A method for real-time resolution and secure access of virtual domain name

Abstract

The application provides a real-time resolution and security access method for virtual domain names, belonging to the technical field of security access, comprising: real-time monitoring of changes in relevant information of virtual domain names, and when changes are detected, new data is sent to each resolution node in the resolution network; according to the current factor set of each resolution node, the domain name access request sent by the client is dynamically distributed to the appropriate resolution node, and after the resolution of the domain name access request is completed in the first node, the resolution result is verified and corrected to determine the target virtual address set; according to the target virtual address set and in combination with the current authority of the client, the security of each target virtual address is determined, and the final virtual address is determined to enable the client to communicate with the control server; after the communication connection is established, the access process is monitored in real time based on the security monitoring mechanism to realize security access. The reliability of resolution is improved and security access is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of secure access, and in particular to a real-time resolution and secure access method of virtual domain name. BACKGROUND

[0002] With the wide application of emerging technologies such as cloud computing and big data, a large number of business systems and data resources are deployed in a virtual environment, and virtual domain name becomes a key entry for accessing these resources. However, the information associated with the virtual domain name is not constant, for example, when the business architecture is adjusted, the server is migrated or the resource is updated, the relevant information of the virtual domain name (such as the corresponding target server address, resolution rule, etc.) will change. If these changes cannot be monitored in time and updated to the resolution network, the user's access request will not be able to accurately reach the target resource, resulting in service interruption or error.

[0003] In the resolution network, the performance and state of each resolution node are in dynamic change at all times. Under different times and different business loads, the hardware resource utilization (such as CPU, memory, disk I / O), network bandwidth occupation and geographical location of the resolution node will affect its processing capacity for domain name access requests. The traditional static allocation request method cannot adapt to such dynamic changes, which is easy to cause some nodes to have too high load and performance degradation, while some nodes have idle resources, resulting in low overall resolution efficiency.

[0004] In addition, the accuracy of the domain name resolution result is crucial. Due to the complexity of the network environment, such as network delay, data transmission error or resolution node failure, the resolution result may deviate. If it is used directly without verification and correction, it may lead to the user accessing to the wrong resource, and even face security risks, such as accessing to a false website maliciously tampered.

[0005] When the client accesses the network resource, it should have different access permissions due to its identity, user group it belongs to and network environment it is in. If the security of the target virtual address cannot be evaluated in combination with the current permissions of the client, sensitive information may be illegally accessed and leaked. At the same time, after the client and the control server establish a communication connection, there is a lack of effective security monitoring mechanism, and the communication process is vulnerable to attacks, such as data theft, tampering or denial of service attacks.

[0006] Therefore, the present application proposes a real-time resolution and secure access method of virtual domain name. SUMMARY

[0007] The application provides a real-time resolution and secure access method for virtual domain names, which updates the resolution nodes by detecting existing changes, dynamically allocates adaptive resolution nodes according to the current factor set, improves the reliability of resolution, and then determines the final virtual address by combining the current authority and security, thereby facilitating the security of communication, and finally realizes secure access by monitoring the access process.

[0008] The application provides a real-time resolution and secure access method for virtual domain names, which updates the resolution nodes by detecting existing changes, dynamically allocates adaptive resolution nodes according to the current factor set, improves the reliability of resolution, and then determines the final virtual address by combining the current authority and security, thereby facilitating the security of communication, and finally realizes secure access by monitoring the access process.

[0009] Step 1: Real-time monitoring of changes in related information of virtual domain names, when detecting changes, new data is sent to each resolution node in the resolution network;

[0010] Step 2: According to the current factor set of each resolution node, dynamically allocate the domain name access request sent by the client to the adaptive resolution node, at this time, the adaptive resolution node is regarded as the first node;

[0011] Step 3: After the first node completes the resolution of the domain name access request, the resolution result is verified and corrected to determine the target virtual address set;

[0012] Step 4: According to the target virtual address set and combining the current authority of the client, the security of each target virtual address is determined, and the final virtual address is determined to enable the client to communicate with the control server;

[0013] Step 5: After establishing a communication connection, the access process is monitored in real time based on a security monitoring mechanism to realize secure access.

[0014] Preferably, the new data is sent to each resolution node in the resolution network, including:

[0015] The configuration file, registration information and geographic location data of each resolution node are first acquired, and the processing capacity, storage capacity, network bandwidth and response time of each resolution node are second acquired;

[0016] According to the first acquisition result and the second acquisition result, the corresponding first score and the second score are configured to each resolution node;

[0017] The geographic location distance between the resolution nodes is calculated and normalized to obtain a node distribution distance graph, a first weight is configured to the first score, and a second weight is configured to the second score;

[0018] According to the first score, the first weight, the second score and the second weight, a comprehensive score is set to the corresponding resolution node, and the resolution nodes within the corresponding division distance range are divided into high-level nodes, middle-level nodes and bottom-level nodes according to the comprehensive score according to the equal interval division rule.

[0019] performing system simulation test on each parsed node to determine a satisfaction coefficient of each parsed node meeting performance requirements under the simulation test and business logic;

[0020] if the satisfaction coefficient is greater than or equal to a preset coefficient, the corresponding division result is kept unchanged;

[0021] otherwise, the parsed node with the satisfaction coefficient less than the preset coefficient is locked and regarded as a second node;

[0022] if the second node is a high-level node or a middle-level node, the second node is converted into a bottom-level node;

[0023] if the second node is a bottom-level node, the corresponding division result is kept unchanged;

[0024] based on the final division result, new data is sequentially distributed from a high-level node to a middle-level node and a low-level node.

[0025] Preferably, the domain name access request sent by the client is dynamically distributed to the adaptive parsed node according to the current factor set of each parsed node, including:

[0026] the historical parsed data set of each parsed node is called, wherein the historical parsed data set includes: parsed success or failure under each historical parsing, historical parsing delay time length, and load of the corresponding parsed node under the corresponding historical parsing, distance between the client and the corresponding parsed node, packet loss rate of the network type to which the corresponding parsed node belongs;

[0027] a multi-objective optimization distribution function is established according to the historical parsed data set;

[0028] the latest current factor set of the corresponding parsed node based on the current time is obtained and input into the multi-objective optimization distribution function to determine the parsed success probability;

[0029] the node corresponding to the maximum probability is selected from all parsed success probabilities and regarded as the adaptive parsed node.

[0030] Preferably, the multi-objective optimization distribution function is established according to the historical parsed data set, including:

[0031] the parsed result of each historical parsing request of the same parsed node is constructed into a historical parsed vector;

[0032] all historical parsed vectors are sequentially arranged in time order to obtain a historical parsed matrix, and the historical parsed matrix is solved to obtain a first characteristic function;

[0033] According to whether the analysis is successful, the historical analysis matrix is divided into a first matrix of complete analysis success and a second matrix of complete analysis failure, and the first matrix and the second matrix are solved respectively to obtain a corresponding second characteristic function and a third characteristic function;

[0034] The number of occurrences of the element in the preferred state in each historical analysis vector is locked respectively, the vector with the largest number of occurrences is combined into a new matrix, and the new matrix is solved to obtain a fourth characteristic function;

[0035] The coefficients of the same variable under the first characteristic function, the second characteristic function and the third characteristic function are extracted to obtain a coefficient array corresponding to the variable, wherein the coefficient array includes a first coefficient based on the first characteristic function, a second coefficient based on the second characteristic function and a third coefficient based on the third characteristic function corresponding to the variable;

[0036] The maximum value in the coefficient array of each variable is extracted to obtain a first array;

[0037] The minimum value in the coefficient array of each variable is extracted to obtain a second array;

[0038] The remaining values in the coefficient array of each variable are extracted to obtain a third array;

[0039] According to the first array, the second array and the third array, a corresponding fifth characteristic function is constructed;

[0040] Curve fitting analysis is performed on the first characteristic function, the second characteristic function, the third characteristic function, the fourth characteristic function and all fifth characteristic functions respectively, and the characteristic function under the best fitting is regarded as a multi-objective optimization distribution function.

[0041] Preferably, the analysis result is verified and corrected to determine the target virtual address set, including:

[0042] The same virtual address and compatible virtual address matching the verified and corrected analysis result are obtained from the domain name-virtual address mapping database;

[0043] Based on the matched same virtual address and compatible virtual address, the target virtual address set is formed.

[0044] Preferably, according to the target virtual address set and in combination with the current authority of the client, the security of each target virtual address is determined, including:

[0045] In combination with the current authority, the operation sub-authority for each target virtual address is dynamically adjusted, and in combination with the address type of the target virtual address, the security of each target virtual address is analyzed.

[0046] Preferably, the access process is monitored in real time based on the security monitoring mechanism, including:

[0047] Each transmission data packet in the access process is deeply parsed to determine malicious requests disguised as normal protocols, wherein the deep parsing includes parsing special character sequences and syntax structures in the transmission data packet;

[0048] The operation behavior of the client on the final virtual address is determined, and the operation behavior is logically parsed to determine the existence of malicious access behavior;

[0049] Abnormal behaviors under different environmental factors in the access process are monitored;

[0050] When the security monitoring mechanism detects the presence of malicious requests, malicious access behaviors and / or abnormal behaviors, an abnormal response process is triggered to provide a security alert.

[0051] Preferably, the operation sub-permissions for each target virtual address are dynamically adjusted in combination with the current permissions, including:

[0052] According to the current permissions of the client, the first risk that the access operation of the client on the target virtual address may cause is analyzed;

[0053] The security attributes previously assigned to each target virtual address are obtained, and in combination with the first risk, the first security coefficient of the corresponding target virtual address is evaluated;

[0054] The second security coefficient of the access to the corresponding target virtual address is evaluated by monitoring the encryption method of the network connection, the stability of the connection, and whether there is a potential security threat in the network path;

[0055] Based on the first security coefficient and the second security coefficient, the operation sub-permissions of the corresponding target virtual address are dynamically adjusted.

[0056] Compared with the prior art, the application has the following advantages:

[0057] The parsing node is updated by detecting the existing changes, and the appropriate parsing node is dynamically allocated according to the current factor set, to improve the reliability of the parsing, and the final virtual address is determined by combining the current permissions and the security, to facilitate the security of the communication, and finally the access process is monitored to realize the secure access. BRIEF DESCRIPTION OF DRAWINGS

[0058] In order to more clearly illustrate the technical solutions in the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings described below are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0059] Figure 1 is a flowchart of a virtual domain name real-time resolution and secure access method provided by an embodiment of the present application. DETAILED DESCRIPTION

[0060] In order to make the objects, technical solutions and advantages of the present application clearer, the following will clearly and completely describe the technical solutions in the present application with reference to the drawings in the present application. Obviously, the described embodiments are only some embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the protection scope of the present application.

[0061] The present application provides a virtual domain name real-time resolution and secure access method, as shown in Figure 1 , comprising:

[0062] Step 1: Real-time monitoring of the change of the related information of the virtual domain name, when detecting that there is a change, the new data is issued to each resolution node in the resolution network;

[0063] Step 2: According to the current factor set of each resolution node, the domain name access request sent by the client is dynamically distributed to the adaptive resolution node, at this time, the adaptive resolution node is regarded as the first node;

[0064] Step 3: After the first node resolves the domain name access request, the resolution result is verified and corrected to determine the target virtual address set;

[0065] Step 4: According to the target virtual address set and in combination with the current authority of the client, the security of each target virtual address is determined, and the final virtual address is determined so that the client communicates with the control server;

[0066] Step 5: After establishing the communication connection, the access process is monitored in real time based on the security monitoring mechanism to realize secure access.

[0067] In this embodiment, the virtual domain name is to protect the core business system, and a virtual domain name is published to the outside to hide the real server architecture. When a user accesses the virtual domain name, the actual access is to a certain node in the configured internal server cluster.

[0068] In this embodiment, the resolution network is composed of a network structure of multiple resolution nodes, responsible for resolving domain names (including virtual domain names) into corresponding IP addresses or other address information that can be used to locate target resources. It can be the domain name system (DNS) network in the Internet, and the resolution network is composed of numerous DNS servers worldwide to resolve the website address (domain name) input by the user into the IP address of the website server.

[0069] In this embodiment, the resolution node is the basic unit in the resolution network, each node has certain computing, storage and network communication capabilities, and is used to store and process domain name resolution related data. It receives domain name resolution requests, performs resolution according to the data stored by itself and related algorithms, and returns the resolution result. For example, in a small resolution network built by an enterprise, the server of each department can be used as a resolution node to be responsible for the resolution of related domain names in the department.

[0070] In this embodiment, the current factor set includes various real-time state information of the resolution node, which is used to evaluate the performance and adaptability of the node. These factors cover the hardware performance of the node (such as CPU usage, memory occupation, disk I / O rate), network conditions (bandwidth occupation, network delay, packet loss rate), geographical location and current load conditions, etc. For example, a resolution node located in the core area of the data center, with sufficient network bandwidth and low CPU usage, will be in a dominant position in the evaluation of the current factor set.

[0071] In this embodiment, when the client sends a domain name access request, the system analyzes the current factor set and finds that a resolution node located in the vicinity of the client and with good performance is most suitable for processing the request, and this node becomes the first node.

[0072] In this embodiment, the result obtained by the first node after resolving the domain name access request is usually the target virtual address or IP address corresponding to the domain name and other information. For example, the user inputs a website domain name, and the resolution node returns the IP address corresponding to the website server as the resolution result by querying its own database and related algorithms.

[0073] In this embodiment, the target virtual address set is a set of virtual addresses determined after the resolution result is verified and corrected. These virtual addresses are filtered and confirmed to accurately correspond to the address of the target resource requested by the client. For example, in an enterprise network, multiple virtual addresses are set for different business applications, and when a user requests to access a business application, the virtual address related to the application determined through the resolution and verification process constitutes the target virtual address set.

[0074] The current permission refers to the access permission of the client at the current time. The permissions are determined according to the identity of the client, the user group to which the client belongs, the network environment in which the client is located, and the permission policy preset by the enterprise or system, and the like. For example, an employee of an enterprise may have a higher permission to access the virtual address of the core business data of the enterprise when logging in to the client in the office network environment; and the permission of the client used by an external visitor is limited to the virtual address of the public information.

[0075] In this embodiment, the final virtual address is the target virtual address with the highest security.

[0076] In this embodiment, the security monitoring mechanism is realized from the aspects of the client, the access process, and the transmission data packet.

[0077] The beneficial effects of the above technical solution are: the resolving node is updated by detecting the existing changes, and the resolving node that is adapted according to the current factor set is dynamically allocated, so as to improve the reliability of resolution, and the final virtual address is determined by combining the current permission and security, so as to facilitate the security of communication, and the security of access is realized by monitoring the access process.

[0078] The present application provides a real-time resolving and secure access method for virtual domain names, which comprises the following steps:

[0079] The configuration file, registration information, and geographic location data of each resolving node are first acquired, and the processing capacity, storage capacity, network bandwidth, and response time of each resolving node are second acquired;

[0080] According to the first acquisition result and the second acquisition result, a corresponding first score and a second score are configured for each resolving node;

[0081] The geographic location distance between the resolving nodes is calculated and normalized to obtain a node distribution distance graph, a first weight is configured for the first score, and a second weight is configured for the second score;

[0082] According to the first score, the first weight, the second score, and the second weight, a comprehensive score is set for the corresponding resolving node, and the resolving nodes within the corresponding division distance range are divided into high-level nodes, middle-level nodes, and bottom-level nodes according to the comprehensive score according to the equal interval division rule;

[0083] Each resolving node is subjected to system simulation testing to determine a satisfaction coefficient of the performance requirement and the business logic of each resolving node under the simulation testing;

[0084] If the satisfaction coefficient is greater than or equal to a preset coefficient, the corresponding division result is kept unchanged;

[0085] Otherwise, the analytic node with a lock satisfaction coefficient less than a preset coefficient is determined as the second node;

[0086] If the second node is a high-level node or a middle-level node, the second node is converted into a low-level node;

[0087] If the second node is a low-level node, the corresponding partition result is kept unchanged.

[0088] Based on the final partition result, new data is sequentially distributed from a high-level node to a middle-level node and a low-level node.

[0089] In this embodiment, the configuration file contains information such as analysis algorithm parameters and cache strategy settings, for example, a specified type of domain name analysis algorithm is used preferentially; the registration information includes the unique identifier of the node and the organization or department to which the node belongs, for example, node number 001 under the department A of an enterprise; the geographic location data includes the latitude and longitude of the data center where the node is located, for example, the node is located in a data center with a latitude of 30 degrees north and a longitude of 120 degrees east.

[0090] In this embodiment, the performance monitoring tool is used to obtain the processing capacity of the analysis node, for example, the number of domain name analysis requests that can be processed per second, such as 1000 analysis requests per second, the storage capacity, for example, the disk space size used by the node to store domain name-IP mapping data, such as 500 GB of available storage space, the network bandwidth, for example, the maximum rate of communication with the external network, such as a network bandwidth of 10 Gbps, and the response time, for example, the average time consumed from receiving an analysis request to returning a result, such as an average response time of 50 milliseconds.

[0091] In this embodiment, a configuration file that is complete and accurate, registration information that is clear and standardized, and a geographic location in a network core area will get a higher score. Assuming that the full score is 10 points, a node with a perfect configuration file and located in a data center in the network core hub will have a first score of 8 points, and the first score = file completeness score + registration standardization and clarity score + network area score, and the total score is 10 points, and the full scores of the file completeness score, the registration standardization and clarity score, and the network area score are 4 points, 3 points, and 3 points, respectively.

[0092] In this embodiment, the second score = processing capacity score + storage capacity score + network bandwidth score + response time score, and the total score is 10 points, and the full scores of the processing capacity score, the storage capacity score, the network bandwidth score, and the response time score are 2.5 points, 2.5 points, 2.5 points, and 2.5 points, respectively. At this time, a node with strong processing capacity and sufficient network bandwidth can have a second score of 9 points.

[0093] In this embodiment, for example, two resolving nodes, A node is located in Beijing (the latitude and longitude are assumed to be 39 degrees north and 116 degrees east), and B node is located in Shanghai (the latitude and longitude are assumed to be 31 degrees north and 121 degrees east), and the straight-line distance between the two is obtained by the geographic distance calculation formula.

[0094] The normalization processing is to convert the calculated geographic distance into the interval [0, 1] through a specific mathematical formula (such as the Min-Max normalization formula), which is convenient for subsequent unified processing and analysis. Assuming that the original distance between A and B nodes is 1000 kilometers, the value of the distance in the node distribution distance diagram after the specific normalization processing may be 0.6.

[0095] In this embodiment, the node distribution distance diagram displays the normalized geographic distance relationship between the resolving nodes in a graphical manner, for example, using a two-dimensional coordinate graph, and each point represents a resolving node. The distance between the points intuitively reflects the relative distance of the geographic position.

[0096] In this embodiment, the second weight = 1 - the first weight, and it should be noted that the first weight represents the importance of the first score in the comprehensive score. If the system pays more attention to the basic configuration and geographic position of the node, the first weight may be set to 0.6.

[0097] In this embodiment, the comprehensive score = the first score x the first weight + the second score x the second score. Assuming that the first score of a certain node is 7 points, the first weight is 0.6; the second score is 8 points, and the second weight is 0.4, then the comprehensive score is 7x0.6+8x0.4=7.4 points.

[0098] In this embodiment, the equal-interval division rule is to divide the positions corresponding to the resolving nodes at equal intervals, so that a plurality of division regions are obtained, and each division region involves a plurality of nodes, and then the comprehensive score range is divided into 0-10 points, and 0-3.0 points is regarded as a bottom-level node interval, 3.1-7.0 points is regarded as a middle-level node interval, and 7.1-10 points is regarded as a high-level node interval.

[0099] In this embodiment, the system simulation test is to simulate the domain name resolution request in the actual business scenario to test the node. For example, 500 different types of domain name resolution requests are sent to the node per second, and the running condition of the node is observed for 1 hour.

[0100] In this embodiment, the satisfaction coefficient is obtained by system simulation test, evaluating the degree to which the node meets the performance requirements (such as the success rate of resolving request processing, the response time compliance rate, etc.) and the business logic (such as resolving according to the specified algorithm, correctly processing different priority requests, etc.). Assuming that the full score is 1, in the simulation test, the success rate of resolving request processing of a node is 95%, the correct execution rate of business logic is 98%, and after comprehensive calculation, the satisfaction coefficient may be 0.93.

[0101] In this embodiment, the preset coefficient is a reference coefficient pre-set according to business requirements and system standards, which is used to judge whether the node meets the standard. For example, the preset coefficient is 0.9, and when the satisfaction coefficient of the node reaches or exceeds this value, it is considered that the node performs qualified in the simulation test.

[0102] In this embodiment, the second node is a resolving node with a satisfaction coefficient less than the preset coefficient. For example, in a batch of node tests, there are three nodes with satisfaction coefficients of 0.85, 0.88, and 0.89, respectively, and these three nodes are the second nodes.

[0103] In this embodiment, the final division result is the resolving node level division result determined after the level adjustment of the non-standard nodes (second nodes). For example, initially, there are 10 high-level nodes, 20 middle-level nodes, and 30 low-level nodes, and after adjustment, there may be 9 high-level nodes, 19 middle-level nodes, and 32 low-level nodes, which is the final division result. Subsequent new data will be sequentially issued from high-level nodes to middle-level nodes and low-level nodes according to this result.

[0104] The beneficial effects of the above technical solution are: two aspects of the resolving node are scored, and the weight is set in combination with the position distance, so as to realize the preliminary division of the node, and further ensure the rationality of the division through the simulation test of the node, and provide a reasonable basis for the orderly issuance of subsequent new data.

[0105] The application provides a real-time resolving and secure accessing method of virtual domain name, which dynamically allocates domain name accessing request sent by a client to a suitable resolving node according to a current factor set of each resolving node, and comprises the following steps:

[0106] The historical resolving data set of each resolving node is called, wherein the historical resolving data set comprises: whether resolving is successful under each historical resolving, historical resolving delay time length, load of the corresponding resolving node under the corresponding historical resolving, distance between the client and the corresponding resolving node, packet loss rate of the network type to which the corresponding resolving node belongs;

[0107] A multi-objective optimization allocation function is established according to the historical resolving data set;

[0108] The latest current factor set corresponding to the analysis node based on the current time is obtained and input into the multi-objective optimization distribution function to determine the analysis success probability;

[0109] The node corresponding to the maximum probability is screened from all analysis success probabilities and regarded as the adaptive analysis node.

[0110] In this embodiment, the current factor set and the parameter variables involved in the historical analysis data set are the same.

[0111] In this embodiment, each analysis node has an analysis success probability, and the node corresponding to the maximum probability is screened to obtain the adaptive analysis node.

[0112] The variable value of each factor in the current factor set is input into the function to obtain a calculation result, if the calculation node is within the standard range set by the multi-objective optimization distribution function, the analysis success probability is determined as 1, otherwise, the analysis success probability is determined as 1 minus the absolute value of the difference between the calculation result and the boundary of the standard range / (the corresponding boundary of the standard range + the calculation result);

[0113] It should be noted that the standard range is pre-set and is (a1, a2).

[0114] The beneficial effects of the above technical solution are: a function is established by determining a historical analysis data set, and then a node corresponding to the maximum probability is obtained by inputting a current factor set into the function to obtain an adaptive analysis node.

[0115] The present application provides a real-time analysis and secure access method for virtual domain names, according to the historical analysis data set, a multi-objective optimization distribution function is established, including:

[0116] The analysis results of each historical analysis request of the same analysis node are constructed into a historical analysis vector;

[0117] All historical analysis vectors are arranged in time sequence to obtain a historical analysis matrix, and the historical analysis matrix is solved to obtain a first characteristic function;

[0118] The historical analysis matrix is divided into a first matrix of full analysis success and a second matrix of full analysis failure according to whether the analysis is successful or not, and the first matrix and the second matrix are solved respectively to obtain a corresponding second characteristic function and a third characteristic function;

[0119] The number of occurrences of the elements in each historical analysis vector in an optimal state is locked respectively, and the vector with the most occurrences is combined into a new matrix and solved to obtain a fourth characteristic function;

[0120] Extract the coefficients of the same variable under the first characteristic function, the second characteristic function and the third characteristic function to obtain a coefficient array corresponding to the variable, wherein the coefficient array comprises: a first coefficient of the variable based on the first characteristic function, a second coefficient of the variable based on the second characteristic function, and a third coefficient of the variable based on the third characteristic function;

[0121] Extract the maximum value in the coefficient array of each variable to construct a first array;

[0122] Extract the minimum value in the coefficient array of each variable to construct a second array;

[0123] Extract the remaining value in the coefficient array of each variable to construct a third array;

[0124] According to the first array, the second array and the third array, a corresponding fifth characteristic function is constructed;

[0125] The first characteristic function, the second characteristic function, the third characteristic function, the fourth characteristic function and all the fifth characteristic functions are respectively subjected to curve fitting analysis, and the characteristic function under the best fitting is regarded as a multi-objective optimization distribution function.

[0126] In this embodiment, the historical analysis vector is {analysis result of the analysis request}, and it should be noted that the analysis result is related to whether the analysis is successful or not, the historical analysis delay time, and the load of the corresponding analysis node under the corresponding historical analysis, the distance between the client and the corresponding analysis node, and the packet loss rate of the network type to which the corresponding analysis node belongs.

[0127] In this embodiment, solving the matrix belongs to the prior art and can be directly solved, and then the related characteristic function Y1=a1x1+a2x2+...+anxn can be directly obtained, wherein x1, x2...xn are corresponding variables, and a1, a2...an are coefficients of the corresponding variables. It should be noted that the variables in the obtained function are consistent, and only the corresponding coefficients are different.

[0128] In this embodiment, the preferred state means that the corresponding element meets the set excellent standard, for example, the element with a successful analysis result is regarded as the element in the preferred state, and then the number of occurrences can be obtained by counting each row vector. Since the number of analysis requests is greater than 1000, the vector with the largest number of occurrences can be obtained to combine a new matrix.

[0129] In this embodiment, the first coefficient, the second coefficient and the third coefficient are coefficients of the corresponding variables.

[0130] In this embodiment, the first array is {maximum value of each variable}.

[0131] The second array is {the minimum value of each variable}.

[0132] The third array is {the remaining value of each variable}.

[0133] In this embodiment, the fifth feature function is constructed by the first array, the second array, and the third array.

[0134] In this embodiment, the curve fitting is implemented based on excl, and the feature function under the best fitting can be directly obtained.

[0135] The beneficial effects of the above technical solutions are: by constructing different matrices to solve the characteristics, the curve fitting results under different functions are comprehensively determined, and the multi-objective optimization distribution function under the best fitting is obtained.

[0136] The application provides a real-time resolution and secure access method for virtual domain names, which verifies and corrects the resolution result, determines a target virtual address set, and comprises the following steps:

[0137] The same virtual address and compatible virtual address matched with the verified and corrected resolution result are obtained from the domain name-virtual address mapping database.

[0138] Based on the matched same virtual address and compatible virtual address, the target virtual address set is formed.

[0139] In this embodiment, the domain name-virtual address mapping database is a data set storing a large number of domain name and virtual address corresponding relationships. It is similar to an "address book" and records the virtual address information to which each domain name should be resolved. For example, in an internal network of an enterprise, employees access internal business systems by inputting specific domain names, and these domain names and corresponding virtual addresses are stored in the database. The database can adopt various storage structures, such as a relational database (such as MySQL) or a non-relational database (such as Redis), to meet the needs of efficient query and management.

[0140] In this embodiment, the verified and corrected resolution result is obtained after the domain name is resolved, and the accuracy of the resolution result is ensured by verification and correction operations. For example, the preliminary resolution result can be verified by comparing with authoritative data sources, checking the consistency of the resolution logic, verifying the real-time network connectivity, etc. If errors or unreasonable places are found in the resolution result, the resolution result will be corrected. For example, the virtual address originally pointed to by the resolution result is unreachable, and after verification and correction, a new and accurate virtual address is obtained. This processed result is the verified and corrected resolution result.

[0141] In this embodiment, the "identical virtual address" refers to a virtual address in the domain name-virtual address mapping database that is completely consistent with the verified and corrected resolution result. For example, if the verified and corrected resolution result is "192.168.1.100," and a query in the database shows a record indicating that a domain name also corresponds to the virtual address "192.168.1.100," then "192.168.1.100" is the identical virtual address. It is the most direct match and accurately corresponds to the target resource requested by the client.

[0142] In this embodiment, although the virtual address such as the compatible virtual address is not exactly the same as the parsing result after verification and correction, it can meet the access needs of the client under certain rules or business logic and can be regarded as an equivalent or replaceable address. For example, in network address planning, there is a subnet division. The parsing result after verification and correction is "192.168.1.100", and the address "192.168.1.101" exists in the database. It is in the same subnet as the former and has the same service capabilities in business. It can provide the client with the same or similar resource access, then "192.168.1.101" can be considered as a compatible virtual address. Or in some cases, different virtual addresses may point to the same physical server, but differ in port or service path, but for the client's request, the same access effect can be achieved, and these addresses can also be classified as compatible virtual addresses.

[0143] In this embodiment, the target virtual address set is composed of the same virtual address and compatible virtual address obtained from the domain name-virtual address mapping database that match the verified and corrected resolution results. This set contains all virtual addresses that may satisfy the client's access request. It provides a candidate address pool for the subsequent determination of safe access addresses based on client permissions. For example, after querying, the same virtual address "192.168.1.100" and compatible virtual addresses "192.168.1.101" and "192.168.1.102" are obtained. Then these three addresses constitute the target virtual address set. Based on this set, the system will further screen out the final virtual address that is suitable for the client's current permissions.

[0144] The beneficial effect of the above technical solution is: identical and compatible virtual addresses are obtained through a database to form a virtual address set.

[0145] The present invention provides a real-time resolution and secure access method for virtual domain names, which determines the security of each target virtual address based on a target virtual address set and in combination with the current permissions of the client, including:

[0146] In combination with the current permission, the operation sub-permission for each target virtual address is dynamically adjusted, and in combination with the address type of the target virtual address, the security of each target virtual address is analyzed.

[0147] The current permission is a set of access capabilities that the client is given at a certain moment, which is generated based on the client identity, the user group to which the client belongs, the network environment in which the client is located, and the pre-set permission policy. For example, the client of a senior manager in an enterprise is given a higher level of current permission in the enterprise office network environment due to the identity and the user group to which the client belongs, covering extensive access rights to many business systems.

[0148] When the client state or environment changes, the current permission changes accordingly, and the operation sub-permission is also adjusted in real time. If an employee originally has a higher permission in the enterprise office network, when he uses a mobile device to work remotely through a public network, the current permission is reduced due to the change in the network environment, and the operation sub-permission for the target virtual address (such as the address of the core business data of the enterprise) will change from being able to modify data to only being able to view limited information. This dynamic adjustment process is performed by the dynamic permission matching engine, which automatically adjusts the operation sub-permission based on the real-time monitoring of client information and the permission policy.

[0149] Target virtual addresses are diverse, such as business application addresses (such as enterprise resource planning system addresses) and data storage addresses (such as database server addresses) according to their purposes, and enterprise internal core addresses, edge network addresses, and external cooperation network addresses according to their network regions. Different types of addresses have different risk characteristics.

[0150] Highly sensitive business application addresses (such as addresses storing strategic planning documents of an enterprise), if the current permission level of the client is low, even if there is a small amount of access permission, the security is low due to the mismatch between the permission and the sensitivity of the address. Only clients with high-level and precisely matched permissions can access securely.

[0151] Target virtual addresses in public accessible networks face more external attack risks compared to enterprise internal core secure region addresses. Even if the client's permission is legal, due to the complexity of the network environment where the address is located, the data is easy to be stolen or tampered with, and the security is relatively low.

[0152] If the target virtual address stores personal privacy or commercial secret data, its security is closely related to the current permission of the client. For example, an address that handles sensitive customer information can only be accessed by clients with strict data protection permissions and multiple authentications to ensure security. If an ordinary permission client can access it, the security risk is extremely high.

[0153] The beneficial effects of the above technical solutions are: by dynamically adjusting the operation sub-permission and analyzing the security based on the address type, a comprehensive, flexible and accurate target virtual address security evaluation system is constructed, and the security risks in network access are effectively prevented.

[0154] The application provides a real-time resolution and secure access method for a virtual domain name, and the access process is monitored in real time based on a security monitoring mechanism, including:

[0155] Each transmission data packet in the access process is deeply analyzed to determine malicious requests disguised as normal protocols, wherein the deep analysis includes analyzing special character sequences and syntax structures in the transmission data packet;

[0156] The operation behavior of the client on the final virtual address is determined, and the operation behavior is logically analyzed to determine the existence of malicious access behavior;

[0157] Abnormal behaviors under different environmental factors in the access process are monitored;

[0158] When the security monitoring mechanism detects the presence of malicious requests, malicious access behaviors and / or abnormal behaviors, an abnormal response process is triggered to provide a security alert.

[0159] In this embodiment, malicious requests, such as SQL injection attacks, often use HTTP protocols to embed special SQL syntax characters in request data. Deep analysis can identify these character sequences, such as detecting "DROPTABLE users--" malicious code that attempts to delete user tables, and blocking attacks to protect data security.

[0160] In this embodiment, malicious access behaviors, such as skipping browsing and directly adding a large number of goods to the shopping cart, or frequently modifying product key information, can be judged as malicious access by logical analysis.

[0161] The beneficial effects of the above technical solutions are: when the security monitoring mechanism detects malicious requests, malicious access behaviors and / or abnormal behaviors, an abnormal response process is triggered and a security alert is provided to achieve rapid response.

[0162] The application provides a real-time resolution and secure access method for a virtual domain name, dynamically adjusts the operation sub-permission for each target virtual address in combination with the current permission, including:

[0163] According to the current permission of the client, the first risk that the access operation of the client on the target virtual address may cause is analyzed;

[0164] The security attribute previously assigned to each target virtual address is obtained, and in combination with the first risk, the first security coefficient of the corresponding target virtual address is evaluated;

[0165] The second security coefficient of the access to the corresponding target virtual address is evaluated by monitoring the encryption mode of the network connection, the stability of the connection, and whether there is a potential security threat in the network path.

[0166] The operation sub-privilege of the corresponding target virtual address is dynamically adjusted based on the first security coefficient and the second security coefficient.

[0167] In this embodiment, the first risk refers to the potential possibility of harm to system security, data integrity, confidentiality, etc. that may occur when the client performs an access operation on the target virtual address according to its current privilege.

[0168] In this embodiment, the first security coefficient = (1 - risk value of the first risk) x protection value of the security attribute.

[0169] The protection value is obtained from an attribute-value table, which contains different security attributes and protection values matched with the attributes, with values ranging from 0 to 1.

[0170] In this embodiment, the second security coefficient is a value reflecting the network-level security of the access to the corresponding target virtual address, obtained by evaluating the encryption mode of the network connection, the stability of the connection, and potential security threats in the network path, with values ranging from 0 to 1.

[0171] In this embodiment, the client performs specific operations on the target virtual address, such as reading, writing, and executing. Based on the first security coefficient and the second security coefficient, these sub-privileges are dynamically adjusted to ensure the security and rationality of the access.

[0172] The above technical solution has the following beneficial effects: The first risk of the access operation on the target virtual address is analyzed according to the current privilege of the client, realizing accurate risk positioning. The security attribute of the target virtual address is obtained, and the first security coefficient is evaluated in combination with the first risk, comprehensively considering the address security. The second security coefficient is obtained by evaluating the network connection-related factors, strengthening the control of network-level security. The operation sub-privilege is dynamically adjusted based on the first and second security coefficients, realizing flexible management of the privilege.

[0173] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, and are not limiting; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can modify the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some technical features; and these modifications or substitutions do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for real-time resolution and secure access of virtual domain names, characterized in that, include: Step 1: Monitor changes in virtual domain name information in real time. When a change is detected, first obtain the configuration file, registration information, and geographic location data of each resolution node. Simultaneously, second obtain the processing capacity, storage capacity, network bandwidth, and response time of each resolution node. Based on the first and second acquisition results, assign a corresponding first and second scores to each resolution node. Calculate the geographic distances between resolution nodes and perform normalization to obtain a node distribution distance map, assign a first weight to the first score, and then assign a second weight to the second score; set a comprehensive score for the corresponding resolution node based on the first score, the first weight, the second score, and the second weight, and divide the resolution nodes within the corresponding divided intervals into high-level nodes, mid-level nodes, and low-level nodes according to the comprehensive score according to the equal-interval division rule; perform system simulation tests on each resolution node to determine whether each resolution node meets the performance requirements and business logic satisfaction coefficient under the simulation test; If the coefficient is greater than or equal to the preset coefficient, the corresponding division result will remain unchanged; Otherwise, the analytical node that satisfies the coefficient less than the preset coefficient is locked and regarded as the second node; If the second node is a high-level node or a mid-level node, converting the second node to a low-level node; If the second node is a bottom-level node, the corresponding partitioning result remains unchanged; Based on the final division results, the new data is sent from the high-level nodes to the middle-level nodes and low-level nodes in sequence; Step 2: Retrieve the historical parsing data set for each parsing node, where the historical parsing data set includes: the parsing success or failure of each historical parsing, the historical parsing delay, the load of the corresponding parsing node under the corresponding historical parsing, the distance between the client and the corresponding parsing node, and the packet loss rate of the network type to which the corresponding parsing node belongs; establish a multi-objective optimization allocation function based on the historical parsing data set; obtain the latest current factor set of the corresponding parsing node based on the current time, and input it into the multi-objective optimization allocation function to determine the parsing success probability; select the node with the highest probability from all parsing success probabilities and regard it as the adapted parsing node. At this time, the adapted parsing node is regarded as the first node; Step 3: After the first node completes the domain name access request resolution, it verifies and modifies the resolution result to determine the target virtual address set; Step 4: Determine the security of each target virtual address based on the target virtual address set and the client's current permissions, and determine the final virtual address that enables the client to communicate with the control server; Step 5: After the communication connection is established, the access process is monitored in real time based on the security monitoring mechanism to achieve secure access.

2. The method for real-time resolution and secure access of virtual domain name according to claim 1, characterized in that, Based on the historical analytical data set, a multi-objective optimization allocation function is established, including: Construct the historical parsing vector from the parsing results of each historical parsing request by the same parsing node; Arranging all historical analytical vectors in rows in chronological order to obtain a historical analytical matrix, and solving the historical analytical matrix to obtain a first characteristic function; The historical resolution matrix is divided into a first matrix of full resolution success and a second matrix of full resolution failure according to whether the resolution is successful or not, and the first matrix and the second matrix are solved respectively to obtain a corresponding second characteristic function and a third characteristic function; The number of occurrences of elements in each historical resolution vector that are in an optimal state is locked respectively, a new matrix is combined from the vectors with the most occurrences, and is solved to obtain a fourth characteristic function; The coefficients of the same variable under the first characteristic function, the second characteristic function and the third characteristic function are extracted to obtain a coefficient array corresponding to the variable, wherein the coefficient array includes a first coefficient based on the first characteristic function, a second coefficient based on the second characteristic function and a third coefficient based on the third characteristic function corresponding to the variable; The maximum value in the coefficient array of each variable is extracted to construct a first array; The minimum value in the coefficient array of each variable is extracted to construct a second array; The remaining values in the coefficient array of each variable are extracted to construct a third array; According to the first array, the second array and the third array, a corresponding fifth characteristic function is constructed; Curve fitting analysis is performed on the first characteristic function, the second characteristic function, the third characteristic function, the fourth characteristic function and all fifth characteristic functions, and the characteristic function under the best fitting is regarded as a multi-objective optimization allocation function.

3. The method for real-time resolution and secure access of virtual domain name according to claim 1, characterized in that, The resolution result is verified and corrected to determine the target virtual address set, including: The same virtual address and compatible virtual address matching the verified and corrected resolution result are obtained from the domain name-virtual address mapping database; Based on the matched same virtual address and compatible virtual address, the target virtual address set is formed.

4. The method for real-time resolution and secure access of virtual domain name according to claim 3, characterized in that, According to the target virtual address set and in combination with the current authority of the client, the security of each target virtual address is determined, including: In combination with the current authority, the operation sub-authority for each target virtual address is dynamically adjusted, and in combination with the address type of the target virtual address, the security of each target virtual address is analyzed.

5. The method for real-time resolution and secure access of virtual domain name according to claim 1, characterized in that, The access process is monitored in real time based on a security monitoring mechanism, including: Each transmission data packet in the access process is deeply parsed to determine malicious requests disguised as normal protocols, wherein the deep parsing includes parsing special character sequences and syntax structures in the transmission data packet; The operation behavior of the client on the final virtual address is determined, and the operation behavior is logically parsed to determine the existence of malicious access behavior; Abnormal behaviors based on different environmental factors in the access process are monitored; When the security monitoring mechanism detects the presence of malicious requests, malicious access behaviors and / or abnormal behaviors, an abnormal response process is triggered to provide a security reminder.

6. The method for real-time resolution and secure access of virtual domain name according to claim 4, characterized in that, In combination with the current authority, the operation sub-authority for each target virtual address is dynamically adjusted, including: According to the current authority of the client, the first risk that its access operation on the target virtual address may cause is analyzed; The security attribute previously assigned to each target virtual address is obtained, and in combination with the first risk, a first security coefficient of the corresponding target virtual address is evaluated; The maximum value in the coefficient array of each variable is extracted to construct a first array; The minimum value in the coefficient array of each variable is extracted to construct a second array; The remaining values in the coefficient array of each variable are extracted to construct a third array; According to the first array, the second array and the third array, a corresponding fifth characteristic function is constructed; Curve fitting analysis is performed on the first characteristic function, the second characteristic function, the third characteristic function, the fourth characteristic function and all fifth characteristic functions, and the characteristic function under the best fitting is regarded as a multi-objective optimization allocation function. The resolution result is verified and corrected to determine the target virtual address set, including: The same virtual address and compatible virtual address matching the verified and corrected resolution result are obtained from the domain name-virtual address mapping database; Based on the matched same virtual address and compatible virtual address, the target virtual address set is formed. According to the target virtual address set and in combination with the current authority of the client, the security of each target virtual address is determined, including: In combination with the current authority, the operation sub-authority for each target virtual address is dynamically adjusted, and in combination with the address type of the target virtual address, the security of each target virtual address is analyzed. The access process is monitored in real time based on a security monitoring mechanism, including: Each transmission data packet in the access process is deeply parsed to determine malicious requests disguised as normal protocols, wherein the deep parsing includes parsing special character sequences and syntax structures in the transmission data packet; The operation behavior of the client on the final virtual address is determined, and the operation behavior is logically parsed to determine the existence of malicious access behavior; Abnormal behaviors based on different environmental factors in the access process are monitored; When the security monitoring mechanism detects the presence of malicious requests, malicious access behaviors and / or abnormal behaviors, an abnormal response process is triggered to provide a security reminder. The second security coefficient for accessing the corresponding target virtual address is evaluated by monitoring the encryption mode of the network connection, the stability of the connection, and whether there is a potential security threat in the network path; The operation sub-permission of the corresponding target virtual address is dynamically adjusted based on the first security coefficient and the second security coefficient.

Images