A method and system for encryption of DNS zone data

Abstract

The application discloses a kind of encryption methods and systems for DNS zone data.The method uses asymmetric encryption algorithm, generates public key and private key by resolution service provider, and stores the key in key management server cluster.Authoritative server and cache server obtain public key from the cluster, which is used to decrypt received ciphertext data.Resolution server software is modified to receive ciphertext data and establish the correspondence between plaintext and ciphertext, while being able to respond to client resolution requests.Client receives ciphertext response through a dedicated SDK and decrypts it, ensuring that the data is not tampered with during transmission.This method simplifies the management of encryption protocols and improves data security and integrity.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to an encryption method and system for DNS zone data. Background Art

[0002] DNS currently offers various security solutions to address security issues at different stages. DNSSEC addresses security between cache servers and recursive servers, and between recursive servers and authoritative servers. For security between clients and cache servers, DNS offers solutions such as DOT and DOH. Zone files stored on resolvers (cache servers, recursive servers, and authoritative servers) are all plaintext, allowing users to modify plaintext zone data.

[0003] In the synchronization of primary and secondary zones, data is transmitted in plain text over the network, which is easily tampered with and cannot be detected.

[0004] The current DNS security solutions have the following problems:

[0005] 1) There are multiple encryption schemes, and different protocols are used at different stages, making implementation complex. Modifications during the conversion between different encryption protocols cannot be detected.

[0006] 2) The zone data is in plain text and is not stored encrypted. If a hacker modifies the zone data, the parsing software will load the incorrect zone data.

[0007] 3) The data may be modified by hackers during transmission, and it is impossible to detect that the data has been modified. Summary of the Invention

[0008] Based on this, an embodiment of the present application provides an encryption method and system for DNS zone data. This method implements encryption protection throughout the entire link process from zone record configuration to client use, and the original data cannot be modified in the intermediate links.

[0009] In a first aspect, a method for encrypting DNS zone data is provided, the method comprising:

[0010] Generate a pair of public and private keys through an asymmetric encryption algorithm, and upload the generated public and private keys to the key management server cluster for storage;

[0011] The authoritative server and cache server are both configured with the address information of the key management server cluster and initiate a request to the key management server cluster to obtain the public key information;

[0012] After receiving the domain name configuration data submitted by the user, the authoritative server automatically calls the encryption service of the key management server cluster to encrypt the domain name configuration data into ciphertext, update the zone record file, and establish a plaintext to ciphertext mapping table in memory;

[0013] When the cache server receives a resolution request from the client and there is no corresponding data in the local cache, it sends a query request to the authoritative server. The authoritative server finds the corresponding ciphertext data through the mapping table in memory and returns it to the cache server;

[0014] The cache server uses the public key obtained from the key management server cluster to decrypt the received ciphertext data. If successful, it caches the plaintext data and returns the decrypted data to the client.

[0015] Optionally, a pair of public and private keys is generated using an asymmetric encryption algorithm, and the generated public and private keys are uploaded to a key management server cluster and stored, including:

[0016] The key management server cluster deploys the service request interface as a cluster to provide encryption and public key download services to the resolution server; among them, the key management server cluster develops a service request interface based on the private key to realize data encryption, public key download and source verification functions.

[0017] Optionally, after receiving the domain name configuration data submitted by the user, the authoritative server automatically calls the encryption service of the key management server cluster to encrypt the domain name configuration data into ciphertext, specifically including:

[0018] Add the domain name configuration data to the authoritative server. After receiving the user's configuration data, the authoritative server automatically calls the encryption interface provided by the key management server cluster to encrypt the configuration data.

[0019] The authoritative server records the encrypted data in the zone record file and establishes a plaintext to ciphertext mapping table in the memory; wherein, an identifier is added to the zone record file to indicate that the current data is encrypted zone data.

[0020] Optionally, the cache server decrypts the received ciphertext data using the public key obtained from the key management server cluster. If successful, it caches the plaintext data and returns the decrypted data to the client. Specifically, the following steps are performed:

[0021] After receiving the encrypted DNS zone data from the authoritative server, the cache server will request the public key from the key management server cluster, use the public key to decrypt the data to verify its legitimacy, and establish a correspondence between the plaintext domain name and the ciphertext result;

[0022] When the client initiates a parsing request, the cache server returns the ciphertext data to the client SDK. The client SDK uses the public key downloaded in advance from the key management server cluster to decrypt the ciphertext. If the decryption is successful, the client SDK provides the plaintext data to the client for use; if the decryption fails, the data is discarded.

[0023] Optionally, the method further includes synchronizing data between the primary and secondary zone servers on the authoritative server, specifically including:

[0024] The secondary zone server initiates a zone synchronization request to the primary zone server; the zone record in the request is a plain text record;

[0025] When the primary zone server receives a request for a plaintext record, it compares it with the cached plaintext configuration data to find the plaintext data to be synchronized;

[0026] Return the ciphertext data corresponding to the plaintext data to the auxiliary zone server;

[0027] The auxiliary zone server parses the zone data using the public key obtained from the key management server. When the parsing is successful, it caches the plaintext data and the corresponding ciphertext data in the memory and stores the ciphertext data in the zone file.

[0028] Optionally, the secondary zone server parses the zone data using the public key obtained from the key management server, and abandons the parsing if the parsing fails.

[0029] In a second aspect, a system for encrypting DNS zone data is provided, the system comprising:

[0030] The parsing server is used to generate a pair of public and private keys through an asymmetric encryption algorithm, and upload the generated public and private keys to the key management server cluster for storage;

[0031] The authoritative server is used to configure the address information of the key management server cluster and initiate a request to the key management server cluster to obtain public key information. After receiving the domain name configuration data submitted by the user, it automatically calls the encryption service of the key management server cluster to encrypt the domain name configuration data into ciphertext, update the zone record file, and establish a plaintext to ciphertext mapping table in memory.

[0032] The cache server is used to configure the address information of the key management server cluster and initiate a request to the key management server cluster to obtain public key information; when receiving a resolution request from the client and there is no corresponding data in the local cache, it initiates a query request to the authoritative server. The authoritative server finds the corresponding ciphertext data through the mapping table in the memory and returns it to the cache server; and uses the public key obtained from the key management server cluster to decrypt the received ciphertext data. If successful, the plaintext data is cached and the decrypted data is returned to the client.

[0033] In a third aspect, an electronic device is provided, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements any encryption method described in the first aspect when executing the computer program.

[0034] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the encryption method described in any one of the first aspects is implemented.

[0035] In a fifth aspect, a computer program product is provided, comprising a computer program / instruction, which implements any encryption method described in the first aspect when the computer program / instruction is executed by a processor.

[0036] The beneficial effects of the technical solutions provided in the embodiments of the present application include at least:

[0037] (1) The zone record is encrypted once, and the entire link transmits the ciphertext, reducing the number of encryption and decryption operations;

[0038] (2) The encryption method is unique, and only one set of keys is needed to complete the encryption and decryption of the entire parsing link data;

[0039] (3) Only one protocol is needed to ensure the security of the entire resolution link;

[0040] (4) The local zone records are also changed from the original plain text to cipher text, which cannot be modified by users;

[0041] (5) Synchronization between the primary and secondary areas, changing from plain text to cipher text, is more secure. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are merely exemplary, and those skilled in the art can derive other implementation drawings based on the provided drawings without inventive effort.

[0043] Figure 1 A flowchart of a method for encrypting DNS zone data provided in an embodiment of the present application;

[0044] Figure 2 A schematic diagram of a specific implementation scheme provided for an embodiment of the present application. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0046] In the description of the present invention, the terms "comprise", "have" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may also include other steps or units that are not explicitly listed but are inherent to these processes, methods, products or apparatuses, or steps or units that are added based on further optimization solutions conceived by the present invention.

[0047] This invention uses a common asymmetric encryption algorithm to encrypt zone records. During the entire resolution link, encrypted data is transmitted. The intermediate server uses the public key to decrypt the encrypted data and obtain the plaintext corresponding to the ciphertext. The client uses the plaintext domain name to make a request, and the resolution server compares the decrypted plaintext. If there is corresponding resolution data, the corresponding ciphertext is returned to the client.

[0048] This invention utilizes the characteristics of asymmetric keys: public keys encrypt and private keys decrypt, and private keys decrypt and public keys encrypt. After an intermediate server modifies data, other servers and clients cannot decrypt the public key. This allows identification of whether data in a zone record has been modified since encryption from the authoritative server.

[0049] First, let’s explain the servers involved in the solution:

[0050] Key management server clusters: These are primarily used to manage public and private keys for asymmetric encryption and provide data encryption services. To ensure high availability, performance, and scalability of key server services, cluster management is required.

[0051] Authoritative servers primarily manage authoritative records. Users configure data directly on authoritative servers. Authoritative servers provide services to recursive servers and can also provide services directly to users. To ensure high availability, authoritative servers implement synchronization between primary and secondary zones, resulting in the existence of primary and secondary authoritative servers.

[0052] Zone data files: For persistence, the authoritative server stores user-configured zone data and the underlying record data in files. Zone data files also exist on the authoritative server's slave servers.

[0053] Cache Server: To improve performance, you can store the results of queries from the authoritative server in a cache server. Within the valid time, when the user requests it, the cached results can be directly returned.

[0054] Client: refers to the user of domain name resolution, such as app, PC, etc.

[0055] Specifically, Figure 1 The flowchart of the method for encrypting DNS zone data shown in FIG. 1 specifically includes the following steps:

[0056] A pair of public and private keys are generated through an asymmetric encryption algorithm, and the generated public and private keys are uploaded to the key management server cluster and stored.

[0057] Among them, the key management server cluster deploys the service request interface as a cluster to provide encryption and public key download services to the resolution server; among them, the key management server cluster develops a service request interface based on the private key to realize data encryption, public key download and source verification functions.

[0058] Both the authoritative server and the cache server are configured with the address information of the key management server cluster and initiate a request to the key management server cluster to obtain the public key information.

[0059] After receiving the domain name configuration data submitted by the user, the authoritative server automatically calls the encryption service of the key management server cluster, encrypts the domain name configuration data into ciphertext, updates the zone record file, and establishes a plaintext to ciphertext mapping table in memory.

[0060] Among them, the configuration data of the domain name is added to the authoritative server. After the authoritative server obtains the user's configuration data, it automatically calls the encryption interface provided by the key management server cluster to encrypt the configuration data;

[0061] The authoritative server records the encrypted data in the zone record file and establishes a plaintext to ciphertext mapping table in the memory; wherein, an identifier is added to the zone record file to indicate that the current data is encrypted zone data.

[0062] When the cache server receives a resolution request from the client and there is no corresponding data in the local cache, it initiates a query request to the authoritative server. The authoritative server finds the corresponding ciphertext data through the mapping table in memory and returns it to the cache server.

[0063] The cache server uses the public key obtained from the key management server cluster to decrypt the received ciphertext data. If successful, it caches the plaintext data and returns the decrypted data to the client.

[0064] After receiving encrypted DNS zone data from the authoritative server, the cache server requests the public key from the key management server cluster. Using this public key, it decrypts the data to verify its legitimacy and establishes a correspondence between the plaintext domain name and the ciphertext result, allowing it to directly provide the ciphertext data in subsequent requests. When a client initiates a resolution request, the cache server returns the ciphertext data to the client SDK, which decrypts the ciphertext using the public key pre-downloaded from the key management server cluster. If decryption is successful, the client SDK provides the plaintext data to the client; if decryption fails, the data is discarded, ensuring data security and the integrity of the resolution process.

[0065] In an optional embodiment of the present application, data synchronization between the primary and secondary zone servers is further performed on the authoritative server, specifically including:

[0066] The secondary zone server initiates a zone synchronization request to the primary zone server; the zone record in the request is a plaintext record; when the primary zone server receives the request for the plaintext record, it compares it with the cached plaintext configuration data to find the plaintext data to be synchronized; and returns the ciphertext data corresponding to the plaintext data to the secondary zone server; the secondary zone server parses the zone data using the public key obtained from the key management server. When the parsing is successful, it caches the plaintext data and the corresponding ciphertext data in the memory, and stores the ciphertext data in the zone file.

[0067] like Figure 2 As shown in the flowchart of the specific implementation scheme, this step also includes the following implementation process:

[0068] The implementation process of this plan is:

[0069] 1. First, the service provider uses an asymmetric encryption algorithm to generate public and private keys, and stores both public and private keys in the key management server cluster. At the same time, a service request interface is developed based on the private key to meet the following capabilities:

[0070] a) Provide data encryption capabilities;

[0071] b) Provide the ability to download public keys;

[0072] c) Provide a source verification mechanism to allow only specific servers to use data encryption capabilities (for example, the authoritative master server in this solution rejects requests for encryption capabilities from other servers except the authoritative master server).

[0073] At the same time, in order to meet the requirements of high performance and scalability, this set of interfaces is deployed as a cluster, and data encryption and public key download capabilities are provided to the parsing server through a unified interface of the cluster.

[0074] 2. The authoritative server and cache server are configured with the address of the key management server cluster and request public key information from the key management server cluster to decrypt the obtained ciphertext data.

[0075] 3. Modify the parsing software of the parsing server to ensure that the parsing server has the following capabilities:

[0076] a) The parsing server is capable of receiving the recorded ciphertext data, and using the public key to decrypt the ciphertext data to obtain the plaintext data, thereby establishing a correspondence between the plaintext and the ciphertext.

[0077] b) The resolution server is capable of receiving normal resolution requests and responding to normal resolution requests using ciphertext.

[0078] c) The parsing server is able to identify whether the received data is plaintext data or ciphertext data.

[0079] d) The parsing server has the ability to record ciphertext data into zone files and can also read ciphertext files.

[0080] 4. Implement a dedicated parsing request SDK. This SDK first downloads the public key from the key management server, identifies the data as ciphertext, and decrypts it using the public key. If decryption fails, the data is considered invalid (indicating that the transmission process has been modified); otherwise, the decrypted data is returned to the user (e.g., the user's app or PC browser).

[0081] After steps 1-4 above, all parsing servers are able to receive normal parsing requests for plaintext and return ciphertext records. Clients can also receive ciphertext responses and determine whether the data has been modified.

[0082] The following is the implementation process when a user sends a configuration to the authoritative server:

[0083] 1. The user adds the domain name configuration data to the authoritative server, for example: configuring the domain name www.baidu.com to resolve to the IP address 1.1.1.1.

[0084] 2. After the authoritative server obtains the user's configuration data, it automatically calls the encryption interface provided by the key management server cluster to encrypt the configuration data.

[0085] 3. The authoritative server records the encrypted data in the zone record file (adds an identifier to the zone record file to indicate that the current data is encrypted zone data), and at the same time establishes a plaintext to ciphertext mapping table in memory.

[0086] The following is the process of normal request processing initiated by the user:

[0087] 1. The client sends a resolution request in a normal resolution packet, such as requesting www.baidu.com.

[0088] 2. When the cache server receives the client's resolution request, it queries the local cache and finds that there is no data related to the domain name www.baidu.com locally, so it initiates a request to the authoritative server.

[0089] 3. When the authoritative server receives the query request from the cache server, it finds the plaintext record of the corresponding domain name www.baidu.com through plaintext. If the match is successful, it returns the corresponding ciphertext data.

[0090] 4. When the cache server receives the ciphertext data returned by the authoritative server, it decrypts it using the public key obtained from the key server. If the decryption is successful, the data obtained is the original data from the authoritative server. Otherwise, the data is considered to have been modified and should be discarded. If it is the original data, both the plaintext and ciphertext are cached in memory to serve subsequent client queries. The ciphertext data is also returned to the client.

[0091] 5. When the client SDK receives the response, it decrypts it using the public key obtained from the key server. If decryption fails, the data is considered modified and should be discarded. If decryption succeeds, the data is secure. The IP address corresponding to the domain name is provided to the client.

[0092] The synchronization logic of the primary and secondary server zones after using ciphertext is as follows:

[0093] 1. The secondary zone server initiates a zone synchronization request to the primary zone server. The zone record in the request is a plain text record.

[0094] 2. When the primary zone server receives a request for a plaintext record, it compares it with the cached plaintext configuration data to find the plaintext data to be synchronized.

[0095] 3. Return the ciphertext data corresponding to the plaintext data to the auxiliary zone server.

[0096] 4. The slave zone server uses the public key obtained from the key management server to parse the zone data. If the parse fails, it indicates that the data has been modified during the synchronization process and should be abandoned. If the parse succeeds, the synchronization is considered successful. The plaintext data and the corresponding ciphertext data are cached in memory and the ciphertext data is stored in the zone file.

[0097] The synchronization of zone ciphertext data can be completed through steps 1-4 above. In summary, the key points of this application include:

[0098] A key management server cluster is required to provide public key distribution tasks and data encryption tasks.

[0099] The key management server has the ability to identify the source and only provides encryption tasks to the authoritative server. It rejects encryption requests from other servers.

[0100] When the authoritative server receives the data, it calls the encryption interface to encrypt it and stores the encrypted data.

[0101] The parsing server needs to implement the mapping between plaintext data and ciphertext data and cache the mapping relationship.

[0102] The parsing server must be able to receive plaintext queries and return ciphertext data.

[0103] Clients, cache servers, and recursive servers need to support decryption capabilities.

[0104] The parsing server must be able to store and load encrypted data.

[0105] The parsing server must be able to configure the key management server.

[0106] The primary server has the ability to provide ciphertext transmission, and the secondary server has the ability to receive ciphertext.

[0107] The present application also provides an encryption system for DNS zone data. The system may include:

[0108] The parsing server is used to generate a pair of public and private keys through an asymmetric encryption algorithm, and upload the generated public and private keys to the key management server cluster for storage;

[0109] The authoritative server is used to configure the address information of the key management server cluster and initiate a request to the key management server cluster to obtain public key information. After receiving the domain name configuration data submitted by the user, it automatically calls the encryption service of the key management server cluster to encrypt the domain name configuration data into ciphertext, update the zone record file, and establish a plaintext to ciphertext mapping table in memory.

[0110] The cache server is used to configure the address information of the key management server cluster and initiate a request to the key management server cluster to obtain public key information; when receiving a resolution request from the client and there is no corresponding data in the local cache, it initiates a query request to the authoritative server. The authoritative server finds the corresponding ciphertext data through the mapping table in the memory and returns it to the cache server; and uses the public key obtained from the key management server cluster to decrypt the received ciphertext data. If successful, the plaintext data is cached and the decrypted data is returned to the client.

[0111] The specific definitions of the DNS zone data encryption system can be found in the definitions of the DNS zone data encryption method described above and will not be repeated here. Each module in the aforementioned DNS zone data encryption system can be implemented in whole or in part via software, hardware, or a combination thereof. Each of these modules can be embedded in or independent of a processor in a computer device in hardware form, or stored in a computer device memory in software form, so that the processor can call and execute the corresponding operations of each module.

[0112] In one embodiment, an electronic device is provided, which may be a computer. The electronic device includes a processor, a memory, and a network interface connected via a system bus. The processor of the device is used to provide computing and control capabilities. The memory of the device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to encrypt data for DNS zone data. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, it implements a method for encrypting DNS zone data.

[0113] In one embodiment, a computer-readable storage medium is further provided, on which a computer program is stored, which involves all or part of the processes in the above-mentioned embodiment method.

[0114] In one embodiment, a computer program product is also provided, including a computer program / instruction, which involves all or part of the process in the above embodiment method.

[0115] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in M ​​forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (SyMchliMk) DRAM (SLDRAM), memory bus (RaMbus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0116] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0117] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A method for encrypting DNS zone data, characterized in that: The method comprises: The parsing server generates a pair of public and private keys using an asymmetric encryption algorithm, and uploads the generated public and private keys to the key management server cluster for storage; The authoritative server and cache server are both configured with the address information of the key management server cluster and initiate a request to the key management server cluster to obtain the public key information; After receiving the domain name configuration data submitted by the user, the authoritative server automatically calls the encryption service of the key management server cluster to encrypt the domain name configuration data into ciphertext, update the zone record file, and establish a plaintext to ciphertext mapping table in memory; When the cache server receives a resolution request from the client and there is no corresponding data in the local cache, it sends a query request to the authoritative server. The authoritative server finds the corresponding ciphertext data through the mapping table in memory and returns it to the cache server; After receiving the encrypted DNS zone data from the authoritative server, the cache server will request the public key from the key management server cluster, use the public key to decrypt the data to verify its legitimacy, and establish a correspondence between the plaintext domain name and the ciphertext result; When the client initiates a parsing request, the cache server returns the ciphertext data to the client SDK. The client SDK uses the public key downloaded in advance from the key management server cluster to decrypt the ciphertext. If the decryption is successful, the client SDK provides the plaintext data to the client for use; if the decryption fails, the data is discarded.

2. The encryption method according to claim 1, wherein: The parsing server generates a pair of public and private keys using an asymmetric encryption algorithm, and uploads the generated public and private keys to the key management server cluster for storage, including: The key management server cluster deploys the service request interface as a cluster to provide encryption and public key download services to the resolution server; among them, the key management server cluster develops a service request interface based on the private key to realize data encryption, public key download and source verification functions.

3. The encryption method according to claim 1, wherein: After receiving the domain name configuration data submitted by the user, the authoritative server automatically calls the encryption service of the key management server cluster to encrypt the domain name configuration data into ciphertext, including: Add the domain name configuration data to the authoritative server. After receiving the user's configuration data, the authoritative server automatically calls the encryption interface provided by the key management server cluster to encrypt the configuration data. The authoritative server records the encrypted data in the zone record file and establishes a plaintext to ciphertext mapping table in the memory; wherein, an identifier is added to the zone record file to indicate that the current data is encrypted zone data.

4. The encryption method according to claim 1, wherein: The method further includes synchronizing data between the primary and secondary zone servers on the authoritative server, specifically including: The secondary zone server initiates a zone synchronization request to the primary zone server; the zone record in the request is a plain text record; When the primary zone server receives a request for a plaintext record, it compares it with the cached plaintext configuration data to find the plaintext data to be synchronized; Return the ciphertext data corresponding to the plaintext data to the auxiliary zone server; The auxiliary zone server parses the zone data using the public key obtained from the key management server. When the parsing is successful, it caches the plaintext data and the corresponding ciphertext data in the memory and stores the ciphertext data in the zone file.

5. The encryption method according to claim 4, wherein: The auxiliary zone server uses the public key obtained from the key management server to parse the zone data, and abandons the parsing if it fails.

6. An encryption system for DNS zone data, characterized in that: The system comprises: The parsing server is used to generate a pair of public and private keys through an asymmetric encryption algorithm, and upload the generated public and private keys to the key management server cluster for storage; The authoritative server is used to configure the address information of the key management server cluster and initiate a request to the key management server cluster to obtain public key information. After receiving the domain name configuration data submitted by the user, it automatically calls the encryption service of the key management server cluster to encrypt the domain name configuration data into ciphertext, update the zone record file, and establish a plaintext to ciphertext mapping table in memory. The cache server is used to configure the address information of the key management server cluster and initiate a request to the key management server cluster to obtain public key information; when receiving a resolution request from the client and there is no corresponding data in the local cache, it initiates a query request to the authoritative server. The authoritative server finds the corresponding ciphertext data through the mapping table in the memory and returns it to the cache server; and after receiving the encrypted DNS zone data from the authoritative server, it requests the public key from the key management server cluster, uses the public key to decrypt the data to verify its legitimacy, and establishes a correspondence between the plaintext domain name and the ciphertext result; when the client initiates a resolution request, the cache server returns the ciphertext data to the client SDK, and the client SDK uses the public key downloaded in advance from the key management server cluster to decrypt the ciphertext. If the decryption is successful, the client SDK provides the plaintext data to the client for use; if the decryption fails, the data is discarded.

7. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

9. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images