Domain name resolution method, system, device, storage medium and program product

Abstract

The embodiments of the present application provide a domain name resolution method, system, device, storage medium and program product. In the domain name resolution system, multiple applications are deployed on multiple host nodes, and multiple domain name filters that jointly provide domain name resolution services for the multiple applications are deployed on at least some of the multiple host nodes. Under this architecture, any domain name filter can obtain the domain name resolution request of the application, identify the target risk type corresponding to the domain name resolution request according to the domain name filtering rules corresponding to different risk types, and use the domain name resolution method corresponding to the target risk type to resolve the domain name resolution request. Deploying domain name filters on at least some of the host nodes allows the domain name filters to detect the risk type of the domain name resolution request in a timely manner before performing the domain name resolution operation, thereby performing risk management as early as possible and improving the security of the applications on the host nodes.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to a domain name resolution method, system, device, storage medium and program product. Background Art

[0002] A cloud computing platform is a unified and manageable system that integrates hardware resources (such as network infrastructure, servers, and storage devices) with software resources (such as applications and services). In a cloud computing platform, the Domain Name System (DNS) plays a vital role. The DNS not only helps users access cloud services through easy-to-remember domain names, but also supports the decoupling of Internet Protocol (IP) addresses when cloud services are connected to each other or when cloud products are connected to external resources.

[0003] In some application scenarios, the host inside the cloud computing platform (hereinafter referred to as the cloud host) has the need to resolve domain names outside the cloud computing platform. To meet this need, a centralized domain name resolution cluster can be used inside the cloud computing platform to provide domain name resolution services to the cloud host. In this case, the cloud products running on the cloud host may reuse the DNS resolution capabilities of the centralized domain name resolution cluster to access external abnormal domain names, which may lead to higher security risks for the cloud products. Therefore, a new solution needs to be proposed. Summary of the invention

[0004] Multiple aspects of the present application provide a domain name resolution method, system, device, storage medium and program product to improve the security of applications running on a host node.

[0005] An embodiment of the present application provides a domain name resolution system, including: multiple host nodes, multiple applications deployed on the multiple host nodes, multiple domain name routers deployed on at least some of the multiple host nodes, and the multiple domain name routers jointly provide domain name resolution services for the multiple applications; wherein any domain name router is used to: obtain a domain name resolution request of a target application; perform risk identification on the domain name resolution request according to domain name filtering rules corresponding to different risk types to obtain a target risk type corresponding to the domain name resolution request; and use a domain name resolution method corresponding to the target risk type to resolve the domain name resolution request to obtain a domain name resolution result.

[0006] Optionally, a domain name manager is deployed on any host node among the multiple host nodes; the domain name manager is used to provide the domain name router with domain name filtering rules corresponding to the different risk types.

[0007] Optionally, the target application includes: an application located on the same host node as the domain name router, and / or an application located on a different host node from the domain name router and having a set distance relationship with the domain name router.

[0008] Optionally, the system also includes: a domain name resolution cluster; the domain name router is used to: if the risk type corresponding to the domain name resolution request is a first risk type, query whether there is an address corresponding to the domain name resolution request in the local cache, and the risk threshold of the first risk type is less than a first threshold; if it exists, use the queried address as the domain name resolution result; if it does not exist, send the domain name resolution request to the domain name resolution cluster, so that the domain name resolution cluster resolves the domain name resolution request to obtain the domain name resolution result.

[0009] The embodiment of the present application also provides a domain name resolution method, which is applied to any domain name router among multiple domain name routers, wherein the multiple domain name routers run on at least some of the multiple host nodes, multiple applications are deployed on the multiple host nodes, and the multiple domain name routers jointly provide domain name resolution services for the multiple applications; the method includes: obtaining a domain name resolution request of a target application; performing risk identification on the domain name resolution request according to domain name filtering rules corresponding to different risk types to obtain a target risk type corresponding to the domain name resolution request; and resolving the domain name resolution request using a domain name resolution method corresponding to the target risk type to obtain a domain name resolution result.

[0010] Optionally, according to the domain name filtering rules corresponding to different risk types, the domain name resolution request is identified for risks to obtain the risk type corresponding to the domain name resolution request, including: obtaining the target domain name filtering rules corresponding to the target application from the domain name filtering rules corresponding to the different risk types, different rules in the target domain name filtering rules correspond to at least one risk type; according to the target domain name filtering rules, the domain name resolution request is matched with rules to obtain the target rule matched by the domain name resolution request; according to the risk type corresponding to the target rule, the risk type corresponding to the domain name resolution request is obtained.

[0011] Optionally, the domain name resolution request is resolved using a domain name resolution method corresponding to the target risk type to obtain a domain name resolution result, including: if the risk type corresponding to the domain name resolution request is a first risk type, querying whether there is an address corresponding to the domain name resolution request in the local cache, and the risk threshold of the first risk type is less than the first threshold; if so, using the queried address as the domain name resolution result; if not, sending the domain name resolution request to a domain name resolution cluster so that the domain name resolution cluster resolves the domain name resolution request to obtain the domain name resolution result.

[0012] Optionally, the domain name resolution request is sent to a domain name resolution cluster so that the domain name resolution cluster resolves the domain name resolution request. After obtaining the domain name resolution result, it also includes: adding the domain name resolution result to the local cache to update the local cache.

[0013] Optionally, the domain name resolution request is resolved using a domain name resolution method corresponding to the target risk type, including: if the risk type corresponding to the domain name resolution request is a second risk type, intercepting the domain name resolution request, or resolving the domain name resolution request to a specified address, which is an invalid address or an address corresponding to a specified security page, and the risk threshold of the second risk type is greater than the second threshold.

[0014] Optionally, the target application and the domain name router are located on the same host node or on different host nodes; if they are located on different host nodes, a set distance relationship is satisfied between the target application and the domain name router.

[0015] An embodiment of the present application also provides an electronic device, comprising: a memory and a processor; the memory is used to store one or more computer instructions; the processor is used to execute the one or more computer instructions to: execute the steps in the method provided in the embodiment of the present application.

[0016] The embodiment of the present application also provides a computer-readable storage medium storing a computer program, which can implement the steps in the method provided in the embodiment of the present application when the computer program is executed by a processor.

[0017] The embodiment of the present application also provides a computer program product, including: a computer program / instructions, which, when executed by a processor, can implement the steps in the method provided in the embodiment of the present application.

[0018] In an embodiment of the present application, multiple applications are deployed on multiple host nodes, and multiple domain name routers are deployed on at least some of the multiple host nodes, and the multiple domain name routers jointly provide domain name resolution services for the multiple applications. Under this architecture, any domain name router is used to: obtain the domain name resolution request of the target application, identify the risk of the domain name resolution request according to the domain name filtering rules corresponding to different risk types, obtain the target risk type corresponding to the domain name resolution request, and use the domain name resolution method corresponding to the target risk type to resolve the domain name resolution request to obtain the domain name resolution result. In this embodiment, the domain name router is deployed on at least some of the host nodes where the application is deployed, so that the domain name router can detect the risk type of the domain name resolution request in time before performing the domain name resolution operation, so as to perform risk management as early as possible and improve the security of the application deployed on the host node. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1 A schematic diagram of the structure of a domain name resolution system provided for an exemplary embodiment of the present application; Figure 2 A schematic diagram of the structure of a domain name resolution system provided by another exemplary embodiment of the present application; Figure 3 A flowchart of a domain name resolution method provided by an exemplary embodiment of the present application; Figure 4 A flowchart of a domain name resolution method provided by another exemplary embodiment of the present application; Figure 5 A schematic diagram of the structure of an electronic device provided as an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0021] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings, and "multiple" generally includes at least two, but does not exclude the inclusion of at least one.

[0022] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0023] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a product or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such a product or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the presence of other identical elements in the product or system including the element.

[0024] The host inside the cloud computing platform (hereinafter referred to as the cloud host) has the need to resolve domain names outside the cloud computing platform. To meet this need, a centralized domain name resolution cluster can be used inside the cloud computing platform to provide domain name resolution services for the cloud host. After receiving the DNS resolution request from the cloud host, the domain name resolution cluster can search for the IP address corresponding to the DNS resolution request on the DNS server inside the domain name resolution cluster based on a recursive query, or can forward the DNS resolution request to the DNS service outside the domain name resolution cluster to call the external DNS service to resolve the DNS resolution request of the cloud host. A variety of cloud products can run on the cloud host. The types and logical complexity of different cloud products may be different. Some cloud products themselves or the software packages they depend on may have fixed codes for accessing public domain names. In this case, after the domain name resolution cluster opens the global public domain name recursive query service or DNS forwarding service for the cloud host, cloud products can also reuse these services to access public domain names. Public domain names may contain some abnormal domain names, thereby increasing the potential risk of data leakage and reverse control for cloud products.

[0025] In the process of solving the above technical problems, the inventors have discovered a method for scanning the code of cloud products to locate the code for accessing public domain names and modifying the located code. However, in some scenarios, the code for accessing public domain names in cloud products can come from third-party software packages, and the code for accessing public domain names cannot be effectively located by code scanning. In the process of solving the above technical problems, the inventors have also discovered a method for adding a hardware firewall outside the domain name resolution cluster, which can filter cloud product requests for resolution of some unsafe public domain names based on the firewall. However, the inventors found that this method, on the one hand, brings a large hardware overhead, and on the other hand, this centralized domain name filtering method puts a large processing pressure on the firewall, which makes the firewall prone to collapse. When the firewall collapses, the network access of the entire cloud computing platform will face security risks.

[0026] In view of the above technical problems, a solution is provided in some embodiments of the present application. The technical solutions provided by the embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0027] Figure 1 is a schematic diagram of the structure of a domain name resolution system provided by an exemplary embodiment of the present application. Figure 1 As shown, the domain name resolution system 100 may include: multiple host nodes, including but not limited to Figure 1 The first host node 10, the second host node 20 and the third host node 30 are shown. Any host node can be implemented as a physical server or a virtual server. In some scenarios, multiple host nodes can be located in a cloud computing cluster, which can be a public cloud or a private cloud, and any host node can be implemented as a cloud server in the cloud computing cluster.

[0028] Among them, multiple applications are deployed on multiple host nodes, and multiple domain name routers are deployed on at least some of the multiple host nodes, and the multiple domain name routers jointly provide domain name resolution services for the multiple applications. The at least some host nodes may include: all host nodes or some host nodes in the domain name resolution system 100. Among them, one domain name router or multiple domain name routers can be deployed on a host node, and this embodiment does not limit it. Among them, any domain name router deployed on any node can be an independently running application or a functional component integrated in other applications. Figure 1As shown, the first host node 10 is deployed with application APP1, application APP2, and application APP3, the second host node 20 is deployed with application APP4, and the third host node 30 is deployed with application APP5; domain name routers are deployed on some host nodes in the domain name resolution system 100, the first host node 10 is deployed with a first domain name router 101, and the second host node 20 is deployed with a second domain name router 201. The first domain name router 101 and the second domain name router 201 are deployed in a distributed manner to jointly provide domain name resolution services for application APP1, application APP2, application APP3, application APP4, and application APP5. In other scenarios, each host node in the domain name resolution system 100 may be respectively deployed with a domain name router, for example Figure 2 As shown, N domain name routers can be deployed on N host nodes.

[0029] In the domain name filtering system 100, any domain name router is used to obtain a domain name resolution request of a target application, and identify the risk of the domain name resolution request according to domain name filtering rules corresponding to different risk types, and obtain the target risk type corresponding to the domain name resolution request. In some optional embodiments, the target application may include an application deployed on the same host node as the domain name router. Figure 1 As shown, the first domain name router 101 can obtain the domain name resolution requests corresponding to the applications APP1, APP2 and APP3, perform risk identification on the domain name resolution requests corresponding to the above multiple applications, and obtain the target risk type corresponding to each domain name resolution request.

[0030] In some other optional embodiments, the target application may include: an application deployed on a different host node than the domain name router. Figure 1 As shown, the second domain name router 201 can obtain the domain name resolution requests corresponding to the application APP4 and the application APP5, perform risk identification on the domain name resolution requests corresponding to the above multiple applications, and obtain the target risk type corresponding to each domain name resolution request. Among them, the application deployed on a different host node from the domain name router may include an application located on a different host node from the domain name router and having a set distance relationship with the domain name router.

[0031] Optionally, the set distance relationship may include a network distance, a physical distance, or a logical distance between the domain name router and the application, which is not limited in this embodiment. The network distance is the time or number of hops (i.e., the number of routers that the data packet passes through) required for data transmission between the domain name router and the application through the network. The longer the network distance, the higher the data transmission delay from the application to the domain name router. The host node and the domain name router meet the set distance relationship, which may be that the number of hops between the domain name router and the application is less than a set number threshold. The physical distance refers to the distance between the host node where the domain name router is located and the host node where the application is located. The longer the physical distance, the greater the data transmission delay may be. The host node and the domain name router meet the set distance relationship, which may be that the network distance is the physical distance between the host where the domain name router is located and the host where the application is located is less than a set number threshold, for example, the host where the domain name router is located and the host where the application is located are located in the same computer room, or in the same city. The logical distance is the distance between the application and the domain name router at the software architecture level, and the host node and the domain name router meet the set distance relationship, which may include: the domain name router and the application are located in the same subnet, in the same virtual private cloud, in the same security group, or in the same network namespace. Based on this implementation method, for a domain name router on any host node, it can provide domain name filtering services to applications on other host nodes based on the principle of proximity, so that the domain name router can detect the risk type of domain name requests at the origin of the domain name resolution request or at a location close to the origin, ensuring that the domain name filtering rules can be quickly and effectively applied to applications to protect network security and performance.

[0032] Among them, the risk type is used to classify different risk levels, for example, the risk type may include: high risk, medium risk, and low risk. In this embodiment, different risk types correspond to different domain name filtering rules, so as to identify the risk of domain name resolution requests based on the domain name filtering rules. For example, the domain name filtering rules corresponding to high risk may include: the domain name to be resolved in the domain name resolution request matches the forbidden list, the port corresponding to the domain name resolution request is the port used for amplification attack, and the user corresponding to the domain name resolution request matches the user list with restricted access to the external network. The domain name filtering rules corresponding to medium risk may include: the string carried in the domain name to be resolved matches the name of the specified advertising website, and the sending time of the domain name resolution request is within the set time range (for example, at night). The domain name filtering rules corresponding to low risk may include: the domain name to be resolved belongs to a reputable network platform, and the domain name to be resolved matches the allowed list. When the risk of the domain name resolution request is identified, the domain name resolution request can be matched with the domain name filtering rules corresponding to different risk types. When the domain name resolution request matches any domain name filtering rule, the domain name router can determine the target risk type corresponding to the domain name resolution request according to the risk type corresponding to the domain name filtering rule. After determining the target risk type, the domain name router can use the domain name resolution method corresponding to the target risk type to resolve the domain name resolution request and obtain the domain name resolution result. In this implementation, different risk types correspond to different domain name resolution methods, so as to differentially process domain name resolution requests of different risk levels and ensure the security of the application.

[0033] In this embodiment, a domain name router is deployed on at least part of the host nodes where the application is deployed, so that the domain name router can detect the risk type of the domain name resolution request in time before performing the domain name resolution operation, so as to perform risk management as early as possible and improve the security of the application deployed on the host node. In addition, the domain name router on any host node can be implemented as a software module running on the host node. Compared with the hardware firewall, this software module has the characteristics of being lightweight and can reuse the existing host nodes, reducing the cost required for domain name filtering.

[0034] In some optional embodiments, any host node among the plurality of host nodes, such as Figure 1A domain name manager 401 may be deployed on the fourth host node 40 shown, and the domain name manager 401 is mainly used to provide domain name filtering rules corresponding to different risk types to the domain name router. Optionally, the domain name manager 401 may obtain a security policy file configured by a user, such as an operator of a domain name filtering system, and obtain domain name filtering rules corresponding to different risk types from the file. The security policy file may be configured by the operator based on experience, or obtained based on a list of harmful websites published by a relevant organization / industry alliance. Optionally, the domain name manager 401 may also periodically access services that can provide domain name filtering through an application programming interface (Application Programming Interface, API) to obtain domain name filtering rules from these services. Optionally, the domain name manager 401 may also access forums or social media groups related to network security through some browser plug-ins or tools to obtain filtering rules shared by relevant professionals in the forums or social media groups, which are not listed one by one.

[0035] In some optional embodiments, the domain manager 401 may precipitate information obtained from forums or social media groups related to network security into domain name filtering rules. For example, the domain manager 401 may obtain domain name related posts from forums or social media groups through an API interface and filter these posts. Optionally, the domain manager 401 may filter out posts that may contain domain name filtering rules based on a predefined keyword list, such as keywords such as "malicious website" and "phishing link", and parse the text content using natural language processing (NLP) technology to identify specific domain names, IP addresses or other related entities mentioned in the posts. The domain manager 401 may perform risk scoring on each extracted domain name based on the descriptions related to the high and low risk attributes in the posts, and label them with corresponding risk tags. Afterwards, the domain name or IP address may be used as a matching condition, and the risk tag may be used as a risk type to establish a domain name filtering rule.

[0036] After the domain name manager 401 obtains the filtering rules corresponding to different risk types, it can periodically send the filtering rules to each domain name router, or the domain name manager 401 can send the obtained domain name filtering rules to each domain name router in real time after each time it obtains the filtering rules corresponding to different risk types. Based on this implementation, in a distributed domain name filtering architecture, the real-time update of the domain name filtering rules is realized, so that the domain name filtering rules on a single host node can also maintain a high timeliness and consistency.

[0037] In some optional embodiments, different applications may correspond to different domain name filtering rules, or different types of applications may correspond to different domain name filtering rules. For example, the domain name filtering rules corresponding to browsers and web applications are used to identify malicious websites, advertisements, etc. The domain name filtering rules corresponding to mail clients are used to identify mail servers or IP addresses from banned lists to prevent spam, phishing emails, and malicious attachments from posing security risks to applications. The domain name filtering rules corresponding to financial transaction software are used to allow access to specific bank API endpoints and authentication portals to restrict other non-essential Internet traffic.

[0038] Optionally, when the domain name router identifies the risk of the domain name resolution request according to the domain name filtering rules corresponding to the different risk types, it can obtain the target domain name filtering rules corresponding to the target application from the domain name filtering rules corresponding to the different risk types. For example, in some embodiments, the domain name router can store the corresponding relationship between different risk types and domain name filtering rules, and query the above corresponding relationship according to the target risk type corresponding to the target application, and obtain the domain name filtering rules corresponding to the target risk type as the target domain name filtering rules corresponding to the target application. Among them, the rules in the target domain name filtering rules can correspond to at least one risk type. That is, the target domain name filtering rules can contain rules for one risk type, or can contain rules for multiple risk types. Figure 2 As shown, when the first domain name router 101 is used to provide domain name resolution services for applications APP1, APP2, and APP3, if a domain name resolution request sent by application APP1 is received, the domain name filtering rule corresponding to application APP1 can be obtained from the domain name filtering rules corresponding to different risk types as the target domain name filtering rule corresponding to application APP1. Correspondingly, when the Nth domain name router is used to provide domain name resolution services for application APPn, if a domain name resolution request sent by application APP1 is received, the domain name filtering rule corresponding to application APPn can be obtained from the domain name filtering rules corresponding to different risk types as the target domain name filtering rule corresponding to application APPn.

[0039] Optionally, the target domain name filtering rules may include one or more filtering rules, and different filtering rules may contain different matching conditions. The domain name router may perform rule matching on the domain name resolution request according to the target domain name filtering rules to obtain the target rule matched by the domain name resolution request. When performing rule matching, the domain name router may match the domain name resolution request with the conditions contained in each rule in the target domain name filtering rules to determine whether the domain name resolution request satisfies the conditions contained in any rule. If the domain name resolution request satisfies the conditions contained in any rule, it can be determined that the domain name resolution request matches the rule corresponding to the condition. The rule matched by the domain name resolution request is described as the target rule. After determining the target rule, the risk type corresponding to the domain name resolution request can be obtained according to the risk type corresponding to the target rule.

[0040] In this implementation, the domain name router can identify the risk type corresponding to the domain name resolution request of the application according to the domain name filtering rules corresponding to the different risk types, so as to distinguish the domain name resolution requests with different risks, thereby improving the security of the application.

[0041] In some optional embodiments, the risk types may be divided according to the level of risk, and the risk types obtained by the division may include: a first risk type and a second risk type. Among them, the risk threshold of the first risk type is less than the first threshold, the risk threshold of the second risk type is greater than the second threshold, and the second threshold is greater than the first threshold. In other words, the risk level of the first risk type is lower than that of the second risk type. The first risk type corresponds to low risk, and the second risk type corresponds to high risk.

[0042] The domain name of the second risk type may include: a known malicious domain name, a phishing website or other domain names that seriously threaten network security. Optionally, when resolving the domain name resolution request using a domain name resolution method corresponding to the target risk type, if the risk type corresponding to the domain name resolution request is the second risk type, the domain name resolution request is intercepted, or the domain name resolution request is resolved to a specified address, which is an invalid address or an address corresponding to a specified security page.

[0043] like Figure 2 As shown in the abnormal DNS response path, when the risk type corresponding to the application APP1 is the second risk type, the first domain name router can directly intercept the domain name resolution request initiated by the application APP1. Based on this implementation, the domain name router can effectively prevent the application from accessing high-risk domain names and improve the security of the application.

[0044] Optionally, if the risk type corresponding to the domain name resolution request is the first risk type, the domain name router may query whether there is an address corresponding to the domain name resolution request in the local cache. If there is an address corresponding to the domain name resolution request in the local cache of the domain name router, the queried address may be used as the domain name resolution result. Figure 2 As shown in the normal DNS response path shown, when the risk type corresponding to the application APP2 is the first risk type, the first domain name router can query whether there is an address corresponding to the domain name resolution request initiated by the application APP2 in the local cache. If the address corresponding to the domain name resolution request exists in the local cache of the first domain name router, the queried address can be used as the domain name resolution result, and the domain name resolution result is returned to the application APP2.

[0045] Alternatively, if Figure 1 as well as Figure 2 As shown, the domain name resolution system 100 also includes: a domain name resolution cluster 50. Among them, the domain name resolution cluster 50 is a centralized domain name resolution cluster composed of multiple DNS servers, which jointly provide domain name resolution services by recursive query or forwarding to external DNS services. In the domain name resolution cluster 50, each DNS server has the ability to independently process DNS queries, and can keep in sync by sharing the same domain name resolution data or through some mechanism. If the address corresponding to the domain name resolution request does not exist in the local cache of the domain name router, the domain name router can send the domain name resolution request to the domain name resolution cluster 50, so that the domain name resolution cluster 50 resolves the domain name resolution request and obtains the domain name resolution result. When the domain name resolution cluster 50 resolves the domain name resolution request, it can search for the resolution result corresponding to the domain name resolution request on multiple DNS servers in the domain name resolution cluster 50 by recursive query. If no resolution result is found, the domain name resolution request can be forwarded to Figure 1 The external domain name resolution service in the external network shown in the figure can resolve the domain name resolution request and return the resolution result. Figure 2 As shown in the normal DNS response path shown, when the risk type corresponding to the application APP3 is the first risk type, the first domain name router can query whether there is an address corresponding to the domain name resolution request initiated by the application APP3 in the local cache. If the address corresponding to the domain name resolution request does not exist in the local cache of the first domain name router, the first domain name router can send the domain name resolution request to the domain name resolution cluster 50, so that the domain name resolution cluster 50 resolves the domain name resolution request and obtains the domain name resolution result. The first domain name router can return the domain name resolution result returned by the domain name resolution cluster 50 to the application APP3.

[0046] In this embodiment, some domain name resolution results can be stored in the local cache of the domain name router for nearby query of resolution results corresponding to domain name resolution requests, thereby reducing the number of domain name resolution requests sent to the domain name resolution cluster 50 and alleviating the access pressure and resolution pressure on the domain name resolution cluster 50.

[0047] In some optional embodiments, after the domain name router sends the domain name resolution request to the domain name resolution cluster 50 and obtains the domain name resolution result, the domain name resolution result can be added to the local cache to update the local cache. Furthermore, when the domain name resolution request is received again, the domain name resolution result corresponding to the domain name resolution request can be queried in the local cache, thereby reducing the dependence on the domain name resolution cluster 50. Optionally, the domain name router can also send the domain name resolution request and its corresponding domain name resolution result to the domain name manager 401 for storage. The domain name manager 401 can send the domain name resolution request and its corresponding domain name resolution result to multiple domain name routers for caching, so that multiple domain name routers can resolve the domain name resolution request locally. Based on this implementation method, the dependence of the domain name resolution service on the centralized domain name resolution cluster 50 can be effectively reduced, and the risk of collapse of the domain name resolution cluster 50 due to excessive access pressure can be reduced, thereby improving the overall security of the domain name resolution system.

[0048] In addition to the domain name resolution system provided in the above-mentioned embodiment, the embodiment of the present application also provides a domain name resolution method, which is applied to any domain name router among multiple domain name routers, the multiple domain name routers run on at least some of the multiple host nodes, the multiple host nodes are deployed with multiple applications, and the multiple domain name routers jointly provide domain name resolution services for the multiple applications. When the method is executed by any domain name router, it mainly includes the following steps: Step 301: Obtain a domain name resolution request of a target application.

[0049] Step 302: According to domain name filtering rules corresponding to different risk types, risk identification is performed on the domain name resolution request to obtain a target risk type corresponding to the domain name resolution request.

[0050] Step 303: Use a domain name resolution method corresponding to the target risk type to resolve the domain name resolution request and obtain a domain name resolution result.

[0051] In step 301, the target application may include an application deployed on the same host node as the domain name router, and / or an application deployed on a different host node from the domain name router. Among them, the application deployed on a different host node from the domain name router may include an application located on a different host node from the domain name router and having a set distance relationship with the domain name router. Optionally, the set distance relationship may include a network distance, a physical distance, or a logical distance between the domain name router and the application, which will not be described separately.

[0052] In step 302, the risk type is used to classify different risk levels, for example, the risk type may include: high risk, medium risk, and low risk. In this embodiment, different risk types correspond to different domain name filtering rules to identify risks of domain name resolution requests based on the domain name filtering rules. For example, the domain name filtering rules corresponding to high risk may include: the domain name to be resolved in the domain name resolution request matches the banned list, the port corresponding to the domain name resolution request is the port used for amplification attacks, and the user corresponding to the domain name resolution request matches the user list with restricted access to the external network. The domain name filtering rules corresponding to medium risk may include: the character string carried in the domain name to be resolved matches the name of the specified advertising website, and the sending time of the domain name resolution request is within the set time range (for example, at night). The domain name filtering rules corresponding to low risk may include: the domain name to be resolved belongs to a reputable network platform, the domain name to be resolved matches the allowed list, etc. Optionally, a method of performing risk identification on the domain name resolution request according to domain name filtering rules corresponding to different risk types to obtain the risk type corresponding to the domain name resolution request may include: obtaining the target domain name filtering rule corresponding to the target application from the domain name filtering rules corresponding to the different risk types; performing rule matching on the domain name resolution request according to the target domain name filtering rule to obtain the target rule matched by the domain name resolution request; and obtaining the risk type corresponding to the domain name resolution request according to the risk type corresponding to the target rule.

[0053] In step 303, after determining the target risk type, the domain name router may adopt the domain name resolution method corresponding to the target risk type to resolve the domain name resolution request and obtain the domain name resolution result. In this embodiment, different risk types correspond to different domain name resolution methods, so as to differentially process domain name resolution requests of different risk levels and ensure the security of the application.

[0054] Optionally, a method of resolving the domain name resolution request by adopting a domain name resolution method corresponding to the target risk type may include: if the risk type corresponding to the domain name resolution request is the second risk type, intercepting the domain name resolution request, or resolving the domain name resolution request to a specified address, which is an invalid address or an address corresponding to a specified security page. Optionally, a method of resolving the domain name resolution request by adopting a domain name resolution method corresponding to the target risk type to obtain a domain name resolution result may include: if the risk type corresponding to the domain name resolution request is the first risk type, querying whether there is an address corresponding to the domain name resolution request in the local cache; if so, using the queried address as the domain name resolution result; if not, sending the domain name resolution request to the domain name resolution cluster so that the domain name resolution cluster resolves the domain name resolution request and obtains the domain name resolution result. Based on this implementation, the local cache of the domain name router may store part of the domain name resolution results for nearby query of the resolution result corresponding to the domain name resolution request, thereby reducing the number of domain name resolution requests sent to the domain name resolution cluster and alleviating the access pressure and resolution pressure on the domain name resolution cluster.

[0055] Optionally, the domain name resolution request is sent to a domain name resolution cluster so that the domain name resolution cluster resolves the domain name resolution request. After obtaining the domain name resolution result, the process further includes: adding the domain name resolution result to the local cache to update the local cache. Furthermore, in the subsequent process of providing domain name resolution services, the domain name router can resolve the domain name resolution request locally, thereby effectively reducing the dependence of the domain name resolution service on the centralized domain name resolution cluster and reducing the risk of collapse of the domain name resolution cluster due to excessive access pressure.

[0056] In this embodiment, multiple applications are deployed on multiple host nodes, and multiple domain name routers are deployed on at least some of the multiple host nodes, and the multiple domain name routers jointly provide domain name resolution services for the multiple applications. In this architecture, any domain name router is used to: obtain the domain name resolution request of the target application, identify the risk of the domain name resolution request according to the domain name filtering rules corresponding to different risk types, obtain the target risk type corresponding to the domain name resolution request, and use the domain name resolution method corresponding to the target risk type to resolve the domain name resolution request to obtain the domain name resolution result. In this implementation, the domain name router is deployed on at least some of the host nodes where the application is deployed, so that the domain name router can timely detect the risk type of the domain name resolution request at the origin of the domain name resolution request or near the origin of the origin, so as to perform risk management as early as possible and improve the security of the application deployed on the host node.

[0057] The following will be combined Figure 4 The flowchart shown in FIG. 1 further illustrates the domain name resolution method provided in the embodiment of the present application. Figure 4 As shown, after the application on the host node in the private cloud initiates a domain name resolution request, the domain name router can intercept the domain name resolution request, match the domain name filtering rules according to the domain name request, and determine whether the domain name resolution request passes the security control policy according to the matching result of the domain name filtering rules. Specifically, if the domain name resolution request matches the rule of the abnormal type in the domain name filtering rule, the domain name router can determine that the domain name resolution request does not pass the security control policy, and can discard the domain name resolution request and record a log. If the domain name resolution request does not match any rule in the domain name filtering rule or matches the rule of the first risk type, it can be determined that the resolution request passes the security control policy.

[0058] After the security control strategy is passed, Figure 4 As shown, the domain name router can check the local cache according to the domain name resolution request and determine whether it matches the local cache record. If the local cache record is matched, the resolution result can be returned to the host node and a log is recorded. If the local cache record is not matched, the domain name resolution request can be forwarded to the DNS resolution cluster in the private cloud to process the DNS resolution request. The DNS resolution cluster in the private cloud can query the local cache record in the cluster. If the domain name resolution request matches the local cache record in the cluster, the resolution result can be returned to the host node and a log is recorded. If the domain name resolution request does not match the local cache record in the cluster, the domain name resolution cluster can forward the domain name resolution request to the DNS service outside the private cloud and obtain the resolution result obtained by the external DNS service. The domain name resolution cluster can return the obtained resolution result to the domain name router, and the domain name router can return the resolution result to the host node, and can save the domain name resolution request and its corresponding resolution result as a local cache record for subsequent query. In addition, the domain name router can regularly upload the local cache record to the domain name manager so that the domain name manager can synchronize cache records between different domain name routers. The domain name manager can also provide a visual interface that can display the number of domain name resolution requests of different risk types counted based on log records to display an abnormal situation report.

[0059] It should be noted that the execution subject of each step of the method provided in the above embodiment can be the same device, or the method can be executed by different devices. For example, the execution subject of steps 301 to 304 can be device A; for another example, the execution subject of steps 301 and 302 can be device A, and the execution subject of step 303 can be device B; and so on.

[0060] In addition, in some of the processes described in the above embodiments and the accompanying drawings, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel, and the sequence numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the sequence numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0061] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0062] Figure 5 The schematic diagram of the structure of an electronic device provided by an exemplary embodiment of the present application is illustrated, and the electronic device can be implemented as any server device in a cloud computing cluster. In some embodiments, the server device can be used as a physical host node, and a domain name router can be run on the physical host node. Multiple domain name routers can be deployed on multiple physical nodes in the cloud computing cluster, and the multiple domain name routers run in a distributed manner to jointly provide domain name resolution services for multiple applications running in the cloud computing cluster. In other implementation embodiments, one or more virtual host nodes can be run on the server device, and a domain name router can be run on the virtual host node. Multiple domain name routers can be deployed on multiple virtual nodes in the cloud computing cluster, and the multiple domain name routers run in a distributed manner to jointly provide domain name resolution services for multiple applications running in the cloud computing cluster.

[0063] like Figure 5 As shown, the electronic device includes: a memory 501 , a processor 502 and a communication component 503 .

[0064] The memory 501 is used to store computer programs and can be configured to store various other data to support operations on the electronic device. Examples of such data include instructions for any application or method used to operate on the electronic device.

[0065] The processor 502 is coupled to the memory 501 and is used to execute the computer program in the memory 501, so as to: obtain a domain name resolution request of a target application; perform risk identification on the domain name resolution request according to domain name filtering rules corresponding to different risk types to obtain a target risk type corresponding to the domain name resolution request; and resolve the domain name resolution request using a domain name resolution method corresponding to the target risk type to obtain a domain name resolution result.

[0066] Optionally, when the processor 502 performs risk identification on the domain name resolution request according to the domain name filtering rules corresponding to different risk types and obtains the risk type corresponding to the domain name resolution request, it is specifically used to: obtain the target domain name filtering rules corresponding to the target application from the domain name filtering rules corresponding to the different risk types, different rules in the target domain name filtering rules correspond to at least one risk type; perform rule matching on the domain name resolution request according to the target domain name filtering rules to obtain the target rule matched by the domain name resolution request; and obtain the risk type corresponding to the domain name resolution request according to the risk type corresponding to the target rule.

[0067] Optionally, when the processor 502 adopts the domain name resolution method corresponding to the target risk type to resolve the domain name resolution request and obtains the domain name resolution result, it is specifically used to: if the risk type corresponding to the domain name resolution request is a first risk type, query whether there is an address corresponding to the domain name resolution request in the local cache, and the risk threshold of the first risk type is less than the first threshold; if it exists, use the queried address as the domain name resolution result; if it does not exist, send the domain name resolution request to the domain name resolution cluster, so that the domain name resolution cluster resolves the domain name resolution request to obtain the domain name resolution result.

[0068] Optionally, after sending the domain name resolution request to the domain name resolution cluster so that the domain name resolution cluster resolves the domain name resolution request and obtains the domain name resolution result, the processor 502 is further used to: add the domain name resolution result to the local cache to update the local cache.

[0069] Optionally, when the processor 502 adopts the domain name resolution method corresponding to the target risk type to resolve the domain name resolution request, it is specifically used to: if the risk type corresponding to the domain name resolution request is the second risk type, intercept the domain name resolution request, or resolve the domain name resolution request to a specified address, which is an invalid address or an address corresponding to a specified security page, and the risk threshold of the second risk type is greater than the second threshold; if located on different host nodes, the target application and the domain name router satisfy the set distance relationship.

[0070] Optionally, the target application and the domain name router are located on the same host node or on different host nodes.

[0071] Further, if Figure 5 As shown, the electronic device also includes: a power supply component 504, a display component 505, an audio component 506 and other components. Figure 5 Only some components are shown schematically, which does not mean that the electronic device only includes Figure 5 Components shown.

[0072] Among them, the memory 501 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0073] The communication component 503 is configured to facilitate wired or wireless communication between the device where the communication component is located and other devices. The device where the communication component is located can access a wireless network based on a communication standard, such as Wi-Fi (wireless network communication technology), 2G (such as Global System for Mobile Communications (GSM)), 3G (such as Wideband Code Division Multiple Access (WCDMA), 4G (such as Long Term Evolution (LTE)), 4G+ (such as upgraded Long Term Evolution (LTE-Advanced, LTE-A)) or 5G (5th Generation Mobile Communication Technology), or a combination thereof. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component can be implemented based on Near Field Communication (NFC) technology, Radio Frequency Identification (RFID) technology, Infrared Data Association (IrDA) technology, Ultra Wide Band (UWB) technology, Bluetooth (BT) technology and other technologies.

[0074] The power supply component 504 is used to provide power to various components of the device where the power supply component is located. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing and distributing power to the device where the power supply component is located.

[0075] The display assembly includes a screen, which may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundary of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.

[0076] The audio component may be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC), and when the device where the audio component is located is in an operating mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal may be further stored in a memory or sent via a communication component. In some embodiments, the audio component also includes a speaker for outputting an audio signal.

[0077] In this embodiment, a domain name router is deployed on a host node where an application is deployed, so that the domain name router can detect the risk type of the domain name resolution request in time before performing the domain name resolution operation, thereby performing risk management as early as possible and improving the security of the application deployed on the host node.

[0078] Accordingly, the embodiment of the present application also provides a computer-readable storage medium storing a computer program, and when the computer program is executed, each step that can be performed by the electronic device in the above method embodiment can be implemented. Among them, the computer-readable storage medium includes volatile or non-volatile or a combination thereof, and can be removable or non-removable. Examples of computer-readable storage media include, but are not limited to, phase-change random access memory (Phase-change Random Access Memory, PRAM), static random access memory (SRAM), dynamic random access memory (Dynamic Random Access Memory, DRAM), other types of random access memory (Random-Access Memory, RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), flash memory or other memory technology, read-only compact disc read-only memory (CD-ROM), digital versatile disc (Digital Video Disc, DVD) or other optical storage, magnetic cassette, tape disk storage or other magnetic storage device or any other non-transmission medium.

[0079] The present application embodiment also provides a computer program product, including: a computer program / instruction, which can implement the steps in the method provided in the present application embodiment when the computer program / instruction is executed by a processor. It should be understood that each process or a combination of multiple processes in the above method flow can be implemented by a computer program or instruction. In addition, these computer programs or instructions can be applied to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device, so that the processor of the general-purpose computer, the special-purpose computer, the embedded processor or other programmable data processing device can be implemented as a device for implementing the corresponding functions in the above method embodiment.

[0080] It should also be noted that the terms "comprises", "includes" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, product or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, product or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the presence of other identical elements in the process, method, product or device including the element.

[0081] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A domain name resolution system, characterized in that: include: A plurality of host nodes, a plurality of applications are deployed on the plurality of host nodes, a plurality of domain name routers are deployed on at least some of the plurality of host nodes, and the plurality of domain name routers jointly provide domain name resolution services for the plurality of applications; Among them, any domain name router is used to: obtain a domain name resolution request of a target application; identify risks on the domain name resolution request according to domain name filtering rules corresponding to different risk types to obtain a target risk type corresponding to the domain name resolution request; and resolve the domain name resolution request using a domain name resolution method corresponding to the target risk type to obtain a domain name resolution result.

2. The system according to claim 1, characterized in that A domain name manager is deployed on any host node among the multiple host nodes; the domain name manager is used to provide the domain name router with domain name filtering rules corresponding to the different risk types.

3. The system according to claim 1 or 2, characterized in that: The target application includes: an application located on the same host node as the domain name router, and / or an application located on a different host node from the domain name router and having a set distance relationship with the domain name router.

4. The system according to claim 1 or 2, characterized in that: Also includes: Domain name resolution cluster; The domain name router is used to: if the risk type corresponding to the domain name resolution request is a first risk type, query whether there is an address corresponding to the domain name resolution request in the local cache, and the risk threshold of the first risk type is less than a first threshold; If it exists, the queried address is used as the domain name resolution result; If not, the domain name resolution request is sent to the domain name resolution cluster, so that the domain name resolution cluster resolves the domain name resolution request to obtain the domain name resolution result.

5. A domain name resolution method, characterized in that: The method is applied to any domain name router among a plurality of domain name routers, wherein the plurality of domain name routers are run on at least some of a plurality of host nodes, a plurality of application programs are deployed on the plurality of host nodes, and the plurality of domain name routers jointly provide domain name resolution services for the plurality of application programs; the method comprises: Get the domain name resolution request of the target application; According to domain name filtering rules corresponding to different risk types, risk identification is performed on the domain name resolution request to obtain a target risk type corresponding to the domain name resolution request; The domain name resolution request is resolved using a domain name resolution method corresponding to the target risk type to obtain a domain name resolution result.

6. The method according to claim 5, characterized in that According to the domain name filtering rules corresponding to different risk types, risk identification is performed on the domain name resolution request to obtain the risk type corresponding to the domain name resolution request, including: Acquire a target domain name filtering rule corresponding to the target application from the domain name filtering rules corresponding to the different risk types, wherein different rules in the target domain name filtering rules correspond to at least one risk type; According to the target domain name filtering rule, the domain name resolution request is matched to obtain the target rule matched by the domain name resolution request; According to the risk type corresponding to the target rule, the risk type corresponding to the domain name resolution request is obtained.

7. The method according to claim 5, characterized in that The domain name resolution request is resolved using a domain name resolution method corresponding to the target risk type to obtain a domain name resolution result, including: If the risk type corresponding to the domain name resolution request is the first risk type, querying whether there is an address corresponding to the domain name resolution request in the local cache, and the risk threshold of the first risk type is less than the first threshold; If it exists, the queried address is used as the domain name resolution result; If not, the domain name resolution request is sent to a domain name resolution cluster, so that the domain name resolution cluster resolves the domain name resolution request to obtain the domain name resolution result.

8. The method according to claim 7, characterized in that The domain name resolution request is sent to a domain name resolution cluster so that the domain name resolution cluster resolves the domain name resolution request. After obtaining the domain name resolution result, the method further includes: The domain name resolution result is added to the local cache to update the local cache.

9. The method according to claim 5, characterized in that The domain name resolution request is resolved using a domain name resolution method corresponding to the target risk type, including: If the risk type corresponding to the domain name resolution request is the second risk type, the domain name resolution request is intercepted, or the domain name resolution request is resolved to a specified address, which is an invalid address or an address corresponding to a specified security page, and the risk threshold of the second risk type is greater than the second threshold.

10. The method according to any one of claims 5 to 9, characterized in that: The target application and the domain name router are located on the same host node or on different host nodes; if they are located on different host nodes, the target application and the domain name router satisfy a set distance relationship.

11. An electronic device, characterized in that: include: Memory and processor; The memory is used to store one or more computer instructions; The processor is configured to execute the one or more computer instructions to: perform the steps in the method according to any one of claims 5-10.

12. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps in the method described in any one of claims 5 to 10 can be implemented.

13. A computer program product, characterized in that include: A computer program / instruction, which, when executed by a processor, can implement the steps of the method described in any one of claims 5 to 10.

Images