JP3873975B2 - View access control method by domain name, DNS server system apparatus, view access control program by domain name, and storage medium storing view access control program by domain name - Google Patents

Description

  The present invention relates to a view access control method by domain name, a DNS server system apparatus, a view access control program by domain name, and a view access control program by domain name, and in particular, a DNS (Domain Name System) server system. The domain name view access control method, DNS server system apparatus, domain name view access control program, and domain name view access control program.

  Conventionally, an access control method using a view (View) for each zone is known in a DNS server system (see, for example, Non-Patent Document 1).

  Normally, the DNS server system searches and responds to the resource record group registered so as to be uniquely determined for the domain name requested by the DNS client system, but when the view is set. Can switch the contents of the resource record that responds to the DNS client system according to the IP address of the DNS client system by switching the zone data for searching the resource record for the domain name according to the IP address of the DNS client system become.

  A view can be set for each zone, and in the DNS server system, zone data for switching to a view unit is registered.

  Further, which zone data (resource data) of a plurality of views is to be responded is determined by comparing the IP address and IP network address described in the access control list for each view with the IP address of the DNS client. If there is a match, the resource record included in the zone data of the corresponding view is returned.

  Here, the zone data is data of a set of a domain name and a corresponding resource record.

By the access control by the view, the logical address service activation method of ENUM (RFC2916) is realized.
Paul Albitz, Cricket Liu, Mitsumasa Kodate, “DNS & BIND 4th Edition”, p. 323-p. 326, Oily Japan

  However, in the conventional access control method based on the view for each zone, the contents of the resource record that responds only for each zone cannot be switched. Therefore, domain names included in the same zone must use the same access control list. It will be necessary.

  For this reason, when the DNS client system to be subjected to access control differs for each domain name, it is necessary to divide the zone or set a view for each access control list to be set for each domain name.

  However, if each telephone number (E.164 number) corresponds to a domain name as in ENUM, the access control policy of the individual who owns the individual telephone number becomes the access control policy for the domain name. Since the access control list may be different for each domain name, setting a view for each access control list required for each domain name is not practical because the number of view planes for each zone increases.

  As described above, in the conventional technique, when the access control policy is different for each domain name, it is difficult to set a view, and it is difficult to realize fine access control for each domain name.

  The present invention has been made in view of the above points. A domain name view access control method, a DNS server system apparatus, a domain name view access control program, and a domain name view that can set an access control policy for each domain name. It is an object to provide a storage medium storing an access control program.

  FIG. 1 is a flowchart for explaining the principle of the present invention.

The present invention (claim 1) is settable access control policy for each domain name, for performing a domain-specific view access control, met domain name by the view access control method in a DNS (Domain Name System) server system unit And
A zone data table, a domain-specific information table, an access control table, and a resource record storage table are provided for dividing and storing zone data and access control lists. The zone data table includes a domain name and a domain name. A pointer to the corresponding domain name information table is stored. The domain name information table includes a pointer to the access control table corresponding to the domain name and resource records corresponding to a plurality of views set for each domain name. A pointer to a storage table is stored. The access control table includes a view ID for identifying a view, and a plurality of IP addresses and IP network addresses for access control corresponding to each view set for each domain name. The resource record storage table stores resource records corresponding to each view set for each domain name. Includes a DNS database storing de,
A request receiving step (step 1) for receiving a DNS query request from a DNS client;
A zone data search step (step 2) for searching a zone data table on the DNS database based on a DNS query request and obtaining a pointer to a corresponding domain name-specific information table;
A first pointer acquisition step (step 3) for accessing the domain name information table based on the pointer to the domain name information table and acquiring a pointer to the access control table;
Based on the pointer to the access control table, the access control table is accessed, the access control list of each view of the access control table is compared with the IP address of the DNS client device, and the access control list corresponding to the largest view ID A view ID determination step (step 4) for sequentially comparing with an access control list corresponding to a small view ID and determining a matching view ID.
A second pointer acquisition step of accessing the domain name information table based on the pointer to the domain name information table and acquiring a pointer to the resource record storage table corresponding to the determined view ID (step 5) When,
Based on a pointer to the resource record storage table, a resource record acquisition step (step 6) for accessing the resource record storage table and acquiring a resource record group;
A response step (step ') of sending a DNS query response to the DNS client device;
And
In the view ID determination step (step 4),
The access control list corresponding to the view with the smallest view ID is not set, and is matched with all IP addresses, so that the IP address of the DNS client device and the access control list corresponding to the largest view ID are When comparing, be sure to match somewhere in multiple views .

  FIG. 2 is a principle configuration diagram of the present invention.

The present invention (Claim 2) is a DNS server system apparatus 1 for performing view access control by domain name, in which an access control policy can be set for each domain name,
The zone data table 131, the domain-specific information table 132, the access control table 133, and the resource record storage table 134, which divide and store the zone data and the access control list, are stored in the zone data table 131. , A pointer to a domain name information table corresponding to the domain name is stored, and the domain name information table 132 includes a pointer to an access control table corresponding to the domain name and a plurality of information set for each domain name. A pointer to a resource record storage table corresponding to the view is stored, and the access control table 133 includes a view ID for identifying the view, a plurality of IP addresses for access control corresponding to each view set for each domain name, and The IP network address is stored as an access control list, and the resource record storage table 134 has a domain name. A DNS database 13 which stores the resource record corresponding to each view set for each emission name,
DNS query transmission / reception processing means 11 for transmitting / receiving a DNS query request and a DNS query response to / from a DNS client device via the network 3;
DNS database search processing means 12 for performing search processing on the DNS database 13,
Have
The DNS database search processing means 12
A first means for searching the zone data table 131 on the DNS database 13 based on the DNS query request and obtaining a pointer to the corresponding domain name information table 132;
A second means for accessing the domain name information table 132 based on the pointer to the domain name information table 132 and obtaining a pointer to the access control table;
Based on the pointer to the access control table 133, the access control table 133 is accessed, the access control list of each view of the access control table 133 and the IP address of the DNS client device are referenced, and the largest view ID is supported. Starting with a comparison with an access control list, sequentially comparing with an access control list corresponding to a small view ID, and determining a matching view ID;
A fourth means for accessing the domain name information table 132 based on the pointer to the domain name information table and obtaining a pointer to the resource record storage table 134 corresponding to the determined view ID;
A fifth means for accessing the resource record storage table 134 based on a pointer to the resource record storage table 143 and acquiring a resource record group;
Have
The third means is
The access control list corresponding to the view with the smallest view ID is not set, and the IP address of the DNS client device is set to match the access control list corresponding to the largest view ID by matching all IP addresses. When the comparison is performed, a means for matching is always included somewhere in the plurality of views .

The present invention (Claim 3) is a domain-specific view access control program that causes a computer to function as the DNS server system apparatus according to Claim 2.

The present invention (Claim 4) is a storage medium storing the program according to Claim 3.

  As described above, in the present invention, the zone data and the access control list are divided into the zone data table, the domain name-specific information table, the access control table, and the resource record storage table. It is possible to hold an access control list and a resource record for each view. Therefore, an access control policy can be set for each domain name.

  Also, in the present invention, the view ID is used for view identification, starting with a comparison with the access control list corresponding to the largest view ID, and sequentially comparing with the access control list corresponding to the small view ID to obtain the smallest The access control list corresponding to the view with the view ID is not set, and the IP address of the DNS client device is compared with the access control list corresponding to the view ID by matching all IP addresses. It is always possible to match some view.

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

  FIG. 3 shows a system configuration in an embodiment of the present invention, and shows a DNS client server system.

  The server system shown in FIG. 1 includes a DNS server device 1, a DNS client device 2, and a network 3 that connects these devices.

  The DNS server system device 1 includes a DNS query transmission / reception processing unit 11, a DNS database search processing unit 12, and a DNS database 13.

  The DNS query transmission / reception processing unit 11 receives a DNS query request and transmits a DNS query response with the DNS client device 2 via the network 3.

  The DNS database search processing unit 12 performs a search process on a plurality of tables in the DNS database 13 that manages zone data.

  The DNS database 13 includes a zone data table 131, a domain name information table 132, an access control table 133, and a resource record storage table 134.

  The zone data table 131 stores a domain name and a pointer to the domain name information table 132 corresponding to the domain name. The pointer may be an address in a memory space or a table name as an object on the database.

  The domain name-specific information table 132 stores a pointer to the access control table 133 corresponding to the domain name and a pointer to the resource record storage table 134 corresponding to a plurality of views set for each domain name. In the domain name information table 132, one table is created for each domain name.

  The access control table 133 stores a view ID for identifying a view and an access control list corresponding to each view set for each domain name.

  In the access control table 133, one table is created for each domain name.

  The view ID may be a numerical value or a character string, but the view ID is uniquely determined by the view ID.

  The access control list holds a plurality of IP addresses and IP network addresses as a list. When an IP address matches an IP address included in the access control list or an IP network address, the IP address refers to data corresponding to the matched view.

  Further, the domain name information table 132 and the access control method 133 may be integrated.

  The resource record storage table 134 stores resource records corresponding to each view set for each domain name. In the resource record storage table 134, one table is created for each domain name. There are multiple resource records corresponding to the domain name.

  The DNS client device 2 is a device equipped with a DNS client function, and is, for example, a DNS cache server, a DNS full service resolver, or a user terminal.

  The network 3 is a communication network to which the DNS server system device 1 and the DNS client device 2 are connected, for example, the Internet.

  Next, the operation in the above configuration will be described.

  FIG. 4 is a sequence diagram of the operation of the entire system in one embodiment of the present invention.

  This will be described below with reference to FIGS.

  The DNS server system device 1 receives a DNS query request from the DNS client device 2 (step 101).

  Next, the DNS database search processing unit 12 searches the zone data table 131 of the DNS database 13 and acquires a pointer to the corresponding domain name information table 132 (step 102).

  Next, the DNS database search processing unit 12 accesses the domain name information table 132 corresponding to the pointer acquired in Step 102 and acquires a pointer to the access control table 133 (Step 103).

  Next, the DNS database search processing unit 12 accesses the access control table 133 corresponding to the pointer acquired in step 103, the access control list of the largest view ID in the access control table 133, and the IP address of the DNS client device 2. Are compared to determine whether they match. If they match, the view ID is determined. If they do not match, a comparison is made with the access control list of the next largest view ID, and the comparison with the access control list is repeated until they match to determine the view ID (step 104).

  Next, the DNS database search processing unit 12 accesses the domain name information table 132 of the DNS database 13 and acquires a pointer to the resource record storage table 134 corresponding to the view ID determined in Step 104 (Step 105). ).

  Next, the DNS database search processing unit 12 accesses the resource record storage table 134 corresponding to the pointer acquired in Step 105, and acquires a resource record group (Step 106).

  Finally, the DNS query transmission / reception processing unit 11 transmits a DNS query response to the DNS client device 2 (step 107).

  The DNS server system device 1 constructs a program for realizing its function in addition to that realized by dedicated hardware, records it on a computer-readable storage medium, and records it on this recording medium. The read program may be read into a computer system and executed.

  Here, the computer system-readable storage medium refers to a storage medium such as a floppy (registered trademark) disk, a CD-ROM, or a hard disk device built in the computer system. Further, the computer system-readable recording medium is a medium that dynamically holds a program for a short time (transmission medium or transmission wave) as in the case of transmitting a program via the Internet, and a server in that case. Such as a volatile memory inside a computer system that holds a program for a certain period of time.

  The present invention is not limited to the above-described embodiments and examples, and various modifications and applications are possible within the scope of the claims.

  The present invention is applicable to a DNS server system.

It is a flowchart for demonstrating the principle of this invention. It is a principle block diagram of this invention. 1 is a system configuration diagram according to an embodiment of the present invention. It is a sequence diagram of the whole system in one embodiment of the present invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 DNS server system apparatus 2 DNS client apparatus 3 Network 11 DNS query transmission / reception processing means, DNS query transmission / reception processing part 12 DNS database search processing means, DNS database search processing part 13 DNS database 131 Zone data table 132 Domain name-specific information table 133 Access Control table 134 Resource record storage table

Claims (4)

A domain name view access control method in a DNS (Domain Name System) server system device for performing view access control by domain , in which an access control policy can be set for each domain name ,
A zone data table, a domain-specific information table, an access control table, and a resource record storage table are provided for dividing and storing zone data and access control lists. The zone data table includes a domain name and a domain name. A pointer to the corresponding domain name information table is stored. The domain name information table includes a pointer to the access control table corresponding to the domain name and resource records corresponding to a plurality of views set for each domain name. A pointer to a storage table is stored. The access control table includes a view ID for identifying a view, and a plurality of IP addresses and IP network addresses for access control corresponding to each view set for each domain name. The resource record storage table stores resource records corresponding to each view set for each domain name. Includes a DNS database storing de,
A request receiving step for receiving a DNS query request from a DNS client;
A zone data search step of searching the zone data table on the database based on the DNS query request and obtaining a pointer to a corresponding domain name-specific information table;
A first pointer acquisition step of accessing the domain name information table based on the pointer to the domain name information table and acquiring a pointer to the access control table;
Based on the pointer to the access control table, the access control table is accessed, the access control list of each view of the access control table is compared with the IP address of the DNS client device, and the largest view ID is supported. A view ID determination step for starting a comparison with an access control list, sequentially comparing with an access control list corresponding to a small view ID, and determining a matching view ID;
A second pointer acquisition step of accessing the domain name information table based on the pointer to the domain name information table and acquiring a pointer to the resource record storage table corresponding to the determined view ID;
Based on the pointer to the resource record storage table, accessing the resource record storage table and acquiring a resource record group,
A response step of transmitting a DNS query response to the DNS client device;
And
In the view ID determination step,
The access control list corresponding to the view with the smallest view ID is not set, and the IP address of the DNS client device, the access control list corresponding to the largest view ID, A domain name-based view access control method characterized in that when a comparison is made, it is necessary to match somewhere in a plurality of views . A DNS (Domain Name System) server system device for performing view access control by domain name, in which an access control policy can be set for each domain name,
A zone data table, a domain-specific information table, an access control table, and a resource record storage table are provided for dividing and storing zone data and access control lists. The zone data table includes a domain name and a domain name. A pointer to the corresponding domain name information table is stored. The domain name information table includes a pointer to the access control table corresponding to the domain name and resource records corresponding to a plurality of views set for each domain name. A pointer to a storage table is stored. The access control table includes a view ID for identifying a view, and a plurality of IP addresses and IP network addresses for access control corresponding to each view set for each domain name. The resource record storage table stores resource records corresponding to each view set for each domain name. And DNS database to store the soil,
DNS query transmission / reception processing means for transmitting / receiving a DNS query request and a DNS query response to / from a DNS client device via a network;
DNS database search processing means for performing search processing on the DNS database;
Have
The DNS database search processing means includes:
First means for searching the zone data table on the DNS database based on the DNS query request and obtaining a pointer to a corresponding information table by domain name;
A second means for accessing the domain name information table based on the pointer to the domain name information table and obtaining a pointer to the access control table;
Based on the pointer to the access control table, the access control table is accessed, the access control list of each view of the access control table and the IP address of the DNS client device are referred to, and the access corresponding to the largest view ID A third means for starting a comparison with the control list, sequentially comparing with an access control list corresponding to a small view ID, and determining a matching view ID;
A fourth means for accessing the domain name information table based on the pointer to the domain name information table and obtaining a pointer to the resource record storage table corresponding to the determined view ID;
A fifth means for obtaining a resource record group by accessing the resource record storage table based on a pointer to the resource record storage table;
Have
The third means includes
The access control list corresponding to the view with the smallest view ID is not set, and the IP address of the DNS client device is changed to the access control list corresponding to the largest view ID by matching all IP addresses. A DNS server system device , comprising means for always matching somewhere in a plurality of views when the above comparisons are made . Computer
A domain-based view access control program that functions as the DNS server system apparatus according to claim 2. A storage medium storing a view access control program classified by domain name, wherein the program according to claim 3 is stored.

Images