Domain name query method and system

Abstract

The invention discloses a domain name query method and system, and the method comprises the steps: enabling a recursive DNS server to forward a domain name query request message to a convergence DNS server for processing after the recursive DNS server receives the domain name query request message when the outlet bandwidth of an authoritative DNS server is congested due to hostile attacks and the like, enabling the convergence DNS server to query the own cache at first, and enabling the convergence DNS server to carry out the processing of the domain name query request message; and if the cache is matched, returning a query result to the recursive DNS server. If the cache is not matched, a DNS query request is initiated to the authoritative DNS through the hidden guarantee channel, and a query result returned by the authoritative DNS is returned to the recursive DNS server, so that the recursive DNS server can return the query result to the recursive DNS server on the basis of convergence of the recursive DNS for further iterative query or directly return the query result to a user; when the authoritative DNS causes exit bandwidth congestion due to malicious attacks and the like, the user can still normally access the authoritative website, and the user experience can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a domain name query method and system. Background Art

[0002] The Domain Name System (DNS) is one of the basic services of the Internet and the foundation of network applications. Its main function is to convert domain names into Internet Protocol (IP) addresses that can be directly recognized by computers to ensure that users can access the correct websites and services. Due to the design of the DNS protocol, technical implementation and architectural vulnerabilities, the DNS system faces multiple threats such as Distributed Denial of Service (DDOS) attacks and cache poisoning.

[0003] At present, when the top-level DNS server or authoritative DNS server is attacked by DDOS, it cannot resolve the domain name, and cannot return the IP address to the requester, which leads to the user being unable to access. Therefore, how to improve the security of the DNS system becomes particularly important. Summary of the invention

[0004] The embodiments of the present application provide a domain name query method and system to solve the problem that a DNS server cannot resolve a domain name when it is attacked by a DDOS.

[0005] In a first aspect, the present application provides a domain name query method, which may include: a recursive DNS server receiving a domain name query request message, wherein the domain name query request message is received when a top-level DNS server or an authoritative DNS server is attacked by a distributed denial of service (DDOS); the recursive DNS server forwards the domain name request message sent to the top-level DNS server or the authoritative DNS server to an aggregation DNS server; the recursive DNS server receives a domain name query result sent by the aggregation DNS server, wherein the domain name query result is obtained by the aggregation DNS server performing a domain name query according to the domain name query request message.

[0006] In a second aspect, the present application also provides a domain name query method, which may include: an aggregation DNS server receives a domain name query request message forwarded by a recursive DNS server and needs to be sent to a top-level DNS server or an authoritative DNS server, wherein the domain name query request message is received when the top-level DNS server or the authoritative DNS server suffers a distributed denial of service (DDOS) attack; the aggregation DNS server performs a domain name query according to the domain name query request message to obtain a domain name query result; the aggregation DNS server sends the domain name query result to the recursive DNS server.

[0007] In a third aspect, the present application further provides a domain name query method. Specifically, the method can be applied to a system including a recursive domain name system DNS server and an aggregation DNS server. The method includes:

[0008] The recursive DNS server receives a domain name query request message, and forwards the domain name query message sent to the top-level DNS server or the authoritative DNS server to the convergent DNS server, wherein the domain name query request message is received when the top-level DNS server or the authoritative DNS server suffers from a distributed denial of service (DDOS) attack; the convergent DNS server performs a domain name query according to the domain name query request message to obtain a domain name query result; the convergent DNS server sends the domain name query result to the recursive DNS server.

[0009] In a possible design, the converged DNS server performs a domain name query according to the domain name query request message, including:

[0010] The converged DNS server queries the DNS cache according to the domain name query request, and the DNS cache includes the correspondence between the domain names and Internet Protocol IP addresses that have been queried within a set time period.

[0011] In a possible design, the converged DNS server performs a domain name query according to the domain name query request message, including:

[0012] If it is determined that the converged DNS server has not found the domain name in the DNS cache according to the domain name query request, a domain name query is performed in a pre-configured record, wherein the pre-configured record includes the correspondence between the domain name and the IP address of the root server of the converged DNS server.

[0013] In one possible design, the method further includes:

[0014] The converged DNS server sends a domain name query request message to the top-level DNS server or the authoritative DNS server through the emergency guarantee tunnel.

[0015] In one possible design, the method further includes:

[0016] The converged DNS server refreshes the data in the DNS cache.

[0017] In a possible design, the converged DNS server refreshes the domain name in the DNS cache, including:

[0018] The converged DNS server obtains the domain names in the DNS cache that meet the set conditions within a set time period, and refreshes the domain names that meet the set conditions; wherein the set conditions include: the number of response records of the domain name is greater than a set threshold, and the difference between the last response time of the domain name and the current time is less than the set time difference.

[0019] In a fourth aspect, the present application provides a domain name query system, which may include a recursive DNS server, configured to receive a domain name query request message and send the domain name query request message to a convergent DNS server; the convergent DNS server, configured to perform a domain name query according to the domain name query request message to obtain a domain name query result; the convergent DNS server, further configured to send the domain name query result to the recursive DNS server.

[0020] In a fifth aspect, the present application provides a server, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein:

[0021] The memory stores a computer program that can be executed by at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the above-mentioned first aspect and any possible design method of the first aspect.

[0022] In a sixth aspect, the present application also provides a storage medium. When the computer program in the storage medium is executed by a processor of a server, the server can execute the above-mentioned first aspect and any possible design method of the first aspect.

[0023] In the seventh aspect, the present application also provides a computer program product, which, when running on a server, enables the server to execute the above-mentioned first aspect and any possible design method of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A flow chart of a domain name query method provided in an embodiment of the present application;

[0025] Figure 2 A schematic diagram of establishing an emergency support tunnel provided in an embodiment of the present application;

[0026] Figure 3 A schematic diagram of a different emergency support tunnel provided in an embodiment of the present application;

[0027] Figure 4 A schematic diagram of a defense against DDOS attacks provided in an embodiment of the present application;

[0028] Figure 5 A flowchart of a method for refreshing a domain name provided in an embodiment of the present application;

[0029] Figure 6 A schematic diagram of the structure of a domain name query device provided in an embodiment of the present application;

[0030] Figure 7 A schematic diagram of the structure of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0032] It should be understood that in the description of the embodiments of the present application, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc. can refer to different or identical objects. "At least one" means one or more, and "plurality" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: including the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following items" or similar expressions refer to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0033] Currently, when a top-level DNS server or an authoritative DNS server is attacked by DDOS, the DNS server's strategies for dealing with the attack may include traffic cleaning, load balancing, elastic scaling, etc. However, due to the scale and complexity of DDOS attacks, these strategies have certain limitations for DDOS attacks. For example, when the scale of a DDOS attack is large, even if the network export bandwidth of the top-level DNS server is adjusted, the DDOS attack problem cannot be solved, and the domain name cannot be resolved, making it impossible for users to access it normally.

[0034] In view of this, a domain name query method for DDOS attacks is proposed in an embodiment of the present application. In this method, when a recursive DNS server issues a domain name query request, the domain name query request can be sent to an aggregation DNS server, which performs a domain name query and establishes an emergency tunnel between the aggregation DNS server and the authoritative DNS server or the top-level DNS server. When the authoritative DNS server or the top-level DNS server is attacked by DDOS, the domain name can be directly queried from the aggregation DNS server and the IP address can be returned to the initiator, thereby ensuring normal access of the user and improving the flexibility of responding to DDOS attacks.

[0035] The method of the embodiment of the present application is described in detail below with reference to the flowchart. Figure 1 FIG. 1 is a flow chart of a domain name query method provided in an embodiment of the present application. Specifically, the method may include the following steps:

[0036] S101, a recursive DNS server receives a domain name query request message.

[0037] It should be understood that DNS is a distributed database that manages the mapping between domain names and IP addresses, and a DNS server is a host that provides domain name resolution services to users. In the embodiment of the present application, the DNS server may include a recursive DNS server and a convergent DNS server.

[0038] S102: The convergent DNS server receives a domain name query request message forwarded by the recursive DNS server.

[0039] It should be understood that the converged DNS is a new DNS form proposed in the embodiment of the present application, and the converged DNS is used to provide domain name query services under emergency response. In addition, the converged DNS server can also be called: converged recursive DNS server, etc., which is not limited in the present application.

[0040] In some embodiments, when a top-level DNS server or an authoritative DNS server is attacked by DDOS, if a recursive DNS server receives a domain name query request message, it may forward the domain name query request message to an aggregation DNS server, which then performs a domain name query.

[0041] In the embodiment of the present application, an emergency protection tunnel can be established between the converged DNS server and the top-level DNS server or the authoritative DNS server through SRv6. Figure 2As shown in the figure, the converged DNS server is deployed in the security cleaning center, and an emergency protection tunnel (emergency protection plane) is established between the converged DNS server and the top-level / authoritative DNS server. In a single domain (AS), each domain deploys a tunnel within the domain. The tunnel within the domain can be deployed based on network slicing as needed, and the SRv6 identifier (Segment Routing over IPv6 with Binding SID, SRv6BSID) is released to the outside of the domain in a service-oriented manner. When the converged DNS server detects that the BSID is contained in the message, it can forward the message to the emergency protection tunnel.

[0042] It should be understood that Figure 2 Only three ASs (AS100, AS200, AS300) and BSID1, BSID2, and BSID3 are taken as examples, and the embodiments of the present application are not limited to this.

[0043] In addition, in the embodiment of the present application, the converged DNS server can establish different emergency protection tunnels with multiple top-level domains and authoritative domains. Figure 3 As shown, for example, the converged DNS server can establish different emergency protection tunnels with the ".cn" server and the ".x.cn" server. In other words, the granularity of the protected domain name can be flexibly defined based on different emergency protection tunnels in this application, which can improve flexibility.

[0044] S103, the convergent DNS server determines whether the domain name query request is found in the DNS cache. If the domain name is found, step S104 is continued, and if not, step S105 is continued.

[0045] In some embodiments, the DNS cache may store the correspondence between some of the queried domain names and IP addresses. The information stored in the DNS cache is time-sensitive, for example, the correspondence between the domain names and IP addresses queried within the past month may also be stored. This application does not specifically limit this.

[0046] S104: The recursive DNS server receives a response message sent by the convergent DNS server.

[0047] The response message may include a domain name query result corresponding to the domain name query request.

[0048] When the convergent DNS server finds the information of the domain name in the DNS cache, it can send the query result corresponding to the domain name query request message to the recursive DNS server.

[0049] Correspondingly, after receiving the response message, the recursive DNS server can return the IP address corresponding to the queried domain name to the client, so that the user can access the corresponding website.

[0050] S105, the convergent DNS server queries whether there is a pre-configured authoritative domain record. If the record is found, S106 is continued, and if no record is found, S107 is continued.

[0051] In some embodiments, the converged DNS server may store a pre-configured correspondence relationship, which is the correspondence relationship between the domain name and IP address of the superior server of the converged DNS server, such as the root server, so that the converged DNS server does not need to send a request to the root server, but can directly query the stored records, thereby improving reliability. It should be understood that in the embodiment of the present application, the pre-configured correspondence relationship stored in the converged DNS server is not the correspondence relationship of the domain name requested in step S101.

[0052] For example, in step S101, the domain name query request is: xxxxx.com. When the converged DNS server receives the query request, according to the solution of the prior art, the converged DNS server needs to query .cn. In the embodiment of the present application, the converged DNS server stores the pre-configured correspondence between .cn and the corresponding IP address, so that the query can be directly performed in the pre-configured correspondence.

[0053] S106, the convergent DNS server forwards the domain name query request message to the authoritative domain of the domain name for query.

[0054] S107, the convergent DNS server forwards the domain name query request message to the top-level domain of the domain name for query.

[0055] In some embodiments, if the convergent DNS server finds the record of the authoritative domain, it can forward the domain name query request to the authoritative domain for query to obtain the query result of the domain name. If the query is not found in the record of the authoritative domain, it is forwarded to the top-level domain for query.

[0056] It should be understood that the records of the authoritative domain are pre-configured in step S105. In the embodiment of the present application, the query records of the top-level domain can also be configured, and there is no limitation on this. If the query records of the top-level domain are configured, there is no need to execute S106, that is, there is no need to forward to the authoritative domain for query, and the query can be directly performed in the top-level domain.

[0057] S108, the convergent DNS server receives the query result and performs a validity check on the query result. If the validity check passes, the process continues to step S109, and if the validity check fails, the process ends.

[0058] In some embodiments, a timer can be started to wait for the query result. If the query result is still not received after the timer expires, the query request is discarded; if the query result is received before the timer expires, the converged DNS server can verify the legitimacy of the query result.

[0059] As a possible implementation, the serial number can be carried in the domain name query request message. When the convergent DNS server replies to the recursive DNS server with the query result, the serial number can be carried in the query result, and then the two serial numbers are compared to see if they are the same. If the two serial numbers are the same, the legitimacy check passes; if the two serial numbers are different, the legitimacy check fails. It should be understood that the serial number is only an example, and it may also be other information in the embodiments of the present application, and this is not limited.

[0060] S109, storing the query result in the DNS cache, and returning to execute S104.

[0061] In some embodiments, after receiving the query result, the converged DNS server may save the query result in the DNS cache so that the next time there is a query request for the domain name, the result can be read from the DNS cache, which can improve the efficiency of domain name query.

[0062] like Figure 4 FIG. 1 is a schematic diagram of a defense against DDOS attacks provided by an embodiment of the present application. Figure 4 As shown, the converged DNS server can be deployed in a security cleaning center, which can include multiple measures to prevent DDOS. The security cleaning center can first clean the DNS traffic and then inject the cleaned DNS traffic back to the converged DNS server.

[0063] After receiving the DNS query request in this application, the DNS query request can be sent to the security cleaning center. At this time, if a large number of attackers launch a DDOS attack on the top-level / authoritative DNS server, it will cause congestion of the top-level domain entrance bandwidth. When the top-level / authoritative DNS server detects the existence of DDOS, it can report the DDOS attack threat to the cross-domain scheduling unit, and then the cross-domain scheduling unit can switch the emergency channel. The recursive DNS can switch the destination address of the DNS query request to the converged DNS server. The converged DNS server forwards the DNS query request to the top-level DNS server through the SRv6 emergency protection tunnel. The response result of the top-level DNS server is sent to the converged DNS server through the SRv6 emergency protection tunnel, and the converged DNS server sends the response result to the recursive DNS server.

[0064] Furthermore, considering the DNS cache mechanism in the prior art, if the converged DNS server does not receive new domain name requests for a long time, the cache will inevitably age, thereby reducing the operating efficiency of the emergency support system. Therefore, in this application, the domain names in the DNS cache can be refreshed to ensure the real-time validity of the cache. For example, Figure 5 As shown, it is a flow chart of a method for refreshing a domain name provided in an embodiment of the present application, see Figure 5 As shown, the method may include the following steps:

[0065] Step 501: The converged DNS server starts a cache refresh timing service.

[0066] As a possible implementation method, the converged DNS server side can start a cache refresh timing task through a timer.

[0067] Step 502: After the timer times out, traverse the cache items to obtain the first cache item.

[0068] It should be understood that the first cache item is any cache item in the cache, such as the first cache item, etc., and there is no limitation on this.

[0069] In some embodiments, when the timer expires, the convergent DNS server may traverse the cache and perform subsequent steps on the cache items in the cache in sequence to determine whether a refresh is required.

[0070] Step 503: Obtain the number of response records of the first cache item, and compare the number of response records of the first cache item with a set threshold.

[0071] In some embodiments, the number of response records of the first cache item, that is, the number of times the domain name is queried and successfully responded to, can be read, and then the number can be compared with a set threshold to determine whether the domain name is frequently queried within a set period of time. It should be understood that if the domain name has not been queried for a long time, the record can be deleted from the cache, so that the information recorded in the cache is always the information of the frequently queried domain name, which can improve the efficiency of domain name query and reduce the pressure on the root server.

[0072] It should be understood that the threshold value may be set to one, that is, the threshold values ​​set for different cache items may be the same. Of course, they may also be different, and this application does not limit this.

[0073] Step 504: If the number of response records of the first cache item is less than the set threshold, the second cache item is obtained and step 503 is repeated.

[0074] That is to say, if the number of response records of a cache item (such as cache item 1) is less than the set threshold, the next cache item will be obtained for judgment. At this time, it can be understood that the domain name of cache item 1 is not frequently accessed, and the cache item can be skipped, that is, cache item 1 will not be included in the refresh queue.

[0075] It should be understood that obtaining the second cache item and repeatedly executing step 503 may include: obtaining the number of response records of the second cache item, and comparing the number of response records of the second cache item with a set threshold.

[0076] Step 505: If the number of response records of the first cache item is greater than the set threshold, continue to execute step 506.

[0077] Step 506, determine whether the difference between the last response time of the domain name and the response time of the last domain name request of the system is greater than the preset time. If the difference is greater than the preset time, reset the number of domain name response records to 0, then skip the cache item, and continue to obtain the next cache item; if the difference is less than the preset time, continue to step 507.

[0078] In some embodiments, the current time may be subtracted from the last response time of the domain name to calculate the time difference between the domain name and the last response time. If the time difference is too large, that is, greater than a preset time (e.g., N hours), it is considered that the domain name has been queried less frequently and the domain name will not be refreshed.

[0079] Step 507: Add the domain name corresponding to the first cache item to a refresh queue.

[0080] Through the above embodiment, the converged DNS server can obtain the recently active domain names in the DNS cache, and then refresh these domain names, automatically triggering pre-query of these active domain names, thereby ensuring the real-time validity of the cache.

[0081] Based on the same technical concept, the embodiment of the present application also provides a device, and the principle of solving the problem by the device is similar to that of the above method. Therefore, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0082] Figure 6 This is a structural diagram of a domain name query device 600 provided in an embodiment of the present application. The device 600 may include a transceiver module 601 and a query module 602.

[0083] When the above device 600 is applied to a system including a recursive domain name system DNS server and a convergent DNS server, the transceiver module 601 is used to receive a domain name query request message and send the domain name query request message to the convergent DNS server; and receive a domain name query result sent by the convergent DNS server. The query module 602 is used to perform a domain name query according to the domain name query request message and obtain a domain name query result.

[0084] In a possible implementation, the query module 602 is specifically configured to perform a domain name query according to the domain name query request message in the following manner:

[0085] The DNS cache is queried according to the domain name query request, wherein the DNS cache includes the correspondence between the domain names and the Internet Protocol IP addresses that have been queried within a set period of time.

[0086] In a possible implementation, the query module 602 is specifically configured to perform a domain name query according to the domain name query request message in the following manner:

[0087] If it is determined that the converged DNS server has not found the domain name in the DNS cache according to the domain name query request, a domain name query is performed in a pre-configured record, wherein the pre-configured record includes the correspondence between the domain name and the IP address of the root server of the converged DNS server.

[0088] In a possible implementation manner, the transceiver module 601 is further used for:

[0089] When the top-level DNS server or the authoritative DNS server detects the presence of a distributed denial of service (DDOS) attack, it instructs the recursive DNS server to send the domain name query request message to the convergent DNS server.

[0090] In a possible implementation manner, the transceiver module 601 is further used for:

[0091] The converged DNS server sends a domain name query request message to the top-level DNS server or the authoritative DNS server through the emergency guarantee tunnel.

[0092] In a possible implementation manner, the device further includes: a refresh module 603; the refresh module 603 is used to refresh the data in the DNS cache.

[0093] In a possible implementation, the refresh module 603 is specifically used to refresh the domain name in the DNS cache in the following manner:

[0094] Obtain domain names in the DNS cache that meet set conditions within a set time period, and refresh the domain names that meet the set conditions; wherein the set conditions include: the number of response records of the domain name is greater than a set threshold, and the difference between the last response time of the domain name and the current time is less than a set time difference.

[0095] The division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, the functional modules in the embodiments of the present application may be integrated in a processor, or may exist physically separately, or two or more modules may be integrated in one module. The coupling between the modules may be achieved through some interfaces, which are usually electrical communication interfaces, but it is not excluded that they may be mechanical interfaces or other forms of interfaces. Therefore, the modules described as separate components may or may not be physically separated, and may be located in one place or distributed to different locations of the same or different devices. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0096] When the query module 602 and the refresh module 603 are processors, the domain name query device 600 involved in the embodiment of the present application can be as follows: Figure 7 See Figure 7 As shown, a server 700 provided in an embodiment of the present application is provided. The server 700 may include a transceiver 701, a processor 702, and a memory 703. The memory 703 stores instructions or programs, and the processor 702 is used to execute the instructions or programs stored in the memory 703.

[0097] It should be understood that the device 600 or server 700 according to the embodiment of the present application may be the DNS server described in the embodiment, and the operations and / or functions of the various modules in the device 600 or server 700 are respectively to implement Figure 1 For the sake of brevity, the corresponding processes in the illustrated embodiment will not be described in detail here.

[0098] It should be understood that the processor mentioned in the embodiments of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0099] It should also be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (doubledatarate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (synchlink DRAM, SLDRAM), and direct rambus RAM (DR RAM).

[0100] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) is integrated in the processor.

[0101] It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0102] Based on the same inventive concept, an embodiment of the present application further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes the method discussed above.

[0103] A computer program product is also provided in an embodiment of the present application, including instructions, which, when executed on a computer, enable the computer to execute the method provided in the above embodiment.

[0104] In some possible implementations, various aspects of the data granularity adjustment method provided in the present application can also be implemented in the form of a program product, which includes a program code. When the program product is run on a device, the program code is used to enable the device to execute the steps of the risk identification method according to various exemplary embodiments of the present application described above in this specification.

[0105] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0106] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0107] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0108] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0109] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A domain name query method, characterized in that: include: The recursive DNS server receives a domain name query request message, where the domain name query request message is received when a top-level DNS server or an authoritative DNS server is attacked by a distributed denial of service (DDOS); The recursive DNS server forwards the domain name request message sent to the top-level DNS server or the authoritative DNS server to the convergent DNS server; The recursive DNS server receives the domain name query result sent by the convergent DNS server, where the domain name query result is obtained by the convergent DNS server performing a domain name query according to the domain name query request message.

2. A domain name query method, characterized in that: The method comprises: The convergent DNS server receives a domain name query request message forwarded by the recursive DNS server and needs to be sent to the top-level DNS server or the authoritative DNS server, wherein the domain name query request message is received when the top-level DNS server or the authoritative DNS server suffers from a distributed denial of service (DDOS) attack; The converged DNS server performs a domain name query according to the domain name query request message to obtain a domain name query result; The convergent DNS server sends the domain name query result to the recursive DNS server.

3. The method according to claim 2, characterized in that The converged DNS server performs a domain name query according to the domain name query request message, including: The converged DNS server queries the DNS cache according to the domain name query request, and the DNS cache includes the correspondence between the domain names and Internet Protocol IP addresses that have been queried within a set time period.

4. The method according to claim 3, characterized in that The converged DNS server performs a domain name query according to the domain name query request message, including: If it is determined that the converged DNS server has not found the domain name in the DNS cache according to the domain name query request, a domain name query is performed in a pre-configured record, wherein the pre-configured record includes the correspondence between the domain name and the IP address of the root server of the converged DNS server.

5. The method according to claim 2, characterized in that The method further comprises: The converged DNS server sends a domain name query request message to the top-level DNS server or the authoritative DNS server through the emergency guarantee tunnel.

6. The method according to claim 2, characterized in that The method further comprises: The converged DNS server refreshes the data in the DNS cache.

7. The method according to claim 6, characterized in that The convergent DNS server refreshes the domain name in the DNS cache, including: The converged DNS server obtains the domain names in the DNS cache that meet the set conditions within a set time period, and refreshes the domain names that meet the set conditions; wherein the set conditions include: the number of response records of the domain name is greater than a set threshold, and the difference between the last response time of the domain name and the current time is less than the set time difference.

8. A domain name query system, characterized in that: include: The recursive DNS server is used to receive a domain name query request message and send the domain name query request message to the convergent DNS server; The converged DNS server is used to perform a domain name query according to the domain name query request message to obtain a domain name query result; The convergent DNS server is also used to send the domain name query result to the recursive DNS server.

9. A server, characterized in that: include: at least one processor, and a memory communicatively connected to the at least one processor, wherein: The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so as to enable the at least one processor to perform the method according to any one of claims 1 to 4.

10. A storage medium, characterized in that: When the computer program in the storage medium is executed by a processor of a server, the server can perform the method according to any one of claims 1 to 4.

Images