A browser encrypted DNS resolution method, system, device and medium based on a DoH protocol

Abstract

The application relates to the technical field of network security, and discloses a browser encryption DNS resolution method, system and device based on a DoH protocol and a medium, the method comprises the following steps: obtaining a target domain name resolution request initiated by a user and inputting the target domain name resolution request into a preset DoH service decision module to obtain a target DoH server address and an encrypted DNS query message; performing integrity matching verification on a received DNS response message; if the verification does not match, triggering a hierarchical fallback mechanism with the original target address as a starting point to determine a target backup resolution scheme; and finally loading network resources by using a successfully obtained IP address. The application effectively solves the problem of resolution failure caused by server failure or response tampering in the DoH resolution process.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a browser-based encrypted DNS resolution method, system, device, and medium based on the DoH protocol. Background Technology

[0002] With the increasing sophistication of cyberattack methods, the traditional DNS protocol, which uses plaintext transmission, is highly vulnerable to security threats such as man-in-the-middle attacks, DNS hijacking, or traffic eavesdropping, seriously endangering users' privacy and network security.

[0003] To address these risks, DNS over HTTPS (DoH) technology was developed. DoH effectively improves the security of domain name resolution by encapsulating DNS queries within an HTTPS encrypted channel.

[0004] However, existing DoH solutions still face many problems in practical applications. On the one hand, a single DoH server may be at risk of service unavailability or malicious tampering with the response. On the other hand, existing DoH solutions do not have an efficient and reliable dynamic rollback and verification mechanism. When encryption and parsing fail, the parsing operation may be interrupted or rolled back to an insecure traditional mode. Therefore, existing DoH solutions cannot meet the actual needs of high-security scenarios such as power grids, government affairs, or finance. Summary of the Invention

[0005] In view of the aforementioned existing problems, the present invention is proposed.

[0006] Therefore, the present invention provides a browser-based encrypted DNS resolution method, system, device and medium based on the DoH protocol, which can solve the problem of resolution interruption caused by single server failure or response tampering in the existing DoH scheme.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, the present invention provides a browser-based encrypted DNS resolution method based on the DoH protocol, comprising: Obtain the target domain name resolution request initiated by the user through the browser; The target domain name resolution request is input into the pre-configured DoH service decision module to obtain the target DoH server address and the corresponding encrypted DNS query message used to perform this resolution; The expected response corresponding to the encrypted DNS query message is subjected to integrity matching verification. If the matching verification result indicates that the expected response does not match the actual received DNS response message, a hierarchical fallback mechanism is triggered starting from the target DoH server address to determine the target backup resolution scheme for performing this resolution. The target IP address, successfully obtained using the target backup resolution scheme or the target DoH server address, drives the browser to establish a network connection and load the network resources corresponding to the target domain name.

[0008] As a preferred embodiment of the browser-encrypted DNS resolution method based on the DoH protocol described in this invention, it further includes: Obtain configuration information for multiple available DoH servers; The configuration information of the multiple available DoH servers is prioritized and sorted using a preset service quality assessment method to generate a DoH server address list.

[0009] As a preferred embodiment of the browser-based encrypted DNS resolution method based on the DoH protocol described in this invention, the step of prioritizing the configuration information of the multiple available DoH servers using a preset service quality assessment method to generate a DoH server address list includes: Obtain historical response latency data for each DoH server, and determine the average of the historical response latency data as the first evaluation metric; Obtain the security certificate level information for each DoH server, and determine the security certificate level information as the second evaluation indicator; Based on the first evaluation index and the second evaluation index, all DoH servers are comprehensively scored according to the weighted scoring rules. The DoH server address list is generated in descending order of comprehensive score.

[0010] As a preferred embodiment of the browser-based encrypted DNS resolution method based on the DoH protocol described in this invention, the step of performing integrity matching verification on the expected response corresponding to the encrypted DNS query message includes: Send the encrypted DNS query message to the target DoH server address and receive the actual DNS response message returned by it; Based on the public key information of the target DoH server address and the actual DNS response message, the actual response digest is calculated; The actual response digest is matched and verified using the standard response digest corresponding to the target DoH server address in the DoH server address list to obtain the matching and verification result.

[0011] As a preferred embodiment of the browser-based encrypted DNS resolution method based on the DoH protocol described in this invention, the step of matching and verifying the actual response digest using the standard response digest corresponding to the target DoH server address in the DoH server address list to obtain the matching and verification result includes: Calculate the summary distance between the actual response summary and the standard response summary; If the digest distance is less than the preset security threshold, it is determined that the actual DNS response message has not been tampered with, and the matching verification result is a match.

[0012] As a preferred embodiment of the browser-encrypted DNS resolution method based on the DoH protocol described in this invention, the DoH service decision module includes a request construction unit and an address selection unit; the request construction unit and the address selection unit are cascaded. The step of inputting the target domain name resolution request into the pre-configured DoH service decision module to obtain the target DoH server address and the corresponding encrypted DNS query message used to perform this resolution includes: The address selection unit of the DoH service decision module selects the address with the best service quality from the preset DoH server address list as the target DoH server address. The target domain name resolution request and the target DoH server address are input into the request construction unit of the DoH service decision module, and the DNS query content is encrypted and encapsulated by calling the national cryptographic SM2 / SM9 algorithm or TLS 1.3 protocol to obtain the encrypted DNS query message.

[0013] As a preferred embodiment of the browser-based encrypted DNS resolution method based on the DoH protocol described in this invention, the step of triggering a hierarchical fallback mechanism starting from the target DoH server address to determine the target backup resolution scheme for performing this resolution includes: Using the sequence number of the target DoH server address in the DoH server address list as the center point, the fallback range is expanded in ascending order of levels, and candidate backup DoH server addresses are selected in a preset order within each level. Perform encrypted DNS queries and integrity matching verifications on the candidate backup DoH server addresses to obtain the target verification results corresponding to the candidate backup DoH server addresses; When the target verification result indicates that the DNS response message returned by the candidate alternative DoH server address matches, the candidate alternative DoH server address is determined as the target alternative resolution scheme; If all candidate alternate DoH server addresses at all levels fail to be verified, the traditional DNS resolution interface of the local operating system will be selected as the target alternate resolution scheme.

[0014] Secondly, the present invention provides a browser-encrypted DNS resolution system based on the DoH protocol, comprising: The first acquisition module is used to acquire the target domain name resolution request initiated by the user through the browser; The first determining module is used to input the target domain name resolution request into the pre-configured DoH service decision module to obtain the target DoH server address and the corresponding encrypted DNS query message used to perform this resolution; The second determining module is used to perform integrity matching verification on the expected response corresponding to the encrypted DNS query message. If the matching verification result indicates that the expected response does not match the actual received DNS response message, a hierarchical fallback mechanism is triggered starting from the target DoH server address to determine the target backup resolution scheme for performing this resolution. The parsing execution module is used to drive the browser to establish a network connection and load the network resources corresponding to the target domain name by using the target backup parsing scheme or the target DoH server address to successfully obtain the target IP address.

[0015] Thirdly, the present invention provides an electronic device including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described above.

[0016] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described above.

[0017] Compared with existing technologies, the beneficial effects of this invention are that it proposes a browser-based encrypted DNS resolution method based on the DoH protocol. This method obtains the target domain name resolution request initiated by the user and inputs it into a pre-set DoH service decision module to obtain the target DoH server address and the encrypted DNS query message. The received DNS response message undergoes integrity matching verification. If the verification fails, a hierarchical fallback mechanism is triggered starting from the original target address to determine a backup resolution scheme. Finally, the successfully obtained IP address is used to load network resources. This invention effectively solves the problem of resolution failure caused by server failure or response tampering during DoH resolution. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating a browser-based encrypted DNS resolution method based on the DoH protocol, as provided in one embodiment of the present invention.

[0020] Figure 2 This is a flowchart illustrating a digital digest generation method based on public-key cryptography for constructing a verifiable DNS response fingerprint, provided as an embodiment of the present invention for a browser-based encrypted DNS resolution method based on the DoH protocol.

[0021] Figure 3 This is a scatter plot of the digest distance of a browser-based encrypted DNS resolution method based on the DoH protocol, provided as an embodiment of the present invention.

[0022] Figure 4 The flowchart illustrates the operation of a browser-based encrypted DNS resolution method based on the DoH protocol, which is a metric method based on Hamming distance or byte-level XOR difference statistics, as provided in an embodiment of the present invention.

[0023] Figure 5 The flowchart illustrates the steps of a browser-based encrypted DNS resolution method based on the DoH protocol, which uses a concentric layer expansion algorithm starting from a central index to dynamically select candidate backup servers from a DoH server address list, as provided in one embodiment of the present invention.

[0024] Figure 6 This invention provides a browser-based encrypted DNS resolution method based on the DoH protocol, which performs end-to-end secure query and comparison operations on candidate backup DoH server addresses, reusing the flowchart of the complete encrypted resolution and verification pipeline defined in S2 to S33.

[0025] Figure 7 This is an internal structure diagram of an electronic device that provides a browser-encrypted DNS resolution method based on the DoH protocol, as an embodiment of the present invention. Detailed Implementation

[0026] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0027] It should be noted in advance that the system mentioned in the embodiments as the subject of real-time operation refers to any system configured with this method.

[0028] Example 1, referring to Figures 1-6 This is the first embodiment of the present invention, which provides a browser-based encrypted DNS resolution method based on the DoH protocol, comprising: This invention provides a method that can effectively solve the problems mentioned above. The following will describe in detail how to implement the browser encrypted DNS resolution method based on the DoH protocol using multiple embodiments. Figure 1 A flowchart illustrating a browser-based encrypted DNS resolution method based on the DoH protocol is shown, including: S1, obtain the target domain name resolution request initiated by the user through the browser; It should be noted that traditional browsers rely on the standard DNS interface provided by the operating system to handle domain name resolution. This interface uses a plaintext transmission protocol and cannot encrypt and protect the query content and response results. This makes it easy for users using this interface to have their access behavior monitored, recorded, or even tampered with by intermediate nodes in the network. This insecurity is especially common in public Wi-Fi or enterprise proxy environments.

[0029] In addition, some browsers already support the DoH protocol, but these existing browsers are usually only configured with a single or static DoH server address. Once the server returns an abnormal response due to network fluctuations, service interruption, or malicious attack, it will often fall back directly to the insecure traditional DNS channel. It is impossible to verify the authenticity of the response or implement a multi-level fault tolerance mechanism, which cannot meet the actual needs of high-security business scenarios such as finance or power.

[0030] Understandably, this solution builds an active domain name resolution entry point inside the browser to capture target domain name resolution requests triggered by user input or clicks in real time, and uses these target domain name resolution requests as the original input source for subsequent encrypted resolution processes. This ensures that all domain names to be resolved are included in a controlled and secure processing path, rather than being handled by the operating system's default resolver, thus blocking the risk of plaintext DNS exposure at the source.

[0031] The aforementioned target domain name resolution request refers to a query instruction triggered by a user through browser address bar input, bookmark click, or hyperlink jump within a webpage to query the mapping relationship between a specific domain name and an IP address. This request contains complete hostname information and query type identifier, is generated by the browser kernel before establishing a TCP connection, and serves as the initial trigger signal for starting the encrypted resolution process in the method of this invention. All such requests are forcibly imported into a preset secure resolution channel and no longer rely on the default DNS resolution behavior of the operating system.

[0032] S2, input the target domain name resolution request into the pre-configured DoH service decision module to obtain the target DoH server address and the corresponding encrypted DNS query message used to perform this resolution; In some embodiments, the DoH service decision module in step S2 includes a request construction unit and an address selection unit; the request construction unit and the address selection unit are cascaded. In some embodiments, the specific steps in step S2 of inputting the target domain name resolution request into a pre-configured DoH service decision module to obtain the target DoH server address and the corresponding encrypted DNS query message used to perform this resolution may include: S21, through the address selection unit of the DoH service decision module, select the address with the best service quality from the preset DoH server address list as the target DoH server address; Specifically, a service quality assessment model based on multi-dimensional weighted scoring can be used to quantify and score each candidate address in the pre-set DoH server address list, and determine the optimal target based on the score ranking. This service quality assessment model integrates two core indicators: historical average response latency and security certificate level.

[0033] In some embodiments, the response latency records of each DoH server over a period of time are first extracted from the local cache, and their arithmetic mean is calculated as the first evaluation metric.

[0034] Furthermore, the X.509 certificate chain information presented by each DoH server during the TLS handshake phase is queried, and based on factors such as the authority of the certificate authority, the strength of the public key algorithm, and whether it supports the national cryptographic standard, it is mapped to discrete security level values ​​as a second evaluation indicator.

[0035] Furthermore, the two indicators are linearly weighted according to preset weights to generate a comprehensive score for each DoH server.

[0036] Furthermore, all servers are reordered from highest to lowest based on their overall scores to form a dynamically optimized list of DoH server addresses, and the first address in the list is selected as the target DoH server address for this resolution.

[0037] For example, when a user visits a bank's official website, the address selection unit selects the target DoH server address from a list that includes Cloudflare, Google Public DNS, and nationally certified government DoH nodes. The government DoH node with the highest score, based on recent actual test latency of less than 50 milliseconds and holding an SM2 certificate certified by the State Cryptography Administration, is selected.

[0038] The DoH server address list refers to a set of DNS over HTTPS service endpoint addresses that are pre-configured and sorted by service quality assessment and maintained locally by the browser. Each address entry contains the complete HTTPS URL path, the corresponding public key fingerprint, and historical performance data. The target DoH server address refers to the unique DoH service endpoint selected by the address selection unit in the current resolution task based on the principle of the highest comprehensive score. It is used to receive the encrypted DNS query message and return the response result.

[0039] S22, input the target domain name resolution request and the target DoH server address into the request construction unit of the DoH service decision module, call the national cryptographic SM2 / SM9 algorithm or TLS 1.3 protocol to encrypt and encapsulate the DNS query content, and obtain an encrypted DNS query message.

[0040] Specifically, the request construction unit can receive the target DoH server address and the original target domain name resolution request output by the address selection unit, and dynamically select the appropriate encryption mechanism based on the encryption capabilities supported by the target DoH server.

[0041] If the target DoH server is deployed in a national critical information infrastructure environment and explicitly declares support for national cryptographic algorithms, then the SM2 or SM9 asymmetric encryption system should be used first to sign and encapsulate the DNS query content.

[0042] If the target DoH server is an internationally recognized public node, a secure transmission channel is established using the widely compatible TLS 1.3 protocol. Within this channel, standard DNS messages are encapsulated using HTTPS POST. This encapsulation and encryption operation can prevent attacks such as eavesdropping, tampering, or forging responses by intermediate nodes.

[0043] For example, when a user accesses a government service platform, the target DoH server address is selected as a government-certified dedicated DoH node. This node declares in its service metadata that it supports SM2 public key encryption. At this time, the request construction unit digitally signs the A record query request for the target domain name "service.gov.cn" using an SM2 private key, encapsulates it into a DoH-compatible payload in a binary format conforming to RFC specifications, and then sends it to the government DoH server via an HTTPS connection.

[0044] The request construction unit refers to the logical processing unit in the DoH service decision module that is specifically responsible for converting the original domain name resolution request and the target server address into an encrypted message conforming to the DoH specification. The encrypted DNS query message refers to the DNS query data structure that has been signed by the national cryptographic SM2 / SM9 algorithm or encapsulated by the TLS 1.3 channel. Its content cannot be read or modified by third parties, and it has verifiable integrity and authenticity of origin. It is used to securely transmit the domain name resolution intent between the browser and the target DoH server.

[0045] S3, perform integrity matching verification on the expected response corresponding to the encrypted DNS query message. If the matching verification result indicates that the expected response does not match the actual received DNS response message, then trigger the hierarchical fallback mechanism starting from the target DoH server address to determine the target backup resolution scheme to be used to perform this resolution. In some embodiments, the specific steps in step S3 of performing integrity matching verification on the expected response corresponding to the encrypted DNS query message may include: S31, send an encrypted DNS query message to the target DoH server address and receive the actual DNS response message returned by it; Specifically, a standard client communication process based on the HTTPS protocol stack can be adopted. A dedicated DoH communication channel can be built in the browser kernel. The generated encrypted DNS query message can be sent as an HTTP POST request body through a TCP connection to port 443 corresponding to the target DoH server address, and a timeout retransmission and response listening mechanism can be started.

[0046] In some embodiments, the browser's network module first establishes a TLS 1.3 secure session based on the target DoH server address. This secure session is used to complete certificate verification and key negotiation.

[0047] Furthermore, the encrypted DNS query message is encapsulated as a POST request payload in application / dns-message format, and the encapsulated result is sent to the DoH interface path of the server.

[0048] Furthermore, a preset response wait timer is activated, typically set to within 2 seconds; If an HTTP 200 status code and payload are received from the server within the time limit, the binary DNS response data is extracted as the actual DNS response message.

[0049] If no response is received within the timeout period or an unsuccessful status code such as 502 or 504 is received, the communication failure will be recorded and the rollback process will be prepared.

[0050] Furthermore, the successfully received actual DNS response message, along with the address of the target DoH server, is passed to the subsequent integrity verification module.

[0051] For example, when a user visits a bank's official website, the browser sends an encrypted query message with an SM2 signature to the government-certified DoH server address https: / / doh.gov-bank.cn / dns-query. Within 800 milliseconds, the server returns a DNS response containing the IP address 10.24.56.78. This response is captured in its entirety and marked as the actual DNS response message for this resolution. This actual DNS response message can be used for the next step of digest comparison.

[0052] S32, Calculate the actual response digest based on the public key information of the target DoH server address and the actual DNS response message; It should be noted that, in order to address the security risk of returning a fake IP address during DoH resolution due to man-in-the-middle tampering or server hijacking, a verifiable response integrity mechanism can be established.

[0053] Specifically, this response integrity mechanism can be established by using a digital digest generation method based on public-key cryptography. Specifically, the public key information corresponding to the target DoH server address can be combined with the actual DNS response message to perform a joint hash operation to generate a response fingerprint that is unique and collision-resistant.

[0054] In some embodiments, a digital digest generation method based on public-key cryptography is used to construct a verifiable DNS response fingerprint, such as... Figure 2 As shown, the specific steps include: Step A1: Read the public key information bound to the target DoH server address from the local secure storage area. This public key information is verified through certificate chain verification or pre-configured through a trusted channel during the DoH server address list initialization phase. Step A2: Receive the actual DNS response message returned by the target DoH server, and concatenate the complete binary content of the actual DNS response message with the public key information corresponding to the target DoH server address to form the combined input data; Step A3: Determine whether the combined input data is empty or has an abnormal format. If it is empty or abnormal, proceed to step A7; otherwise, proceed to step A4. Step A4: Use the SM3 hash algorithm certified by the State Cryptography Administration or the internationally recognized SHA-256 algorithm to perform a one-way hash operation on the combined input data and generate a fixed-length byte sequence as the actual response digest. Step A5: Extract the standard response digest corresponding to the target DoH server address from the DoH server address list. This standard response digest is generated and bound to the storage by a trusted source when the server endpoint is configured. Step A6: Compare the actual response digest with the standard response digest bit by bit and calculate the digest distance between the two. If the digest distance is less than the preset security threshold, it is determined that the response has not been tampered with and the matching verification result is a match, then proceed to step A8; otherwise, it is determined that the response has an unacceptable deviation and the matching verification result is a mismatch, then proceed to step A9. Step A7: Record the response verification failure event, trigger the hierarchical rollback mechanism, and end the current summary generation process; Step A8: Encapsulate the target DoH server address and its returned target IP address into a valid resolution scheme, and terminate subsequent verification operations; Step A9: Using the sequence number of the target DoH server address in the DoH server address list as the center point, initiate the hierarchical fallback mechanism, select candidate backup DoH server addresses, and re-execute the encryption query and digest generation process.

[0055] like Figure 3 The image shows a scatter plot of the digest distance. The horizontal axis of the scatter plot represents the DoH query number, and the vertical axis represents the digest distance (in bits) between the actual response digest obtained in this query and the standard response digest. Figure 3 The vast majority of points are concentrated at y=0, indicating that the response has not been tampered with; a small number of points are located at y=1 or y=2, which are reasonable fluctuations caused by the network environment; individual points reach y=4 or y=5, exceeding the preset security threshold (shown by the red line), and will be judged by the system as an untrusted response, triggering the hierarchical rollback mechanism.

[0056] The aforementioned actual response digest is a unique digital fingerprint generated based on the public key information and the actual DNS response message using a cryptographic hash function; the aforementioned standard response digest is a baseline digest value that is obtained through a trusted channel and bound to the corresponding DoH server address during the DoH server address list initialization phase; the aforementioned digest distance refers to the number of different bits in the binary representation of two fixed-length digest values; and the aforementioned preset security threshold refers to the maximum acceptable difference in bits between the actual response digest and the standard response digest, predefined in the system security policy.

[0057] S33. Using the standard response digest corresponding to the target DoH server address in the DoH server address list, match and verify the actual response digest to obtain the matching and verification result.

[0058] In some embodiments, step S33 uses the standard response digest corresponding to the target DoH server address in the DoH server address list to match and verify the actual response digest, obtaining the matching and verification result, including: S331, Calculate the summary distance between the actual response summary and the standard response summary; In some embodiments, a metric based on Hamming distance or byte-level XOR difference statistics can be used to compare the actual response digest bit by bit with the standard response digest, such as... Figure 4 As shown, the specific steps include: Step B1: Obtain the actual response digest and the standard response digest from the integrity verification module. Both digests are fixed-length binary sequences. Step B2: Determine whether the length of the actual response summary is consistent with that of the standard response summary. If the lengths are inconsistent, proceed to step B7; otherwise, proceed to step B3. Step B3: Align the actual response summary and the standard response summary with the same bit order, perform a bitwise XOR operation, and generate a difference bitmap; Step B4: Iterate through each bit in the difference bitmap, count the total number of bits with a value of 1, and obtain the digest distance; Step B5: Read the preset security threshold in the local policy engine and determine whether the digest distance is less than the preset security threshold. If it is less, proceed to step B6; otherwise, proceed to step B8. Step B6: Determine that the actual DNS response message has not been tampered with, and the matching verification result is a match. Encapsulate the target DoH server address and its returned target IP address into a valid resolution scheme, and end the verification process. Step B7: Record the summary format exception event, mark the current DoH server response as untrusted, trigger the hierarchical rollback mechanism, and end the current comparison process; Step B8: If the actual DNS response message has an unacceptable deviation and the matching verification result is a mismatch, the hierarchical fallback mechanism is initiated with the target DoH server address in the DoH server address list as the center point, and the candidate backup DoH server verification process is entered.

[0059] The aforementioned difference bitmap is a binary sequence generated by performing a bitwise XOR operation on two digests. The difference bitmap is used to identify inconsistencies.

[0060] S332, if the digest distance is less than the preset security threshold, it is determined that the actual DNS response message has not been tampered with, and the matching verification result is a match.

[0061] It should be noted that, in order to solve the problem of valid responses being misjudged as abnormal due to strict equality comparison during DoH parsing, a dynamic verification mechanism with fault tolerance can be introduced.

[0062] In some embodiments, the aforementioned dynamic verification mechanism can be implemented by setting a preset security threshold to a fixed integer based on the cryptographic digest length and typical network environment disturbance statistics. For example, a maximum of 3 bit differences are allowed in a 256-bit SM3 digest. This threshold is written into the security policy configuration file during the system initialization phase and is prohibited from being dynamically modified at runtime to prevent attackers from bypassing verification by increasing the threshold.

[0063] In some embodiments, the summary distance value calculated in the previous step is obtained first.

[0064] Furthermore, it reads the preset security thresholds stored in the local policy engine.

[0065] Furthermore, compare whether the distance between the comparison abstracts is strictly less than the preset security threshold; If the conditions are met, a judgment signal indicating a match is generated and the current parsing is marked as trustworthy. If the conditions are not met, the response is deemed to have an unacceptable deviation, possibly indicating a man-in-the-middle injection or server logic anomaly, and a layered rollback mechanism is triggered.

[0066] Furthermore, the matching verification result, along with the original response data, is passed to the parsing and execution module to determine whether to use the IP address to establish a connection.

[0067] For example, when a user visits a bank's official website, the calculated distance between the actual response digest and the standard response digest is 2, while the system's preset security threshold is 3. Since 2 is less than 3, the browser determines that the response has not been maliciously tampered with, and the matching verification result is a match. Subsequently, it directly uses the returned IP address 10.24.56.78 to initiate an HTTPS connection and complete the secure login process.

[0068] In some embodiments, step S3 triggers a hierarchical fallback mechanism starting from the target DoH server address to determine the target backup resolution scheme for performing this resolution, including: S34, taking the index of the target DoH server address in the DoH server address list as the center point, expand the fallback range in ascending order of levels, and select candidate backup DoH server addresses in a preset order within each level range; Specifically, S34 can be implemented using a concentric layer expansion algorithm starting from the central index. The DoH server address list can be regarded as a one-dimensional ordered sequence. The candidate window is expanded outward layer by layer with the index position of the initial target server as the origin. Within each layer, the query order is determined according to the descending order of service quality score or the principle of geographical proximity.

[0069] In some embodiments, a concentric layer expansion algorithm starting from the central index is used to dynamically select candidate backup servers from the DoH server address list, such as... Figure 5 As shown, the specific steps include: Step C1: Determine the sequence number of the initial target DoH server address in the DoH server address list, and use it as the central index; Step C2: Initialize the current backtracking level to the first level, and set the left and right boundaries to be the center index minus one and the center index plus one, respectively; Step C3: Determine whether the left and right boundaries exceed the valid index range of the DoH server address list. If the left boundary is less than zero, set it to zero; if the right boundary is greater than the maximum index of the list, set it to the maximum index of the list. Step C4: Within the left and right boundaries of the current fallback level, extract all DoH server addresses that have not yet been tried to form a candidate set for the current level; Step C5: Determine if the current layer candidate set is empty. If it is empty, proceed to step C9; otherwise, proceed to step C6. Step C6: Sort the DoH server addresses in the current layer candidate set from high to low according to the comprehensive score in the DoH server address list. If the scores are the same, sort them according to the principle of geographical proximity. Step C7: Iterate through the sorted candidate set of the current layer in sequence, and perform encrypted DNS query and integrity matching verification for each candidate backup DoH server address; Step C8: Determine whether the verification result of the current candidate backup DoH server address is a match. If yes, determine the candidate backup DoH server address and its returned target IP address as the target backup resolution scheme and proceed to step C10; otherwise, continue to traverse the next candidate address. Step C9: Determine whether the current fallback level has covered the entire DoH server address list. If yes, proceed to step C11; otherwise, increment the fallback level by one level, update the left and right boundaries to the original center index minus and plus the current level value respectively, and return to step C3. Step C10: Terminate the layered fallback mechanism, use the target backup resolution scheme to drive the browser to establish a network connection and load the network resources corresponding to the target domain name; Step C11: Select the traditional DNS resolution interface of the local operating system as the target backup resolution scheme and end the rollback process.

[0070] The aforementioned central index refers to the position number of the initial target DoH server address in the DoH server address list after service quality assessment and sorting; the aforementioned fallback level refers to the integer number of layers expanding outward from the central index, with the nth layer covering the range from the central index minus n to the central index plus n; the aforementioned current layer candidate set refers to the subset of DoH server addresses within the current fallback level boundary that have not yet participated in verification; the aforementioned comprehensive score refers to a quantitative indicator calculated based on the historical average response latency and security certificate level information according to a weighted scoring rule; the aforementioned geographical proximity principle means that when the comprehensive scores are the same, the DoH server address that is closer to the user terminal network topology is given priority.

[0071] S35, Perform encrypted DNS query and integrity matching verification on the candidate backup DoH server address to obtain the target verification result corresponding to the candidate backup DoH server address; In some embodiments, the process of performing end-to-end secure query and comparison operations on candidate backup DoH server addresses reuses the complete encryption parsing and verification pipeline defined in S2 to S33, such as... Figure 6 As shown, the specific steps include: Step D1: Input the original target domain name resolution request and the current candidate backup DoH server address into the address selection unit of the DoH service decision module to confirm that the candidate backup DoH server address is the target DoH server address for this resolution. Step D2: The target domain name resolution request and the target DoH server address are passed to the request construction unit of the DoH service decision module, which calls the national cryptographic SM2 or SM9 algorithm or TLS 1.3 protocol to encrypt and encapsulate the DNS query content, and generate an encrypted DNS query message. Step D3: Send an encrypted DNS query message to the target DoH server address and start a response listening mechanism to wait for the actual DNS response message to be received; Step D4: Determine whether an HTTP 200 status code and payload have been received within the preset time limit. If received, proceed to step D5; otherwise, mark the current communication as failed and proceed to step D9. Step D5: Extract binary DNS response data from the payload as the actual DNS response message; Step D6: Obtain the public key information bound to the target DoH server address from the local secure storage area, and input the public key information and the actual DNS response message into the cryptographic hash function to calculate the actual response digest; Step D7: Read the standard response digest corresponding to the target DoH server address from the DoH server address list, and calculate the digest distance between the actual response digest and the standard response digest; Step D8: Determine whether the summary distance is less than the preset security threshold. If it is less, determine that the matching verification result is a match and proceed to step D10; otherwise, determine that the matching verification result is a mismatch and proceed to step D9. Step D9: Record the failure of the current candidate backup DoH server address verification, return to the hierarchical fallback mechanism, select the next candidate backup DoH server address and re-execute this process; Step D10: Determine the current candidate backup DoH server address and its returned target IP address as the target backup resolution scheme, and terminate subsequent verification operations.

[0072] Among them, the candidate backup DoH server address refers to the DoH service endpoint selected in the current level of the hierarchical fallback mechanism to replace the original target server; the encrypted DNS query message refers to the DNS query data structure after being signed by the national cryptographic SM2 or SM9 algorithm or encapsulated by the TLS 1.3 channel; the actual DNS response message refers to the original DNS response content returned by the target DoH server after successfully processing the encrypted DNS query message; the actual response digest is a unique digital fingerprint generated by cryptographic hash function based on the public key information of the target DoH server address and the actual DNS response message; the standard response digest is the baseline digest value obtained in advance through a trusted channel and bound to the corresponding DoH server address during the initialization phase of the DoH server address list; the digest distance refers to the number of different bits in the binary representation of two fixed-length digest values; and the preset security threshold refers to the maximum acceptable difference in bits between the actual response digest and the standard response digest as predefined in the system security policy.

[0073] S36, When the target verification result indicates that the DNS response message returned by the candidate alternate DoH server address matches, the candidate alternate DoH server address is determined as the target alternate resolution scheme; Specifically, an atomic verification-acceptance mechanism can be set up to implement S36. After completing the full verification process of S35 for each candidate backup DoH server address, the target verification result is immediately checked to see if it matches. If it does, the current fallback level and all subsequent extension operations are terminated, and the candidate address and its successfully resolved IP address are bound as the final resolution scheme for this request.

[0074] In some embodiments, when implementing an atomic verification-acceptance mechanism, the target verification result output from the integrity matching verification module can be received first.

[0075] Furthermore, it determines whether the target verification result output by the integer matching verification module explicitly indicates that the DNS response message returned by the candidate backup DoH server address has not been tampered with and its content is credible.

[0076] If a match is determined, the corresponding candidate backup DoH server address and the target IP address contained in the actual DNS response message returned by the server are extracted.

[0077] Furthermore, the two are combined and encapsulated into a target backup parsing scheme, serving as a legitimate parsing exit to replace the original failed path.

[0078] Furthermore, the hierarchical rollback loop is interrupted, and other candidate addresses at the same or outermost layers are no longer attempted.

[0079] For example, when accessing a bank's official website, the response returned by the financial alliance DoH node (sequence number 3) has a verified digest distance of 0, and the target verification result is a match. The system immediately identifies this node and its resolved IP address 10.24.56.78 as the target backup resolution scheme, skips further queries to the national public DoH node (sequence number 4), and directly enters the connection establishment phase.

[0080] The aforementioned target verification result refers to the binary judgment conclusion obtained after performing encrypted DNS query and integrity matching verification on the candidate backup DoH server address. The value of the target verification result is either match or non-match. The target backup resolution scheme refers to the executable resolution result formed by the first candidate backup DoH server address that passes the integrity verification and the target IP address that is successfully returned after the primary DoH server verification fails. This is used to drive the browser to complete subsequent network connection and resource loading.

[0081] S37. If all candidate alternate DoH server addresses at all levels fail to be verified, the traditional DNS resolution interface of the local operating system will be selected as the target alternate resolution scheme.

[0082] Specifically, after verifying all candidate backup DoH server addresses within the outermost fallback range and all returning non-matching results, the final downgrade strategy can be triggered by calling the operating system's native DNS resolution function encapsulated in the browser's underlying network stack to perform a plaintext DNS query.

[0083] In some embodiments, it can be confirmed first that all levels of the DoH server address list have been rolled back. This list of DoH server addresses that have been rolled back includes all candidate addresses that extend outward from the center point to the beginning and end of the list.

[0084] Furthermore, check whether the target verification result of each candidate address is a mismatch; if so, none of them pass the integrity matching verification.

[0085] Furthermore, terminate all DoH-related communication processes and release established security sessions and cache contexts.

[0086] Furthermore, it can call the getaddrinfo or similar standard API provided by the operating system to initiate an unencrypted UDP or TCP DNS query to the locally configured default DNS server.

[0087] Furthermore, the traditional DNS resolution interface and the IP address it returns are jointly identified as the target backup resolution scheme.

[0088] For example, when a user accesses a bank's official website in a highly secure isolated network, the government DoH node, the financial alliance node, and the national public DoH node all return invalid or tampered responses due to network policy restrictions. After multiple layers of fallback verification all fail, the system finally uses the locally configured operator DNS server to perform a plaintext query, successfully obtains the IP address 10.24.56.78, and uses it to complete the page loading. Although encryption is sacrificed, business continuity is guaranteed.

[0089] The traditional DNS resolution interface of the local operating system mentioned above refers to the standard domain name resolution function provided by the operating system kernel or network service module. It usually communicates with the locally configured DNS server through unencrypted UDP port 53 and does not include HTTPS encapsulation or response integrity verification.

[0090] S4. The target IP address, which is successfully obtained using the target backup resolution scheme or the target DoH server address, drives the browser to establish a network connection and load the network resources corresponding to the target domain name.

[0091] It should be noted that traditional browsers usually initiate TCP connections directly using the obtained IP address after completing DNS resolution. However, if the IP address comes from an unverified resolution path, it may redirect users to phishing websites or malicious content distribution nodes, causing serious harm such as the leakage of account credentials.

[0092] In addition, some traditional browsers do not distinguish the source of the parsing results. After the encryption parsing fails, they silently fall back to the plaintext channel without any risk warning, exposing users to the risk of man-in-the-middle attacks without their knowledge, especially in highly sensitive business scenarios such as finance or government affairs.

[0093] Understandably, this solution ensures that the target IP address originates from a trusted resolution path that has undergone integrity verification, whether it is the initial target DoH server, the first verified candidate backup DoH server in the layered fallback mechanism, or the traditional DNS interface as a last resort, before allowing the browser kernel to initiate subsequent HTTPS connections and resource loading processes based on that IP address.

[0094] For example, when a user visits a bank's official website, the system eventually obtains the IP address 10.24.56.78 through the financial alliance DoH node and verifies the match. The browser then establishes a TLS 1.3 encrypted connection with this IP as the target and loads the login page. If all DoH paths fail and traditional DNS is used, the system can trigger security alerts or restrict sensitive operations simultaneously, even though the IP obtained is resolved in plaintext.

[0095] In some embodiments, configuration information for multiple available DoH servers can also be obtained; The configuration information of multiple available DoH servers is prioritized using a preset service quality assessment method to generate a list of DoH server addresses.

[0096] Specifically, during the initialization phase or periodic maintenance cycle, the browser can obtain a set of available DoH server configuration information from local policy configuration, user-defined settings, or trusted third-party service directories. Each configuration information includes the complete HTTPS endpoint URL, supported encryption protocol types, public key fingerprint, and optional geographic region label.

[0097] Furthermore, based on a preset service quality assessment method, these configuration information are quantitatively scored and sorted, ultimately constructing a dynamically optimized DoH server address list. This DoH server address list ensures that subsequent parsing requests are preferentially scheduled to the node with the best overall performance.

[0098] For example, when the system starts up for the first time, the browser loads the built-in list of public DoH services, which may include Cloudflare DoH, Google Public DNS over HTTPS, nationally certified government DoH nodes, and financial industry alliance DoH services, for a total of 8 candidate addresses; Furthermore, the average historical response latency recorded by each server over the past 24 hours is collected; for example, the average latency for government service nodes is 45 milliseconds, and for Cloudflare it is 62 milliseconds. Furthermore, by analyzing its TLS certificate chain, the security certificate level can be identified. For example, government nodes use SM2 certificates issued by the State Cryptography Administration and are rated as high security level, while some international nodes only support RSA-2048 and have not passed the national cryptographic compliance certification and are rated as medium security level. Furthermore, a comprehensive score can be calculated based on a weighted average of 70% response latency and 30% security level. The government node scored 92.5, while Cloudflare scored 84.3. Furthermore, a list of DoH server addresses is generated by sorting the scores from highest to lowest, with government service nodes at the top.

[0099] Among them, the multiple available DoH server configuration information refers to a set of structured DoH service description data that can be called by the browser. Each item includes the service address, encryption capability identifier, public key information and performance metadata. The preset service quality evaluation method refers to the multi-index weighted scoring rules defined by the system policy, which includes at least two evaluation dimensions: historical average response latency and security certificate level.

[0100] In some embodiments, a preset quality of service (QoS) assessment method is used to prioritize the configuration information of multiple available DoH servers, generating a DoH server address list, including: Obtain historical response latency data for each DoH server, and determine the average of the historical response latency data as the primary evaluation metric; Specifically, the browser's built-in performance monitoring module can continuously record the time interval between each query sent to each DoH server and the receipt of a valid response, and maintain a sliding time window mechanism to maintain the latency samples of the most recent valid responses.

[0101] In some embodiments, after each successful DoH resolution, the millisecond-level time elapsed between sending the encrypted DNS query message and receiving and verifying the actual DNS response message is recorded.

[0102] Furthermore, the time consumption value is stored in the local latency log queue at the corresponding DoH server address. This queue uses a fixed-length circular buffer structure, for example, retaining the 30 most recent valid samples.

[0103] Furthermore, periodically or before generating the DoH server address list, all historical response latency data in this queue is read.

[0104] Furthermore, after removing timeout or outliers, the arithmetic mean of the remaining valid samples is calculated.

[0105] Furthermore, the arithmetic mean is used as the first evaluation metric for the DoH server, and this first evaluation metric is used for subsequent comprehensive scoring.

[0106] For example, in the past 30 resolutions, the response latency of the government DoH node was 42ms, 48ms, 45ms, etc., with a calculated average of 46.3 milliseconds. In contrast, a certain international node repeatedly showed a latency of more than 300ms, with an average of 218 milliseconds. Therefore, the government node is significantly better than the latter in the first evaluation indicator, which provides a key basis for its high position in the comprehensive ranking.

[0107] Obtain the security certificate level information for each DoH server, and determine the security certificate level information as the second evaluation indicator; Specifically, each time a TLS connection is established with the DoH server, the X.509 certificate chain provided by the server can be parsed, and its security attributes can be scored according to the preset cryptographic policy rule set to generate discrete security certificate level information.

[0108] In some embodiments, the public key algorithm type, signature hash algorithm, certificate authority identifier, and whether the national cryptographic standard is supported can be extracted from the server certificate after the TLS 1.3 handshake is completed.

[0109] Furthermore, the system matches certificates against a locally built-in security level mapping table. For example, certificates using the SM2 public key algorithm and issued by a CA recognized by the State Cryptography Administration are rated as Level 5 (the highest). Certificates using RSA-2048 and SHA-256 and issued by mainstream international CAs are rated as Level 4. Certificates using ECC but not registered with the CA are rated as Level 2. Self-signed or SHA-1 certificates are rated as Level 1.

[0110] Furthermore, this level value is used as the security certificate level information for the DoH server.

[0111] Furthermore, it is directly designated as the second evaluation indicator for use in subsequent weighted comprehensive scoring.

[0112] For example, the certificate returned by the government DoH node is issued by the National E-Government Extranet CA Center and uses a combination of SM2 / SM3 algorithms. The system determines that the security certificate level is 5. However, although an international public DoH node uses a certificate issued by Let's Encrypt, it only supports RSA-2048 and is not compatible with Chinese cryptographic standards, so the security certificate level is 4. Therefore, in the second evaluation indicator, the government node receives a higher weight, which strengthens its priority scheduling position in high-security services.

[0113] The security certificate level information mentioned above refers to the integer level value assessed based on the cryptographic strength of the DoH server's TLS certificate, the authority of the issuing authority, and whether it complies with the national commercial cryptography management standards. The value range is usually from 1 to 5.

[0114] Based on the first and second evaluation indicators, all DoH servers are comprehensively scored according to the weighted scoring rules. Specifically, a linear weighted fusion method can be used to solve the comprehensive score, which involves normalizing the first and second evaluation indicators respectively, and then calculating the comprehensive score of each DoH server according to the preset weight coefficients.

[0115] In some embodiments, the first evaluation metric is first reverse normalized, for example, the average response latency is mapped to a performance score of 0 to 100, with lower latency resulting in a higher score. The formula used here is: performance score = max(0, 100 - (average latency ÷ 10)), ensuring that 50 milliseconds corresponds to 50 points and 10 milliseconds corresponds to 90 points.

[0116] Furthermore, the safety certificate level information of the second assessment indicator is directly multiplied by 20 to convert it into a safety score of 0 to 100. For example, level 1 gets 20 points, while level 5 gets 100 points.

[0117] Furthermore, the weight ratios can be set according to system policies. For example, in high-security scenarios such as finance and government affairs, a performance weight of 30% and a security weight of 70% can be used, while in ordinary browsing scenarios, a performance weight of 70% and a security weight of 30% can be used.

[0118] Furthermore, a weighted composite score is calculated for each DoH server: performance score × performance weight + security score × security weight.

[0119] Furthermore, all servers are sorted from highest to lowest based on this comprehensive score.

[0120] Continuing with the example above, a government DoH node has a performance score of 93.7 (average latency of 46.3 milliseconds) and a security score of 100 (Level 5). In high-security mode, its overall score is 93.7 × 0.3 + 100 × 0.7 = 98.11. Meanwhile, an international public DoH node has a performance score of 78.2 (average latency of 218 milliseconds) and a security score of 80 (Level 4). Its overall score is 78.2 × 0.3 + 80 × 0.7 = 79.46. Therefore, the government node significantly outperforms it and is ranked first in the DoH server address list.

[0121] A list of DoH server addresses is generated based on the overall score, from highest to lowest.

[0122] Specifically, a stable sorting algorithm can be used to sort all DoH server configuration items with calculated comprehensive scores in descending order, and the sorting result can be solidified into a list of DoH server addresses used internally by the browser, serving as the sole data source for subsequent address selection units.

[0123] In some embodiments, all DoH servers participating in the evaluation and their corresponding comprehensive score values ​​can be collected first.

[0124] Furthermore, merge sort or quick sort algorithms with a time complexity of O(n log n) are invoked to sort the results from highest to lowest based on the overall score as the primary key.

[0125] If there are ties in the scores, the tie will be broken by prioritizing the security certificate level, followed by the secondary rule of better response latency, to ensure that the ranking result is certain and reproducible.

[0126] Furthermore, the sorted DoH server configuration information is stored sequentially into a structured list in memory. Each item in the structured list contains a complete HTTPS URL, public key fingerprint, historical performance data, and security level metadata.

[0127] Furthermore, the structured list is persisted to a local secure storage area for the DoH service decision module to access in real time.

[0128] For example, the government DoH node has a comprehensive score of 98.11, the financial alliance node has a score of 92.35, Cloudflare has a score of 84.60, and Google Public DNS has a score of 79.46. The generated DoH server address list after sorting is as follows: https: / / doh.gov-bank.cn / dns-query, https: / / doh.finance-alliance.cn / dns, https: / / cloudflare-dns.com / dns-query, and https: / / dns.google / dns-query. This sorting ensures that users accessing the bank's official website will be given priority to the highest-level government nodes.

[0129] Example 2, refer to Figure 7 This embodiment also provides a browser-encrypted DNS resolution system based on the DoH protocol, including: The first acquisition module is used to acquire the target domain name resolution request initiated by the user through the browser; The first determining module is used to input the target domain name resolution request into the pre-configured DoH service decision module to obtain the target DoH server address and the corresponding encrypted DNS query message used to perform this resolution; The second determination module is used to perform integrity matching verification on the expected response corresponding to the encrypted DNS query message. If the matching verification result indicates that the expected response does not match the actual received DNS response message, a hierarchical fallback mechanism is triggered starting from the target DoH server address to determine the target backup resolution scheme for performing this resolution. The parsing and execution module is used to drive the browser to establish a network connection and load the network resources corresponding to the target domain name by successfully obtaining the target IP address using the target backup parsing scheme or the target DoH server address.

[0130] The above-mentioned unit modules can be embedded in the processor of the electronic device in hardware form or independent of it, or they can be stored in the memory of the electronic device in software form, so that the processor can call and execute the corresponding operations of the above modules.

[0131] This embodiment also provides an electronic device, which can be a terminal, and its internal structure diagram can be as follows: Figure 7 As shown, the electronic device includes a processor, memory, communication interface, display screen, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage medium. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. When executed by the processor, the computer program implements a browser-encrypted DNS resolution method based on the DoH protocol. The display screen can be an LCD screen or an e-ink screen. The input device can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the device's casing, or an external keyboard, touchpad, or mouse.

[0132] This embodiment also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, it performs the following steps: Obtain the target domain name resolution request initiated by the user through the browser; Input the target domain name resolution request into the pre-configured DoH service decision module to obtain the target DoH server address and the corresponding encrypted DNS query message used to perform this resolution; The expected response to the encrypted DNS query message is subjected to integrity matching verification. If the matching verification result indicates that the expected response does not match the actual received DNS response message, a hierarchical fallback mechanism is triggered starting from the target DoH server address to determine the target backup resolution scheme for this resolution. The target IP address, successfully obtained using the target backup DNS resolution scheme or the target DoH server address, drives the browser to establish a network connection and load the network resources corresponding to the target domain name.

[0133] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

[0134] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0135] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A browser encrypted DNS resolution method based on a DoH protocol, characterized in that, include: Obtain the target domain name resolution request initiated by the user through the browser; The target domain name resolution request is input into the pre-configured DoH service decision module to obtain the target DoH server address and the corresponding encrypted DNS query message used to perform this resolution; The expected response corresponding to the encrypted DNS query message is subjected to integrity matching verification. If the matching verification result indicates that the expected response does not match the actual received DNS response message, a hierarchical fallback mechanism is triggered starting from the target DoH server address to determine the target backup resolution scheme for performing this resolution. The target IP address, successfully obtained using the target backup resolution scheme or the target DoH server address, drives the browser to establish a network connection and load the network resources corresponding to the target domain name.

2. The browser encrypted DNS resolution method based on the DoH protocol of claim 1, wherein, Also includes: Obtain configuration information for multiple available DoH servers; The configuration information of the multiple available DoH servers is prioritized and sorted using a preset service quality assessment method to generate a DoH server address list.

3. The browser encrypted DNS resolution method based on the DoH protocol of claim 2, wherein, The process of prioritizing the configuration information of the multiple available DoH servers using a preset service quality assessment method to generate a DoH server address list includes: Obtain historical response latency data for each DoH server, and determine the average of the historical response latency data as the first evaluation metric; Obtain the security certificate level information for each DoH server, and determine the security certificate level information as the second evaluation indicator; Based on the first evaluation index and the second evaluation index, all DoH servers are comprehensively scored according to the weighted scoring rules. The DoH server address list is generated in descending order of comprehensive score.

4. The browser-based encrypted DNS resolution method based on the DoH protocol as described in claim 3, characterized in that, The integrity matching verification of the expected response corresponding to the encrypted DNS query message includes: Send the encrypted DNS query message to the target DoH server address and receive the actual DNS response message returned by it; Based on the public key information of the target DoH server address and the actual DNS response message, the actual response digest is calculated; The actual response digest is matched and verified using the standard response digest corresponding to the target DoH server address in the DoH server address list to obtain the matching and verification result.

5. The browser-based encrypted DNS resolution method based on the DoH protocol as described in claim 4, characterized in that, The step of matching and verifying the actual response digest using the standard response digest corresponding to the target DoH server address in the DoH server address list to obtain the matching and verification result includes: Calculate the summary distance between the actual response summary and the standard response summary; If the digest distance is less than the preset security threshold, it is determined that the actual DNS response message has not been tampered with, and the matching verification result is a match.

6. The browser-based encrypted DNS resolution method based on the DoH protocol as described in claim 5, characterized in that, The DoH service decision module includes a request construction unit and an address selection unit; the request construction unit and the address selection unit are cascaded together. The step of inputting the target domain name resolution request into the pre-configured DoH service decision module to obtain the target DoH server address and the corresponding encrypted DNS query message used to perform this resolution includes: The address selection unit of the DoH service decision module selects the address with the best service quality from the preset DoH server address list as the target DoH server address. The target domain name resolution request and the target DoH server address are input into the request construction unit of the DoH service decision module, and the DNS query content is encrypted and encapsulated by calling the national cryptographic SM2 / SM9 algorithm or TLS 1.3 protocol to obtain the encrypted DNS query message.

7. The browser-based encrypted DNS resolution method based on the DoH protocol as described in claim 6, characterized in that, The step of triggering a tiered fallback mechanism starting from the target DoH server address to determine the target backup resolution scheme for performing this resolution includes: Using the sequence number of the target DoH server address in the DoH server address list as the center point, the fallback range is expanded in ascending order of levels, and candidate backup DoH server addresses are selected in a preset order within each level. Perform encrypted DNS queries and integrity matching verifications on the candidate backup DoH server addresses to obtain the target verification results corresponding to the candidate backup DoH server addresses; When the target verification result indicates that the DNS response message returned by the candidate alternative DoH server address matches, the candidate alternative DoH server address is determined as the target alternative resolution scheme; If all candidate alternate DoH server addresses at all levels fail to be verified, the traditional DNS resolution interface of the local operating system will be selected as the target alternate resolution scheme.

8. A browser-based encrypted DNS resolution system based on the DoH protocol, using the method described in any one of claims 1 to 7, characterized in that, include: The first acquisition module is used to acquire the target domain name resolution request initiated by the user through the browser; The first determining module is used to input the target domain name resolution request into the pre-configured DoH service decision module to obtain the target DoH server address and the corresponding encrypted DNS query message used to perform this resolution; The second determining module is used to perform integrity matching verification on the expected response corresponding to the encrypted DNS query message. If the matching verification result indicates that the expected response does not match the actual received DNS response message, a hierarchical fallback mechanism is triggered starting from the target DoH server address to determine the target backup resolution scheme for performing this resolution. The parsing execution module is used to drive the browser to establish a network connection and load the network resources corresponding to the target domain name by using the target backup parsing scheme or the target DoH server address to successfully obtain the target IP address.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the browser encrypted DNS resolution method based on the DoH protocol according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the browser encrypted DNS resolution method based on the DoH protocol according to any one of claims 1 to 7.

Images