Method and system for quick effect of authority analysis record change

Abstract

The present application belongs to the field of information technology, and relates to a method and system for quickly taking effect of authoritative analysis record change. A recursive node registers node identification, push endpoint, push channel and identity authentication information to an authoritative server to establish a node-level push relationship not containing a specific resource record set subscription. The authoritative server associates domain name queries actually initiated by the recursive node with registration information, and records a resource record set, a resolution view and a cache expected expiration time. When resolution data changes, the authoritative server screens target recursive nodes whose cache has not expired, resolution view matches and push channel is valid, and sends a push message containing update status, version information, TTL value and integrity check information. After verification of the message, the target recursive node atomically replaces or invalidates corresponding DNS cache according to the version information, thereby shortening the resolution data update delay in the recursive node supporting the mechanism.

Description

Technical Field

[0001] This invention belongs to the fields of information technology and DNS system technology, specifically relating to a method and system for quickly taking effect changes to authoritative DNS records. Background Technology

[0002] The DNS system is one of the fundamental infrastructures of the internet, responsible for resolving human-readable domain names into computer-readable IP addresses. The DNS system employs a distributed architecture, primarily consisting of two roles: recursive servers and authoritative nameservers. Recursive servers receive domain name resolution requests from clients, and when necessary, initiate queries to authoritative nameservers on behalf of the clients, returning the query results to the clients while caching the results to improve the efficiency of subsequent queries. Authoritative nameservers store the final resolved data for domain names, providing authoritative resolution answers to external queries.

[0003] TTL (Time To Live) is a crucial attribute of DNS records, instructing recursive servers how long they can cache query results. When a recursive server queries a domain for the first time, it retrieves the resolution result and corresponding TTL value from the authoritative server and caches the result locally. Within the TTL's validity period, any query request for that domain will directly return the cached result without needing to query the authoritative server again. The TTL mechanism was designed to reduce the load on authoritative servers and improve resolution efficiency, but it also introduces data update delays. When a domain administrator changes the resolution record on the authoritative server (e.g., changing the IP address), the time for the changes to take effect across the entire network depends on the original record's TTL value due to the recursive server's caching. For domains with long TTLs (e.g., 86,400 seconds, or 24 hours), the updated resolution data may take up to a day to take effect across the entire network.

[0004] To address the update latency issue caused by TTL, existing technologies offer the following solutions: (1) Reduce TTL value in advance. Before planning to change the DNS resolution data, the domain administrator should reduce the TTL value to a shorter time (e.g., 300 seconds) 24 hours or even longer in advance, wait for the entire network cache to expire before making the data change, and then restore the TTL value after the new data takes effect. Although this method can shorten the update delay to a certain extent, it requires precise planning of the change time window, and will increase the query load on the authoritative server during the transition period after the TTL is restored. In addition, this method cannot meet the requirement of rapid effectiveness for urgent change needs.

[0005] (2) Manually clear public DNS cache. Some public DNS service providers (such as Google Public DNS, Cloudflare, and OpenDNS) provide interfaces for manually clearing caches, allowing administrators to proactively clear the cache of specific domains via web forms or APIs. However, this solution only applies to a few specific public DNS services and cannot cover all recursive servers across the entire network. This solution is ineffective for cached data from non-public services such as enterprise intranet DNS servers and ISP recursive servers.

[0006] (3) The forced cache update mechanism for traditional recursive servers is limited. Although RFC 8765 defines DNS Push Notifications based on subscription and stateful connections, and some DNS servers provide local cache refresh commands, traditional authoritative servers cannot directly force any recursive server to overwrite their cache with just a single ordinary DNS query; cross-network updates still require recursive nodes to support the corresponding protocol in advance, complete authentication, and establish reachable push relationships.

[0007] (4) Local Area Network Broadcast Notification. Chinese Patent CN114466073A discloses a method for quickly updating DNS cache records applicable to a local area network: the authoritative server monitors the record values ​​in the authoritative zone and broadcasts an update message including the record name and record type to the intranet when the record value is updated; after receiving the broadcast message, the recursive server clears the relevant old cache and re-queries the authoritative server for the updated record value when subsequent client access requests arrive. This scheme is mainly applicable to environments where both the authoritative server and the recursive server are deployed in a local area network. It adopts a broadcast method oriented towards the intranet and does not form a targeted update range based on the actual query records of each recursive node for a specific resource record set, the expected cache expiration time, the resolution view, and the status of the push channel; at the same time, after clearing the old cache, the recursive server still needs to obtain the updated record value from the authoritative server in subsequent query processes.

[0008] (5) Cache update based on update database. Chinese patent CN120658707A discloses a push-based DNS cache update method: after a DNS record is changed, the authoritative server sends a change event to the update database, and the recursive server periodically initiates update DNS queries to the update database, and deletes or marks invalid local caches according to the domain name list in the update response; when a cache miss occurs, the recursive server obtains the latest resolution result from the authoritative server. In this scheme, the link from the authoritative server to the update database adopts push, while the link from the update database to the recursive server adopts periodic query. The update timeliness is affected by the active pull update interval and requires the update database as an intermediate component; its update events are mainly filtered based on the last synchronization timestamp, without combining the actual query records of the recursive node for a specific resource record set, the expected cache expiration time, and the resolution view to form a targeted update range.

[0009] (6) Subscription-based DNS Push Notifications. RFC 8765 defines DNS Push Notifications: A client sends a subscription request to the authoritative DNS server (which can act as a proxy) for a specific DNS record. When a resource record changes, the authoritative server proactively pushes the change message to all clients that have subscribed to that record.

[0010] In summary, the existing technology has the following fundamental problems: (1) Limited push target formation mechanism: Existing subscription push requires the client to establish a subscription for a specific DNS record, and ordinary queries themselves cannot form an authenticated and reachable targeted update relationship; (2) Lack of cache control: The recursive server has complete control over the cached data, and the authoritative server cannot affect its caching strategy; (3) Difficulty in synchronizing across the entire network: There is no effective mechanism to ensure the consistency and timeliness of parsed data for a large number of recursive servers distributed across the entire network; (4) Change response delay: For changes that need to take effect urgently (such as failover and security incident response), the existing methods cannot meet the need for rapid implementation; (5) Some existing cache update schemes still require subsequent queries: CN114466073A triggers the recursive server to clear the relevant cache through broadcast, and CN120658707A triggers the recursive server to delete or mark the relevant cache as invalid by updating the domain name list returned by the database. In the above schemes, the recursive server still needs to obtain the updated resolution result from the authoritative server when the subsequent cache is not hit. Therefore, there is still room for improvement in reducing subsequent query interactions and further shortening the latency of the complete update link. (6) The existing solutions differ from the targeted filtering based on actual queries in their method of forming update targets: CN114466073A uses LAN broadcast to notify the intranet recursive server; CN120658707A mainly filters change events based on the last synchronization timestamp and obtains them periodically by the recursive server. Neither of them simultaneously filters target recursive nodes based on the actual query records of the recursive node on the resource record set, the expected cache expiration time, the parsed view matching relationship, and the push channel status. (7) Some solutions require intermediate update components: CN120658707A requires that DNS change events be saved and provided through the update database. The authoritative server and the recursive server do not directly push the change data. The system also needs to maintain the update database and its data synchronization, availability and query mechanism.

[0011] Therefore, there is an urgent need for a technical solution that can associate recursive node information with actual domain name queries, TTL, and resolution views, and thereby form a targeted update range. Summary of the Invention

[0012] The purpose of this invention is to provide a method and system for quickly taking effect changes to authoritative DNS records. By associating the actual domain name query of a recursive node with node-level registration and authentication information, update data with version information is sent to the recursive node whose cache is expected to be valid, whose DNS view matches, and whose push channel is effective when the DNS data changes, thereby shortening the DNS cache update latency in the recursive node.

[0013] The technical solution adopted in this invention is as follows: A method for authoritatively resolving changes to records quickly takes effect includes the following steps: The recursive node sends recursive node registration information to the authoritative server. The recursive node is a recursive server instance that runs recursive domain name resolution service, maintains DNS cache and deploys cache update adapter. The recursive node registration information includes at least node identifier, push endpoint, supported push channels and identity authentication information to establish an identity-authenticated node-level push relationship. The recursive node registration information does not include subscriptions for specific domain name resource record sets. The authoritative server responds to the domain name query request initiated by the recursive node and associates the domain name query request with the registration information of the recursive node to generate an access record. The access record includes at least the domain name, record type, resolution view identifier, node identifier, query time, TTL value in the response, and cache expected expiration time determined based on the query time and the TTL value. When the parsed data in the authoritative server changes, the target resource record set and parsed view affected by the change are determined, and target recursive nodes with cached expected expiration times later than the current time and valid push channels are selected from the access records. Generate a push message carrying the update status, version information, TTL value and integrity verification information of the target resource record set, and send the push message through the authenticated push channel corresponding to the target recursive node; The target recursive node verifies the push message and performs atomic replacement or invalidation processing on the data in the local DNS cache corresponding to the target resource record set and the resolution view according to the version information.

[0014] Furthermore, the source address of the domain name query request, the authenticated session identifier, and / or the node marker carried in the domain name query request are matched with the recursive node registration information to associate the domain name query request with the corresponding recursive node; if the matching cannot be completed, the source address of the domain name query request is not directly determined as a pushable endpoint.

[0015] Furthermore, for the same recursive node, domain name, record type, and resolution view, the access record is updated according to the last query time, and the cache expected expiration time is set to the sum of the last query time and the TTL value in the query response.

[0016] Furthermore, the resolution view identifier is determined based on at least one of the following: the request source network, EDNS Client Subnet information, line identifier, and regional policy; the push message is only sent to the target recursive node whose access record's resolution view matches the changed resolution view.

[0017] Furthermore, the update status includes at least one of resource record set addition, resource record set replacement, resource record set deletion, and negative resolution status; when the target recursive node receives a resource record set deletion or negative resolution status, it invalidates the corresponding positive cache record and updates the local DNS cache according to the negative cache parameter in the push message.

[0018] Furthermore, the push channel includes a push channel based on DNS Stateful Operations and running on a TLS / TCP connection, and / or a push channel based on an HTTPS callback interface; the target recursive node uses at least one of a certificate, public key signature, or message authentication code to verify the source and integrity of the push message.

[0019] Furthermore, the version information includes a monotonically increasing version number associated with the resource record set and the parsed view; the target recursive node rejects push messages with a version number no higher than the locally processed version number; the authoritative server retryes push messages that fail to be sent only before the cache's expected expiration time.

[0020] A system for rapid effect of authoritative DNS record changes includes a node registration and authentication module, an access record manager, a data change monitoring module, and a push engine deployed on the authoritative server side, and a cache update adapter deployed on the recursive node side. The node registration and authentication module receives recursive node registration information and establishes authenticated node-level push relationships. The access record manager associates domain name query requests received by the authoritative server with the recursive node registration information to generate access records, which include at least the domain name, record type, DNS view identifier, node identifier, query time, TTL value, and cache expiration time. The data change monitoring module determines the target resource record set and DNS view affected by DNS data changes. The push engine filters target recursive nodes whose cache expiration time is later than the current time and whose push channels are valid, generates push messages containing update status, version information, TTL value, and integrity verification information, and sends them. The cache update adapter verifies the push messages and performs atomic replacement or invalidation processing on the corresponding DNS cache data of the recursive nodes according to the version information.

[0021] The present invention also provides a computer device including a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the methods described above.

[0022] The present invention also provides a computer-readable storage medium storing a computer program that, when executed by a computer, implements the above-described method.

[0023] Compared with the prior art, the present invention has the following advantages: 1) Quick activation: Push messages containing update status, version information and TTL value are sent to recursive nodes that meet the filtering conditions through an certified push channel, so that the recursive nodes can process the update without waiting for the original cache TTL to expire naturally, thereby shortening their DNS cache update latency; 2) Improve effective update coverage: By maintaining access records generated by actual queries, filter recursive nodes whose cache is expected to be valid, whose parsed views match, and whose push channels are effective, thereby reducing the sending of invalid messages to nodes that do not have valid caches or do not have the ability to receive them; 3) Compatibility and fallback: Supports push channels based on DNS Stateful Operations and running on TLS / TCP connections, as well as HTTPS callback channels; recursive servers that are not registered, have not deployed cache update adapters, or have failed pushes continue to operate according to the traditional TTL mechanism; 4) Fine-grained control: Based on the resource record set, parsed view, recursive node, cache expected expiration time and push channel status, a targeted update range is formed to reduce invalid pushes and save network and processing resources; 5) Fault switching support: When authoritative parsing data is affected by node failure or changes in scheduling strategy, updated data can be sent to recursive nodes that meet the filtering criteria to shorten the duration of fault parsing records in the relevant recursive nodes. 6) Security Incident Response: When anomalies are found in authoritative parsing data or when emergency handling is required, the priority of relevant push tasks can be increased, and certified correction data can be sent to recursive nodes that meet the filtering criteria to shorten the duration of abnormal cache in relevant nodes. 7) Compared with the DNS push scheme based on resource record set subscription, the recursive node in this invention only establishes node-level registration and authentication relationships, without the need to subscribe separately for each resource record set in advance; the access record is triggered by the actual DNS query, and the push target must also meet the conditions such as the cache not being expected to expire, the resolution view matching, and the push channel being valid. Attached Figure Description

[0024] Figure 1 This is a flowchart illustrating the steps of a method for quickly taking effect on authoritative record changes according to an embodiment of the present invention.

[0025] Figure 2 This is a flowchart illustrating the steps of a method for quickly taking effect on authoritative record changes, according to another embodiment of the present invention.

[0026] Figure 3 This is a schematic diagram of a system architecture for authoritative parsing record changes to take effect quickly, according to an embodiment of the present invention.

[0027] Figure 4 This is an example diagram of an access record pool according to an embodiment of the present invention. Detailed Implementation

[0028] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0029] The technical problem to be solved by this invention is: how to form an authentic, reachable, and targeted update range that matches the resolution view based on the actual query and its expected cache expiration time, without requiring a pre-established subscription for each DNS record, and to securely update the recursive server cache.

[0030] The main contents of this invention include: 1) Recursive Node Registration and Authentication. A recursive node sends a registration request (recursive node registration information) to the authoritative server (push server). The registration request carries at least the following information: node_id (node ​​identifier), push_endpoint (push endpoint), channel_type (supported push channel types), credential (authentication information), and capability (caching update capability information). The push_endpoint is either an HTTPS callback address or an established TLS / TCP session identifier. The capability includes at least one of the following: supported resource record types, update operation types, message verification methods, and caching methods. The push server verifies the credential, saves the registration information, and returns the registration_id (registration identifier). Registration only indicates that the node has the ability to receive updates; it does not indicate that the node has subscribed to any specific resource record set.

[0031] In one specific embodiment, the recursive node establishes a bidirectional TLS connection with the authoritative server. The authoritative server verifies the recursive node's certificate and binds the certificate body, node_id, and registration_id. Upon successful verification, a session_id is generated for association with subsequent queries and push messages. When using message authentication codes, the authentication key is securely configured during node deployment or registration approval and supports rotation. When a recursive node is revoked, the authoritative server marks the corresponding registration_id, certificate, or authentication key as invalid and terminates the corresponding session and subsequent pushes.

[0032] 2) Query and Recursive Node Association. When a recursive node initiates a query, it can send the query through an authenticated TLS / TCP session, or include the registration_id and authentication data in the extended fields of the query request. The authoritative server can also use the verified source address as an auxiliary matching condition. Only when the query matches valid registration information is an access record that can be used for push notifications generated; the source IP, ephemeral source port, or network prefix cannot be used as a push endpoint on its own.

[0033] 3) Access Records and Resolution Views. Access records include at least the following: domain, record_type, view_id, node_id, last_query_time, response_ttl, cache_expire_time, channel_id, and push_status. cache_expire_time equals the sum of the last query time of the recursive node and the TTL of the current response. view_id is determined based on the source network, EDNS Client Subnet, region, or line policy; only records whose view_id matches the changed resolution view are selected during push.

[0034] 4) Versioning, Security, and Caching. A new monotonically increasing version number is generated each time the resource record set and its parsed view change. Push messages include the addition, replacement, deletion, or negation parsing status, version number, TTL, message identifier, and integrity verification information. The target recursive node verifies the message using a TLS certificate, public key signature, or message authentication code, rejects messages no higher than the processed version, and atomically replaces the corresponding resource record set. For deletion or negation statuses, the old positive cache is invalidated and processed according to the negation cache parameters.

[0035] 5) Reachability and Scope of Application. Only recursive nodes that have completed node registration, authentication, and have a valid push channel will receive push notifications. Recursive servers that are not registered, have failed authentication, have unreachable channels, or have not deployed a cache update adapter will continue to operate according to the traditional TTL mechanism. Therefore, the rapid implementation scope of this invention is limited to recursive nodes that support this mechanism and maintain a valid push relationship, and does not imply a forced update of all recursive servers or ordinary terminal clients on the Internet.

[0036] In one embodiment, the present invention provides a method for quickly applying changes to authoritative resolution records, such as... Figure 1 As shown, it includes the following steps: The recursive node sends recursive node registration information to the authoritative server. The recursive node is a recursive server instance that runs recursive domain name resolution service, maintains DNS cache and deploys cache update adapter. The recursive node registration information includes at least node identifier, push endpoint, supported push channels and identity authentication information to establish an identity-authenticated node-level push relationship. The recursive node registration information does not include subscriptions for specific domain name resource record sets. The authoritative server responds to the domain name query request initiated by the recursive node and associates the domain name query request with the registration information of the recursive node to generate an access record. The access record includes at least the domain name, record type, resolution view identifier, node identifier, query time, TTL value in the response, and cache expected expiration time determined based on the query time and the TTL value. When the parsed data in the authoritative server changes, the target resource record set and parsed view affected by the change are determined, and target recursive nodes with cached expected expiration times later than the current time and valid push channels are selected from the access records. Generate a push message carrying the update status, version information, TTL value and integrity verification information of the target resource record set, and send the push message through the authenticated push channel corresponding to the target recursive node; The target recursive node verifies the push message and performs atomic replacement or invalidation processing on the data in the local DNS cache corresponding to the target resource record set and the resolution view according to the version information.

[0037] In one embodiment, the source address of the domain name query request, the authenticated session identifier, and / or the node marker carried in the domain name query request are matched with the recursive node registration information to associate the domain name query request with the corresponding recursive node; if the matching cannot be completed, the source address of the domain name query request is not directly determined as a pushable endpoint.

[0038] In one embodiment, for the same recursive node, domain name, record type, and resolution view, the access record is updated according to the last query time, and the cache expected expiration time is set to the sum of the last query time and the TTL value in the query response.

[0039] In one embodiment, the resolution view identifier is determined based on at least one of the request source network, EDNS Client Subnet information, line identifier, and regional policy; the push message is only sent to the target recursive node whose access record's resolution view matches the changed resolution view.

[0040] In one embodiment, the update status includes at least one of resource record set addition, resource record set replacement, resource record set deletion, and negative resolution status; when the target recursive node receives a resource record set deletion or negative resolution status, it invalidates the corresponding positive cache record and updates the local DNS cache according to the negative cache parameter in the push message.

[0041] In one embodiment, the push channel includes a push channel based on DNS Stateful Operations and running on a TLS / TCP connection, and / or a push channel based on an HTTPS callback interface; the target recursive node uses at least one of a certificate, public key signature, or message authentication code to verify the source and integrity of the push message.

[0042] In one embodiment, the version information includes a monotonically increasing version number associated with the resource record set and the parsed view; the target recursive node rejects push messages with a version number no higher than the locally processed version number; and the authoritative server retryes push messages that fail to be sent only before the cache's expected expiration time.

[0043] In one embodiment, the present invention provides a method for quickly applying changes to authoritative resolution records, such as... Figure 2 As shown, it includes the following steps: (1) The recursive node starts the cache update adapter, and ordinary terminal clients do not participate in the registration of the recursive node.

[0044] (2) The recursive node sends the recursive node registration information to the authoritative server. The recursive node registration information includes node identifier, push endpoint, push channel type, identity authentication information and cache update capability information.

[0045] (3) The authoritative server verifies the identity authentication information of the recursive node, saves the registration information of the recursive node, and establishes a node-level push relationship with identity authentication; the node-level push relationship does not include subscription to a specific resource record set.

[0046] (4) The recursive node initiates a domain name query request to the authoritative server. The authoritative server associates the domain name query request with the recursive node's registration information by using at least one of the certified session identifier, node tag, and verified source address.

[0047] (5) The authoritative server generates and maintains access records, recording resource record sets, parsed view identifiers, node identifiers, query times, and TTL values ​​in the response, and determines the cache expiration time as the sum of the last query time and the TTL value in the query response.

[0048] (6) When the parsed data in the authoritative server changes, determine the affected resource record set and parsed view.

[0049] (7) The authoritative server filters the target recursive nodes from the access records whose cache expiration time is later than the current time, whose parsed views match and whose push channels are valid; query source addresses that have not completed registration association are not used as push endpoints.

[0050] (8) The authoritative server generates a push message containing update status, version information, TTL value, message identifier and integrity verification information, and sends it to the target recursive node through an authenticated push channel.

[0051] (9) The target recursive node verifies the source, integrity and version information of the push message, and rejects push messages that fail authentication, are duplicates or are old versions.

[0052] (10) After verification, the target recursive node performs atomic replacement or invalidation on the corresponding DNS cache; if the push mechanism is abnormal, the recursive node falls back to the traditional TTL cache update mechanism.

[0053] In one embodiment, the present invention provides a system for rapidly implementing authoritative resolution record changes, such as... Figure 3 As shown, the system includes a node registration and authentication module, an access record manager, a data change monitoring module, and a push engine deployed on the authoritative server side, as well as a cache update adapter deployed on the recursive node side. Specifically, the system includes the following core components: (1) Authoritative DNS server. The core component responsible for domain name resolution service, providing authoritative resolution answers for domain names, and integrating access record tracking and proactive push functions.

[0054] (2) Node registration and authentication module and access record manager. The node registration and authentication module saves the node identifier, push endpoint, channel type and authentication information of the recursive node; the access record manager associates the actual query with the registered node and maintains the resource record set, parsed view and cache expected expiration time.

[0055] (3) Data Change Monitoring Module. Monitors data change events on the authoritative DNS server, including data changes triggered by DNS dynamic update protocol (RFC 2136), management backend operations, API calls, etc., and triggers the corresponding push process.

[0056] (4) Push Engine. It is responsible for filtering target recursive nodes based on the access record pool, constructing a push message containing update status, version information, TTL value and integrity verification information, and sending the push message through the authenticated push channel corresponding to the target recursive node.

[0057] (5) Cache update adapter. Deployed on the recursive node side, it is responsible for receiving push messages, verifying the message source, integrity and version information, and performing atomic replacement or invalidation processing on the corresponding DNS cache of the recursive node.

[0058] The key features of this invention are: no need to pre-subscribe to specific DNS records; the authoritative server dynamically generates access records based on actual queries and matches the query source information with authenticated nodes. After data changes, updated status with version information is only pushed to nodes whose cache is not expected to expire, whose resolution views match, and whose channels are valid.

[0059] The following provides specific examples of applications of the method of the present invention.

[0060] Example 1: Implementation based on DNS Stateful Operations and TLS / TCP.

[0061] 1) Implementation Principle. The recursive node establishes a TLS / TCP connection with the authoritative server and establishes a DNSStateful Operations (DSO) session on that connection. Node registration only establishes node-level authentication and push relationships; it does not include subscriptions to specific resource record sets. The authoritative server associates the actual DNS queries initiated by the recursive node in the authentication session with the node registration information. When the relevant resource record set changes, the authoritative server sends a one-way DSO push message carrying the updated data through the same session.

[0062] Push messages can adopt the following logical structure: DSO_PUSH_UPDATE { node_id:<registered_node_id> , qname: "example.com", qtype: A, view_id:<resolution_view> , update_action: add | replace | delete | negative, records: [{rdata: "192.0.2.1", ttl: 300}], negative_params: {rcode: NXDOMAIN | NOERROR, negative_ttl: 300}, rrset_version:<monotonic_counter> , message_id:<unique_identifier> , integrity_proof:<signature_or_mac> } DSO_PUSH_UPDATE represents the one-way push operation of DSO defined in this embodiment, and its payload is encapsulated in a predefined DSO TLV. The DSO TLV includes at least a type field, a length field, and a data field; the data field carries node_id, qname, qtype, view_id, update_action, rrset_version, message_id, and integrity verification information. During the registration phase, recursive nodes declare whether they support the DSO TLV through their capabilities. The authoritative server only sends this operation to recursive nodes that have declared support and completed authentication. update_action indicates the resource recordset's addition, replacement, deletion, or negative parsing status; records carry the latest resource record data when added or replaced; negative_params are used to distinguish between NXDOMAIN and NODATA and carry negative cache parameters; rrset_version is used to reject old versions or duplicate messages; integrity_proof is used to verify the message source and integrity.

[0063] After receiving the push message, the target recursive node verifies the TLS session identity and integrity_proof, and checks rrset_version and message_id. If the verification is successful, it performs atomic replacement or invalidation on the DNS cache corresponding to qname, qtype and view_id, and returns the processing status to the authoritative server.

[0064] 2) Implementation of the Access Record Pool. The access record pool is the core data structure of this invention, used to record recursive nodes that have completed registration and association and have queried authoritative parsing data within the expected valid time of the corresponding cache. The access record pool is as follows: Figure 4 As shown, it includes domain (domain name), record_type (record type), view_id (view identifier), node_id (node ​​identifier), last_query_time (query time), response_ttl (TTL value in the response), cache_expire_time (expected cache expiration time), channel_id (channel identifier), rrset_version (version), push_status (push status), message_id (message identifier), and last_push_time (last push time).

[0065] The access record pool is implemented using an in-memory database (such as Redis) or persistent storage (such as MySQL, MongoDB, etc.), and supports efficient queries based on conditions such as domain name, record type, and time window.

[0066] 3) Collection of access records. When the authoritative server receives a DNS query request, the system performs the following steps to collect access records: a) Parse the query request to obtain the domain name, record type, and information used to determine the parsed view; b) Associate the query request with the recursive node registration information based on the authenticated session identifier, registration_id, and / or verified node tag; the source IP is only used as auxiliary verification information; c) Query authoritative resolution data to obtain the resource record set and response TTL corresponding to the corresponding resolution view; d) The estimated cache expiration time is determined as the sum of the current query time and the response TTL; e) Generate or update access records according to node_id, domain name, record type and view_id, and save the corresponding channel_id; f) Queries that cannot be associated with valid registration information will not generate target records that can be used for proactive push notifications.

[0067] To reduce storage overhead, multiple queries for the same node_id, domain name, record type, and view_id can be merged, and the cache expiration time can be updated with the time of the last query; different recursive nodes are not merged according to network prefix.

[0068] 4) Push message construction. When a change in parsed data is detected, the push engine performs the following steps to construct a push message: a) Identify the resource record sets and parsed views involved in the changes; b) Query the access record pool and filter target recursive nodes whose cache expiration time is later than the current time, whose parsed views match, and whose push channels are valid; c) Generate a monotonically increasing version number and a unique message identifier for the modified resource record set and parsed view; d) Construct a push message based on the change type that includes the status of addition, replacement, deletion or negative resolution, the latest resource record data or negative cache parameters, TTL value, version information and integrity verification information.

[0069] 5) Sending push messages. The push engine sends push messages in the following ways: a) DNS Protocol Channel: Send push messages based on DNSStateful Operations through a TLS / TCP session pre-established and authenticated by the recursive node; send cache overwrite messages directly to port 53 without relying on the source IP of a normal DNS query; b) HTTPS channel: For recursive nodes that support HTTPS callbacks, push messages are sent through the HTTPS callback endpoint that is registered and authenticated during registration.

[0070] To ensure push reliability, the push engine implements the following mechanisms: Retry mechanism: For push requests that fail to be sent, retry is performed according to the exponential backoff strategy, but the retry time shall not exceed the expected expiration time of the corresponding access record's cache. Batch sending: For a large number of access records, batch sending can improve efficiency; Priority scheduling: The priority of push notifications is determined based on factors such as the frequency of access by visitors and the scope of impact.

[0071] Specifically: (1) Access frequency: Recursive servers with high access frequency are pushed first because their cache affects a wider range of users; (2) Influence scope: The influence scope parameter can be determined based on the user scale of the recursive node service or the pre-configured node level, and the public service name is not used as the basis for judging the node identity or credibility. (3) Urgency level: Changes triggered by security events (such as DNS hijacking responses) have a higher priority than regular configuration changes; (4) Push success rate or failure rate (failure_rate): Nodes with low historical push success rate (high failure rate) are given lower priority to avoid wasting resources.

[0072] Push priority calculation formula: priority = w1 access_frequency + w2 influence_scope + w3 urgency_level - w4 failure_rate w1~w4 are configurable weight parameters.

[0073] 6) Implementation on the recursive node side. The recursive node deploys the cache update adapter and implements the following functions: (1) Channel management: Establish and maintain authenticated DSO / TLS sessions and / or listen for HTTPS callback endpoints registered during registration; (2) Message verification: Verify the session identity, integrity verification information, version number and message identifier of the push message; (3) Cache update: Perform atomic replacement or invalidation on the corresponding DNS cache according to the resource record set, resolution view and update status; (4) Status feedback: Report the status of successful processing, failure or ignored processing to the authoritative server.

[0074] To ensure that push messages are processed correctly, the system implements a push confirmation mechanism: (1) The push message contains a unique message_id, which is generated by combining at least two of the following: rrset_version, resource record set identifier, parsing view identifier and target recursive node identifier, or is composed of a globally unique identifier generated by the authoritative server; (2) After the receiver has finished processing, it returns an ACK confirmation message via DNS response or HTTPS callback; (3) The ACK message includes: message ID, processing status (success / failed / ignored), and processing timestamp; (4) After receiving the ACK, the authoritative server updates the push_status field in the access record pool; (5) For unconfirmed pushes, retry according to the exponential backoff strategy until the maximum number of retries is reached or the expected expiration time of the corresponding access record cache is reached, whichever comes first. (6) After the retry stop condition is met, the target recursive node is marked as "unreachable" and new push tasks are suspended; new push tasks that are still within the expected validity period of the cache are processed only after the suspension period ends and the push channel is re-verified as valid.

[0075] The recursive server side implements a TTL fault-tolerant rollback strategy to ensure that service continuity is not affected when the push mechanism fails: (1) Push verification failure rollback: If the push message signature verification fails or the data format is abnormal, the recursive server ignores the push and keeps the original cache record until the TTL expires naturally; (2) Adapter not deployed rollback: Recursive servers without deployed adapters are not affected and continue to work according to the traditional TTL mechanism, and there is no compatibility issue with the overall DNS system; (3) Dual-mode operation: The recursive server with the deployed adapter supports both push update and TTL expiration cache update methods. If push fails, it will automatically fall back to the TTL mechanism.

[0076] Example 2: Implementation based on HTTP / HTTPS push.

[0077] 1) Implementation Principle. This embodiment uses the HTTP / HTTPS protocol as the push channel, leveraging the broad compatibility of Web services to achieve cross-network parsing and data push.

[0078] 2) System Architecture. The system architecture of this embodiment includes: Authoritative DNS servers: provide DNS resolution services.

[0079] Push API Service: A push service based on a RESTful API.

[0080] Web server cluster: hosting push API services.

[0081] Cache update adapter: An application deployed in recursive nodes to perform node registration, message reception, authentication, and DNS cache updates.

[0082] 3) Push API Design. The push API adopts the following interface design: POST / api / v1 / push Content-Type: application / json Authorization: Bearer<access_token> { "message_id": "<unique_identifier> ", "domain": "example.com", "record_type": "A", "view_id": "<resolution_view> ", "update_action": "add|replace|delete|negative", "records": [{"target": "192.0.2.1", "ttl": 300}], "negative_params": {"rcode": "NXDOMAIN", "negative_ttl": 300}, "rrset_version": 12345, "signature": "<digital_signature> ", "timestamp": 1706745600 } 4) Implementation of the cache update adapter. The cache update adapter is a proxy service deployed on the recursive node side, used to complete node registration, receive authenticated HTTPS push messages, and update the DNS cache of the recursive node. The adapter implements the following functions: Registration mechanism: When the cache update adapter on the recursive node side starts, it registers the node identifier, HTTPS callback address, capability parameters and authentication credentials with the push server to obtain the registration_id; Message reception: Listens on HTTP / HTTPS ports to receive push messages; Local cache update: Update the local DNS cache of the recursive node; Cache invalidation: invalidates the corresponding old cache record, forcing subsequent queries to re-parse.

[0083] Example 3: Application in CDN scenarios.

[0084] 1) Application Scenarios. In a CDN (Content Delivery Network) scenario, domain name resolution is used to direct user requests to the nearest edge node. When edge nodes change (e.g., a new node is added, or a node fails), the resolution data needs to be updated quickly to achieve traffic scheduling.

[0085] 2) Implementation Scheme. In a CDN scenario, this invention can be deeply integrated with the CDN's Global Load Balancing (GSLB) system: Node status monitoring: Real-time monitoring of the health status and load of each edge node; Intelligent scheduling strategy: Dynamically adjust the parsing strategy based on the node status; Quick activation: When edge nodes change, the push mechanism of this invention updates the cache of recursive nodes that meet the filtering conditions, thereby shortening the update latency of traffic scheduling records in the relevant recursive nodes.

[0086] 3) Achieved Effects. Applying this invention in CDN scenarios can shorten the DNS cache update latency involved in node failover, new node activation, and load balancing adjustments, and improve the timeliness of traffic scheduling.

[0087] Example 4: Application in DNS security protection.

[0088] 1) Application Scenarios. When a domain name is found to have been maliciously tampered with (such as DNS hijacking or DNS poisoning) or there are security risks in domain name resolution, it is necessary to urgently update the resolution data to block malicious traffic.

[0089] 2) Implementation Scheme. In DNS security protection scenarios, this invention can achieve rapid response: Anomaly detection: Monitor the resolution data of authoritative DNS servers and detect abnormal changes; Threat assessment: Assess the scope and severity of the impact of malicious changes; Emergency Push: Triggers a high-priority push process, sending authenticated correction parsing data to recursive nodes whose cache is not expected to expire, whose parsing views match, and whose push channels are valid; Continuous monitoring: Continuously monitor authoritative analytical data and the push processing status reported by the target recursive node.

[0090] 3) Implementation Effects. Applying this invention in DNS security protection scenarios can shorten the duration of abnormal caching in recursive nodes that support this mechanism, and provide a more timely means of updating DNS cache for handling security incidents.

[0091] It should be understood that the methods and systems described in this invention can be implemented using different module division methods, and multiple modules can be combined or deployed in a distributed manner. The node registration and authentication module, access record manager, data change monitoring module, and push engine on the authoritative server side, as well as the cache update adapter on the recursive node side, can each be implemented by one or more processors executing corresponding computer programs. The computer program can be stored in one or more computer-readable storage media and executed collaboratively by processors deployed on the authoritative server side and the recursive node side to complete the steps corresponding to the respective sides in the method of this invention. For example, one embodiment of this invention provides a computer device (computer, server, etc.) including a memory and a processor. The memory stores a computer program, which is configured to be executed by the processor. The computer program includes instructions for executing the steps in the method of this invention. For example, another embodiment of this invention provides a computer-readable storage medium (such as ROM / RAM, disk, optical disk, etc.) storing a computer program. When the computer program is executed by a computer, it implements the steps of the method of this invention. For example, another embodiment of this invention provides a computer program product including a computer program, which, when executed by a computer, implements the steps of the method of this invention.

[0092] The specific embodiments of the present invention disclosed above are intended to help understand the content of the present invention and to implement it accordingly. Those skilled in the art will understand that various substitutions, changes, and modifications are possible without departing from the spirit and scope of the present invention. The present invention should not be limited to the content disclosed in the embodiments of this specification; the scope of protection of the present invention is defined by the claims.

Claims

1. A method for authoritatively analyzing and quickly applying changes to records, characterized in that, Includes the following steps: The recursive node sends recursive node registration information to the authoritative server. The recursive node is a recursive server instance that runs recursive domain name resolution service, maintains DNS cache and deploys cache update adapter. The recursive node registration information includes at least node identifier, push endpoint, supported push channels and identity authentication information to establish an identity-authenticated node-level push relationship. The recursive node registration information does not include subscriptions for specific domain name resource record sets. The authoritative server responds to the domain name query request initiated by the recursive node and associates the domain name query request with the registration information of the recursive node to generate an access record. The access record includes at least the domain name, record type, resolution view identifier, node identifier, query time, TTL value in the response, and cache expected expiration time determined based on the query time and the TTL value. When the parsed data in the authoritative server changes, the target resource record set and parsed view affected by the change are determined, and target recursive nodes with cached expected expiration times later than the current time and valid push channels are selected from the access records. Generate a push message carrying the update status, version information, TTL value and integrity verification information of the target resource record set, and send the push message through the authenticated push channel corresponding to the target recursive node; The target recursive node verifies the push message and performs atomic replacement or invalidation processing on the data in the local DNS cache corresponding to the target resource record set and the resolution view according to the version information.

2. The method according to claim 1, characterized in that, The source address of the domain name query request, the authenticated session identifier, and / or the node tag carried in the domain name query request are matched with the recursive node registration information to associate the domain name query request with the corresponding recursive node. If the matching cannot be completed, the source address of the domain name query request will not be directly determined as a pushable endpoint.

3. The method according to claim 1, characterized in that, For the same recursive node, domain name, record type, and resolution view, update the access record according to the last query time, and set the cache expected expiration time to the sum of the last query time and the TTL value in the query response.

4. The method according to claim 1, characterized in that, The resolution view identifier is determined based on at least one of the following: the request source network, EDNS Client Subnet information, line identifier, and regional policy; the push message is only sent to the target recursive node whose access record's resolution view matches the changed resolution view.

5. The method according to claim 1, characterized in that, The update status includes at least one of resource record set addition, resource record set replacement, resource record set deletion, and negative resolution status; when the target recursive node receives a resource record set deletion or negative resolution status, it invalidates the corresponding positive cache record and updates the local DNS cache according to the negative cache parameters in the push message.

6. The method according to claim 1, characterized in that, The push channels include push channels based on DNS StatefulOperations and running on TLS / TCP connections, and / or push channels based on HTTPS callback interfaces; The target recursive node uses at least one of a certificate, public key signature, or message authentication code to verify the source and integrity of the push message.

7. The method according to claim 1, characterized in that, The version information includes a monotonically increasing version number associated with the resource record set and the parsed view; the target recursive node rejects push messages with a version number that is not higher than the locally processed version number; The authoritative server will only retry sending failed push messages before the cache's expected expiration time.

8. A system for authoritatively analyzing and rapidly updating records, characterized in that: This includes a node registration and authentication module, an access record manager, a data change monitoring module, and a push engine deployed on the authoritative server side, as well as a cache update adapter deployed on the recursive node side; The node registration and authentication module is used to receive recursive node registration information and establish node-level push relationships with verified identities. The access record manager is used to associate the domain name query request received by the authoritative server with the recursive node registration information to generate access records. The access records include at least the domain name, record type, resolution view identifier, node identifier, query time, TTL value, and cache expected expiration time. The data change monitoring module is used to determine the target resource record set and parsing view affected by the parsing data change; The push engine is used to filter target recursive nodes whose cache expiration time is later than the current time and whose push channel is valid, generate push messages containing update status, version information, TTL value and integrity verification information and send them; The cache update adapter is used to verify push messages and perform atomic replacement or invalidation processing on the corresponding DNS cache data of the recursive node according to the version information.

9. A computer device, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program, which, when executed by the processor, causes the processor to perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

Images