triggering the client to execute domain name resolution on the access request to obtain a first IP address, requesting data from the first server based on the first IP address, when the first response time is greater than the second response time, sending the access request to the second server, receiving a second IP address returned by the second server for resolving the access request, and executing a domain name anti-checking operation, and requesting data from the first server based on the second IP address when judging that the domain name reverse checking result meets a preset standard. According to the invention, the security and response timeliness of the network access request can be ensured.

Description

Technical Field

[0001] The present invention relates to the field of data request processing, and in particular to a method, device, electronic device and storage medium for processing a network access request. Background Art

[0002] DNS (Domain Name System, DNS) server maps domain names to IP addresses, allowing people to easily access the Internet. For example, when a user accesses the URL of the first server (such as www.example.com) from a client, the IP address behind www.example.com (such as 192.168.1.1) is actually found through the DNS server, thereby enabling the client to access the target service.

[0003] Normally, when a user enters a URL in a browser or application, the client sends a domain name resolution request to the DNS server. After receiving the domain name resolution request, the DNS server looks up the IP address corresponding to the domain name and returns it to the client in a response message.

[0004] In actual applications, the DNS server may be attacked by a network and return an incorrect IP address to the client, causing the client to be attacked by phishing or domain name hijacking. Alternatively, due to reasons such as DNS server overload and network congestion, it takes too long to resolve the domain name, causing delays or even failures when users access the website.

[0005] Therefore, how to ensure the security and efficiency of network requests is a technical problem that needs to be solved urgently. Summary of the invention

[0006] In view of the above, it is necessary to provide a method for processing a network access request, the purpose of which is to ensure the security and response timeliness of the network access request.

[0007] The method for processing a network access request provided by the present invention comprises:

[0008] When monitoring that the client sends an access request to the first server, calculating a first response time required for the client to perform domain name resolution on the access request;

[0009] Determine a second server according to the domain name of the first server, and calculate a second response time required for the second server to perform domain name resolution on the access request;

[0010] Comparing the first response time with the second response time, when the first response time is less than or equal to the second response time, triggering the client to perform domain name resolution on the access request to obtain a first IP address, and requesting data from the first server based on the first IP address;

[0011] When the first response time is greater than the second response time, the access request is sent to the second server, the second IP address returned by the second server after parsing the access request is received, a reverse domain name lookup operation is performed on the second IP address, and when it is determined that the reverse domain name lookup result meets a preset standard, data is requested from the first server based on the second IP address.

[0012] Optionally, before calculating the first response time required for the client to perform domain name resolution on the access request, the method further includes:

[0013] Obtain a preset number of domain names, and obtain the IP addresses corresponding to the domain names;

[0014] A domain name-IP mapping table is generated according to the mapping relationship between the domain name and the IP address corresponding to the domain name.

[0015] Optionally, calculating a first response time required for the client to perform domain name resolution on the access request includes:

[0016] Acquire a first parameter associated with the first response time, where the first parameter includes at least one of available memory, coordinate position, and network type of the client;

[0017] A first response time of the client performing domain name resolution on the access request is calculated according to the first parameter.

[0018] Optionally, calculating a second response time required for the second server to perform domain name resolution on the access request includes:

[0019] Acquire a second parameter associated with the second response time, where the second parameter includes at least one of load information, cache information, and network delay information of the second server;

[0020] A second response time of the second server performing domain name resolution on the access request is calculated according to the second parameter.

[0021] Optionally, the method further includes:

[0022] According to the coordinate position of the client, a preset number of servers whose physical distances to the client are less than a threshold are acquired;

[0023] Calculate the initial response time required for each server to perform domain name resolution on the access request;

[0024] The server corresponding to the initial response time with the smallest value is selected as the second server.

[0025] Optionally, triggering the client to perform domain name resolution on the access request to obtain a first IP address includes:

[0026] Extract the first domain name in the access request, input the first domain name into the domain name resolution component of the client, and obtain the first IP address corresponding to the first domain name from the domain name-IP mapping table of the domain name resolution component.

[0027] Optionally, performing a reverse domain name lookup operation on the second IP address includes:

[0028] Requesting the second server for a reverse lookup record corresponding to the second IP address;

[0029] Receiving the reverse lookup record corresponding to the second IP address returned by the second server, parsing the reverse lookup record, and obtaining a second domain name corresponding to the second IP address;

[0030] Extracting a first domain name in the access request, and comparing the first domain name with the second domain name;

[0031] If the first domain name is consistent with the second domain name, it is determined that the reverse domain name lookup result of the second IP address meets a preset standard.

[0032] In order to solve the above problem, the present invention further provides a device for processing a network access request, the device comprising:

[0033] A first calculation module is used to calculate a first response time required for the client to perform domain name resolution on the access request when monitoring that the client sends an access request to the first server;

[0034] A second calculation module, configured to determine a second server according to the domain name of the first server, and calculate a second response time required for the second server to perform domain name resolution on the access request;

[0035] a first resolution calculation module, configured to compare the first response time with the second response time, and when the first response time is less than or equal to the second response time, trigger the client to perform domain name resolution on the access request to obtain a first IP address, and request data from the first server based on the first IP address;

[0036] The second resolution and calculation module is used to send the access request to the second server when the first response time is greater than the second response time, receive the second IP address returned by the second server after resolving the access request, perform a reverse domain name lookup operation on the second IP address, and request data from the first server based on the second IP address when it is determined that the reverse domain name lookup result meets a preset standard.

[0037] In order to solve the above problem, the present invention further provides an electronic device, the electronic device comprising:

[0038] at least one processor; and,

[0039] a memory communicatively connected to the at least one processor; wherein,

[0040] The memory stores a network access request processing program that can be executed by the at least one processor, and the network access request processing program is executed by the at least one processor so that the at least one processor can execute the above-mentioned network access request processing method.

[0041] In order to solve the above problems, the present invention also provides a computer-readable storage medium, on which a network access request processing program is stored. The network access request processing program can be executed by one or more processors to implement the above network access request processing method.

[0042] Compared with the prior art, the present invention calculates a first response time required for the client to perform domain name resolution on the access request and a second response time required for the second server to perform domain name resolution on the access request when monitoring the client to send an access request to the first server;

[0043] When the first response time is less than or equal to the second response time, it means that the client is at least as fast as the external second server, or can resolve the domain name address of the access request faster. The first domain name used by the client to resolve the access request is used first to improve the response speed and reduce the dependence on the external second server, thereby avoiding domain name hijacking incidents.

[0044] When the first response time is greater than the second response time, it means that the client's response time is longer than that of the second server. Sending the access request to the second server for resolution can improve the response speed. By performing a reverse domain name lookup operation on the second IP address returned by the second server, the problem of the client being attacked by phishing or domain name hijacking can be effectively solved.

[0045] The present invention selects the best resolution method from a variety of resolution methods, thereby improving the processing efficiency of network requests, and configures a corresponding strategy for each resolution method to resolve phishing attacks on the client or domain name hijacking incidents, thereby ensuring data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A flowchart of a method for processing a network access request provided by an embodiment of the present invention;

[0047] Figure 2 A schematic diagram of a module of a device for processing a network access request provided by an embodiment of the present invention;

[0048] Figure 3 A schematic diagram of the structure of an electronic device for implementing a method for processing a network access request provided by an embodiment of the present invention;

[0049] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings in conjunction with the embodiments. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical scheme and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0051] It should be noted that the descriptions of "first", "second", etc. in the present invention are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0052] Reference Figure 1 FIG. 1 is a flow chart of a method for processing a network access request provided by an embodiment of the present invention. The method is executed by an electronic device.

[0053] In this embodiment, the method for processing a network access request includes:

[0054] S1. When monitoring that a client sends an access request to a first server, calculating a first response time required for the client to perform domain name resolution on the access request;

[0055] In this embodiment, when the access request monitoring module installed on the client monitors the user entering the URL of the first server in the browser or application of the client, a first parameter that affects the first response time is obtained, and the first parameter includes at least one of the client's available memory, coordinate position, and network type. The first response time required for the client's built-in domain name resolution component to perform domain name resolution on the access request is calculated based on the first parameter.

[0056] The client includes but is not limited to computers, mobile phones and tablet computers. The first server refers to the server that the user enters the URL to access. For example, the user enters the URL (such as www.example.com), which is the server that the user wants to access.

[0057] Domain name resolution refers to resolving the first domain name of an access request (eg, www.example.com) into its IP address (eg, 192.168.1.1).

[0058] The first response time refers to the amount of time it takes for a client to complete the first domain name resolution process for an access request. The first response time is affected by many factors, including the client's performance (such as processor speed, memory), the client's current network status (such as bandwidth, latency), and whether the client has cached the relevant DNS records.

[0059] In order to further illustrate the implementation of the present invention, the entire text is described with Example H, which is not intended to limit the present invention in any way:

[0060] In Example H, when user A attempts to access the loan application page of financial platform B (e.g., www.example.com) on the client, the simulation calculates the first response time (e.g., the first response time is 0.3 seconds) required for the client's built-in domain name resolution component to resolve the first domain name (e.g., 192.168.1.1) of the access request.

[0061] In one embodiment, before calculating the first response time required for the client to perform domain name resolution on the access request, the method further includes:

[0062] Obtain a preset number of domain names, and obtain the IP addresses corresponding to the domain names;

[0063] A domain name-IP mapping table is generated according to the mapping relationship between the domain name and the IP address corresponding to the domain name.

[0064] A preset number (eg, 10,000) of common domain names or predefined domain names are obtained. These domain names can be selected based on user usage frequency, importance, or user customization. The present invention does not impose any limitation on the method of obtaining domain names.

[0065] For each domain name, its current valid IP address needs to be obtained, and a domain name-IP mapping table is created according to each domain name and the IP address corresponding to each domain name. The preset calling function and the domain name-IP mapping table are encapsulated to obtain a domain name resolution component. The calling function can then be used to quickly query the mapping relationship between each domain name in the domain name-IP mapping table and the IP address corresponding to each domain name, and obtain the first domain name of the access request.

[0066] The domain name resolution component is responsible for converting the domain name corresponding to the access request into an IP address and is an IP toolkit with domain name resolution function.

[0067] The domain name resolution component is built into the client as an IP toolkit. By storing the mapping relationship between commonly used domain names and their IP addresses, the domain name can be quickly resolved without relying on an external second server, and the first server can be accessed normally, reducing the risk of IP address hijacking, thereby improving the response speed and security of the client's network requests.

[0068] The updating and maintenance of the domain name resolution component can be performed by the developers of the first server, thereby ensuring that the first IP address corresponding to the access request is not tampered with externally, or it can be maintained by a third platform with a high security level, thereby also ensuring that the first IP address corresponding to the access request is not tampered with externally.

[0069] In other embodiments, in order to maintain the accuracy of the domain name resolution component's resolution, the updated information of each domain name in the domain name-IP mapping table and the IP address corresponding to each domain name is periodically obtained through an automatic update mechanism or a manual update strategy, and the domain name resolution component is regularly updated to ensure the stability and accuracy of the domain name resolution component.

[0070] The specific location and method of installing the domain name resolution component on the client will vary depending on the type of device (such as PC, smartphone, router, etc.) and operating system (such as Windows, macOS, Linux, Android, iOS, etc.) (for example, it can be C:\ProgramFiles\ in Windows and / usr / local / bin / in Linux). Regardless of the device on which the domain name resolution component is installed, compatibility, security, and performance impacts must be considered.

[0071] In one embodiment, before calculating the first response time required for the client to perform domain name resolution on the access request, the method further includes:

[0072] Obtain a first API interface of a DNS resolver built into an operating system corresponding to the client;

[0073] The preset security domain name filtering table is loaded into the DNS resolver through the first API interface, and the loaded DNS resolver is encapsulated to obtain the domain name resolution component.

[0074] The present invention provides another method for obtaining a domain name resolution component, obtaining a first API interface of a DNS resolver built into an operating system corresponding to a client, loading a secure domain name filter table into a resolution process of the DNS resolver through the first API interface, and encapsulating the DNS resolver after loading the secure domain name filter table into a domain name resolution component.

[0075] The safe domain name filter table is a blacklist containing known malicious sites or untrusted domain names, or a whitelist that only allows access. In order to ensure the effectiveness of the safe domain name filter table, the safe domain name filter table needs to be updated regularly.

[0076] Combining the resolution mechanism of the underlying DNS resolver of the operating system with the filtering logic of the custom secure domain name filter table can reduce the workload of collecting common domain names or predefined domain names, and ensure the richness of IP addresses. The repackaged DNS resolver is used by the client. The domain name resolution component is equivalent to having the same resolution function as an external second server. At the same time, the secure domain name filter table can enhance the network security of the client, prevent access to malicious websites and reduce the risk of IP address hijacking.

[0077] In one embodiment, the method further comprises:

[0078] Obtaining at least one authentication certificate of the first server and verifying the validity of the authentication certificate;

[0079] If the authentication certificate is valid, the verified authentication certificate is stored in the domain name resolution component.

[0080] Obtain an SSL / TLS certificate from the first server or from a trusted certificate authority (CA), use the obtained SSL / TLS certificate as an authentication certificate, and verify the validity of the authentication certificate, including checking whether it is expired, whether it is issued by a trusted CA, and whether the public key hash value matches.

[0081] Obtain the public key, signature algorithm, validity period, issuer and other certificate data of the authentication certificate after successful verification, and store the above certificate data in the domain name resolution component.

[0082] When the domain name resolution component is used for domain name resolution, if the domain name of the access request is associated with a stored authentication certificate, the domain name resolution component can immediately provide certificate information without obtaining it from the first server, thereby accelerating the TLS handshake process and ensuring the security of the connection between the client and the first server.

[0083] In other embodiments, the certificate information in the domain name resolution component is updated regularly through an automatic update mechanism or a manual update strategy, thereby ensuring the stability and security of the domain name resolution component.

[0084] In one embodiment, calculating the first response time required for the client to perform domain name resolution on the access request includes:

[0085] Acquire a first parameter associated with the first response time, where the first parameter includes at least one of available memory, coordinate position, and network type of the client;

[0086] A first response time of the client performing domain name resolution on the access request is calculated according to the first parameter.

[0087] By obtaining at least one of the client's available memory, coordinate position, and network type as the first parameter, the following effects can be produced:

[0088] 1. Get the available memory of the client. By monitoring the RAM usage on the client, you can understand how much memory the domain name resolution component uses. The more available memory, the better the performance of the domain name resolution component and the faster the resolution speed.

[0089] 2. Get the client's coordinates. The client's location information can help predict the physical distance between the client and the first server, which in turn affects the network delay information. The closer the distance, the lower the network delay information and the shorter the response time.

[0090] 3. Get the client's network type, including the client's network environment, such as Wi-Fi, 4G, 5G, or wired network. Different types of networks have different bandwidths and stability, which directly affect the resolution speed and reliability of the domain name resolution component.

[0091] In other embodiments, the client's CPU usage, disk I / O speed, operating system version, and firewall settings may also be obtained as first parameters associated with the first response time. The present invention may select the most relevant first parameters for separate or combined calculations based on specific scenarios to obtain the first response time, without any limitation.

[0092] In one embodiment, calculating, according to the first parameter, a first response time of the domain name resolution component of the client for performing domain name resolution on the access request includes:

[0093] constructing a first scoring table for evaluating the first response time according to the first parameter;

[0094] The first parameter is input into the first scoring table for scoring, and a first response time of the client parsing the access request is obtained according to the scoring result.

[0095] According to a pre-written first scoring algorithm, the influence of the above first parameters (available memory, coordinate position, network type, etc.) on the resolution speed of the domain name resolution component is calculated to generate a first scoring table.

[0096] The first scoring table includes but is not limited to the following indicators: available memory score, coordinate position score, and network type score.

[0097] According to the importance of each first parameter on the first response time, different weights are assigned to the first scoring table. For example, the network type may have a greater impact on the first response time, so a higher weight is assigned to the network type score.

[0098] According to the first scoring algorithm of the first scoring table, a real-time first parameter is obtained to score the resolution speed of the domain name resolution component to obtain a first response time, which reflects the expected performance of the domain name resolution component under current conditions.

[0099] The first scoring algorithm formula is:

[0100] S1=w1×M+w2×D+w3×N

[0101] Among them, S1 is the first response time, M is the score of the client's available memory, D is the score of the client's coordinate position, N is the score of the client's network type, and w1, w2, and w3 are the weights of M, D, and N respectively.

[0102] By constructing a scoring mechanism for the first scoring table, the first response time required by the client to perform domain name resolution on an access request can be accurately calculated.

[0103] The present invention obtains the first response time in order to determine whether the client should perform domain name resolution by itself or send the resolution task to the second server for domain name resolution. Because different resolution devices have different response times, selecting the fastest device can significantly improve the speed of network access.

[0104] S2. Determine a second server according to the domain name of the first server, and calculate a second response time required for the second server to perform domain name resolution on the access request;

[0105] In this embodiment, a preset DNS server table is queried according to the domain name of the first server, and the DNS server table contains information of multiple DNS servers, including service quality, geographical location, historical performance, etc. According to preset matching criteria (such as geographical location, service quality, security and reliability, and cache strategy, etc.), the DNS server that best processes the domain name of the first server is selected from the DNS server table, thereby determining the second server, and obtaining a log of monitoring the second server (DNS server) or using a performance monitoring tool to obtain a second parameter that affects the second response time, the second parameter including but not limited to the load information, cache information, and network delay information of the second server.

[0106] A second response time required for the second server to resolve the access request is calculated based on the one or more second parameter combinations.

[0107] The second response time refers to the time required for the second server to resolve the domain name of the access request. For example, in the traditional DNS query process, the client will send a domain name resolution request to its configured second server. The second server is responsible for finding and returning the IP address corresponding to the domain name. This search process may involve searching in the local cache, recursively querying other second servers, or obtaining information directly from the authoritative second server. All of these operations take time, and this total time consumption is the "second response time."

[0108] The second server refers to an intermediate server (DNS server) that provides domain name resolution service for the client's access request.

[0109] Continuing with Example H, when user A attempts to access the loan application page of financial platform B (e.g., www.example.com) on the client, the client simulates and calculates the second response time (e.g., the second response time is 0.4 seconds) required for a second server outside the client to resolve the first domain name (e.g., 192.168.1.1) of the access request based on a second parameter that affects the response time of the second server.

[0110] In one embodiment, calculating the second response time required for the second server to perform domain name resolution on the access request includes:

[0111] Acquire a second parameter associated with the second response time, where the second parameter includes at least one of load information, cache information, and network delay information of the second server;

[0112] A second response time of the second server performing domain name resolution on the access request is calculated according to the second parameter.

[0113] In one embodiment, calculating, according to the second parameter, a second response time of the second server performing domain name resolution on the access request includes:

[0114] constructing a second scoring table for evaluating the second response time according to the second parameter;

[0115] The second parameter is input into the second scoring table for scoring, and a second response time of the second server parsing the access request is obtained according to the scoring result.

[0116] Using at least one of the load information, cache information, and network delay information of the second server as the second parameter can produce the following effects:

[0117] Obtain the load information of the second server, including the number of requests currently processed by the second server, queue length, CPU usage, etc. The load information reflects the pressure status of the second server. The higher the load, the longer the second response time is usually.

[0118] Get the cache information of the second server, the number and type of records stored in the cache of the second server, and the freshness of these records. A high hit rate of cache information means that the server can respond to queries faster.

[0119] The network delay information of the second server is obtained. The network delay information directly reflects the communication speed between the client and the second server. The lower the network delay information, the shorter the second response time of the second server.

[0120] In other embodiments, the number of DNS recursive queries of the second server, the hardware configuration of the second server, the software version and optimization of the second server, etc. are obtained as the second parameter associated with the second response time. The present invention can select the most relevant second parameter for separate calculation or combined calculation according to the specific scenario, and no limitation is made to this.

[0121] The influence of the second parameters (load information, cache information, network delay information, etc.) on the resolution speed of the second server is calculated by using a pre-written second scoring algorithm to generate a second scoring table.

[0122] The second scoring table includes but is not limited to the following indicators: load information score, cache information score and network delay information score.

[0123] According to the importance of each second parameter on the second response time, different proportions of weights are allocated on the second scoring table. For example, load information may have a greater impact on the second response time, so a higher weight is assigned to the load information score.

[0124] According to the second scoring algorithm of the second scoring table, a real-time second parameter is obtained to score the parsing speed of the second server to obtain a second response time, which reflects the expected performance of the second server under current conditions.

[0125] The second scoring algorithm formula is:

[0126] S2=w L ×L+W C ×C+W K ×K

[0127] Wherein, S2 is the second response time, L is the score of the load information of the second server, C is the score of the cache information of the second server, K is the score of the network delay information of the second server, and W is the score of the load information of the second server. L , W C , W K are the weights of L, C, and K respectively.

[0128] Each score L, C, K can be calculated as follows:

[0129] For load information L:

[0130] L = f (number of requests, queue length, CPU usage)

[0131] Function f decreases the score value as the number of requests, queue length, and CPU usage increase.

[0132] For cache information C:

[0133] C = g (cache hit rate, record freshness)

[0134] Function g increases the score value as the cache hit rate increases and the record freshness increases.

[0135] For network delay information K

[0136] K = h (average network delay information)

[0137] Function h increases the score value as the average network delay information decreases.

[0138] In order to ensure the validity and accuracy of the second scoring table, the above functions and weights need to be calibrated and adjusted regularly to adapt to changes in the operating environment of the second server and adjustments to the optimization goals.

[0139] In one embodiment, the method further comprises:

[0140] According to the coordinate position of the client, a preset number of servers whose physical distances to the client are less than a threshold are acquired;

[0141] Calculate the initial response time required for each server to perform domain name resolution on the access request;

[0142] The server corresponding to the initial response time with the smallest value is selected as the second server.

[0143] In order to solve the problem of dependence on a single second server and unstable performance of a single second server, the coordinate position of the client is determined through the client's IP address positioning and GPS data, and a preset number (for example, 10) servers are obtained, and the physical distance between these servers and the client (for example, the physical distance between the server and the client is calculated using longitude and latitude coordinates or the great circle distance formula) is less than a threshold (for example, the threshold is 10 kilometers, and the threshold can be set based on the physical distance, and can also be set based on factors such as network coverage and service quality requirements).

[0144] Monitor the load, network delay information and health status of each server to obtain a second parameter affecting the second response time of each server, and calculate the expected initial response time of each server to resolve the access request based on the second parameter.

[0145] The initial response times of all servers are compared, and the server corresponding to the initial response time with the smallest value is selected as the second server.

[0146] By dynamically selecting the optimal second server from multiple servers, the processing efficiency of network requests can be improved.

[0147] In order to solve the problem in the prior art that due to the overload of the second server, network congestion and other reasons, it takes too long to resolve the domain name, causing delays or even failures when users access the website, the present invention adopts the concept of multi-path resolution of the domain name of the access request:

[0148] The first resolution path is to use the domain name resolution component built into the client to resolve the domain name of the access request.

[0149] The second resolution path utilizes a second server outside the client to resolve the domain name of the access request.

[0150] The third resolution path is to select the best second server from multiple servers to resolve the domain name of the access request.

[0151] In order to determine which resolution path among the first to third resolution paths is more suitable for resolving access requests, it is necessary to perform simulation calculations on the first to third resolution paths, so as to obtain the most suitable method for resolving access requests, thereby improving the processing efficiency of network requests.

[0152] S3. Compare the first response time with the second response time. When the first response time is less than or equal to the second response time, trigger the client to perform domain name resolution on the access request to obtain a first IP address, and request data from the first server based on the first IP address.

[0153] In this embodiment, when the first response time is less than or equal to the second response time, it means that the domain name resolution component of the client is at least as fast as the external second server, or can resolve the domain name address of the access request faster, so that the domain name resolution component is used preferentially to resolve the first domain name of the access request to improve the response speed and reduce the dependence on the external second server, thereby avoiding the occurrence of domain name hijacking incidents.

[0154] When the domain name resolution component is used to resolve the first domain name of the access request, if the first domain name of the access request already exists in the local cache of the domain name resolution component, the IP address of the first domain name is used as the first IP address and sent to the first server to request data.

[0155] For the same domain names frequently accessed by clients, the IP addresses of these same domain names are stored in the local cache of the domain name resolution component, thereby improving the speed of subsequent requests.

[0156] If the first domain name of the access request does not exist in the local cache of the domain name resolution component, a query is performed from the domain name-IP mapping table of the domain name resolution component to obtain the first IP address.

[0157] In other embodiments, there may be extreme cases where the access request is directly sent to the second server for resolution if the first IP address is not obtained by querying the domain name-IP mapping table of the domain name resolution component.

[0158] The client can use its built-in domain name resolution component to quickly respond to user access requests, and the domain name resolution component is maintained by the developer of the first server or a third platform with a high security level, reducing dependence on the external second server and possibly avoiding potential delays and security risks in the DNS query process.

[0159] Continuing with Example H, if the first response time is 0.3 seconds and the second response time is 0.4 seconds, it means that the domain name resolution component of the client can resolve the domain name address of the access request more quickly, and thus the domain name resolution component is used preferentially to resolve the first domain name www.example.com of the access request, and the first IP address is 192.168.1.1, and the first IP address is sent to the first server to request data.

[0160] In one embodiment, triggering the client to perform domain name resolution on the access request to obtain the first IP address includes:

[0161] Extract the first domain name in the access request, input the first domain name into the domain name resolution component of the client, and obtain the first IP address corresponding to the first domain name from the domain name-IP mapping table of the domain name resolution component.

[0162] When determining to use the domain name resolution component to resolve the client's access request, the domain name resolution component first queries the local cache whether there is a first domain name of the access request. If so, the IP address of the first domain name is used as the first IP address and sent to the first server to request data.

[0163] If the first domain name of the access request does not exist in the local cache, the domain name-IP mapping table inside the domain name resolution component is queried. If the record of the first domain name is found in the domain name-IP mapping table, the IP address of the first domain name is used as the first IP address and sent to the first server to request data.

[0164] In one embodiment, triggering the client to perform domain name resolution on the access request to obtain the first IP address includes:

[0165] Obtaining a first domain name of the access request, calling a first API interface of the DNS resolver using a preset resolution calling function, inputting the first domain name into the DNS resolver for query, and obtaining an initial IP address;

[0166] It is determined whether the secure domain name filtering table stores an IP address identical to the initial IP address; if so, the initial IP address is used as the first IP address.

[0167] The present invention provides another method for obtaining the first IP address. When the domain name resolution component is used to resolve the access request of the client, the first domain name in the access request is input into the DNS resolver to request resolution of the IP address corresponding to the first domain name. After the DNS resolver successfully resolves the first domain name, an initial IP address is returned.

[0168] The secure domain name filter table is a preset list configured by the system administrator, which contains domain names or IP addresses that are considered secure and is used to prevent external access to modify or replace the initial IP address.

[0169] If the initial IP address exists in the secure domain name filtering table, indicating that the target of the access request is secure or permitted, the initial IP address will be used as the first IP address corresponding to the first domain name to request data from the first server.

[0170] By introducing the check of the secure domain name filter table, an extra layer of security is added to prevent clients from accessing malicious websites or being spoofed by DNS.

[0171] In one embodiment, the method further comprises:

[0172] The first IP address is combined with the verified authentication certificate and sent to the first server to request data.

[0173] The first IP address is combined with the verified authentication certificate and sent to the first server without obtaining an SSL / TLS certificate from the first server, thereby speeding up the TLS handshake process and ensuring the security of the connection between the client and the first server.

[0174] S4. When the first response time is greater than the second response time, the access request is sent to the second server, a second IP address returned by the second server after parsing the access request is received, a reverse domain name lookup operation is performed on the second IP address, and when it is determined that the reverse domain name lookup result meets a preset standard, data is requested from the first server based on the second IP address.

[0175] In this embodiment, when the first response time is greater than the second response time, it indicates that the expected response time for the domain name resolution component to resolve the domain name is longer than the expected response time for resolution through the second server. To improve efficiency, the access request is sent to the second server for resolution.

[0176] After receiving the query of the access request, the second server will query whether there is a first domain name of the access request in its cache. If so, the second server will construct a DNS response packet including the second IP address corresponding to the first domain name of the access request, and return the DNS response packet to the client.

[0177] If not, the current second server will recursively query other second servers until the second IP address corresponding to the first domain name of the access request is found.

[0178] After the client receives the second IP address, it performs a reverse DNS query on the second IP address to obtain the second domain name of the second IP address. If the second domain name of the reverse domain name query result is consistent with the first domain name of the initial access request, it is considered that the second IP address meets the preset standards and there is no problem of domain name hijacking. Finally, the second IP address is sent to the first server to request data.

[0179] By performing a reverse domain name lookup operation on the second IP address, the problem of domain name hijacking easily occurring on the client when using an external second server can be solved. Thus, the use of an external second server can also improve the security and efficiency of the client's network request.

[0180] Continuing with Example H, if the first response time is 0.5 seconds and the second response time is 0.4 seconds, it means that the second server can resolve the domain name address of the access request faster, so the second server is used preferentially to resolve the first domain name www.example.com of the access request, and the second IP address obtained is 192.168.1.1. A reverse domain name lookup operation is performed on the second IP address. If the second domain name obtained by the reverse domain name lookup is also www.example.com, it means that the second IP address has not been hijacked, and data is requested from the first server based on the second IP address.

[0181] In one embodiment, performing a reverse domain name lookup operation on the second IP address includes:

[0182] Requesting the second server for a reverse lookup record corresponding to the second IP address;

[0183] Receiving the reverse lookup record corresponding to the second IP address returned by the second server, parsing the reverse lookup record, and obtaining a second domain name corresponding to the second IP address;

[0184] Extracting a first domain name in the access request, and comparing the first domain name with the second domain name;

[0185] If the first domain name is consistent with the second domain name, it is determined that the reverse domain name lookup result of the second IP address meets a preset standard.

[0186] In order to prevent domain name hijacking, a reverse lookup domain name operation is performed on the second IP address, a reverse lookup type DNS query request is constructed using the second IP address, and the constructed reverse lookup query is sent to the second server to request a reverse lookup record related to the second IP address. A reverse lookup record (Pointer Record, PTR record) is a type of DNS record that is used to map an IP address back to a domain name, and whether it is relatively consistent with the first domain name of the forward query access request.

[0187] After receiving the reverse query, the second server will search for the reverse query record corresponding to the IP address of the query request. If there is a reverse query record, the second server will include it in the response and return it to the client.

[0188] After receiving the response from the second server, the client parses the content of the reverse lookup record, extracts the second domain name associated with the second IP address, and compares the first domain name (the domain name originally requested to access) with the second domain name parsed from the reverse lookup record (the domain name obtained by reverse query).

[0189] If the first domain name is exactly the same as the second domain name, this indicates that the second IP address does point to the first server that the client wants to access, so the reverse domain name query result meets the preset standard.

[0190] If the first domain name is inconsistent with the second domain name, this indicates that the second IP address has been hijacked, and therefore the reverse domain name query result does not meet the preset standard, and the domain name resolution component of the client re-parses the access request.

[0191] By performing a reverse domain name lookup operation on the second IP address, it can be ensured that the second IP address points to a reliable server that matches the initial request, so that the second IP address can be safely used to establish a connection with the first server and initiate a data request.

[0192] In one embodiment, performing a reverse domain name lookup operation on the second IP address includes:

[0193] Obtaining API interface information of the second server, and constructing a reverse domain name query function according to the API interface information;

[0194] Querying the second domain name corresponding to the second IP address from the database of the second server using the reverse domain name lookup function;

[0195] comparing the first domain name corresponding to the access request with the second domain name;

[0196] If the first domain name is consistent with the second domain name, it is determined that the reverse domain name lookup result of the second IP address meets a preset standard.

[0197] The present invention also provides another method for reverse domain name query operation, which obtains the API interface information of the second server, and constructs a reverse domain name query function according to the API interface information. The reverse domain name query function can call all logics of the second server API.

[0198] By calling the reverse domain name query function, passing in the second IP address as a parameter, executing the reverse domain name query function to send a request to the API interface of the second server, requesting to obtain the reverse query record related to the second IP address, the efficiency of obtaining the reverse query record can be improved.

[0199] After receiving the response from the second server, the reverse lookup record in the response is parsed to extract the second domain name.

[0200] Compare the first domain name (the domain name originally requested for access) with the second domain name resolved from the reverse lookup record (the domain name obtained by reverse lookup).

[0201] If the first domain name is exactly the same as the second domain name, this indicates that the second IP address does point to the first server that the client wants to access, so the reverse domain name query result meets the preset standard.

[0202] The present invention intelligently determines whether to directly use the domain name resolution component to perform domain name resolution or to perform it through a second server to achieve optimal response time and security, thereby improving the processing efficiency of network requests.

[0203] In summary, when the present invention monitors that a client sends an access request to a first server, it calculates a first response time required for the client to perform domain name resolution on the access request, and calculates a second response time required for the second server to perform domain name resolution on the access request;

[0204] When the first response time is less than or equal to the second response time, it means that the domain name resolution component of the local client is at least as fast as the external second server, or can resolve the domain name address of the access request faster. The domain name resolution component is used preferentially to resolve the first domain name of the access request to improve the response speed and reduce the dependence on the external second server. Since the local domain name resolution component is not accessed externally, domain name hijacking incidents can also be avoided.

[0205] When the first response time is greater than the second response time, it means that the domain name resolution component takes a longer time to resolve the domain name than the second server. Sending the access request to the second server for resolution can improve the response speed. By performing a reverse domain name lookup operation on the second IP address returned by the second server, the problem of the client being attacked by phishing or domain name hijacking can be effectively solved.

[0206] The present invention selects the best resolution method from a variety of resolution methods, thereby improving the processing efficiency of network requests, and configures a corresponding strategy for each resolution method to resolve phishing attacks on the client or domain name hijacking incidents, thereby ensuring data security.

[0207] like Figure 2 , which is a module diagram of a device for processing a network access request provided by an embodiment of the present invention.

[0208] The network access request processing device 100 of the present invention can be installed in an electronic device. According to the functions to be implemented, the network access request processing device 100 may include a first calculation module 110, a second calculation module 120, a first analysis module 130 and a second analysis module 140. The module of the present invention can also be called a unit, which refers to a series of computer program segments that can be executed by an electronic device processor and can complete fixed functions, which are stored in the memory of the electronic device.

[0209] In this embodiment, the functions of each module / unit are as follows:

[0210] The first calculation module 110 is used to calculate a first response time required for the client to perform domain name resolution on the access request when monitoring that the client sends an access request to the first server;

[0211] A second calculation module 120, configured to determine a second server according to the domain name of the first server, and calculate a second response time required for the second server to perform domain name resolution on the access request;

[0212] A first resolution calculation module 130, configured to compare the first response time with the second response time, and when the first response time is less than or equal to the second response time, trigger the client to perform domain name resolution on the access request to obtain a first IP address, and request data from the first server based on the first IP address;

[0213] The second resolution and calculation module 140 is used to send the access request to the second server when the first response time is greater than the second response time, receive the second IP address returned by the second server after resolving the access request, perform a reverse domain name lookup operation on the second IP address, and request data from the first server based on the second IP address when it is determined that the reverse domain name lookup result meets a preset standard.

[0214] In one embodiment, before calculating the first response time required for the client to perform domain name resolution on the access request, the method further includes:

[0215] Obtain a preset number of domain names, and obtain the IP addresses corresponding to the domain names;

[0216] A domain name-IP mapping table is generated according to the mapping relationship between the domain name and the IP address corresponding to the domain name.

[0217] In one embodiment, calculating the first response time required for the client to perform domain name resolution on the access request includes:

[0218] Acquire a first parameter associated with the first response time, where the first parameter includes at least one of available memory, coordinate position, and network type of the client;

[0219] A first response time of the client performing domain name resolution on the access request is calculated according to the first parameter.

[0220] In one embodiment, calculating the second response time required for the second server to perform domain name resolution on the access request includes:

[0221] Acquire a second parameter associated with the second response time, where the second parameter includes at least one of load information, cache information, and network delay information of the second server;

[0222] A second response time of the second server performing domain name resolution on the access request is calculated according to the second parameter.

[0223] In one embodiment, the method further comprises:

[0224] According to the coordinate position of the client, a preset number of servers whose physical distances to the client are less than a threshold are acquired;

[0225] Calculate the initial response time required for each server to perform domain name resolution on the access request;

[0226] The server corresponding to the initial response time with the smallest value is selected as the second server.

[0227] In one embodiment, triggering the client to perform domain name resolution on the access request to obtain the first IP address includes:

[0228] Extract the first domain name in the access request, input the first domain name into the domain name resolution component of the client, and obtain the first IP address corresponding to the first domain name from the domain name-IP mapping table of the domain name resolution component.

[0229] In one embodiment, performing a reverse domain name lookup operation on the second IP address includes:

[0230] Requesting the second server for a reverse lookup record corresponding to the second IP address;

[0231] Receiving the reverse lookup record corresponding to the second IP address returned by the second server, parsing the reverse lookup record, and obtaining a second domain name corresponding to the second IP address;

[0232] Extracting a first domain name in the access request, and comparing the first domain name with the second domain name;

[0233] If the first domain name is consistent with the second domain name, it is determined that the reverse domain name lookup result of the second IP address meets a preset standard.

[0234] like Figure 3 , which is a schematic diagram of the structure of an electronic device for implementing a method for processing a network access request provided by an embodiment of the present invention.

[0235] In this embodiment, the electronic device 1 includes, but is not limited to, a memory 11, a processor 12, and a network interface 13, which can be interconnected and communicated via a system bus. The memory 11 stores a network access request processing program 10, and the network access request processing program 10 can be executed by the processor 12. Figure 3 Only the electronic device 1 having components 11-13 and a processing program 10 for network access request is shown. It can be understood by those skilled in the art that Figure 3 The structure shown does not constitute a limitation on the electronic device 1 , and may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0236] The memory 11 includes a memory and at least one type of readable storage medium. The memory provides a cache for the operation of the electronic device 1; the readable storage medium may be a non-volatile storage medium such as a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., SD or DX memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a disk, an optical disk, etc. In some embodiments, the readable storage medium may be an internal storage unit of the electronic device 1; in other embodiments, the non-volatile storage medium may also be an external storage device of the electronic device 1, such as a plug-in hard disk, a smart memory card (SmartMediaCard, SMC), a secure digital (SecureDigital, SD) card, a flash card (FlashCard), etc. equipped on the electronic device 1. In this embodiment, the readable storage medium of the memory 11 is generally used to store the operating system and various application software installed on the electronic device 1, such as storing the code of the processing program 10 of the network access request in one embodiment of the present invention, etc. In addition, the memory 11 may also be used to temporarily store various types of data that have been output or are to be output.

[0237] In some embodiments, the processor 12 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips. The processor 12 is generally used to control the overall operation of the electronic device 1, such as performing control and processing related to data interaction or communication with other devices. In this embodiment, the processor 12 is used to run the program code stored in the memory 11 or process data, such as running the processing program 10 for network access requests.

[0238] The network interface 13 may include a wireless network interface or a wired network interface, and the network interface 13 is used to establish a communication connection between the electronic device 1 and a terminal (not shown in the figure).

[0239] Optionally, the electronic device 1 may further include a user interface, which may include a display (Display), an input unit such as a keyboard (Keyboard), and the optional user interface may also include a standard wired interface and a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, and an OLED (Organic Light-Emitting Diode) touch device, etc. Among them, the display may also be appropriately referred to as a display screen or a display unit, which is used to display information processed in the electronic device 1 and to display a visual user interface.

[0240] It should be understood that the embodiment is for illustration only and the scope of the patent application is not limited to this structure.

[0241] The network access request processing program 10 stored in the memory 11 of the electronic device 1 is a combination of multiple instructions. When running in the processor 12, it can achieve:

[0242] When monitoring that the client sends an access request to the first server, calculating a first response time required for the client to perform domain name resolution on the access request;

[0243] Determine a second server according to the domain name of the first server, and calculate a second response time required for the second server to perform domain name resolution on the access request;

[0244] Comparing the first response time with the second response time, when the first response time is less than or equal to the second response time, triggering the client to perform domain name resolution on the access request to obtain a first IP address, and requesting data from the first server based on the first IP address;

[0245] When the first response time is greater than the second response time, the access request is sent to the second server, the second IP address returned by the second server after parsing the access request is received, a reverse domain name lookup operation is performed on the second IP address, and when it is determined that the reverse domain name lookup result meets a preset standard, data is requested from the first server based on the second IP address.

[0246] Specifically, the specific implementation method of the processor 12 for the processing program 10 of the network access request can be referred to Figure 1 The description of the relevant steps in the corresponding embodiments will not be repeated here.

[0247] Furthermore, if the module / unit integrated in the electronic device 1 is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. The computer-readable medium can be non-volatile or non-volatile. The computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, and a read-only memory (ROM).

[0248] The computer-readable storage medium stores a network access request processing program 10, which can be executed by one or more processors. The specific implementation method of the computer-readable storage medium of the present invention is basically the same as the various embodiments of the above-mentioned network access request processing method, and will not be repeated here.

[0249] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the modules is only a logical function division, and there may be other division methods in actual implementation.

[0250] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0251] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional modules.

[0252] It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0253] Therefore, no matter from which point of view, the embodiments should be regarded as illustrative and non-restrictive, and the scope of the present invention is limited by the appended claims rather than the above description, so it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention. Any attached figure mark in the claims should not be regarded as limiting the claims involved.

[0254] In addition, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in the system claim can also be implemented by one unit or device through software or hardware. The second and other words are used to indicate names, but not to indicate any particular order.

[0255] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention.

Claims

1. A method for processing a network access request, characterized in that: The method comprises: When monitoring that the client sends an access request to the first server, calculating a first response time required for the client to perform domain name resolution on the access request; Determine a second server according to the domain name of the first server, and calculate a second response time required for the second server to perform domain name resolution on the access request; Comparing the first response time with the second response time, when the first response time is less than or equal to the second response time, triggering the client to perform domain name resolution on the access request to obtain a first IP address, and requesting data from the first server based on the first IP address; When the first response time is greater than the second response time, the access request is sent to the second server, the second IP address returned by the second server after parsing the access request is received, a reverse domain name lookup operation is performed on the second IP address, and when it is determined that the reverse domain name lookup result meets a preset standard, data is requested from the first server based on the second IP address.

2. The method for processing a network access request according to claim 1, wherein: Before calculating the first response time required for the client to perform domain name resolution on the access request, the method further includes: Obtain a preset number of domain names, and obtain the IP addresses corresponding to the domain names; A domain name-IP mapping table is generated according to the mapping relationship between the domain name and the IP address corresponding to the domain name.

3. The method for processing a network access request according to claim 1, wherein: The calculating the first response time required for the client to perform domain name resolution on the access request includes: Acquire a first parameter associated with the first response time, where the first parameter includes at least one of available memory, coordinate position, and network type of the client; A first response time of the client performing domain name resolution on the access request is calculated according to the first parameter.

4. The method for processing a network access request according to claim 1, wherein: The calculating a second response time required for the second server to perform domain name resolution on the access request includes: Acquire a second parameter associated with the second response time, where the second parameter includes at least one of load information, cache information, and network delay information of the second server; A second response time of the second server performing domain name resolution on the access request is calculated according to the second parameter.

5. The method for processing a network access request according to claim 1, wherein: The method further comprises: According to the coordinate position of the client, a preset number of servers whose physical distances to the client are less than a threshold are acquired; Calculate the initial response time required for each server to perform domain name resolution on the access request; The server corresponding to the initial response time with the smallest value is selected as the second server.

6. The method for processing a network access request according to claim 2, wherein: The triggering the client to perform domain name resolution on the access request to obtain a first IP address includes: Extract the first domain name in the access request, input the first domain name into the domain name resolution component of the client, and obtain the first IP address corresponding to the first domain name from the domain name-IP mapping table of the domain name resolution component.

7. The method for processing a network access request according to claim 1, wherein: The performing a reverse domain name lookup operation on the second IP address includes: Requesting the second server for a reverse lookup record corresponding to the second IP address; Receiving the reverse lookup record corresponding to the second IP address returned by the second server, parsing the reverse lookup record, and obtaining a second domain name corresponding to the second IP address; Extracting a first domain name in the access request, and comparing the first domain name with the second domain name; If the first domain name is consistent with the second domain name, it is determined that the reverse domain name lookup result of the second IP address meets a preset standard.

8. A network access request processing device, characterized in that: The device comprises: A first calculation module is used to calculate a first response time required for the client to perform domain name resolution on the access request when monitoring that the client sends an access request to the first server; A second calculation module, configured to determine a second server according to the domain name of the first server, and calculate a second response time required for the second server to perform domain name resolution on the access request; a first resolution calculation module, configured to compare the first response time with the second response time, and when the first response time is less than or equal to the second response time, trigger the client to perform domain name resolution on the access request to obtain a first IP address, and request data from the first server based on the first IP address; The second resolution and calculation module is used to send the access request to the second server when the first response time is greater than the second response time, receive the second IP address returned by the second server after resolving the access request, perform a reverse domain name lookup operation on the second IP address, and request data from the first server based on the second IP address when it is determined that the reverse domain name lookup result meets a preset standard.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores a network access request processing program that can be executed by the at least one processor, and the network access request processing program is executed by the at least one processor so that the at least one processor can execute the network access request processing method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a network access request processing program, and the network access request processing program can be executed by one or more processors to implement the network access request processing method according to any one of claims 1 to 7.

Images