CN104253796A - Domain name system fast region identification method based on network address binding region levels - Google Patents
Domain name system fast region identification method based on network address binding region levels Download PDFInfo
- Publication number
- CN104253796A CN104253796A CN201310263939.2A CN201310263939A CN104253796A CN 104253796 A CN104253796 A CN 104253796A CN 201310263939 A CN201310263939 A CN 201310263939A CN 104253796 A CN104253796 A CN 104253796A
- Authority
- CN
- China
- Prior art keywords
- name server
- request
- authoritative
- domain name
- server
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention relates to the technical field of domain name systems, in particular to a domain name system fast region identification method based on network address binding region levels. Optimization is implemented on the basis of the original DNS analysis; the method includes in an authoritative name server, pointing NS records to corresponding bound IP through regions with different levels, after a domain name analysis request is transmitted to the authoritative name server according to a standard DNS analysis procedure, allowing the authoritative name server to extract the region name from the requested domain name according to the region level bound to the request inlet IP, judging whether the extracted region name is in the authorization region list range of the authoritative name server or not, and performing the analysis procedure. By the aid of the method, sequential multiple domain name and matched region list extractions are avoided, whether the requested domain name is in the range of the authoritative name server accepted the request or not can be judged through once extraction, the problem that the regional match is of a vulnerable loophole is avoided, and security and analyzing efficiency of the domain name analyzing process are improved.
Description
Technical field
The present invention relates to domain name system technology field, especially relate to the quick district recognition methods of address binding region layer level Network Based in domain name system.
Background technology
DNS is the abbreviation of domain name system in computer system (Domain Name System or Domain Name Service), it is a kernel service of internet, it is as a distributed data base that domain name and IP address can be mapped mutually, people can be made to access the Internet more easily, and do not spend the IP string remembeing directly to be read by machine.DNS is made up of resolver and name server, and name server refers to the domain name and corresponding IP address of preserving All hosts in this network, and has server domain name being converted to IP address function.DNS uses TCP and UDP port number to be 53, mainly uses UDP, and between server, backup uses TCP.
IP is the abbreviation of English Internet Protocol (agreement interconnected between network), and Chinese, referred to as " net association ", namely carries out communicating and the agreement that designs for computer network is interconnected.In the internet, it to make to be connected to the set of rule that online all computer networks realize intercoming mutually, defines the rule should observed when computer communicates on the internet.The computer system of any manufacturer production, just can interconnect with internet as long as observe IP agreement.Also have a very important content in IP agreement, that is exactly all define a unique address to the every platform computer on internet and miscellaneous equipment, is called " IP address ".Owing to there being this unique address, just ensure that user is when the calculating hands-operation networked, the object can efficiently and easily selected from thousands upon thousands computers needed for oneself comes.
TCP is the abbreviation of English Transmission Control Protocol (transmission control protocol), TCP is a kind of SCCP connection-oriented (connect guiding), reliably, based on transport layer (Transport layer) communication protocol of byte stream, is illustrated (specified) by the RFC 793 of IETF.In the computer network osi model simplified, it completes the 4th layer of function specified by transport layer, and UDP is another important host-host protocol in same layer.UDP is the abbreviation of User Datagram Protocol, and Chinese name is User Datagram Protoco (UDP), is a kind of connectionless transport layer protocol in OSI Reference Model, provides the simple unreliable information transfer service towards affairs.TCP/IP (Transmission Control Protocol/Internet Protocol) i.e. transmission control protocol/IP(Internet Protocol) is the protocol suite of an industrial standard, and it designs for wide area network (WAN).It is grown up by the research institution of Advanced Research Projects Agency Network net
Domain name (Domain Name), upper a certain the computer in the internet (Internet) be made up of the name of a string separation or calculate the title of unit, for the electronic bearing of the mark computer when transfer of data.DNS distributed data base is the hierarchical structure of a downtree shape, and this database take domain name as index.In fact each domain name is exactly the path of this reverse tree.The superiors of number are roots, and extend down to have a lot of branch, the crosspoint of these branches is known as node, and each node still can continue to divide downwards.The depth capacity of whole tree must not more than 127 layers, and each node has a text label that can reach 63 bytes.The program stored about name space information is called name server, name server contains the complete information of certain part in name space, this part is called district (ZONE), and the content in district stores from this locality or loads other name servers.Name server has authority to this district, and a name server also can have authority to multiple district simultaneously.
NS (Name System) record is authoritative name server record, and be used to specify the authoritative name server in this district, the authoritative name server in this district is responsible for the parsing of resolving domain name belonging to this district.
People are accustomed to remembering domain name, but machinery compartment only identifies IP address mutually, and be one to one between domain name and IP address, the conversion work between them is called domain name mapping, i.e. dns resolution; Domain name mapping needs to have been come by special domain name resolution server, and whole process is carried out automatically.When uploading to your fictitious host computer after your website making completes, you directly can input the website that you is browsed in IP address in a browser, also your website of inquiry of the domain name can be inputted, although the content drawn is the same but the process called is different, input IP address directly calls content from main frame, input domain name is pointed to the IP address of corresponding main frame, then call the content of website from main frame.
Dns resolution process is: step one, the request of client initiated domain name analysis, and request is sent to the name server of client; The name server of step 2, client receives request, and name server is inquiry request in the local cache of client; If inquire the entry of request in the local cache of client, then Query Result is directly returned to client by name server, and resolving terminates; If do not inquire the entry of request in the local cache of client, then request is sent to root name character server by name server, and the subdomain of inquired root, the record of authoritative name server and IP address thereof are returned to name server by root name character server; Step 3, name server send recurrence request to authoritative name server, carry out following step 4; Step 4, authoritative name server accept recurrence request and inquiry authority stores in authoritative name server; If inquire the entry that authority stores in authoritative name server, then the Query Result returned is saved in the local cache of client by authoritative name server, and allow use next time, Query Result is returned to client, resolving terminates simultaneously; If do not inquire the entry that authority stores in authoritative name server, then the record of authoritative name server and IP address thereof are returned to name server again, name server sends recurrence request to authoritative name server, carries out step 5; Step 5, repetition step 4, until find the entry of coupling.
Generally, multiple district can share authoritative name server, and namely authoritative name server has administered multiple district.After any domain name mapping inquiry is sent to authoritative name server, authoritative name server must match domain name corresponding to inquiry whether in the district that authoritative name server is administered, if, then authoritative server stores to search corresponding record and form respond packet authority further and returns, if do not exist, then return corresponding error message bag.If the number of labels of request domain name is many, the then reverse character string successively intercepted of authoritative name server palpus, and check this character string whether in authoritative name server administrative area list list, such as request analysis domain name is aa.bb.cc.dd.ee.ff.gg.hh.com., then existing authoritative name server first intercepts out hh.com, and judges hh.com whether in district's list scope of self administration, if, then stop intercepting and searching, Matching band success; If do not exist, then intercept out gg.hh.com further, and judge gg.hh.com whether in district's list scope of self administration, if, stop intercepting and searching, Matching band success.Circulation searching coupling like this, until search successfully when certain once intercepts, or the last aa.bb.cc.dd.ee.ff.gg.hh.com. intercepted is excluded in district's list scope of self administration.The algorithm complex of this Matching band depends on the number of times intercepting and mate.
Be easy under attack in prior art when dns resolution, if the domain name of malicious attacker structure request is a lot of containing number of labels, and requested domain name is not in authoritative name server administrative area under fire, then the operand be easy to by repeatedly intercepting domain name and Matching band list one by one exhausts by the system resources in computation of authoritative name server.Also there is no effective solution at present.
Summary of the invention
Technical problem solved by the invention is to provide the quick district recognition methods of address binding region layer level Network Based in a kind of domain name system, the present invention improves on the basis of original dns resolution, by on authoritative name server, the IP of the number of plies in being set by place, district name space and NS record correspondence sets up binding relationship, avoid and repeatedly intercept domain name and Matching band list one by one, only need once to intercept the domain name that can judge to ask whether under the administration of the authoritative name server accepted request, thus avoid the problem that district's coupling becomes pregnable leak.Improve the fail safe of domain name resolution process, improve the analyzing efficiency of domain name resolution process, save the time.
In order to solve the problems of the technologies described above, the invention provides the quick district recognition methods of address binding region layer level Network Based in domain name system, comprising:
Various level district is tied on different IP addresses by S1, authoritative name server respectively, and namely NS record points on the described IP address of corresponding binding by various level district respectively described in each;
S2, the request of client initiated domain name analysis, and described request is sent to the local name server of described client;
S3, described local name server inquire about the relative recording item of described request in own cache;
If S3.a inquires the entry of described request in the own cache of described local name server, then Query Result is directly returned to described client by described local name server, and resolving terminates;
If S3.b does not inquire the entry of described request in the own cache of described local name server, then described request is sent to root name character server by described local name server, the described NS record of root name character server inquiry TLD and the NS of described TLD record the information of corresponding IP address, and Query Information is returned to described local name server, described local name server with described Query Information for the further recurrence of clue, again initiate recurrence request, until recurrence is to described authoritative name server corresponding to described request domain name;
S4, described request recurrence are to described authoritative name server, described authoritative name server goes out the described region layer level of binding according to the entrance IP address maps of recurrence request described in described step S1, and described authoritative name server intercepts out district's title of described recurrence request from the domain name of described recurrence request according to described region layer level;
S5: described authoritative name server judges the described district title that intercepts out whether within the scope of the empowered zone list of described authoritative name server;
If S5.a described district title is within the scope of the empowered zone list of described authoritative name server, described authoritative name server carries out domain name mapping handling process, in the storage of described authoritative name server, inquire about described authoritative entry whether exist, Query Result group bag is returned to described local name server by described authoritative name server, described Query Result is saved in own cache by described local name server again, follow-up inquiry of the domain name request is allowed to use, described Query Result respond packet is returned to described client, resolving terminates simultaneously;
If S5.b is not within the scope of the empowered zone list of described authoritative name server, then described authoritative name server judges that described recurrence request is invalidation request or query-attack, abandon described recurrence request or return relevant error information to described local name server, described relevant error information respond packet is returned to described client by described local name server, and resolving terminates.
Preferably, described in described step S1, different level refers to more than three layers and three layers.
Wherein, described NS (Name Server) record is name server record, is used to specify this domain name and by which dns server is resolved.During registered domain name, always have the dns server of acquiescence, the domain name of each registration is resolved by a DNS name server.DNS is the abbreviation of domain name system (Domain Name System), it is a kernel service of internet, it is as a distributed data base that domain name and IP address can be mapped mutually, people can be made to access the Internet more easily, and do not spend the IP string remembeing directly to be read by machine.IP is the abbreviation of English Internet Protocol (agreement interconnected between network), and Chinese, referred to as " net association ", namely carries out communicating and the agreement that designs for computer network is interconnected.In the internet, it to make to be connected to the set of rule that online all computer networks realize intercoming mutually, defines the rule should observed when computer communicates on the internet.The computer system of any manufacturer production, just can interconnect with internet as long as observe IP agreement.IP address has uniqueness.
The present invention compared with prior art, has following beneficial effect:
The invention provides the quick district recognition methods of address binding region layer level Network Based in a kind of domain name system, by the IP of the number of plies in place, district name space tree and NS record correspondence is set up binding relationship, avoid and repeatedly intercept domain name and Matching band list one by one, only need once to intercept the domain name that can judge to ask whether under the administration of the authoritative name server accepted request, thus avoid the problem that district's coupling becomes pregnable leak.Improve the fail safe of domain name resolution process, improve the analyzing efficiency of domain name resolution process, save the time.
Accompanying drawing explanation
Fig. 1 schematically illustrates quick district's recognition methods flow chart of address binding region layer level Network Based in domain name system;
Fig. 2 schematically illustrates the binding IP schematic diagram in various level district.
Embodiment
In order to the technical scheme understanding technical problem solved by the invention better, provide, below in conjunction with drawings and Examples, the present invention is further elaborated.Specific embodiment described herein only in order to explain enforcement of the present invention, but is not intended to limit the present invention.
In a preferred embodiment, Fig. 1 schematically illustrates quick district's recognition methods flow process of address binding region layer level Network Based in domain name system;
Various level district is tied on different IP addresses by S1, authoritative name server respectively, and namely NS record points on the described IP address of corresponding binding by various level district respectively described in each;
S2, client initiated domain name analysis DNS request bag, and described DNS request bag is sent to the local name server of described client;
S3, described local name server inquire about the relative recording item of described DNS request bag in own cache;
If S3.a inquires the entry of described DNS request bag in the own cache of described local name server, then Query Result is directly returned to described client by described local name server, and resolving terminates;
S3.b, if do not inquire the entry of described DNS request bag in the own cache of described local name server, then described DNS request bag is sent to root name character server by described local name server, the described NS record of root name character server inquiry TLD and the NS of described TLD record the information of corresponding IP address, and Query Information is returned to described local name server, described local name server with described Query Information for the further recurrence of clue, again initiate recurrence DNS request bag, until recurrence is to described authoritative name server corresponding to described DNS request bag domain name,
S4, described DNS request bag recurrence are to described authoritative name server, described authoritative name server goes out the described region layer level of binding according to the entrance IP address maps of the bag of recurrence DNS request described in described step S1, and described authoritative name server intercepts out district's title of described recurrence DNS request bag from the domain name of described recurrence DNS request bag according to described region layer level;
S5: described authoritative name server judges the described district title that intercepts out whether within the scope of the empowered zone list of described authoritative name server;
If described district title is within the scope of the empowered zone list of described authoritative name server, described authoritative name server carries out domain name mapping handling process, in the storage of described authoritative name server, inquire about described authoritative entry whether exist, Query Result respond packet is returned to described local name server by described authoritative name server, described Query Result is saved in own cache by described local name server again, follow-up inquiry of the domain name request is allowed to use, described Query Result respond packet is returned to described client, resolving terminates simultaneously;
If not within the scope of the empowered zone list of described authoritative name server, then described authoritative name server judges that described recurrence DNS request bag is invalid DNS request bag or attacks DNS request bag, abandon described recurrence DNS request bag or return relevant error information to described local name server, described relevant error information respond packet is returned to described client by described local name server, and resolving terminates.
In the embodiment be more preferably, described in described step S1, different level refers to more than three layers and three layers.
Specific embodiment:
Fig. 2 schematically illustrates the binding IP schematic diagram in various level district, on authoritative name server, various level district (ZONE) is tied to respectively on different IP.Such as the district of three levels is tied on LV3-IP, and the district of four levels is tied on LV4-IP, and the district of five levels is tied on LV5-IP; Districts more than five levels is generally fewer, increases corresponding binding IP if having; One level is rhizosphere name, and two levels are TLD, is domain name registration/management board and controls.
This patent does not change the authoritative name server dns resolution process in the district of one deck and two levels, only changes the authoritative name server dns resolution process in three levels and above district thereof.
Domain name mapping request is by after standard dns resolution flow process recurrence to authoritative name server, and authoritative name server, according to the region layer level of request entrance IP binding, intercepts out district's title from request domain name.Such as request domain is called xyz.def.abc.com., if entrance IP is LV3-IP, then from xyz.def.abc.com., intercepts out district be called abc.com.; If in like manner entrance IP is LV4-IP, then the district intercepted out from xyz.def.abc.com. is called def.abc.com.; If in like manner entrance IP is LV5-IP, then the district intercepted out from xyz.def.abc.com. is called xyz.def.abc.com..
The present invention is described in detail in preferred embodiment above by concrete; but those skilled in the art should be understood that; the present invention is not limited to the above embodiment; all within general principle of the present invention; any amendment of doing, combination and equivalent replacement etc., be all included within protection scope of the present invention.
Claims (2)
1. the quick district recognition methods of address binding region layer level Network Based in domain name system, is characterized in that, comprising:
Various level district is tied on different IP addresses by S1, authoritative name server respectively, and namely NS record points on the described IP address of corresponding binding by various level district respectively described in each;
S2, the request of client initiated domain name analysis, and described request is sent to the local name server of described client;
S3, described local name server inquire about the relative recording item of described request in own cache;
If S3.a inquires the entry of described request in the own cache of described local name server, then Query Result is directly returned to described client by described local name server, and resolving terminates;
If S3.b does not inquire the entry of described request in the own cache of described local name server, then described request is sent to root name character server by described local name server, the described NS record of root name character server inquiry TLD and the NS of described TLD record the information of corresponding IP address, and Query Information is returned to described local name server, described local name server with described Query Information for the further recurrence of clue, again initiate recurrence request, until recurrence is to described authoritative name server corresponding to described request domain name;
S4, described request recurrence are to described authoritative name server, described authoritative name server goes out the described region layer level of binding according to the entrance IP address maps of recurrence request described in described step S1, and described authoritative name server intercepts out district's title of described recurrence request from the domain name of described recurrence request according to described region layer level;
S5: described authoritative name server judges the described district title that intercepts out whether within the scope of the empowered zone list of described authoritative name server;
If S5.a described district title is within the scope of the empowered zone list of described authoritative name server, described authoritative name server carries out domain name mapping handling process, in the storage of described authoritative name server, inquire about described authoritative entry whether exist, Query Result group bag is returned to described local name server by described authoritative name server, described Query Result is saved in own cache by described local name server again, follow-up inquiry of the domain name request is allowed to use, described Query Result respond packet is returned to described client, resolving terminates simultaneously;
If S5.b is not within the scope of the empowered zone list of described authoritative name server, then described authoritative name server judges that described recurrence request is invalidation request or query-attack, abandon described recurrence request or return relevant error information to described local name server, described relevant error information respond packet is returned to described client by described local name server, and resolving terminates.
2. the quick district recognition methods of address binding region layer level Network Based in domain name system according to claim 1, it is characterized in that, described in described step S1, different level refers to more than three layers and three layers.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201310263939.2A CN104253796B (en) | 2013-06-27 | 2013-06-27 | Quick area's recognition methods based on network address binding region layer level in domain name system |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201310263939.2A CN104253796B (en) | 2013-06-27 | 2013-06-27 | Quick area's recognition methods based on network address binding region layer level in domain name system |
Publications (2)
Publication Number | Publication Date |
---|---|
CN104253796A true CN104253796A (en) | 2014-12-31 |
CN104253796B CN104253796B (en) | 2018-01-05 |
Family
ID=52188336
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN201310263939.2A Expired - Fee Related CN104253796B (en) | 2013-06-27 | 2013-06-27 | Quick area's recognition methods based on network address binding region layer level in domain name system |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN104253796B (en) |
Cited By (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN105704259A (en) * | 2016-01-21 | 2016-06-22 | 中国互联网络信息中心 | IP recognition method and system for domain name authority service source |
CN107135236A (en) * | 2017-07-06 | 2017-09-05 | 广州优视网络科技有限公司 | A kind of detection method and system of target Domain Hijacking |
CN107302601A (en) * | 2016-04-15 | 2017-10-27 | 北京北信源软件股份有限公司 | A kind of instant messaging DNS and analytic method |
CN111131285A (en) * | 2019-12-30 | 2020-05-08 | 互联网域名***北京市工程研究中心有限公司 | Active protection method for random domain name attack |
CN114285823A (en) * | 2021-12-30 | 2022-04-05 | 哈尔滨工业大学 | DNS (Domain name System) system based universal network identifier analysis method and system |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20070118667A1 (en) * | 2005-11-21 | 2007-05-24 | Limelight Networks, Inc. | Domain name resolution based dynamic resource assignment |
CN101640679A (en) * | 2009-04-13 | 2010-02-03 | 山石网科通信技术(北京)有限公司 | Domain name resolution agent method and device therefor |
-
2013
- 2013-06-27 CN CN201310263939.2A patent/CN104253796B/en not_active Expired - Fee Related
Patent Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20070118667A1 (en) * | 2005-11-21 | 2007-05-24 | Limelight Networks, Inc. | Domain name resolution based dynamic resource assignment |
CN101640679A (en) * | 2009-04-13 | 2010-02-03 | 山石网科通信技术(北京)有限公司 | Domain name resolution agent method and device therefor |
Cited By (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN105704259A (en) * | 2016-01-21 | 2016-06-22 | 中国互联网络信息中心 | IP recognition method and system for domain name authority service source |
CN105704259B (en) * | 2016-01-21 | 2019-06-21 | 中国互联网络信息中心 | A kind of domain name authority services source IP recognition methods and system |
CN107302601A (en) * | 2016-04-15 | 2017-10-27 | 北京北信源软件股份有限公司 | A kind of instant messaging DNS and analytic method |
CN107135236A (en) * | 2017-07-06 | 2017-09-05 | 广州优视网络科技有限公司 | A kind of detection method and system of target Domain Hijacking |
CN111131285A (en) * | 2019-12-30 | 2020-05-08 | 互联网域名***北京市工程研究中心有限公司 | Active protection method for random domain name attack |
CN111131285B (en) * | 2019-12-30 | 2022-03-01 | 深圳网基科技有限公司 | Active protection method for random domain name attack |
CN114285823A (en) * | 2021-12-30 | 2022-04-05 | 哈尔滨工业大学 | DNS (Domain name System) system based universal network identifier analysis method and system |
CN114285823B (en) * | 2021-12-30 | 2024-02-02 | 哈尔滨工业大学 | DNS system-based universal network identification analysis method and system |
Also Published As
Publication number | Publication date |
---|---|
CN104253796B (en) | 2018-01-05 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7225272B2 (en) | Method and apparatus for providing name services | |
CN103248726B (en) | A kind of many reciprocity Internet of Things identification analytic method | |
US8370457B2 (en) | Network communication through a virtual domain | |
US20060218289A1 (en) | Systems and methods of registering and utilizing domain names | |
CN106302842A (en) | A kind of domain name analytic method, Apparatus and system | |
IL292776B2 (en) | Asset search and discovery system using graph data structures | |
CN103891247B (en) | Method and system for domain name system based discovery of devices and objects | |
BR112013029001B1 (en) | METHOD FOR DNS RESOLUTION OF CONTENT REQUESTS IN A CDN SERVICE | |
CN105450787B (en) | Mapping network addresses methods, devices and systems | |
CN104253796A (en) | Domain name system fast region identification method based on network address binding region levels | |
CN112600868B (en) | Domain name resolution method, domain name resolution device and electronic equipment | |
CN105282269B (en) | A kind of configuration method and method of servicing of local dns root server | |
CN108702396A (en) | For the method for data processing, equipment and computer program and hierarchical domain name system area file | |
CN100473072C (en) | Network address server | |
CN102546854A (en) | Domain name analysis method for building hyper text transport protocol (HTTP) connection for domain name and server | |
KR100463208B1 (en) | Internal Natural Domain Service System with Local Name Servers for Flexible Top-Level Domains | |
CN102833262A (en) | Whois information-based phishing website gathering, identification method and system | |
CN106973125A (en) | Domain name mapping implementation method and device | |
CN110809070A (en) | Website domain name resolution record processing method and device, electronic equipment and storage medium | |
CN103685584A (en) | Method and system of resisting domain name hijacking based on tunnelling | |
CN105872119A (en) | Method and apparatus for implementing domain name resolution system | |
CN109995885B (en) | Domain name space structure presentation method, device, equipment and medium | |
CN113946587A (en) | Handle identifier analysis caching method, query method and handle identifier analysis system | |
CN107786594A (en) | Service request processing method and device | |
CN102378407A (en) | Object name resolution system and method in internet of things |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
C06 | Publication | ||
PB01 | Publication | ||
C10 | Entry into substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
GR01 | Patent grant | ||
GR01 | Patent grant | ||
CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20180105 Termination date: 20180627 |
|
CF01 | Termination of patent right due to non-payment of annual fee |