JP2005210513A - View access control method classified by domain name, dns server system device, view access control program classified by domain name, and storage medium storing view access control program classified by domain name - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To realize a view access control classified by domain names which can establish an access control policy for each domain name. <P>SOLUTION: The device comprises a DNS (Domain Name System) database which manages resources records; a DNS query tranceiver processing means for transceiving of DNS query request and DNS query answer between DNS client devices through a network; and a database search processing means to perform search processing for the DNS database. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a view access control method by domain name, a DNS server system apparatus, a view access control program by domain name, and a view access control program by domain name, and in particular, a DNS (Domain Name System) server system. The domain name view access control method, DNS server system apparatus, domain name view access control program, and domain name view access control program.

  Conventionally, an access control method using a view (View) for each zone is known in a DNS server system (see, for example, Non-Patent Document 1).

  Normally, the DNS server system searches and responds to the resource record group registered so as to be uniquely determined for the domain name requested by the DNS client system, but when the view is set. Can switch the contents of the resource record that responds to the DNS client system according to the IP address of the DNS client system by switching the zone data for searching the resource record for the domain name according to the IP address of the DNS client system become.

  A view can be set for each zone, and in the DNS server system, zone data for switching to a view unit is registered.

  Further, which zone data (resource data) of a plurality of views is to be responded is determined by comparing the IP address and IP network address described in the access control list for each view with the IP address of the DNS client. If there is a match, the resource record included in the zone data of the corresponding view is returned.

  Here, the zone data is data of a set of a domain name and a corresponding resource record.

By the access control by the view, the logical address service activation method of ENUM (RFC2916) is realized.
Paul Albitz, Cricket Liu, Mitsumasa Kodate, “DNS & BIND 4th Edition”, p. 323-p. 326, Oily Japan

  However, in the conventional access control method based on the view for each zone, the contents of the resource record that responds only for each zone cannot be switched. Therefore, domain names included in the same zone must use the same access control list. It will be necessary.

  For this reason, when the DNS client system to be subjected to access control differs for each domain name, it is necessary to divide the zone or set a view for each access control list to be set for each domain name.

  However, if each telephone number (E.164 number) corresponds to a domain name as in ENUM, the access control policy of the individual who owns the individual telephone number becomes the access control policy for the domain name. Since the access control list may be different for each domain name, setting a view for each access control list required for each domain name is not practical because the number of view planes for each zone increases.

  As described above, in the conventional technique, when the access control policy is different for each domain name, it is difficult to set a view, and it is difficult to realize fine access control for each domain name.

  The present invention has been made in view of the above points. A domain name view access control method, a DNS server system apparatus, a domain name view access control program, and a domain name view that can set an access control policy for each domain name. It is an object to provide a storage medium storing an access control program.

  FIG. 1 is a flowchart for explaining the principle of the present invention.

The present invention provides a domain name view access control method in which an access control policy can be set for each domain name.
Each domain name has a plurality of views, and an access control list and resource records are held on the database for each view.

The present invention also provides a database with
The zone data and access control list are divided and stored in a zone data table, a domain name information table, an access control table, and a resource record storage table.
In the zone data table, a domain name and a pointer to the domain name information table corresponding to the domain name are stored.
In the information table by domain name, a pointer to an access control table corresponding to the domain name and a pointer to a resource record storage table corresponding to a plurality of views set for each domain name are stored.
In the access control table, a view ID for identifying a view and a plurality of IP addresses and IP network addresses for access control corresponding to each view set for each domain name are stored as an access control list.
The resource record storage table stores a resource record corresponding to each view set for each domain name.

Further, the present invention provides a DNS (Domain Name System) server system device,
Receiving a DNS query request from a DNS client device (step 1);
Based on the DNS query request, the zone data table on the database is searched, and a pointer to the corresponding domain name information table is obtained (step 2).
Based on the pointer to the domain name information table, the domain name information table is accessed to obtain a pointer to the access control table (step 3).
Based on the pointer to the access control table, the access control table is accessed, the access control list of each view of the access control table is compared with the IP address of the DNS client device, and a matching view ID is determined (step 4). ),
Based on the pointer to the domain name information table, the domain name information table is accessed to obtain a pointer to the resource record storage table corresponding to the determined view ID (step 5),
Based on the pointer to the resource record storage table, the resource record storage table is accessed to obtain a resource record group (step 6).
A DNS query response to the DNS client device is transmitted (step 7).

In the present invention, a view is identified by a view ID by a numerical value or a character string,
The view ID has order based on a certain rule.

In addition, the present invention, when comparing the access control list of each view of the access control table and the IP address of the DNS client device,
Starting with a comparison with the access control list corresponding to the largest view ID, the comparison is sequentially made with the access control list corresponding to the small view ID.

  In addition, the present invention does not set an access control list corresponding to the view with the smallest view ID, and matches all IP addresses, thereby corresponding to the IP address of the DNS client device and the largest view ID. When comparing with the access control list to be used, it must match somewhere in the multiple views.

  FIG. 2 is a principle configuration diagram of the present invention.

The present invention is a DNS server system apparatus 1 for performing view access control by domain name, in which an access control policy can be set for each domain name,
DNS database 13 for managing resource records;
DNS query transmission / reception processing means 11 for transmitting / receiving a DNS query request and a DNS query response to / from the DNS client device 2 via the network 3;
DNS database search processing means 12 for performing a search process on the DNS database 13.

The DNS database 13 of the present invention is
A zone data table 131, a domain name information table 132, an access control table 133, and a resource record storage table 134, which divide and store zone data and access control lists;
The zone data table 131 stores a domain name and a pointer to a domain name information table corresponding to the domain name,
The domain name-specific information table 132 stores a pointer to an access control table corresponding to a domain name and a pointer to a resource record storage table corresponding to a plurality of views set for each domain name.
The access control table 133 stores a view ID for identifying a view and a plurality of IP addresses and IP network addresses for access control corresponding to each view set for each domain name as an access control list.
The resource record storage table 134 stores resource records corresponding to each view set for each domain name.

The DNS database search processing means 12 of the present invention
A first means for searching the zone data table 131 on the database 13 based on the DNS query request and obtaining a pointer to the corresponding domain name-specific information table 132;
A second means for accessing the domain name information table 132 based on the pointer to the domain name information table 132 and obtaining a pointer to the access control table 133;
Based on the pointer to the access control table 133, the access control table 133 is accessed, the access control list of each view of the access control table 133 is compared with the IP address of the DNS client device 2, and the matching view ID is determined. A third means for determining;
A fourth means for accessing the domain name information table 132 based on the pointer to the domain name information table and obtaining a pointer to the resource record storage table 134 corresponding to the determined view ID;
And a fifth means for accessing the resource record storage table 134 based on a pointer to the resource record storage table 134 and acquiring a resource record group.

The third means of the DNS database search processing means 12 of the present invention is:
When comparing the access control list for each view in the access control table 133 with the IP address of the DNS client device, start with a comparison with the access control list corresponding to the largest view ID, and sequentially correspond to the smaller view IDs. Comparing means for comparing with the access control list to be included.

Also, the above comparison means is
The access control list corresponding to the view with the smallest view ID is not set, and the IP address of the DNS client device, the access control list corresponding to the largest view ID, When the comparison is performed, means for matching is always included somewhere in the plurality of views.

The present invention is a domain name view access control program in which an access control policy can be set for each domain name,
On the database,
A zone data table storing a domain name and a pointer to a domain name information table corresponding to the domain name;
A domain name information table storing a pointer to an access control table corresponding to a domain name and pointers to resource record storage tables corresponding to a plurality of views set for each domain name;
A view ID for identifying a view, an access control table storing a plurality of IP addresses and IP network addresses for access control corresponding to each view set for each domain name, as an access control list;
Assuming that the source record storage table storing the resource records corresponding to each view set for each domain name is stored,
On the computer,
A request receiving step of receiving a DNS query request from a DNS client device;
A first search step of searching a zone data table of a database and obtaining a pointer to a corresponding domain name information table;
A second search step of accessing the domain name information table based on the pointer to the domain name information table and obtaining a pointer to the access control table;
The access control table is accessed based on the pointer to the access control table, the access control list of each view of the access control table is compared with the IP address of the DNS client device, and a matching view ID is determined. And the search step
A fourth search step of accessing the domain name information table based on the pointer to the domain name information table and obtaining a pointer to the resource record storage table corresponding to the view ID determined in the third search step When,
A fifth search step of accessing the resource record storage table and obtaining a resource record group based on the pointer to the resource record storage table;
A response transmission step of transmitting a DNS query response to the DNS client.

In the third search step of the present invention,
When comparing the access control list of each view of the access control table with the IP address of the DNS client device, start with a comparison with the access control list corresponding to the largest view ID, and sequentially correspond to the smaller view IDs. A step of performing comparison with the access control list is executed.

The present invention is a storage medium storing a view access control program for each domain name in which an access control policy can be set for each domain name,
On the database,
A zone data table storing a domain name and a pointer to a domain name information table corresponding to the domain name;
A domain name information table storing a pointer to an access control table corresponding to a domain name and pointers to resource record storage tables corresponding to a plurality of views set for each domain name;
A view ID for identifying a view, an access control table storing a plurality of IP addresses and IP network addresses for access control corresponding to each view set for each domain name, as an access control list;
Assuming that the source record storage table storing the resource records corresponding to each view set for each domain name is stored,
On the computer,
A request receiving step of receiving a DNS query request from a DNS client device;
A first search step of searching a zone data table of a database and obtaining a pointer to a corresponding domain name information table;
A second search step of accessing the domain name information table based on the pointer to the domain name information table and obtaining a pointer to the access control table;
The access control table is accessed based on the pointer to the access control table, the access control list of each view of the access control table is compared with the IP address of the DNS client device, and a matching view ID is determined. And the search step
A fourth search step of accessing the domain name information table based on the pointer to the domain name information table and obtaining a pointer to the resource record storage table corresponding to the view ID determined in the third search step When,
A fifth search step of accessing the resource record storage table and obtaining a resource record group based on the pointer to the resource record storage table;
A response transmission step of transmitting a DNS query response to the DNS client is stored.

In the third search step of the present invention,
When comparing the access control list of each view of the access control table with the IP address of the DNS client device, start with a comparison with the access control list corresponding to the largest view ID and sequentially correspond to the smaller view IDs. A step of performing comparison with the access control list is executed.

  As described above, in the present invention, the zone data and the access control list are divided into the zone data table, the domain name-specific information table, the access control table, and the resource record storage table. It is possible to hold an access control list and a resource record for each view. Therefore, an access control policy can be set for each domain name.

  Also, in the present invention, the view ID is used for view identification, starting with a comparison with the access control list corresponding to the largest view ID, and sequentially comparing with the access control list corresponding to the small view ID to obtain the smallest The access control list corresponding to the view with the view ID is not set, and the IP address of the DNS client device is compared with the access control list corresponding to the view ID by matching all IP addresses. It is always possible to match some view.

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

  FIG. 3 shows a system configuration in an embodiment of the present invention, and shows a DNS client server system.

  The server system shown in FIG. 1 includes a DNS server device 1, a DNS client device 2, and a network 3 that connects these devices.

  The DNS server system device 1 includes a DNS query transmission / reception processing unit 11, a DNS database search processing unit 12, and a DNS database 13.

  The DNS query transmission / reception processing unit 11 receives a DNS query request and transmits a DNS query response with the DNS client device 2 via the network 3.

  The DNS database search processing unit 12 performs a search process on a plurality of tables in the DNS database 13 that manages zone data.

  The DNS database 13 includes a zone data table 131, a domain name information table 132, an access control table 133, and a resource record storage table 134.

  The zone data table 131 stores a domain name and a pointer to the domain name information table 132 corresponding to the domain name. The pointer may be an address in a memory space or a table name as an object on the database.

  The domain name-specific information table 132 stores a pointer to the access control table 133 corresponding to the domain name and a pointer to the resource record storage table 134 corresponding to a plurality of views set for each domain name. In the domain name information table 132, one table is created for each domain name.

  The access control table 133 stores a view ID for identifying a view and an access control list corresponding to each view set for each domain name.

  In the access control table 133, one table is created for each domain name.

  The view ID may be a numerical value or a character string, but the view ID is uniquely determined by the view ID.

  The access control list holds a plurality of IP addresses and IP network addresses as a list. When an IP address matches an IP address included in the access control list or an IP network address, the IP address refers to data corresponding to the matched view.

  Further, the domain name information table 132 and the access control method 133 may be integrated.

  The resource record storage table 134 stores resource records corresponding to each view set for each domain name. In the resource record storage table 134, one table is created for each domain name. There are multiple resource records corresponding to the domain name.

  The DNS client device 2 is a device equipped with a DNS client function, and is, for example, a DNS cache server, a DNS full service resolver, or a user terminal.

  The network 3 is a communication network to which the DNS server system device 1 and the DNS client device 2 are connected, for example, the Internet.

  Next, the operation in the above configuration will be described.

  FIG. 4 is a sequence diagram of the operation of the entire system in one embodiment of the present invention.

  This will be described below with reference to FIGS.

  The DNS server system device 1 receives a DNS query request from the DNS client device 2 (step 101).

  Next, the DNS database search processing unit 12 searches the zone data table 131 of the DNS database 13 and acquires a pointer to the corresponding domain name information table 132 (step 102).

  Next, the DNS database search processing unit 12 accesses the domain name information table 132 corresponding to the pointer acquired in Step 102 and acquires a pointer to the access control table 133 (Step 103).

  Next, the DNS database search processing unit 12 accesses the access control table 133 corresponding to the pointer acquired in Step 103, the access control list of the largest view ID in the access control table 133 and the IP address of the DNS client device 2. Are compared to determine whether they match. If they match, the view ID is determined. If they do not match, a comparison is made with the access control list of the next largest view ID, and the comparison with the access control list is repeated until they match to determine the view ID (step 104).

  Next, the DNS database search processing unit 12 accesses the domain name information table 132 of the DNS database 13 and acquires a pointer to the resource record storage table 134 corresponding to the view ID determined in Step 104 (Step 105). ).

  Next, the DNS database search processing unit 12 accesses the resource record storage table 134 corresponding to the pointer acquired in Step 105, and acquires a resource record group (Step 106).

  Finally, the DNS query transmission / reception processing unit 11 transmits a DNS query response to the DNS client device 2 (step 107).

  The DNS server system device 1 constructs a program for realizing its function in addition to that realized by dedicated hardware, records it on a computer-readable storage medium, and records it on this recording medium. The read program may be read into a computer system and executed.

  Here, the computer system-readable storage medium refers to a storage medium such as a floppy (registered trademark) disk, a CD-ROM, or a hard disk device built in the computer system. Further, the computer system-readable recording medium is a medium that dynamically holds a program for a short time (transmission medium or transmission wave) as in the case of transmitting a program via the Internet, and a server in that case. Such as a volatile memory inside a computer system that holds a program for a certain period of time.

  The present invention is not limited to the above-described embodiments and examples, and various modifications and applications are possible within the scope of the claims.

  The present invention is applicable to a DNS server system.

It is a flowchart for demonstrating the principle of this invention. It is a principle block diagram of this invention. 1 is a system configuration diagram according to an embodiment of the present invention. It is a sequence diagram of the whole system in one embodiment of the present invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 DNS server system apparatus 2 DNS client apparatus 3 Network 11 DNS query transmission / reception processing means, DNS query transmission / reception processing part 12 DNS database search processing means, DNS database search processing part 13 DNS database 131 Zone data table 132 Domain name-specific information table 133 Access Control table 134 Resource record storage table

Claims (15)

In the view access control method by domain name in which an access control policy can be set for each domain name,
A view access control method for each domain name, comprising: a plurality of views for each domain name; and an access control list and a resource record for each view are stored on a database. In the database,
The zone data and access control list are divided and stored in a zone data table, a domain name information table, an access control table, and a resource record storage table.
The zone data table stores a domain name and a pointer to a domain name-specific information table corresponding to the domain name,
The domain name-specific information table stores a pointer to an access control table corresponding to a domain name and a pointer to a resource record storage table corresponding to a plurality of views set for each domain name,
In the access control table, a view ID for identifying a view, and a plurality of IP addresses and IP network addresses for access control corresponding to each view set for each domain name are stored as an access control list,
The resource record storage table stores a resource record corresponding to each view set for each domain name, and a view access control method for each domain name. In a DNS (Domain Name System) server system device,
Receiving a DNS query request from a DNS client device;
Based on the DNS query request, search the zone data table on the database, obtain a pointer to the corresponding domain name information table,
Based on the pointer to the domain name information table, access the domain name information table to obtain a pointer to the access control table,
Based on the pointer to the access control table, the access control table is accessed, the access control list of each view of the access control table is compared with the IP address of the DNS client device, and a matching view ID is determined. ,
Based on the pointer to the domain name information table, access the domain name information table to obtain a pointer to the resource record storage table corresponding to the determined view ID,
Based on the pointer to the resource record storage table, access the resource record storage table to obtain a resource record group,
The domain name view access control method according to claim 2, wherein a DNS query response to the DNS client device is transmitted. Identify the view by a numerical or character string view ID,
4. The view access control method for each domain name according to claim 1, wherein the view ID is given an order based on a certain rule. When comparing the access control list of each view of the access control table and the IP address of the DNS client device,
4. The view access control method by domain name according to claim 3, wherein comparison is made with an access control list corresponding to a small view ID, starting with a comparison with an access control list corresponding to the largest view ID.   The access control list corresponding to the view with the smallest view ID is not set, and the IP address of the DNS client device, the access control list corresponding to the largest view ID, The domain name view access control method according to claim 5, wherein when the comparison is made, a certain view of a plurality of views is always matched. A DNS server system device for performing view access control by domain name, in which an access control policy can be set for each domain name,
A DNS database for managing resource records;
DNS query transmission / reception processing means for transmitting / receiving a DNS query request and a DNS query response to / from a DNS client device via a network;
DNS database search processing means for performing search processing on the DNS database;
A DNS server system device comprising: The DNS database is
A zone data table, an information table by domain name, an access control table, and a resource record storage table, which divides and stores zone data and access control lists,
The zone data table stores a domain name and a pointer to a domain name-specific information table corresponding to the domain name,
The domain name-specific information table stores a pointer to an access control table corresponding to a domain name and a pointer to a resource record storage table corresponding to a plurality of views set for each domain name,
The access control table stores a view ID for identifying a view and a plurality of IP addresses and IP network addresses for access control corresponding to each view set for each domain name as an access control list,
8. The DNS server system apparatus according to claim 7, wherein the resource record storage table stores a resource record corresponding to each view set for each domain name. The DNS database search processing means includes:
First means for searching the zone data table on the database based on the DNS query request and obtaining a pointer to a corresponding domain name-specific information table;
A second means for accessing the domain name information table based on the pointer to the domain name information table and obtaining a pointer to the access control table;
Based on the pointer to the access control table, the access control table is accessed, the access control list of each view of the access control table is compared with the IP address of the DNS client device, and a matching view ID is determined. A third means;
A fourth means for accessing the domain name information table based on the pointer to the domain name information table and obtaining a pointer to the resource record storage table corresponding to the determined view ID;
A fifth means for obtaining a resource record group by accessing the resource record storage table based on a pointer to the resource record storage table;
The DNS server system apparatus according to claim 7, including: The third means of the DNS database search processing means is:
When comparing the access control list of each view of the access control table with the IP address of the DNS client device, it starts with a comparison with the access control list corresponding to the largest view ID, and sequentially decreases to a smaller view ID. 10. The DNS server system apparatus according to claim 9, further comprising comparison means for performing comparison with a corresponding access control list. The comparison means includes
The access control list corresponding to the view with the smallest view ID is not set, and the IP address of the DNS client device, the access control list corresponding to the largest view ID, 11. The view access control apparatus for each domain name according to claim 10, further comprising means for always matching somewhere in a plurality of views when the comparison is made. A domain name view access control program that can set an access control policy for each domain name.
On the database,
A zone data table storing a domain name and a pointer to a domain name information table corresponding to the domain name;
A domain name information table storing a pointer to an access control table corresponding to a domain name and pointers to resource record storage tables corresponding to a plurality of views set for each domain name;
A view ID for identifying a view, an access control table storing a plurality of IP addresses and IP network addresses for access control corresponding to each view set for each domain name, as an access control list;
Assuming that the source record storage table storing the resource records corresponding to each view set for each domain name is stored,
On the computer,
A request receiving step of receiving a DNS query request from a DNS client device;
A first search step of searching the zone data table of the database to obtain a pointer to a corresponding information table by domain name;
A second search step of accessing the domain name information table based on the pointer to the domain name information table and obtaining a pointer to the access control table;
Based on the pointer to the access control table, the access control table is accessed, the access control list of each view of the access control table is compared with the IP address of the DNS client device, and a matching view ID is determined. A third search step;
Based on the pointer to the domain name information table, the domain name information table is accessed to obtain a pointer to the resource record storage table corresponding to the view ID determined in the third search step. And the search step
A fifth search step of accessing the resource record storage table and obtaining a resource record group based on a pointer to the resource record storage table;
A response transmission step of transmitting a DNS query response to the DNS client is executed. In the third search step,
When comparing the access control list of each view of the access control table with the IP address of the DNS client device, it starts with a comparison with the access control list corresponding to the largest view ID, and sequentially decreases to a smaller view ID. 13. The domain-based view access control program according to claim 12, wherein a step of comparing with a corresponding access control list is executed. A storage medium storing a view access control program for each domain name in which an access control policy can be set for each domain name,
On the database,
A zone data table storing a domain name and a pointer to a domain name information table corresponding to the domain name;
A domain name information table storing pointers to access control tables corresponding to domain names, and pointers to resource record storage tables corresponding to a plurality of views set for each domain name;
A view ID for identifying a view, an access control table storing a plurality of IP addresses and IP network addresses for access control corresponding to each view set for each domain name, as an access control list;
Assuming that a source record storage table storing resource records corresponding to each view set for each domain name is stored,
On the computer,
A request receiving step of receiving a DNS query request from a DNS client device;
A first search step of searching the zone data table of the database to obtain a pointer to a corresponding information table by domain name;
A second search step of accessing the domain name information table based on the pointer to the domain name information table and obtaining a pointer to the access control table;
Based on the pointer to the access control table, the access control table is accessed, the access control list of each view of the access control table is compared with the IP address of the DNS client device, and a matching view ID is determined. A third search step;
Based on the pointer to the domain name information table, the domain name information table is accessed to obtain a pointer to the resource record storage table corresponding to the view ID determined in the third search step. And the search step
A fifth search step of accessing the resource record storage table and obtaining a resource record group based on a pointer to the resource record storage table;
A storage medium storing a domain-specific view access control program, wherein a program for executing a response transmission step of transmitting a DNS query response to the DNS client is stored. In the third search step,
When comparing the access control list of each view of the access control table with the IP address of the DNS client device, it starts with a comparison with the access control list corresponding to the largest view ID, and sequentially decreases to a smaller view ID. 15. A storage medium storing a domain-specific view access control program according to claim 14, wherein a step of performing comparison with a corresponding access control list is executed.

Images