Domain name encryption method and apparatus based on content delivery network, and domain name decryption method and apparatus based on content delivery network

Abstract

The present disclosure relates to a domain name encryption method and apparatus based on a content delivery network, and a domain name decryption method and apparatus based on a content delivery network. The encryption method comprises: receiving an access request for an initial server sent by a terminal; when the initial server needs to be redirected to a target server, acquiring a synthetic-record domain name of the target server, wherein the synthetic-record domain name carries a domain name resolution result of the target server; and encrypting the synthetic-record domain name to obtain an encrypted synthetic-record domain name, and sending the encrypted synthetic-record domain name to the terminal.

Description

Domain name encryption method, decryption method and device based on content distribution network

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed on September 27, 2023, with application number 202311268420.3 and invention name “Domain name encryption method, decryption method and device based on content distribution network”. The entire contents of that application are incorporated by reference into this application. Technical Field

[0003] The present disclosure relates to the field of computer technology, and in particular to a domain name encryption method, decryption method, and device based on a content distribution network. Background Art

[0004] Domain name resolution is a technology that links domain names to the IP (Internet Protocol) addresses of website hosting, allowing users to easily access websites using registered domain names. Domain names are often used instead of IP addresses to identify website addresses. Domain name resolution is the process of converting domain names to IP addresses, and is performed by DNS (Domain Name System) servers.

[0005] In CDN (Content Delivery Network) systems, synthetic record domain names are usually supported. That is, when a user requests DNS resolution, the resolution result is hidden in the requested domain name, and the DNS then extracts the resolution result from the synthetic record domain name.

[0006] However, if the synthetic record domain name is intercepted by an unauthorized user, they can forge legitimate domain name resolution and certificates based on the characteristics of the synthetic record domain name. Related technologies typically address this issue by using a whitelist mechanism, restricting legitimate resolution to only whitelisted domains within specific network segments. However, due to the relatively discrete network segments of CDN edge nodes in practice, the CDN system must configure a large number of whitelisted domains, resulting in low efficiency.

[0007] Summary of the Invention

[0008] The present disclosure provides a domain name encryption method, decryption method and device based on a content distribution network.

[0009] According to one aspect of the present disclosure, a domain name encryption method is provided, which is applied to a content delivery network (CDN). The method includes:

[0010] Receiving an access request to an initial server sent by a terminal;

[0011] In the case where the initial server needs to be redirected to the target server, obtaining a synthetic record domain name of the target server, the synthetic record domain name carrying a domain name resolution result of the target server;

[0012] The synthesized record domain name is encrypted to obtain an encrypted synthesized record domain name, and the encrypted synthesized record domain name is sent to the terminal.

[0013] According to a second aspect of the present disclosure, a domain name decryption method based on a content distribution network is provided, which is applied to a domain name system (DNS). The method includes:

[0014] Receiving a domain name resolution request sent by a terminal, wherein the domain name resolution request includes an encrypted synthetic record domain name;

[0015] Decrypting the encrypted synthetic record domain name to obtain a domain name resolution result;

[0016] Sending the domain name resolution result to the terminal.

[0017] According to a third aspect of the present disclosure, a domain name decryption method based on a content distribution network is provided, which is applied to a terminal. The method includes:

[0018] Send an access request to the CDN system for the initial server;

[0019] Receiving an encrypted synthetic record domain name sent by the CDN system; wherein the encrypted synthetic record domain name is obtained by encrypting the domain name resolution result of the target server;

[0020] Sending a domain name resolution request containing the encrypted synthetic record domain name to the DNS system;

[0021] Receiving the domain name resolution result sent by the DNS system;

[0022] An access request for the target server is sent to the DNS system based on the domain name resolution result.

[0023] According to a fourth aspect of the present disclosure, a domain name encryption device based on a content delivery network is provided, which is applied to a CDN system. The device includes:

[0024] An access request receiving module, configured to receive an access request sent by a terminal to an initial server;

[0025] A synthetic record domain name acquisition module, configured to acquire a synthetic record domain name of a target server when it is necessary to redirect the initial server to a target server, the synthetic record domain name carrying a domain name resolution result of the target server;

[0026] The encryption module is used to encrypt the synthetic record domain name to obtain an encrypted synthetic record domain name, and send the encrypted synthetic record domain name to the terminal.

[0027] According to a fifth aspect of the present disclosure, a domain name decryption device based on a content distribution network is provided, which is applied to a DNS system. The device includes:

[0028] A domain name resolution request receiving module, configured to receive a domain name resolution request sent by a terminal, wherein the domain name resolution request includes an encrypted synthetic record domain name;

[0029] A decryption module, used to decrypt the encrypted synthetic record domain name to obtain a domain name resolution result;

[0030] The domain name resolution result sending module is used to send the domain name resolution result to the terminal.

[0031] According to a sixth aspect of the present disclosure, a domain name decryption device based on a content distribution network is provided, which is applied to a terminal, and includes:

[0032] An access request sending module, used to send an access request for the initial server to the CDN system;

[0033] An encrypted synthetic record domain name receiving module is used to receive the encrypted synthetic record domain name sent by the CDN system; wherein the encrypted synthetic record domain name is obtained by encrypting the domain name resolution result of the target server;

[0034] A domain name resolution request sending module, configured to send a domain name resolution request containing the encrypted synthetic record domain name to a DNS system;

[0035] A domain name resolution result receiving module, configured to receive the domain name resolution result sent by the DNS system;

[0036] An access request sending module is used to send an access request for the target server to the DNS system based on the domain name resolution result.

[0037] According to a seventh aspect of the present disclosure, an electronic device is provided, comprising: a memory and a processor, wherein the memory stores a computer program, and the processor implements the above method when executing the program.

[0038] According to an eighth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the above method of the present disclosure is implemented.

[0039] The disclosed embodiment provides a solution that receives an access request from a terminal to an initial server and, if necessary, redirects the initial server to a target server. The solution then obtains the target server's synthetic record domain name by encrypting the synthetic record domain name to obtain an encrypted synthetic record domain name, which is then sent to the terminal. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Further details, features and advantages of the present disclosure are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which:

[0041] FIG1 is a schematic diagram of a scenario provided by an exemplary embodiment of the present disclosure;

[0042] FIG2 is a flow chart of a domain name encryption method based on a content distribution network provided by an exemplary embodiment of the present disclosure;

[0043] FIG3 is a schematic block diagram of functional modules of a domain name encryption device based on a content distribution network provided by an exemplary embodiment of the present disclosure;

[0044] FIG4 is a schematic block diagram of functional modules of a domain name decryption device based on a content distribution network provided by an exemplary embodiment of the present disclosure;

[0045] FIG5 is a schematic block diagram of functional modules of a domain name decryption device based on a content distribution network provided by another exemplary embodiment of the present disclosure;

[0046] FIG6 is a structural block diagram of an electronic device provided by an exemplary embodiment of the present disclosure;

[0047] FIG7 is a structural block diagram of a computer system provided by an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0048] The following describes embodiments of the present disclosure in more detail with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0049] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0050] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the description below. It should be noted that the concepts of "first", "second", etc. mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0051] It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, they should be understood as "one or more".

[0052] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0053] It is understandable that before using the technical solutions disclosed in the various embodiments of this disclosure, the type, scope of use, usage scenarios, etc. of the personal information involved in this disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0054] For example, in response to a user's active request, a prompt message is sent to the user to clearly inform the user that the operation requested will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the electronic device, application, server, storage medium, or other software or hardware that performs the operations of the disclosed technical solution based on the prompt message.

[0055] As an optional but non-limiting implementation method, in response to receiving the user's active request, the method of sending a prompt message to the user can be, for example, a pop-up window, and the prompt message can be presented in the form of text in the pop-up window. In addition, the pop-up window can also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device. It is understandable that the above notification and the process of obtaining user authorization are only illustrative and do not constitute a limitation on the implementation method of the present disclosure. Other methods that meet relevant laws and regulations can also be applied to the implementation method of the present disclosure.

[0056] In an embodiment, as shown in FIG1 , when a terminal needs to access, for example, an edge server, it sends a domain name resolution request to the DNS. Upon receiving the domain name resolution request, the DNS system resolves the domain name included in the domain name resolution request and sends the resolution result to the terminal. For example, the resolution result may be the IP address of the first edge server in FIG1 .

[0057] When the terminal obtains the IP address of the first edge server, it will send an access request to the first edge server in the CND system based on the IP address. In the CDN scheduling system, there is a 302 scheduling that redirects the scheduling of the edge node. This redirection generally dynamically accesses a node based on the optimal scheduling decision. For example, after the terminal accesses the first edge server node, the first edge server will redirect the access resource to the second edge server of the 1.1.1.1 node. For example, the first edge server can rewrite https: / / 1.1.1.1 / bytedance.jpg. Since the redirection of 302 scheduling is based on security considerations, HTTPS access is often used. This access method can directly reach the target domain name, but because the certificate is not convenient to issue, there will be a problem of needing an HTTPS certificate. Because generally when 1.1.1.1 is used as a domain name, it is not very convenient to issue a certificate.

[0058] Since the CDN system can usually support synthetic record domain names, the CDN system will return a synthetic record domain name carrying the domain name resolution result of the second edge server to the terminal. After receiving the synthetic record domain name, the terminal will send the synthetic record domain name to the DNS server. Once the above synthetic record domain name is intercepted by an illegal user, the illegal user will forge a legal domain name resolution and certificate based on the characteristics of the synthetic record domain name. In addition, the use of a whitelist method will lead to low efficiency. In the embodiment of the present disclosure, the CDN system will encrypt the synthetic record domain name to obtain an encrypted synthetic record domain name, and return the encrypted synthetic record domain name to the terminal. After receiving the encrypted synthetic record domain name, the terminal will send a request containing the encrypted synthetic record domain name to the DNS. The DNS receives the request, decrypts the encrypted synthetic record domain name, obtains the IP address of the second edge server, and returns the IP address to the terminal. In this way, the terminal can access the second edge server after receiving the IP address.

[0059] In the embodiment, the AES (Advanced Encryption Standard) encryption algorithm or other encryption algorithms can be specifically used. In the embodiment, AES is used as an example for description, but the embodiment is not limited thereto. For example, the CDN system redirects the scheduling of the edge node to the second edge server through 302 scheduling, and the address of the edge server is 1.1.1.1.

[0060] For IPv4, a key sequence containing multiple keys is obtained. For example, the first key key1 in the key sequence can be selected for encryption. For the AES encryption algorithm, an IV offset value needs to be selected for each encryption. The offset value includes 16 characters, and the hexadecimal characters are required to represent 0-F. For example, the selected IV offset value is: E10ADC3949BA59AB. It should be noted that in the embodiment, try not to use the same IV offset value each time encryption is performed. Different IV offset values ​​can be used, otherwise the security of the encryption system will be reduced. Among them, the encrypted characters are described in uppercase, which essentially uses the hexadecimal value in the memory during encryption.

[0061] The CDN system encrypts 1-1-1-1. If you read it directly as ASCII after encryption, you'll typically get unreadable encoded characters. Here, we've chosen the Base32 encoding rule. The encoded result is: KU5WBWRU7NVQ76YYBT4R77OLJE=======.

[0062] In this embodiment, the characters obtained after base32 encoding are only uppercase letters. If an encoding method such as base64 is used, the encoded characters will have different uppercase and lowercase letters. However, since the entire DNS system is case-insensitive, the DNS system will forcibly convert uppercase letters to lowercase letters when requesting a domain name. This will cause the encrypted information to be distorted and the DNS server will be unable to correctly decrypt it.

[0063] In this embodiment, the trailing '=' characters are removed from the base32 encoded string; these characters are similar to the trailing padding complement. After the peer receives KU5WBWRU7NVQ76YYBT4R77OLJE, it can be calculated that six additional '=' characters are required. This calculation is: 8 - len(str) % 8, which is 8 - 26 % = 8 - 2 = 6.

[0064] This will get you the encrypted synthetic record domain name:

[0065] 1E10ADC3949BA59AB.KU5WBWRU7NVQ76YYBT4R77OLJE.bytedance.com. The first 1 indicates encryption using the first key. This is followed by the IV offset value "E10ADC3949BA59AB," followed by the encrypted information. It's important to note that the DNS system is case-insensitive; in practice, the requested domain name will be converted to lowercase.

[0066] In this way, the CDN will send the encrypted synthetic record domain name to the terminal, and the terminal will send a domain name resolution request containing the encrypted synthetic record domain name to the DNS.

[0067] The DNS system will obtain 1e10adc3949ba59ab.ku5wbwru7nvq76yybt4r77olje.bytedance.com.

[0068] The DNS system finds the encryption key corresponding to the first character, key1, and obtains the 16-character encryption offset IV. It then capitalizes the prefix of the subsequent bytedance.com subdomain, ku5wbwru7nvq76yybt4r77olje, and adds padding (=) to the end. The updated string is then decrypted, resulting in the decrypted information 1-1-1-1. The response is 1.1.1.1 according to the standard synthetic record resolution process.

[0069] Regarding IPv6, the difference between IPv6 and IPv4 is that the character length of IPv6 may exceed 63 characters after encryption, but DNS resolution requires that a level only allows a maximum of 63 characters. Therefore, in the embodiment, '.' is used to split the encrypted characters. For example:

[0070] In IPv6, when encrypting AD80-0000-0000-0000-ABAA-0000-00C2-0002 (which can also be abbreviated as AD80--ABAA-0-C2-2), the encrypted character length may exceed 63 bits:

[0071] R7ZEDSPI63PLWBNRYHKBKU7I7V2KUN3DBYJJLHGPHBFIXXAD7HLEPLESFEOIT2RMLNHBWYJD7WVFM===. As the DNS protocol requires that each level of domain name cannot exceed 63 characters, the embodiment uses "." to split the domain name, resulting in:

[0072] 1E10ADC3949BA59AB.R7ZEDSPI63PLWBNRYHKBKU7I7V2KUN3DBYJJLHGPHBFIXXAD7HLEPLESFEOI.T2RMLNHBWYJD7WVFM.huoshanlive.com. The subsequent processing method after segmentation is the same as that for IPv4, so it is not repeated here.

[0073] When the DNS system obtains the encrypted composite record domain name, it processes the characters following the IV offset value, removes the '.', converts it to uppercase, and adds a '=' at the end. The rest of the processing is the same as the above IPv4 and will not be repeated here.

[0074] It should be noted that in order to make the encrypted synthetic record domain name more intuitive and increase readability, the resource identifier of the domain name can be read from the encrypted synthetic record domain name. The disclosed embodiment can also support matching of the encrypted domain name similar to the wildcard domain name prefix. For example, the domain name resource identifier in the above IPv4 is douyin, and the domain name can be set to douyin-1e10adc3949ba59ab.ku5wbwru7nvq76yybt4r77olje.bytedance.com in the embodiment. In the DNS system, the prefix *- can be configured for the zone of the synthetic record bytedance.com, indicating that a wildcard prefix can be implemented. When the DNS system specifically implements the synthetic record, if the *- configuration is read, all characters before the - in the domain name request are ignored, and then the logic of synthetic record decryption is performed to increase the readability of the encrypted synthetic record domain.

[0075] Based on the above embodiment, in another embodiment provided by the present disclosure, a domain name encryption method based on a content delivery network is further provided. The method can be applied to a CDN system. As shown in FIG2 , the method may include the following steps:

[0076] Step S210: receiving an access request for an initial server sent by a terminal.

[0077] Step S220: When the initial server needs to be redirected to the target server, the synthetic record domain name of the target server is obtained.

[0078] In an embodiment, the synthesized record domain name carries the domain name resolution result of the target server.

[0079] Step S230: encrypt the synthesized record domain name to obtain an encrypted synthesized record domain name, and send the encrypted synthesized record domain name to the terminal.

[0080] By encrypting the synthetic record domain name, the embodiment can prevent illegal users from knowing the data format of the domain name resolution result in the synthetic record domain name, thereby improving data security and greatly improving the domain name processing efficiency compared to using technical means such as whitelists.

[0081] In this embodiment, the terminal obtains the IP address of the initial server by sending a domain name resolution request to the DNS system. Using this IP address, the terminal sends an access request to the CDN system for the initial server. As shown in Figure 1, the initial server can be the first edge server mentioned above, and the target server can be the second edge server mentioned above.

[0082] If the initial server is not the optimal edge node for the terminal, the CDN system will redirect the terminal's intended node from the initial server to another server, the target server, through 302 scheduling. The CDN system will send a synthesized record domain name containing the target server's domain name resolution result to the terminal. However, for security reasons, the CDN system will encrypt this synthesized record domain name to generate an encrypted synthesized record domain name and send it to the terminal.

[0083] In this embodiment, when the CND system encrypts a composite record domain name, it primarily encrypts the domain name resolution result within the composite record domain name. Specifically, the CND system encrypts the domain name resolution result within the composite record domain name to obtain an encrypted composite record domain name containing the encrypted domain name resolution result. This eliminates the need to encrypt all data within the composite record domain name, thereby improving encryption efficiency.

[0084] Based on the above embodiment, in order to encrypt the domain name resolution result in the synthetic record domain name, a corresponding algorithm can be selected for encryption. Therefore, the method may further include the following steps:

[0085] Step S231 obtains the target key and target offset value.

[0086] Step S232 encrypts the domain name resolution result based on the target key and the target offset value to obtain an encrypted synthetic record domain name.

[0087] In the embodiment, referring to the description of the above embodiment, the AES algorithm can be selected for encryption. Of course, other encryption methods can also be used for encryption, including other symmetric encryption algorithms or asymmetric encryption algorithms, etc. The embodiment only uses the AES algorithm as an example for illustration, and the embodiment is not limited to this.

[0088] When using the AES algorithm for encryption in IPv4 scenarios, multiple sets of keys are available. A single key can be selected as the target key for encryption, and an IV offset value is obtained as the target offset value. The target offset value can include 16 characters, for example: E10ADC3949BA59AB. In this way, the domain name resolution result can be encrypted using the target key and target offset value to obtain an encrypted composite record domain name.

[0089] The encrypted synthetic record domain name can be obtained by the above encryption method. If the encrypted synthetic record domain name is read directly in ASCII, it is usually not directly readable and needs to be encoded. Therefore, based on the above embodiment, in another embodiment provided by the present disclosure, the method can also include the following steps:

[0090] Step S240: Encode the encrypted domain name resolution result using a target encoding method to obtain encoded data.

[0091] Step S250: performing target processing on the coded data to obtain processed target coded data.

[0092] The target processing is used to remove target characters from the encoded data.

[0093] Step S260: Obtain the encrypted composite record domain name based on the target key identifier, the target offset value, and the encrypted domain name resolution result.

[0094] In an embodiment, base32 can be used to encode the domain name resolution result. For example, the encoded data is obtained: KU5WBWRU7NVQ76YYBT4R77OLJE=======, and the "=" therein is removed by target processing to obtain KU5WBWRU7NVQ76YYBT4R77OLJE, and then the encrypted synthetic record domain name can be obtained. For details, please refer to the corresponding description of the above embodiment, which will not be repeated here.

[0095] It should be noted that, in the embodiment, in a scenario where the domain name resolution result belongs to IPv6, the encrypted character string in the encrypted domain name resolution result may be segmented to obtain the encrypted domain name resolution result.

[0096] Since the length of IPv6 characters may exceed 63 characters after encryption, but DNS resolution requires that a level only allows a maximum of 63 characters, the embodiment uses '.' to separate the encrypted characters.

[0097] In an embodiment, a domain name identifier corresponding to the domain name resolution result may be obtained, and the domain name identifier may be added to the encrypted composite record domain name as a prefix of the encrypted composite record domain name.

[0098] For example, the resource identifier of the domain name can be read from the encrypted composite record domain name to support matching the encrypted domain name similar to the wildcard domain name prefix. For example, adding the domain name resource identifier douyin as a prefix to the encrypted composite record domain name will make the encrypted composite record domain name more readable.

[0099] Based on the above embodiment, in another embodiment provided by the present disclosure, a domain name decryption method based on a content distribution network is further provided. The method can be applied to a DNS system and may include the following steps:

[0100] Step S310: Receive a domain name resolution request sent by a terminal, wherein the domain name resolution request includes an encrypted synthetic record domain name.

[0101] Step S320: decrypt the encrypted synthesized record domain name to obtain a domain name resolution result.

[0102] Step S330: Send the domain name resolution result to the terminal.

[0103] In an embodiment, after receiving a domain name resolution request sent by a terminal, the DNS system obtains the encrypted synthetic record domain name contained in the domain name resolution request, decrypts the encrypted synthetic record domain name, obtains a domain name resolution result, and sends the domain name resolution result to the terminal.

[0104] During the process of decrypting the encrypted synthetic record domain name by the DNS system, the encryption algorithm in the encrypted synthetic record domain name can be decrypted. For example, when the encryption algorithm is a symmetric encryption algorithm, the encryption key used during encryption can be obtained for decryption. When an asymmetric encryption algorithm is used, the corresponding decryption key can be obtained for decryption.

[0105] Specifically, a target key corresponding to the encrypted composite record domain name can be obtained, and a target offset value within the encrypted composite record domain name can be obtained. The encrypted composite record domain name is decrypted based on the target key and target offset value to obtain a domain name resolution result. For example, in an embodiment, an encrypted domain name resolution result within the encrypted composite record domain name can be obtained, and target processing can be performed on the encrypted domain name resolution result to obtain a processed encrypted domain name resolution result. The target processing includes adding target characters to the encrypted domain name resolution result. The processed encrypted domain name resolution result is then decrypted based on the target key and target offset value to obtain a domain name resolution result.

[0106] In an embodiment, when the DNS system decrypts the encrypted synthetic record domain name, it can select a corresponding key according to the encrypted synthetic record domain name. For example, the encrypted synthetic record domain name encrypted by the AES algorithm, the first character is the corresponding key identifier. If the key identifier is 1, it means that the corresponding key is key1, and based on the 16-bit characters after the key representation as the target offset value, the encrypted resolution result after the target offset value in the encrypted synthetic record domain name is converted to uppercase characters, and the corresponding number of "=" is added at the end, and the processed encrypted resolution domain name is decrypted to obtain the IP address of the target server, and the IP address is sent to the terminal as the domain name resolution result.

[0107] Based on the above embodiment, in another embodiment provided by the present disclosure, a domain name decryption method based on a content distribution network is further provided. The method can be applied to a terminal and may include the following steps:

[0108] Step S410: Send an access request for the initial server to the CDN system.

[0109] Step S420: Receive the encrypted synthetic record domain name sent by the CDN system, wherein the encrypted synthetic record domain name is obtained by encrypting the domain name resolution result of the target server.

[0110] Step S430: Send a domain name resolution request containing the encrypted synthetic record domain name to the DNS system.

[0111] Step S440: Receive the domain name resolution result sent by the DNS system.

[0112] Step S450: Send an access request for the target server to the DNS system based on the domain name resolution result.

[0113] In the embodiments provided herein, as shown in FIG1 , when a terminal needs to access an edge server in a CDN system, for example, the edge server may be referred to as an initial server. The terminal sends a domain name resolution request for the initial server to the DNS. After receiving the domain name resolution result for the initial server from the DNS system, the terminal sends an access request for the initial server to the CDN.

[0114] If the initial server is not the optimal server for the terminal, that is, other servers will provide better server resources for the terminal, then the CDN will dispatch the terminal's access request from the initial server to the target server. At the same time, for security reasons, the CDN will send an encrypted synthetic record domain name to the terminal in the form of a synthetic record. The encrypted synthetic record domain name contains the encrypted domain name resolution result of the target server.

[0115] After receiving the encrypted synthetic record domain name, the terminal will send a request containing the encrypted synthetic record domain name to the DNS system in order to obtain the domain name resolution result of the target server returned by the DNS system through decryption, so that the terminal can send an access request for the target server to the DNS system based on the domain name resolution result.

[0116] By dividing the functional modules into corresponding functional modules, an embodiment of the present disclosure provides a domain name encryption device based on a content distribution network. This domain name encryption device can be a server or a chip applied to a server. Figure 3 is a schematic block diagram of the functional modules of a domain name encryption device based on a content distribution network provided by an exemplary embodiment of the present disclosure. As shown in Figure 3, this domain name encryption device based on a content distribution network can be applied to a CDN and can include:

[0117] An access request receiving module 11 is configured to receive an access request sent by a terminal to an initial server;

[0118] A synthetic record domain name acquisition module 12 is used to acquire a synthetic record domain name of a target server when it is necessary to redirect the initial server to a target server, wherein the synthetic record domain name carries a domain name resolution result of the target server;

[0119] The encryption module 13 is configured to encrypt the synthesized record domain name to obtain an encrypted synthesized record domain name, and send the encrypted synthesized record domain name to the terminal.

[0120] In another embodiment provided by the present disclosure, the encryption module is further configured to:

[0121] The domain name resolution result in the synthesized record domain name is encrypted to obtain an encrypted synthesized record domain name including the encrypted domain name resolution result.

[0122] In another embodiment provided by the present disclosure, the encryption module is further configured to:

[0123] Get the target key and target offset value;

[0124] The domain name resolution result is encrypted based on the target key and the target offset value to obtain the encrypted synthetic record domain name.

[0125] In another embodiment provided by the present disclosure, the apparatus further includes:

[0126] The encoding module is used to encode the encrypted domain name resolution result through a target encoding method to obtain encoded data;

[0127] a target processing module, configured to perform target processing on the coded data to obtain processed target coded data; wherein the target processing is configured to remove target characters from the coded data;

[0128] The encrypted composite record domain name acquisition module is used to obtain the encrypted composite record domain name based on the identifier of the target key, the target offset value and the encrypted domain name resolution result.

[0129] In another embodiment provided by the present disclosure, the apparatus further includes:

[0130] The segmentation module is used to perform character segmentation on the encrypted character string in the encrypted domain name resolution result when the domain name resolution result belongs to IPv6, so as to obtain the encrypted domain name resolution result.

[0131] In another embodiment provided by the present disclosure, the device further includes:

[0132] The identification acquisition module is used to obtain the domain name identifier corresponding to the domain name resolution result;

[0133] The identifier adding module is used to add the domain name identifier as a prefix of the encrypted composite record domain name to the encrypted composite record domain name.

[0134] By dividing the functional modules into corresponding modules, an embodiment of the present disclosure provides a domain name decryption device based on a content distribution network. This domain name decryption device based on a content distribution network can be a server or a chip applied to a server. This device can be applied to a DNS system. Figure 4 is a schematic block diagram of the functional modules of the domain name decryption device based on a content distribution network provided by an exemplary embodiment of the present disclosure. As shown in Figure 4, the device may include:

[0135] A domain name resolution request receiving module 21 is configured to receive a domain name resolution request sent by a terminal, wherein the domain name resolution request includes an encrypted synthetic record domain name;

[0136] A decryption module 22 is used to decrypt the encrypted synthetic record domain name to obtain a domain name resolution result;

[0137] The domain name resolution result sending module 23 is configured to send a message containing the domain name resolution result to the terminal.

[0138] In another embodiment provided by the present disclosure, the decryption module is specifically configured to:

[0139] Obtaining a target key corresponding to the encrypted composite record domain name, and obtaining a target offset value in the encrypted composite record domain name;

[0140] The encrypted synthesized record domain name is decrypted based on the target key and the target offset value to obtain a domain name resolution result.

[0141] In another embodiment provided by the present disclosure, the decryption module is further configured to:

[0142] Obtaining the encrypted domain name resolution result in the encrypted composite record domain name;

[0143] Performing target processing on the encrypted domain name resolution result to obtain a processed encrypted domain name resolution result; wherein the target processing includes adding target characters to the encrypted domain name resolution result;

[0144] The processed encrypted domain name resolution result is decrypted based on the target key and the target offset value to obtain the domain name resolution result.

[0145] By dividing functional modules into corresponding functional modules, an embodiment of the present disclosure provides a domain name decryption device based on a content distribution network. The domain name decryption device can be a server or a chip applied to a server. The device can be applied to a terminal. Figure 5 is a schematic block diagram of the functional modules of the domain name decryption device based on a content distribution network provided by an exemplary embodiment of the present disclosure. As shown in Figure 5, the device may include:

[0146] An access request sending module 31 is used to send an access request for the initial server to the CDN system;

[0147] The encrypted synthetic record domain name receiving module 32 is used to receive the encrypted synthetic record domain name sent by the CDN system; wherein the encrypted synthetic record domain name is obtained by encrypting the domain name resolution result of the target server;

[0148] A domain name resolution request sending module 33 is used to send a domain name resolution request containing the encrypted synthetic record domain name to the DNS system;

[0149] A domain name resolution result receiving module 34 is configured to receive the domain name resolution result sent by the DNS system;

[0150] The access request sending module 35 is configured to send an access request for the target server to the DNS system based on the domain name resolution result.

[0151] The relevant device part corresponds to the above method embodiment. For details, please refer to the description of the above embodiment and will not be repeated here.

[0152] An embodiment of the present disclosure further provides an electronic device, comprising: at least one processor; a memory for storing instructions executable by the at least one processor; wherein the at least one processor is configured to execute the instructions to implement the above method disclosed in the embodiment of the present disclosure.

[0153] Figure 6 is a schematic diagram of the structure of an electronic device provided by an exemplary embodiment of the present disclosure. As shown in Figure 6, the electronic device 1800 includes at least one processor 1801 and a memory 1802 coupled to the processor 1801. The processor 1801 can execute the corresponding steps of the above method disclosed in the embodiment of the present disclosure.

[0154] The processor 1801 can also be referred to as a central processing unit (CPU), which can be an integrated circuit chip with signal processing capabilities. Each step in the method disclosed in the embodiments of the present disclosure can be completed by hardware integrated logic circuits in the processor 1801 or by software instructions. The processor 1801 can be a general-purpose processor, a digital signal processor (DSP), an ASIC, a field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of the present disclosure can be directly implemented as being executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module can be located in the memory 1802, such as a storage medium mature in the art, such as a random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The processor 1801 reads the information in the memory 1802 and, in conjunction with its hardware, completes the steps of the method.

[0155] In addition, when various operations / processes according to the present disclosure are implemented via software and / or firmware, the programs constituting the software can be installed from a storage medium or a network to a computer system having a dedicated hardware structure, such as computer system 1900 shown in FIG7 . When the various programs are installed, the computer system can perform various functions, including those described above. FIG7 is a block diagram of the structure of a computer system provided by an exemplary embodiment of the present disclosure.

[0156] Computer system 1900 is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are intended to be examples only and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0157] As shown in FIG7 , computer system 1900 includes a computing unit 1901, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 1902 or a computer program loaded from a storage unit 1908 into a random access memory (RAM) 1903. Various programs and data required for the operation of computer system 1900 may also be stored in RAM 1903. Computing unit 1901, ROM 1902, and RAM 1903 are connected to each other via a bus 1904. An input / output (I / O) interface 1905 is also connected to bus 1904.

[0158] Several components within computer system 1900 are connected to I / O interface 1905, including an input unit 1906, an output unit 1907, a storage unit 1908, and a communication unit 1909. Input unit 1906 can be any type of device capable of inputting information into computer system 1900. Input unit 1906 can receive input numeric or character information and generate key input signals related to user settings and / or function control of an electronic device. Output unit 1907 can be any type of device capable of presenting information and may include, but is not limited to, a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. Storage unit 1908 may include, but is not limited to, a magnetic disk or an optical disk. Communication unit 1909 allows computer system 1900 to exchange information / data with other devices over a network, such as the Internet, and may include, but is not limited to, a modem, a network card, an infrared communication device, a wireless communication transceiver and / or chipset, such as a Bluetooth™ device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0159] The computing unit 1901 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 1901 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units that run machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 1901 performs the various methods and processes described above. For example, in some embodiments, the above-mentioned methods disclosed in the embodiments of the present disclosure may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 1908. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 1900 via the ROM 1902 and / or the communication unit 1909. In some embodiments, the computing unit 1901 may be configured to perform the above-mentioned methods disclosed in the embodiments of the present disclosure by any other appropriate means (e.g., by means of firmware).

[0160] An embodiment of the present disclosure further provides a computer-readable storage medium, wherein, when instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the above method disclosed in the embodiment of the present disclosure.

[0161] The computer-readable storage medium in the embodiments of the present disclosure can be a tangible medium that can contain or store a program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. The above-mentioned computer-readable storage medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the above. More specifically, the above-mentioned computer-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0162] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0163] The embodiments of the present disclosure further provide a computer program product, including a computer program, wherein when the computer program is executed by a processor, the method disclosed in the embodiments of the present disclosure is implemented.

[0164] In embodiments of the present disclosure, computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or combinations thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer.

[0165] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0166] The modules, components, or units described in the embodiments of the present disclosure may be implemented in software or hardware. The names of the modules, components, or units do not necessarily limit the modules, components, or units themselves.

[0167] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, and without limitation, exemplary hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0168] The above descriptions are merely some embodiments of the present disclosure and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the above-mentioned disclosed concepts. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in the present disclosure.

[0169] Although some specific embodiments of the present disclosure have been described in detail by way of examples, those skilled in the art will appreciate that the above examples are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Those skilled in the art will appreciate that modifications may be made to the above embodiments without departing from the scope and spirit of the present disclosure. The scope of the present disclosure is defined by the appended claims.

Claims

1. A domain name encryption method based on a content distribution network, applied to a content distribution network CDN, the method comprising: receiving an access request to an initial server sent by a terminal; In the case where the initial server needs to be redirected to the target server, obtaining a synthetic record domain name of the target server, the synthetic record domain name carrying a domain name resolution result of the target server; as well as The synthesized record domain name is encrypted to obtain an encrypted synthesized record domain name, and the encrypted synthesized record domain name is sent to the terminal.

2. The method according to claim 1, wherein encrypting the synthetic record domain name comprises: The domain name resolution result in the synthetic record domain name is encrypted to obtain an encrypted synthetic record domain name including the encrypted domain name resolution result.

3. The method according to claim 2, wherein encrypting the domain name resolution result comprises: Get the target key and target offset value; as well as The domain name resolution result is encrypted based on the target key and the target offset value to obtain the encrypted synthetic record domain name.

4. The method according to claim 3, further comprising: Encoding the encrypted domain name resolution result by using a target encoding method to obtain encoded data; Performing target processing on the coded data to obtain processed target coded data; wherein the target processing is used to remove target characters in the coded data; as well as The encrypted synthetic record domain name is obtained based on the identifier of the target key, the target offset value and the encrypted domain name resolution result.

5. The method according to claim 2, further comprising: If the domain name resolution result belongs to IPv6, the encrypted domain name resolution result The encrypted string in the result is segmented by characters to obtain the encrypted domain name resolution result.

6. The method according to any one of claims 1 to 5, further comprising: Get the domain name identifier corresponding to the domain name resolution result; as well as The domain name identifier is added to the encrypted composite record domain name as a prefix of the encrypted composite record domain name.

7. A domain name decryption method based on a content distribution network, applied to a domain name system DNS, the method comprising: Receiving a domain name resolution request sent by a terminal, wherein the domain name resolution request includes an encrypted synthetic record domain name; Decrypting the encrypted synthetic record domain name to obtain a domain name resolution result; as well as Sending the domain name resolution result to the terminal.

8. The method according to claim 7, wherein decrypting the encrypted synthetic record domain name to obtain a domain name resolution result comprises: Obtaining a target key corresponding to the encrypted synthetic record domain name, and obtaining a target offset value in the encrypted synthetic record domain name; as well as The encrypted synthetic record domain name is decrypted based on the target key and the target offset value to obtain a domain name resolution result.

9. The method of claim 8, wherein decrypting the encrypted composite record domain name based on the target key and the target offset value comprises: Obtaining the encrypted domain name resolution result in the encrypted synthetic record domain name; Performing target processing on the encrypted domain name resolution result to obtain a processed encrypted domain name resolution result; wherein the target processing includes adding target characters in the encrypted domain name resolution result; as well as The processed encrypted domain name resolution result is decrypted based on the target key and the target offset value to obtain the domain name resolution result.

10. A domain name decryption method based on a content distribution network, applied to a terminal, the method comprising: Sending an access request for the initial server to the CDN system; Receiving the encrypted synthetic record domain name sent by the CDN system; wherein the encrypted synthetic record domain name is obtained by encrypting the domain name resolution result of the target server; Sending a domain name resolution request including the encrypted synthetic record domain name to a DNS system; Receiving the domain name resolution result sent by the DNS system; and An access request for the target server is sent to the DNS system based on the domain name resolution result.

11. A domain name encryption device based on a content distribution network, applied to a CDN system, the device comprising: An access request receiving module, used for receiving an access request sent by a terminal to an initial server; A synthetic record domain name acquisition module, used to acquire the synthetic record domain name of the target server when it is necessary to redirect the initial server to the target server, the synthetic record domain name carrying the domain name resolution result of the target server; as well as The encryption module is used to encrypt the synthetic record domain name to obtain the encrypted synthetic record domain name, and send the encrypted synthetic record domain name to the terminal.

12. A domain name decryption device based on a content distribution network, applied to a DNS system, the device comprising: A domain name resolution request receiving module, used to receive a domain name resolution request sent by a terminal, wherein the domain name resolution request includes an encrypted synthetic record domain name; A decryption module, used to decrypt the encrypted synthetic record domain name to obtain a domain name resolution result; as well as The domain name resolution result sending module is used to send the domain name resolution result to the terminal.

13. A domain name decryption device based on a content distribution network, applied to a terminal, the device comprising: An access request sending module, used for sending an access request for an initial server to the CDN system; The encrypted synthetic record domain name receiving module is used to receive the encrypted domain name sent by the CDN system. Synthesized record domain name; wherein the encrypted synthesized record domain name is obtained by encrypting the domain name resolution result of the target server; A domain name resolution request sending module, used for sending a domain name resolution request containing the encrypted synthetic record domain name to a DNS system; A domain name resolution result receiving module, used to receive the domain name resolution result sent by the DNS system; and An access request sending module is used to send an access request for the target server to the DNS system based on the domain name resolution result.

14. An electronic device comprising: at least one processor; a memory for storing the at least one processor-executable instruction; The at least one processor is configured to execute the instructions to implement the method according to any one of claims 1-10.

15. A computer-readable storage medium, wherein when instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the method according to any one of claims 1 to 10.

Images