WO2008116416A1

WO2008116416A1 - Method, device and system for domain name system to update dynamically

Info

Publication number: WO2008116416A1
Application number: PCT/CN2008/070553
Authority: WO
Inventors: Chunqiang Li
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-03-26
Filing date: 2008-03-21
Publication date: 2008-10-02
Also published as: CN101277257A; CN101277257B

Abstract

A method, device and system for a Domain Name System to update dynamically, relates to network security techniques. The invention is for solving the problem of insecurity of the dynamical DNS updating process. The method includes steps of that: DNS client generates an IP address according to a given rule, DNS client generates a dynamical updating request message and sends the dynamical updating request message along with the IP address to DNS server, DNS server generates a second IP address according to the same rule as that of DNS client and identifies the address. after receiving the DNS dynamical updating request message, and DNS server updates Domain Name System resource record according to the DNS dynamical updating request message. The invention is adapted in DNS systems.

Description

Method, device and system for dynamically updating domain name system

The present invention relates to network security technologies in the field of communication networks, and in particular, to a method, apparatus and system for dynamically updating a domain name system.

Background technique

In the Internet, the IP address is usually used as the network layer identifier of the host. However, the IP address is just a string of numbers. In order to facilitate the memory, the host name is generated. In the communication process, the IP address of the communication entity needs to be used, so it is necessary to be able to translate the host name into the corresponding IP address. The original host name and IP address mapping is stored in the hosts.txt file of the Network Information Center (NIC). At that time, because the number of hosts is small, this file does not change frequently, so other hosts are NICs from the NIC once a day. Download this file on the host for hostname and IP address mapping. However, as the network scale expands and the number of hosts increases, frequent download requests put tremendous pressure on the NIC's host, which also affects the quality of service. Many LAN users want to manage their own hostnames, rather than waiting for the NIC to add their hostnames to the hosts.txt file for many days. Some organizations also want to have their own namespace configuration. It was finally decided to use a hierarchical name space organization scheme, the Domain Name System (DNS). DNS is a large distributed database system. The basic function it performs is the translation of network resource names (from each host name on the earliest simple network to a later domain name, email address, etc.) to an IP address. The records in the DNS database system are called Resource Records (RR), have the same LabeK tag, Class, and Type, but a group of resource records with different Data is called resource record. Set (RRSet).

Autonomy and openness are the main principles of DNS design. Security issues were not considered at the beginning of the design of the DNS. For example, the attacker changes the IP address of a legitimate website to the IP address of a fake or malicious website in the DNS. If an ordinary user intends to access the website but does not have the IP address of the website, the DNS query should be initiated first. User's network traffic will be directed to a malicious The website, and it is very likely to disclose the confidential information of the user. In order to solve DNS-related security problems, the DNS Security Extension (DNS SEC) proposes a series of measures. The main idea is to sign the information in the DNS by public key signature technology and perform data source authentication on the DNS information. And integrity check. By obtaining the public key of the verification signature, the domain name resolver can judge the authenticity and integrity of the obtained resource record by verifying the signature.

In order to better adapt to the development of the Internet, the International Network Standards Organization IETF proposed a new IP version of IPv6. The IPv6 protocol provides a huge address space, which has become the biggest driving force for promoting IPv6. Many applications on the Internet are inseparable from the support of DNS. DNS in IPv6 networks is very important. Some new features of IPv6 and DNS support are inseparable. IPv6 supports address autoconfiguration, which is a plug-and-play mechanism that allows IPv6 network interfaces to obtain link-local addresses, site-local addresses, and global addresses without any manual intervention, and can prevent addresses from appearing. Duplicate conflicts. IPv6 supports stateless address autoconfiguration and stateful address autoconfiguration. DHCP (Dynamic Host Configuration Protocol) is a stateful autoconfiguration mechanism. The stateless autoconfiguration of IPV6 is described in RFC2462. For a node that performs stateless autoconfiguration on an IPv6 address, first determine its own link-local address; then verify the uniqueness of the link-local address on the link; and finally determine the IPv6 address to be configured. According to the definition in IPV6, stateful autoconfiguration and stateless autoconfiguration can coexist and operate together. Cryptographically Generated Addresses (CGA) is a mechanism for IPv6 address stateless auto-configuration to generate interface identifiers. It is mainly used to prevent IP address theft and spoofing, and enhances the security of IPv6 addresses. The basic idea of CGA is to obtain the interface identifier of the IPv6 address by calculating the hash value of the public key. The corresponding private key can digitally sign the message sent from this address. In order to verify the association between the IP address and the public key, the verifier needs to know the value of the IP address itself, the public key and the auxiliary parameters. The verifier can continue to verify the message signed by the public key owner. Because the CGA mechanism itself is not authenticated by a public trusted third party, an attacker can generate a new CGA with any subnet prefix and his own public key. However, an attacker cannot use another person's CGA to send a signed message and pass verification, unless someone else's can be obtained. Private key.

For servers in the network, users can access it through a fixed domain name without having to worry about whether its IP address changes or not, and it does not have to remember its lengthy 128-bit IPv6 address. This is to establish a correspondence between the domain name and the IP address. When the user communicates with the server, the corresponding IPv6 address can be obtained by the domain name.

When the IP address changes, it is necessary to modify the correspondence between the domain name and the IP address in a timely and automatic manner. This is the DNS dynamic update. Specifically, after the IP address is changed due to changes in the network topology, the DNS client can automatically send a request for updating the IP address to the DNS server, and the DNS server responds to the resource in the DNS database according to the request for updating the IP address. If the record is updated, the user can still reach the client through the domain name, that is, the domain name can be queried to obtain the new IP address of the node.

In the process of implementing the present invention, the inventors have found that the prior art has the following problems: The DNS server responds to all requests for updating the IP address, and updates the resource records in the DNS database according to the request, which may make the attacker very It is easy to tamper with legitimate DNS record entries, which causes the DNS dynamic update to be insecure.

Summary of the invention

Embodiments of the present invention provide a method, an apparatus, and a system for dynamically updating a DNS domain name system. It can support stateless automatic configuration of addresses, automatically generate IP addresses based on information such as the domain name of the communicating entity, and associate the corresponding domain name, public key and IP address to achieve more secure DNS dynamic update in IPv6 environment. .

An embodiment of the method for dynamically updating the domain name system includes the following steps:

The domain name system client generates an IP address according to a specific rule;

The domain name system client generates a domain name system dynamic update request message according to the IP address, and sends the domain name system dynamic update request message to the domain name system server to carry the IP address; the domain name system server receives the domain name system dynamic update request After the message, generating a second IP address according to the same rule as the domain name system client, if the IP address is equal to the second IP Address, complete address insurance card;

The domain name system server updates the domain name system resource record according to the domain name system dynamic update request message.

The domain name system client disclosed in the embodiment of the present invention includes:

An address generating unit, configured to dynamically generate an IP address according to a cryptographic method according to the information of the domain name system client;

And a request message generating unit, configured to generate a domain name system dynamic update request message according to the IP address.

The domain name system disclosed in the embodiment of the present invention includes:

a domain name system client, configured to generate an IP address according to a specific rule; generate a domain name system dynamic update request message according to the IP address, and send the domain name system dynamic update request message to the domain name system server, and carry the IP address;

a domain name system server, configured to receive a domain name system dynamic update request message sent by the domain name system client, perform address verification on the domain name system dynamic update request message, and update the domain name system resource record according to the domain name system dynamic update request message.

The embodiment of the invention also discloses a domain name system server, including:

a storage unit, configured to store a domain name system resource record;

a receiving unit, configured to receive a domain name system dynamic update request message sent by a domain name system client, and a parsing unit, configured to parse the domain name system dynamic update request message, and obtain information and an IP address of the domain name system client;

An address generating unit, configured to generate a second IP address according to the same rule as the domain name system client according to the information of the domain name system client obtained by the parsing unit;

An address verification unit, configured to perform address verification on the domain name system client by determining whether the IP address and the second IP address are the same;

The domain name system resource record update unit is configured to update the domain name system resource record stored in the storage unit according to the domain name system dynamic update request message. The embodiment of the invention supports the stateless configuration function of the IP address, and enhances the DNS by using the generated IP address and the corresponding public key to protect the dynamic update of the domain name system by using the information such as the public key, the domain name and the IP address of the domain name system client. Dynamic update security.

DRAWINGS

1 is a system structural diagram of a dynamic update of a domain name system according to an embodiment of the present invention;

2 is a flowchart of a method for dynamically updating a domain name system according to an embodiment of the present invention;

3 is a flowchart of dynamically generating an IP address by a domain name system client according to an embodiment of the present invention; FIG. 4 is a schematic structural diagram of a domain name system client according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a domain name system server according to an embodiment of the present invention.

detailed description

The invention is further illustrated by the following figures and specific examples, but should not be construed as limiting the invention.

Embodiment 1 of the present invention discloses a method for dynamically updating a domain name system. In the DNS system shown in Figure 1, when the network topology changes, the DNS client will dynamically generate a new IP address based on some of its own information, in order to ensure that the domain name of the DNS client can be found on the DNS server. The IP address of the DNS client, the DNS client initiates a DNS update request message to the DNS server, and after receiving the update request message, the DNS server is authenticated, and the domain name corresponding to the DNS client is updated in the resource record RR of the DNS server. The IP address is the newly generated IP address.

2 is a detailed flowchart of a method for dynamically updating a domain name system according to an embodiment of the present invention. Updates to the original DNS resource records on the DNS server should also apply to DNS registration on the DNS server to create a new DNS resource record.

Step 201: The DNS client dynamically generates a new IP address according to the cryptographic method according to its own information.

Specifically, the DNS client is based on its own domain name (Domain Name) and subnet prefix (Subnet). Prefix), Public Key and Collision Count dynamically generate IP addresses in accordance with cryptographic methods. FIG. 3 is a flowchart of dynamically generating an IP address by a DNS client according to an embodiment of the present invention.

Step 301: Before calculating the IP address, first clear the conflict count;

Step 302: Generate an interface identifier according to a cryptographic method. The specific calculation formula may be: Interface ID=First( N, PRF(Domain Name | Expression ) ), where Expression (expression) is information related to the DNS client. Combined, this information includes subnet prefix, public key, conflict count, etc. In addition, Expression can also be empty. PRF (Expression) represents a function for pseudo-random processing of Expression, which may be a function such as SHA-1, SHA-256, CBC-DES, CBC-AES, or a method for generating a cryptographically generated address CGA proposed by RFC3972.

Step 303: The connection subnet prefix and the interface identifier form an IP address. In this embodiment, it may specifically be IP Address = Subnet Prefix | Interface ID, "|" means that the front and the back are directly connected.

Step 304: After the IP address is generated by the DNS client, perform the IP address repetitive detection. If an address conflict occurs, go to step 305. If no address conflict occurs, go to step 306.

Step 305: After adding the conflict count to 1, perform step 302 again to calculate the IP address.

Step 306: The DNS client prepares to send an update request message to the DNS server.

In the above process, if an IP address of several consecutive calculations has an address conflict, resulting in a collision count greater than 3, and the DNS client uses the selected domain name for registration for the first time, modify the registered public key used or domain name.

Step 202: After generating the IP address, the DNS client generates a DNS dynamic update request message and signs it.

After the DNS client generates an IP address according to the cryptographic method, it generates a public key resource record (KEY RR), and then generates a DNS dynamic update request message. The message format is as follows: Header

Zone

Prerequisite ( Prerequisite )

Update (Update)

Additional Data ~ In this message, zone indicates the area to be updated; Prerequisite indicates the prerequisites for dynamic update to be met, either RR must exist/not exist or RRSet must exist/not exist; Update indicates that it needs to be updated RR or RRSet; Additional Data includes records related to the update, or records related to the new record of this dynamic update operation.

After generating the above DNS dynamic update request message, the DNS client signs the entire DNS update request message with its corresponding private key to generate a signature resource record (SIG RR ) and attach it to the end of the additional data segment. If the DNS client is the first to use the DNS domain name for update registration, the generated public key resource record needs to be added to the additional data segment to notify the DNS server of the public key.

Step 203: The DNS client sends the signed DNS dynamic update request message to the DNS server, and carries the generated IP address. The IP address and the domain name of the DNS client together form a resource record, which is added to the Update field of the DNS dynamic update request message.

Step 204: The DNS server receives the signed DNS dynamic update request message and performs parsing. The purpose of the analysis is to obtain the domain name, subnet mask, and other information and IP address of the DNS client.

Step 205: The DNS server determines, according to the parsing result, whether the DNS client has an update request authority. In this embodiment, the DNS server determines whether the IP address carried in the DNS dynamic update request message is generated according to a cryptographic method. If yes, Then, the DNS client has the update request authority, and step 206 is performed. If no, the DNS client does not have the update request permission, and the DNS server rejects the update request.

Step 206: The DNS server uses the same information according to the same rules as the DNS client. Generate an IP address.

Specifically, the DNS server dynamically generates an IP address according to the cryptographic method based on the DNS client's domain name, subnet prefix, public key, and collision count.

Step 207: The DNS server determines whether the IP address generated in step 206 is the same as the IP address carried in the DNS dynamic update request sent by the DNS client. If they are the same, step 208 is performed. If not, the DNS server rejects the update request. .

Step 208: The DNS server verifies the signature resource record in the DNS dynamic update request message by using a public key. If the verification is passed, go to step 209. Otherwise, the DNS server rejects the update request.

Step 209: The DNS server completes the update requested by the DNS client, that is, updates the DNS resource record, and sends an update response message to the DNS client.

The embodiment of the invention also discloses a system for dynamically updating a domain name system. As shown in FIG. 1, the system includes a DNS client and a DNS server. The DNS client is configured to dynamically generate an IP address according to a specific rule when the network topology changes, or perform DNS registration on the DNS server; generate a DNS dynamic update request message according to the IP address, and send the DNS dynamic update request message to the DNS server. Sending the DNS dynamic update request message, carrying the IP address. The DNS client is further configured to use the private key to sign the DNS dynamic update request message, generate a signature resource record, and add the generated signature resource record to the DNS dynamic update request message. The DNS client may be further configured to generate a public key resource record, and when the DNS dynamic update request message is sent to the DNS server for the first time, carry the public key resource. The DNS server is configured to receive a DNS dynamic update request message sent by the DNS client, perform address verification on the DNS dynamic update request message, and update a DNS resource record according to the DNS dynamic update request message. The DNS server is further configured to perform rights verification on the DNS client according to the DNS dynamic update request message. The DNS server may be further configured to verify a signature resource record in the DNS dynamic update request message according to the public key of the DNS client. The DNS server may be further configured to: after updating the DNS resource record, to the DNS guest The client sends an update response message.

The embodiment of the present invention further discloses a domain name system client. As shown in FIG. 4, it is a schematic structural diagram of a DNS client according to an embodiment of the present invention. The DNS client includes an address generating unit, a request message generating unit, a signing unit, a resource record generating unit, and a sending unit. The address generation unit is configured to dynamically generate an IP address according to the information of the DNS client and the cryptographic method when the network topology changes, or when the DNS is registered on the DNS server. The specific algorithm is described in the method section. And a request message generating unit, configured to generate a DNS dynamic update request message according to the IP address, where the format of the update request message is a message format in the foregoing method, and a new IP address is added in the Update field. a signature unit, configured to sign the DNS dynamic update request message according to a private key of the DNS client itself, and generate a signature resource record, where the signature resource record is added in an additional data field in the DNS dynamic update request message, Sign the DNS client for signature verification on the DNS server. The resource record generating unit is configured to generate a public key resource record of the DNS client. If a certain DNS client uses a domain name for registration for the first time, the public key resource record is added to the additional data field in the DNS dynamic update request message. After receiving the public key resource record, the DNS server uses the public key in the public key resource record to perform signature verification on the DNS dynamic update request message sent by the same domain name. And a sending unit, configured to send the signed DNS dynamic update request message to the DNS server.

The embodiment of the present invention further discloses a domain name system server. As shown in FIG. 5, it is a schematic structural diagram of a domain name system server according to an embodiment of the present invention.

The domain name system server includes a storage unit for storing a domain name system resource record. The receiving unit is configured to receive a DNS dynamic update request message sent by the DNS client. The parsing unit is configured to parse the DNS dynamic update request message, and obtain information and an IP address of the DNS client, where the information of the DNS client includes a domain name, a subnet prefix, and the like. An address generating unit, configured to generate a second IP address according to the same rule as the DNS client according to the information of the DNS client obtained by the parsing unit, where the second IP address may be generated by using a cryptographic method according to the rules in the foregoing method flow. address. An address verification unit, configured to determine whether the IP address and the second IP address are related Similarly, the DNS client performs address verification. If the same, the address verification is performed. If not, the DNS server rejects the update request of the DNS client. a domain name system resource record update unit, configured to update a domain name system resource record stored in the storage unit according to the DNS dynamic update request message, and when performing a DNS dynamic update, first searching for a storage unit, if there is a domain name corresponding to the DNS client The resource record is modified, and if there is no DNS resource record corresponding to the domain name of the DNS client, a new DNS resource record is created.

The DNS server further includes: a signature verification unit, configured to verify, according to the public key of the DNS client, a signature resource record in the DNS dynamic update request message, if the public key matches a private key in the signature resource record, the signature After the verification is passed, the signature verification unit sends the DNS dynamic update request message that the signature verification passes to the domain name system resource record update unit.

The DNS server further includes: a rights verification unit, configured to determine, according to information of the DNS client obtained by the parsing unit, whether the DNS client has permission to request dynamic DNS update, and if the DNS client has permission to request dynamic DNS update, Sending information of the DNS client to the address generating unit. The sending unit, when the domain name system resource record updating unit updates the domain name system resource record, is configured to send an update response message to the DNS client, to notify that the update has been completed.

The embodiment of the invention supports the stateless configuration function of the IP address, and the DNS dynamic update is enhanced by using the generated IP address and the corresponding public key to protect the dynamic update of the DNS by associating the public key, the domain name and the IP address of the DNS client. Security.

In conclusion, the above is only a preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and scope of the invention are intended to be included within the scope of the invention.

Claims

Claim

A method for dynamically updating a domain name system, comprising the steps of:

The domain name system client generates a domain name system dynamic update request message according to the IP address, and sends the domain name system dynamic update request message to the domain name system server, and carries the IP address;

After receiving the domain name system dynamic update request message, the domain name system server generates a second IP address according to the same rule as the domain name system client, and if the IP address is equal to the second IP address, completes the address insurance certificate;

The domain name system server updates the domain name system resource record based on the domain name system dynamic update request message.

The method for dynamically updating a domain name system according to claim 1, wherein the domain name system client generates an IP address according to a specific rule, specifically: the domain name system client according to its own domain name, subnet prefix, public The key and conflict counts are generated according to a cryptographic method;

The generating, by the domain name system server, the second IP address according to the same rule as the domain name system client means: the domain name system server according to the domain name system client domain name, subnet prefix, public key, and conflict count according to the cryptographic method Generating the second IP address.

The method for dynamically updating a domain name system according to claim 2, wherein the conflict count is cleared before generating the IP address or the second IP address.

The method for dynamically updating a domain name system according to claim 3, wherein after the domain name system client generates the IP address, and before the domain name system client generates a domain name system dynamic update request message, The method further includes the step of performing address repeat detection. If an address conflict occurs, the conflict count is incremented by one, and the domain name system client regenerates the IP address;

When the conflict count exceeds a certain threshold, modify the domain name used by the domain name system client or register the public key, clear the conflict count, and the domain name system client regenerates the IP address.

The method for dynamically updating a domain name system according to claim 2, wherein after the domain name system client generates a domain name system dynamic update request message, the domain name system server is sent to the domain name system server. Before the domain name system dynamic update request message, the method further includes the step of the domain name system client signing the domain name system dynamic update request message with its own private key to generate a signature resource record.

The method for dynamically updating a domain name system according to claim 1 or 5, wherein before the domain name system server updates the domain name system resource record, the method further comprises: the domain name system server pairing the domain name system client Step of performing rights verification: If the domain name system server determines that the IP address requested by the domain name system client is an IP address generated according to a cryptographic method, the domain name system client has an update request authority.

The method for dynamically updating a domain name system according to claim 6, wherein the step of verifying the domain name system resource record after completing the address verification further comprises the step of signature verification: the domain name system server according to the domain name system client Ending the public key to verify the signature resource record in the domain name system dynamic update request message;

After the domain name system server updates the domain name system resource record, the domain name system server further includes the step of sending an update response message to the domain name system client.

8. A domain name system client, characterized in that:

An address generating unit, configured to dynamically generate an IP address according to a cryptographic method according to information of the domain name system client;

The domain name system client according to claim 8, further comprising: a signing unit, configured to sign the domain name system dynamic update request message according to a private key of the domain name system client itself, and generate a signature Resource record.

The domain name system client according to claim 9, wherein the domain name system client further comprises:

a resource record generating unit, configured to generate a public key resource record of the domain name system client, where the public key resource record is used for signature verification of the domain name system client;

And a sending unit, configured to send the signed domain name system dynamic update request message.

11. A domain name system client according to any one of claims 8 to 10, characterized in that The information of the domain name system client includes the domain name system client's own domain name, subnet prefix, public key, and conflict count.

12. A domain name system, characterized by comprising:

a domain name system server, configured to receive a domain name system dynamic update request message sent by the domain name system client, perform address verification on the domain name system dynamic update request message, and update a domain name system resource record according to the domain name system dynamic update request message.

13. The domain name system according to claim 12, characterized in that

The domain name system server is further configured to perform rights verification on the domain name system client according to the domain name system dynamic update request message.

14. The domain name system of claim 12, wherein

The domain name system client is further configured to use the private key to sign the domain name system dynamic update request message; and add the generated signature resource record to the domain name system dynamic update request message;

The domain name system server is further configured to verify the signature resource record in the domain name system dynamic update request message according to the public key of the domain name system client.

The domain name system according to any one of claims 12 to 14, wherein the domain name system client is further configured to generate a public key resource record, and send the domain name to the domain name system server for the first time. When the system dynamically updates the request message, the public key resource is carried;

The domain name system server is further configured to send an update response message to the domain name system client after updating the domain name system resource record.

16. A domain name system server, comprising:

a storage unit, configured to store a domain name system resource record;

a receiving unit, configured to receive a domain name system dynamic update request message sent by a domain name system client; a parsing unit, configured to parse the domain name system dynamic update request message, and obtain information and an IP address of the domain name system client;

The domain name system resource record update unit is configured to update the domain name system resource record stored in the storage unit according to the domain name system dynamic update request message.

The domain name system server according to claim 16, further comprising: a signature verification unit, configured to verify the signature resource record in the domain name system dynamic update request message according to the public key of the domain name system client.

The domain name system server according to claim 16 or 17, further comprising: a rights verification unit, configured to determine, according to the information of the domain name system client obtained by the parsing unit, whether the domain name system client requests the domain name system The dynamically updated permission, if the domain name system client has the right to request the domain name system to dynamically update, the information of the domain name system client is sent to the address generating unit;

And a sending unit, configured to send an update response message to the domain name system client, to notify that the update has been completed.