DNS Processing System Kernel Application Layer Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current DNS systems face challenges in handling high volumes of DNS requests and defending against attacks, with existing software struggling to process millions of requests per second and providing adequate security, especially due to their reliance on UDP and structural anomalies.
Innovation Solution
A method and system that process DNS behavior by determining the appropriate processing body (kernel or application layer) based on the DNS behavior type, allowing network data packets to be transferred and processed accordingly, utilizing the kernel for high-capacity attack handling and the application layer for time-sensitive requests, thereby enhancing processing capacity and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS defense capability is improved by filtering and security checks, then security against attacks is enhanced, but service processing capability and response performance deteriorate
Solution Approach 1:
The DNS server is divided into multiple independent processing threads, each capable of handling DNS requests separately. This threading architecture allows the system to perform security checks and filtering operations in parallel, maintaining both high security and fast processing speeds without blocking the entire server when handling attacks or malicious requests.
2Device complexity
If a single DNS server handles all requests, then system complexity is reduced, but the system cannot handle millions of requests per second under attack
Solution Approach 1:
Multiple DNS servers are merged into a unified system that shares common resources such as caching mechanisms, configuration files, and security databases. This allows the system to handle millions of requests per second by distributing load across multiple physical servers while maintaining a unified response and shared security posture, effectively scaling capacity without proportionally increasing complexity.
3Speed
If DNS servers use UDP for fast communication, then response speed is improved, but the system becomes vulnerable to easily generated simulation attacks
Solution Approach 1:
An intermediary layer is introduced between the UDP protocol and the DNS processing logic. This intermediary implements security checks, request validation, and filtering mechanisms that can identify and block malicious requests before they reach the core DNS resolution process, thereby maintaining fast UDP-based communication while protecting against attacks.
Data Source
AI summary
The invention provides a method, device and system for processing DNS behavior. The method comprises: resolving received network data packet; judging a DNS behavior type corresponding to the network data packet according to the resolution result; determining a processing body according to the DNS behavior type, wherein the processing body comprises a kernel and/or an application layer; and transferring the network data packet to the determined processing body, and processing the network data packet by the determined processing body. The method in the disclosure can improve the DNS defense capability, while improving the service processing capability of a single machine.