Zero-storage domain name dynamic analysis method and system for edge computing environment

Abstract

The invention relates to the technical field of edge computing, and discloses a zero-storage domain name dynamic analysis method and system in an edge computing environment, and the method comprises the steps: obtaining IP address data of a target server, carrying out the filling processing, symmetric encryption and reversible coding of the IP address data according to a set domain name coding rule, and generating an encrypted domain name; receiving a domain name resolution request sent by a client, and executing dynamic domain name resolution in the requested domain name to obtain decrypted data; and removing filling bytes according to a filling length field in the decrypted data, restoring the original IP address, and returning the original IP address to the client, in addition, a system is realized according to the method, the mapping relationship between the domain name and the IP address is encrypted and coded through a symmetric encryption algorithm, so that the resolution server does not need to store any mapping table, and the resolution efficiency is improved. And the corresponding IP address can be obtained in real time only by decrypting the domain name character string, so that efficient, safe and easy-to-manage dynamic domain name resolution is realized, and the storage requirement and the hardware cost are greatly reduced.

Description

Technical Field

[0001] The present invention relates to the field of edge computing technology, and in particular to a zero-storage domain name dynamic resolution method and system in an edge computing environment. Background Art

[0002] With the widespread adoption of edge computing in the Internet of Things, CDN, and the Industrial Internet, edge server nodes are becoming massive (over 100,000), geographically dispersed, and highly dynamic (daily change rate ≥20%). Traditional DNS resolution mechanisms, relying on static mapping table storage, face challenges in real-time performance, storage overhead, and security. In edge computing scenarios, service interruptions caused by DNS-related failures are increasing, necessitating a dynamic domain name resolution solution with zero storage and real-time response.

[0003] In traditional domain name resolution systems, domain name servers need to maintain a large number of mapping tables between domain names and IP addresses. When the server IP address changes, the corresponding DNS records must be updated in a timely manner to ensure the accuracy of domain name resolution. Representative technologies include: (1) Query optimization (such as US7426576B1): Improve resolution efficiency through intelligent DNS server selection and caching strategies, but it is necessary to maintain a centralized mapping table, and the storage overhead increases exponentially with the number of nodes (1000 nodes require 500GB of storage); (2) Alias ​​routing (such as US8886750B1): Use alias records (CNAME) to achieve indirect resolution. Although it improves flexibility, it requires multi-layer search and maintenance of massive alias mapping tables, and the resolution delay increases by more than 40%; (3) Standard DNS dynamic update: Push record changes through the NOTIFY / RFC 2136 protocol, but due to the protocol polling mechanism and TTL cache, the delay in IP change effectiveness is as high as minutes (average >30s).

[0004] The aforementioned solutions all rely on pre-stored domain-IP mapping tables, failing to address the fundamental conflict between storage and real-time performance. Domain name resolution servers must maintain terabyte-scale mapping tables (1,000 nodes consume 500GB), resulting in hardware costs exceeding 35% of the total system investment and increasing as the number of edge nodes increases. Furthermore, mapping table updates rely on manual or scripted maintenance (daily maintenance frequency >200 times), resulting in an average latency >500ms for changes to take effect. The TTL caching mechanism causes delays in change propagation, leading to a 15% service interruption rate in edge scenarios. Furthermore, domain-IP mappings are stored and transmitted in plaintext, making them vulnerable to DNS hijacking. This centralized mapping table becomes a single point of attack, with a data tampering risk rating of CVSS 7.8. Furthermore, frequent IP changes require constant updates to DNS records, resulting in extremely high annual maintenance costs for a single node and the operational expenses for a system with tens of thousands of nodes.

[0005] In summary, existing technologies cannot meet the core requirements of edge computing for real-time, elastic expansion and security due to architectural defects. Summary of the Invention

[0006] The purpose of the present invention is to address the shortcomings of the above-mentioned prior art and to provide a zero-storage domain name dynamic resolution method and system for an edge computing environment, so as to solve the problems of complex data management, poor real-time performance, and insufficient security in the prior art, and to achieve efficient, secure, and easy-to-manage dynamic domain name resolution.

[0007] On the one hand, a zero-storage domain name dynamic resolution method in an edge computing environment is provided, comprising the following steps: S1: Obtain the IP address data of the target server, perform padding, symmetric encryption, and reversible encoding on it according to the set domain name encoding rules to generate an encrypted domain name; S2: Receives the domain name resolution request sent by the client, performs dynamic domain name resolution on the requested domain name, and obtains decrypted data; S3: Removes the padding bytes based on the padding length field in the decrypted data, restores the original IP address, and returns it to the client.

[0008] Furthermore, in step S1, padding, symmetric encryption and reversible encoding are performed according to the set domain name encoding rules, including: S11: Fill the IP address data and construct a data packet based on it; S12: Determine a symmetric encryption algorithm and a key management mechanism, and use the symmetric encryption algorithm to perform group encryption on the data packet; S13: Perform reversible encoding on the encrypted IP address, where the encoding complies with RFC 4648 standard, and convert the encoded content into lowercase characters to obtain an encoded string.

[0009] Preferably, the constructing data packet further comprises: Calculate the number of padding bytes , add at the end of the IP address data Fill bytes and generate a version number, fill length Data packet including value, IP address data and padding bytes, number of padding bytes The calculation is shown as follows: in, is the length of the IP address data, is the encryption algorithm block length, which is obtained according to the symmetric encryption algorithm.

[0010] Preferably, the version number is used to define the IP protocol type, wherein, If the IPv4 protocol is identified, the IP address data length is 4 bytes, and the version number is 0; If the IPv4 / IPv6 mixed protocol is identified, and the IP address data length is 20 bytes, the version number is 1.

[0011] Furthermore, in step S1, generating an encrypted domain name includes: Establishing a domain name structure, including a domain name prefix and a domain name suffix, wherein the domain name prefix is ​​composed of the encoded string, and the domain name suffix is ​​selected according to the version number, and the prefix and suffix are combined to generate the encrypted domain name; The secure domain name is distributed to the client through a secure channel, and the client uses the domain name to access the service.

[0012] Furthermore, in step S2, the dynamic domain name resolution includes: S21: Extract the prefix from the requested domain name, remove the domain name suffix, convert the domain name prefix to uppercase characters, and decode it to obtain an encrypted data block; S22: Use the pre-shared key to decrypt the encrypted data block and obtain the data containing the version number and padding length. plaintext data packets containing values ​​and IP address data; S23: According to filling length The value truncates the padding bytes behind it and restores the original IP address.

[0013] Preferably, managing and updating the pre-shared key further includes: Establish a secure key distribution mechanism to assign independent keys to resolution servers in different geographical areas; Periodically generate new encryption keys and broadcast them to the entire domain to enhance security; It supports the coexistence of multiple keys and supports parallel decryption of new and old keys during the key rotation period, ensuring a smooth transition of the key update process.

[0014] On the other hand, a zero-storage domain name dynamic resolution system for an edge computing environment is provided, including: The encrypted domain name generation module is used to obtain the IP address data of the target server, perform padding processing, symmetric encryption and reversible encoding on it according to the set domain name encoding rules, and generate an encrypted domain name; The dynamic domain name resolution module is used to receive the domain name resolution request sent by the client, perform dynamic domain name resolution on the requested domain name to obtain decrypted data; The IP address restoration module is used to remove the padding bytes according to the padding length field in the decrypted data, restore the original IP address, and return it to the client.

[0015] In addition, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the method for dynamic resolution of domain names in an edge computing environment with zero storage is implemented.

[0016] At the same time, an electronic device is provided, including: one or more processors; a storage device for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement the zero-storage domain name dynamic resolution method in the edge computing environment described in any one of the above items.

[0017] Compared with the prior art, the present invention has the following beneficial effects: This invention directly encodes IP address information into the domain name. When resolving, the IP address can be obtained by decrypting the domain name. The storage requirement is reduced from TB level to near zero, solving the storage bottleneck of large-scale edge computing environments. The instant encryption and decryption algorithm based on packet encryption has a resolution delay of <5ms, which is more than 100 times faster than traditional DNS resolution and meets the low-latency requirements of edge computing. The present invention designs a versioned reversible encoding mechanism that supports protocol evolution, supports IPv4, IPv6, and hybrid protocol stacks, and has future expansion capabilities; The present invention supports flexible encoding from 4-byte IPv4 to 20-byte mixed addresses, and solves the problem of unified encryption processing of IP addresses of different lengths. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings: Figure 1 This is a flowchart of a zero-storage domain name dynamic resolution method in an edge computing environment according to the present invention; Figure 2 This is a specific flow chart of a zero-storage domain name dynamic resolution method in an edge computing environment of the present invention; Figure 3 This is a flow chart of dynamic domain name resolution of the present invention; Figure 4 This is a diagram of the overall system architecture of the present invention. DETAILED DESCRIPTION

[0019] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0020] The present invention encrypts the mapping relationship between domain names and IP addresses through a symmetric encryption algorithm, so that the resolution server does not need to store any mapping table and can obtain the corresponding IP address in real time by simply decrypting the domain name string, thereby realizing true dynamic domain name resolution.

[0021] The specific implementation of the present invention is described below with reference to the accompanying drawings and embodiments.

[0022] Example 1 like Figure 1 As shown, the technical solution of a zero-storage domain name dynamic resolution method in an edge computing environment provided by this embodiment includes the following steps: S1: The edge server obtains the IP address data of the target server, performs padding, symmetric encryption, and reversible encoding on it according to the set domain name encoding rules to generate an encrypted domain name; S2: Receives the domain name resolution request sent by the client, performs dynamic domain name resolution on the requested domain name, and obtains decrypted data; S3: Removes the padding bytes based on the padding length field in the decrypted data, restores the original IP address, and returns it to the client.

[0023] In this embodiment, we use the Blowfish algorithm as a symmetric encryption algorithm, which uses the same key for encryption and decryption. The Blowfish algorithm is a symmetric block encryption algorithm that uses 64-bit blocks and variable-length keys (32-448 bits). The reversible encoding uses the Base32 encoding method to convert binary data into a 32-printable character encoding method that complies with the RFC 4648 standard. The specific process is as follows: Figure 2 shown.

[0024] First, we set the domain name encoding rules in the domain name encoding service, including: Determine the symmetric encryption algorithm (Blowfish algorithm) and key management mechanism; Design the domain name encoding format: Encrypt the IP address information using Blowfish and then perform Base32 encoding; Establish the domain name structure: [Base32 encoded string]. [domain name suffix]; Supports version encoding: different versions are distinguished by different domain name suffixes.

[0025] According to the domain name encoding rules set above, we perform the padding, symmetric encryption, and reversible encoding operations on the target server's IP address data in step S1, specifically including: S11: Fill the IP address data and construct a data packet based on it; S12: Based on the determined symmetric encryption algorithm and key management mechanism, encrypt the data packet in groups using the symmetric encryption algorithm; S13: Perform reversible encoding on the encrypted IP address, where the encoding complies with RFC 4648 standard, and convert the encoded content into lowercase characters to obtain an encoded string.

[0026] In order to meet the requirements of the block encryption algorithm, a technology of adding padding bytes at the end of the data to align the length is used. On this basis, the data packet construction further includes: Calculate the number of padding bytes , add at the end of the IP address data Fill bytes and generate a version number, fill length The data packet includes the value, IP address data and padding bytes, that is: [version number: 1 byte] [padding length: 1 byte] [IP address data] [padding bytes], the number of padding bytes The calculation is shown as follows: in, is the length of the IP address data, is the encryption algorithm packet length, which is obtained according to the symmetric encryption algorithm. For the Blowfish algorithm in this embodiment, its packet length is 8 bytes.

[0027] In this embodiment, the obtained IP address is divided into IPv4 or IPv6 version, the IP address data is padded so that its length is a multiple of 8 bytes, and the Base32 encoding used also complies with the RFC 4648 standard.

[0028] The version number is used to define the IP protocol type, where: If the IPv4 protocol is identified, the IP address data length is 4 bytes, and the version number is 0; If the IPv4 / IPv6 mixed protocol is identified, and the IP address data length is 20 bytes, the version number is 1.

[0029] Based on the above content, generate an encrypted domain name, including: Establishing a domain name structure, including a domain name prefix and a domain name suffix, wherein the domain name prefix is ​​composed of the encoded string, and the domain name suffix is ​​selected according to the version number, and the prefix and suffix are combined to generate the encrypted domain name; The secure domain name is distributed to the client through a secure channel, and the client uses the domain name to access the service.

[0030] Specifically, in this embodiment, if the version number is 0 (IPv4 protocol), the domain name suffix is ​​".edge.example.com", the combined secure domain name is [Base32 string].edge.example.com, and the data packet is [version number: 0][padding length][IPv4 address: 4 bytes][padding bytes]. The encoding example is: 192.168.1.100 → abcdef123456.edge.example.com; If the version number is 1 (IPv4 / IPv6 mixed protocol), the domain name suffix is ​​".service.example.org", the combined secure domain name is [Base32 string].service.example.org, and the data packet is [version number: 1][padding length][IPv4: 4 bytes][IPv6: 16 bytes][padding bytes]. The encoding example is: 192.168.1.100+2001:db8::1→xyz789uvw012.service.example.org.

[0031] The domain name resolution server receives the domain name resolution request sent by the client. Dynamic domain name resolution can automatically resolve the domain name to the corresponding IP address in real time without pre-storing the mapping relationship. The dynamic domain name resolution of step S2 is performed. Figure 3 As shown, specifically including: S21: Extract the prefix from the requested domain name, remove the domain name suffix, convert the domain name prefix to uppercase characters, and perform Base32 decoding to obtain an encrypted data block; S22: Decrypt the encrypted data block using the pre-shared Blowfish key to obtain the data block containing the version number and padding length. plaintext data packets containing values ​​and IP address data; S23: According to filling length The value is truncated after the padding bytes, the original IP address is restored, and the parsing result is returned.

[0032] For detailed process, see Figure 3 ,In this embodiment, we introduce security management in the ,decryption process to record error logs.

[0033] The pre-shared key is managed and updated through the key management mechanism set above, specifically including: Establish a secure key distribution mechanism to assign independent keys to resolution servers in different geographical areas; Periodically generate new encryption keys and broadcast them to the entire domain to enhance security; It supports the coexistence of multiple keys and supports parallel decryption of new and old keys during the key rotation period, ensuring a smooth transition of the key update process.

[0034] For enterprise edge CDN systems, due to network optimization and load balancing needs, an average of 20% of servers need to change their IP addresses every day. Traditional solutions require updating about 200 DNS records daily. Delays in DNS record updates cause some users to fail to access. Maintaining a large DNS mapping table requires storage costs of about 500GB, which is costly and error-prone due to high manual maintenance costs. By applying the method of this embodiment, a domain name encoding service is deployed to generate an encrypted domain name for each edge server. The client accesses the edge service through the encrypted domain name, and the resolution server decrypts the domain name in real time to obtain the latest IP address. When the server IP changes, only the encrypted domain name needs to be updated, and there is no need to maintain the mapping table. Therefore, the storage cost is reduced to near 0, the domain name resolution delay is reduced from an average of 500ms to 5ms, and the operation and maintenance cost is reduced by 70%.

[0035] For the IoT edge computing platform, the number of edge computing nodes included is huge, and the nodes are distributed all over the world, and the IP addresses change frequently. Through the Blowfish symmetric encryption algorithm adopted in the method of this embodiment, the key is managed in a hierarchical manner, different keys are set according to geographical regions, the encrypted domain name format adopts [Base32 encoded string].edge.example.com, supports versioned encoding, selects the encoding scheme according to the IP protocol type, deploys distributed resolution services, and provides services nearby. Therefore, the above method of this embodiment realizes real-time domain name resolution that supports 100,000+ nodes, with an average resolution time of <3ms, and the key update process has no impact on the service.

[0036] The method of this embodiment overturns the architectural model of traditional DNS, which requires the maintenance of a large number of mapping tables. It encodes IP address information directly into the domain name, and the IP address can be obtained by decrypting the domain name during resolution. The storage requirement is reduced from the TB level to near zero, solving the storage bottleneck of large-scale edge computing environments; it solves the traditional DNS update delay problem, and uses an instant decryption algorithm based on Blowfish block encryption, with a resolution delay of <5ms, which is more than 100 times faster than the traditional DNS resolution speed, meeting the low-latency requirements of edge computing; it designs a versioned encoding mechanism that supports protocol evolution, supports IPv4, IPv6 and hybrid protocol stacks, and has future expansion capabilities; it solves the problem of unified encryption processing of IP addresses of different lengths, and supports flexible encoding of 4-byte IPv4 to 20-byte hybrid addresses.

[0037] In addition, this embodiment also provides a zero-storage domain name dynamic resolution system for an edge computing environment, including: The encrypted domain name generation module is used to obtain the IP address data of the target server, perform padding processing, symmetric encryption and reversible encoding on it according to the set domain name encoding rules, and generate an encrypted domain name; The dynamic domain name resolution module is used to receive the domain name resolution request sent by the client, perform dynamic domain name resolution on the requested domain name to obtain decrypted data; The IP address restoration module is used to remove the padding bytes according to the padding length field in the decrypted data, restore the original IP address, and return it to the client.

[0038] The system is based on Figure 4 The architecture shown includes: The key generation unit generates an encryption key and transmits the key to the key distribution unit. After receiving the key, the key distribution unit sends a key distribution completion notification to the key update unit. The key update unit provides the new key to the encryption processing unit according to the update policy. After receiving the key, the encryption processing unit performs data encryption operations. The security authentication module verifies identity information and passes the authentication results to the access control layer. The access control layer implements permission control based on the authentication results and sends the operation log to the security logger, which records all security events. The client device generates a service request and sends an instruction to the encrypted resolution request module. After the encrypted resolution request module processes the request, it converts it into a domain name resolution request format and outputs it. The domain name resolution request module sends the standardized request to the resolution server. The request receiving unit receives the domain name resolution request from the client and forwards the request data to the encryption resolution service. The encryption resolution service coordinates the resolution process and assigns the request to the domain name resolution unit. The domain name resolution unit processes the domain name data structure, extracts the encrypted field and transmits it to the decryption processing unit. The decryption processing unit receives the encrypted data and performs the decryption operation. The result returning unit receives the output of the decryption processing unit and returns the resolution result to the client.

[0039] It should be noted that the steps in the zero-storage domain name dynamic resolution method for the edge computing environment provided in this embodiment can be implemented based on the corresponding modules in the zero-storage domain name dynamic resolution system for the edge computing environment. Those skilled in the art can refer to the technical solution of the system to implement the step flow of the method, that is, the embodiments in the system can be understood as preferred examples for implementing the method, which will not be elaborated here.

[0040] In addition to implementing the system and its various devices provided by the present invention in purely computer-readable program code, it is entirely possible to implement the same functions of the system and its various devices provided by the present invention in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, embedded microcontrollers, etc. by logically programming the method steps. Therefore, the system and its various devices provided by the present invention can be considered a hardware component, and the devices included therein for implementing the various functions can also be considered as structures within the hardware component; the devices for implementing the various functions can also be considered as both software modules implementing the method and structures within the hardware component.

[0041] Finally, it should be noted that the above description is merely a preferred embodiment of the present invention, and the scope of protection of the present invention is not limited to the above embodiment. All technical solutions based on the principles of the present invention are within the scope of protection of the present invention. It should be noted that improvements and modifications that do not depart from the principles of the present invention, which are apparent to those skilled in the art, should also be considered within the scope of protection of the present invention.

[0042] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

Claims

1. A zero-storage domain name dynamic resolution method in an edge computing environment, characterized in that: The steps include: S1: Obtain the IP address data of the target server, perform padding, symmetric encryption, and reversible encoding on it according to the set domain name encoding rules to generate an encrypted domain name; S2: Receives the domain name resolution request sent by the client, performs dynamic domain name resolution on the requested domain name, and obtains decrypted data; S3: Removes the padding bytes based on the padding length field in the decrypted data, restores the original IP address, and returns it to the client.

2. The zero-storage domain name dynamic resolution method in the edge computing environment according to claim 1 is characterized in that: In step S1, padding, symmetric encryption, and reversible encoding are performed according to the set domain name encoding rules, including: S11: Fill the IP address data and construct a data packet based on it; S12: Determine a symmetric encryption algorithm and a key management mechanism, and use the symmetric encryption algorithm to perform group encryption on the data packet; S13: Perform reversible encoding on the encrypted IP address, where the encoding complies with RFC 4648 standard, and convert the encoded content into lowercase characters to obtain an encoded string.

3. The zero-storage domain name dynamic resolution method in the edge computing environment according to claim 2 is characterized in that: The constructing data packet further comprises: Calculate the number of padding bytes , add at the end of the IP address data Fill bytes and generate a version number, fill length Data packet including value, IP address data and padding bytes, number of padding bytes The calculation is shown as follows: in, is the length of the IP address data, is the encryption algorithm block length, which is obtained according to the symmetric encryption algorithm.

4. The zero-storage domain name dynamic resolution method in an edge computing environment according to claim 3 is characterized in that: The version number is used to define the IP protocol type, where: If the IPv4 protocol is identified, the IP address data length is 4 bytes, and the version number is 0; If the IPv4 / IPv6 mixed protocol is identified, and the IP address data length is 20 bytes, the version number is 1.

5. The zero-storage domain name dynamic resolution method in the edge computing environment according to claim 4 is characterized in that: In step S1, generating an encrypted domain name further includes: Establishing a domain name structure, including a domain name prefix and a domain name suffix, wherein the domain name prefix is ​​composed of the encoded string, and the domain name suffix is ​​selected according to the version number, and the prefix and suffix are combined to generate the encrypted domain name; The secure domain name is distributed to the client through a secure channel, and the client uses the domain name to access the service.

6. The zero-storage domain name dynamic resolution method in the edge computing environment according to claim 5 is characterized in that: In step S2, the dynamic domain name resolution includes: S21: Extract the prefix from the requested domain name, remove the domain name suffix, convert the domain name prefix to uppercase characters, and decode it to obtain an encrypted data block; S22: Use the pre-shared key to decrypt the encrypted data block and obtain the data containing the version number and padding length. plaintext data packets containing values ​​and IP address data; S23: According to filling length The value truncates the padding bytes behind it and restores the original IP address.

7. The zero-storage domain name dynamic resolution method in an edge computing environment according to claim 6 is characterized in that: Managing and updating the pre-shared key further includes: Establish a secure key distribution mechanism to assign independent keys to resolution servers in different geographical areas; Periodically generate new encryption keys and broadcast them to the entire domain to enhance security; It supports the coexistence of multiple keys and supports parallel decryption of new and old keys during the key rotation period, ensuring a smooth transition of the key update process.

8. A zero-storage domain name dynamic resolution system for edge computing environment, characterized in that: include: The encrypted domain name generation module is used to obtain the IP address data of the target server, perform padding processing, symmetric encryption and reversible encoding on it according to the set domain name encoding rules, and generate an encrypted domain name; The dynamic domain name resolution module is used to receive the domain name resolution request sent by the client, perform dynamic domain name resolution on the requested domain name to obtain decrypted data; The IP address restoration module is used to remove the padding bytes according to the padding length field in the decrypted data, restore the original IP address, and return it to the client.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by the processor, a zero-storage domain name dynamic resolution method for an edge computing environment is implemented as described in any one of claims 1-12.

10. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement the zero-storage domain name dynamic resolution method for an edge computing environment as described in any one of claims 1-12.

Images