KR100317748B1 - Access control method of zone data for transmission control protocol query/response in secure dns, and naming services server - Google Patents

Abstract

The present invention is an element technology of the base service provided on the Internet, and is a description of the next resource record (NXT RR) generated in the processing of a naming service used to obtain cross-mapping information of a domain name and an IP address, which is an Internet address. The present invention relates to a zone information access control method for eliminating errors and a secure naming service server having a naming service function.

To this end, the present invention uses an interprocess communication method when establishing a multi-connection for a TCP connection of a naming service server having a TCP connection structure, so that a plurality of response processes record information to be recorded in the zone information database. When passed to the main process, it updates the database's cache information with that information.

Therefore, it is possible to prevent NXT RR errors in the database, which can be generated by writing a plurality of response processes directly to the database, respectively, the information transmitted in response.

Description

ACCESS CONTROL METHOD OF ZONE DATA FOR TRANSMISSION CONTROL PROTOCOL QUERY / RESPONSE IN SECURE DNS, AND NAMING SERVICES SERVER}

The present invention relates to a method for managing a database in a naming service system, which is one of Internet-based services. In particular, the present invention relates to a database when a secure domain name server is required to establish a transmission control protocol (hereinafter referred to as TCP) connection. Transmission control protocol (TCP) in a secure domain name system (hereinafter referred to as DNS) that can prevent the next resource record (hereinafter referred to as NXT RR) error for the cache information to be updated. The present invention relates to a zone information access control method for query / response processing and a secure naming service server that can be implemented by the same.

In general, all Internet services must access a remote service system to provide services to users. At this time, the system to be provided with the service should be connected to the Internet protocol (IP) address of the system providing the service, but the IP address of any host for which the general user provides arbitrary services on the Internet. It is impossible to know all of them. Therefore, instead of the IP address, the host name (domain name) is expressed as a user-friendly English name. The naming service function is to provide information on the mapping relationship between the name expressed in English and the IP address of the real system. This naming service function is a specific system (now widely used BIND system), which is currently being upgraded to versions 4.9.x and 8.1.x. However, this BIND system was implemented at the time of design without considering TCP connection setup for user queries.

Recently, many studies and implementations of the secure domain name system of the type shown in FIG. 1 have been conducted.

Referring to FIG. 1, a secure domain name system includes a resolver 20 that receives a service request from a user program 10 of an application layer and transmits a query to a name server, and an external name server 40 (the resolver 20). It may include a name server 30 for processing a response to the query from the (), and the zone information database 33 managed by the name server 30.

However, among these, the zone information is easily exposed to spoofing by hacking / cracking. Therefore, you must ensure that the zone information you get from the name server has not been tampered with by hackers / crackers. To this end, signature resource record (hereinafter referred to as SIG RR) data is used. However, this guarantee resource record (SIG RR) data increases the length of the transmission data, so that transmission is not possible with the existing User Datagram Protocol message, and therefore the transmission control protocol (TCP) message processing Is required.

2 illustrates an example of cache information update for a next resource record (NXT RR) error that may occur in a secure domain name server 30.

Referring to FIG. 2, two response processes 32 (1) and 32 (2) generated at the time of establishing a TCP multiple connection by the main process 31 receive and receive a response message RR from the external name server 40. The cache information of the information database is updated. In this case, when each of the response processes 32 (1) and 32 (3) updates zone information, the next process record (NXT RR) data is generated as a data structure for concatenating each zone information as shown in FIG. do.

However, since each of the response processes individually accesses the database and requests the update of the zone information, there is a problem that an NXT RR error 33b actually occurs.

Accordingly, the present invention has been made to eliminate the NXT RR error that occurs when the TCP multiple connection, the present invention provides an inter-process communication (IPC) method between a plurality of response processes and the main process generated when the TCP multiple connection is established. By sending a response message received from an external name server to the main processor, and allowing the main process receiving the response message from each response process to manage the zone information database. Provides zone information access control method and secure naming service server for transmission control protocol (TCP) query / response processing in secure domain name system (DNS) to prevent next resource record data error that occurs when updating cache information. There is a purpose.

In order to achieve the above object, an embodiment of the present invention provides a plurality of response processes and a plurality of response processes generated when a TCP connection is established to process a response to a query from an external name server. A secure domain name system including a name server of a TCP connection structure including a controlling main process, wherein the name server controls access to the zone information database for TCP query / response processing. Setting up a message queue for interprocess communication (IPC) between the plurality of response processes and the main process generated during setup; TCP in the secure domain name system, wherein the plurality of response processors and the main process transmit data of a specific structure to each other through the set message queue and update cache information of the zone information database. Provides zone information access control method for query / response processing.

In one embodiment of the present invention, the updating of the cache information may include: checking whether data is transmitted from an external name server, receiving and temporarily storing a response message transmitted from an external name server; Converting the temporarily stored response message into data of a specific structure defined in the set message queue; And transmitting the converted response message through the set message queue, and the operation may be performed in the plurality of response processes of the name server, respectively.

The updating of the cache information may include: checking whether there is data transmitted through the set message queue, and reading data of a specific structure from the message queue; Converting data of a specific structure read from the message queue into a structure corresponding to cache information; And updating cache information of the zone information database with the converted data, and the operation may be executed in the main process of the name server.

In order to achieve the above object, another embodiment of the present invention includes a plurality of name servers having a transmission control protocol (TCP) connection structure, and the name server transmits data for TCP query / response processing of the name server. A naming service server having a secure TCP connection structure that updates cache information in a zone information database to be managed to form a connection structure of each zone information, wherein a plurality of response processes are generated when multiple connections are established using the TCP connection structure. A message queue for interprocess communication (IPC) between the main process and the main process; Naming having a secure transmission control protocol (TCP) connection structure, wherein the cache information of the zone information database is updated by mutually transmitting data of a specific structure through the set message queue between the plurality of response processors and the main process. Provide a service server.

In another embodiment of the present invention, the cache information updated in the zone information database is converted into data having a specific structure defined in the message queue from a response message received from an external name server, and the plurality of cache information is transmitted through the message queue. Sent from the response process to the main process; And reconverting the data of the specific structure into data having a structure corresponding to the cache information and updating the zone information database by the main process.

1 is a block diagram showing the structure of a secure domain name system

2 is an example of cache information configuration in which the next resource record (NXT RR) error is generated by each response process when a TCP connection is established.

3 is an example of a cache information configuration correctly updated

Figure 4 is a configuration example of a name server of the TCP connection structure to which the present invention is applied

5 is an operation flowchart of an interprocess communication process executed by the main process of FIG. 4 illustrated to explain a method for controlling access to a database according to the present invention.

6 is a flowchart illustrating an interprocess communication process executed by each response process shown in FIG. 4 to explain a method for controlling access to a database according to the present invention.

<Description of the symbols for the main parts of the drawings>

10: user program 20: resolver

30, 40: Name Server 33a: Resource Record Data

33b: Next resource record data updated incorrectly

310: main process 320 (1) -320 (N): response process

330: zone information database

These objects, features and advantages of the present invention will be more readily understood by reference to the accompanying drawings and the following detailed description.

The present invention below is a method for controlling access to a zone information database in a secure naming service server (hereinafter referred to as a name server) including a plurality of response processes generated when establishing a TCP connection structure and one main process controlling the same, and a method of controlling the same. This applied server is proposed as a preferred embodiment. In this specification, a naming service in a name server including a main process, a plurality of response processes, and a zone information database is described. However, the technical idea of the present invention is not limited thereto and can be variously modified and implemented by those skilled in the art. Of course.

Figure 4 shows an example of the configuration of a name server of the TCP connection structure in a secure domain name system to which the present invention is applied.

Referring to FIG. 4, a name server in a secure domain name system (DNS) according to the present invention includes a plurality of responses generated when establishing a transmission control protocol (TCP) connection to process a response to a query from an external name server. A zone information database including a main process 310 that sets up a message queue for inter-process communication with processes 320 (1) -320 (N), wherein cache information is directly managed by the main process 310 330. In this case, the cache information updated in the zone information database 330 is converted into data having a specific structure defined in the message queue from a response message received from an external name server, and then the plurality of response processes are performed through the message queue. From (320 (1) -320 (N)) to the main process 310. Data of a specific structure transmitted through the message queue is converted into data of a structure corresponding to cache information and then updated and stored in the zone information database 330 by the main process 310.

The name server accessing the zone information database for TCP query / response processing may include: establishing a message queue for interprocess communication (IPC) between a plurality of response processes and the main process generated when the TCP connection is established. Setting and updating the cache information of the zone information database by mutually transmitting data having a specific structure between the plurality of response processors and the main process through the set message queue. FIGS. 5 and FIG. 6 is shown in the flowchart.

5 is a flowchart illustrating communication with the response process executed by the main process of the name server and update of cache information, and FIG. 6 illustrates communication and message transfer operation with the main process executed by each response process of the name server. Is a flow chart. In these drawings, a process of accessing the zone information database managed by the name server through inter-process communication based on the message passing method, which is performed through the set message queue, is illustrated as an example.

Referring to FIG. 5, the main process may include establishing a message queue for interprocess communication (IPC) and establishing a communication environment (spatial space) (S311 and S312) and data of a specific structure through the message queue. It is configured to sequentially execute the steps (S313-S318) received from the plurality of response processes to update the cache information of the zone information database.

In particular, in the updating of the cache information executed in the main process of the name server, checking whether there is data transmitted through the set message queue, and reading data of a specific structure from the message queue (S313). (S315), converting data of a specific structure read from the message queue into a structure corresponding to cache information (S316, S317), and updating cache information of the zone information database with the converted data. It may include (S318).

Referring to FIG. 6, the plurality of response processes may include establishing a message queue for interprocess communication (S321) and establishing a message queue between the plurality of response processors and the main process. It is configured to sequentially execute the step (S322-S325) of transmitting data to the main process.

In particular, the updating of the cache information respectively executed in the plurality of response processes of the name server may be performed by checking whether data is transmitted from an external name server and receiving a response message transmitted from an external name server to temporarily. Storing (S322, S323), converting the temporarily stored response message into data having a specific structure defined in the set message queue (S324), and transmitting the converted response message through the set message queue. Step S325 may be included.

Referring to the operation and the effects of the present invention configured as described above are as follows.

First, in order to prevent a next resource record (NXT RR) error, by storing only the information stored in the cache information for the resource record (RR) transmitted from the external name server, only the main process 310 by processing, By processing the cache information at the same time in the response process (320 (1)-320 (N)) of the can be prevented.

In the present invention, the message passing method is used as a communication method between each response process and the main process.

This message passing method is an interprocess communication method for establishing a message queue between a plurality of response processes and one main process, and then transmitting data having a specific structure through the set queue. The operations performed in the response processes 320 (1) -320 (N) are as follows.

In the main process 310, a message queue is first set up to configure an environment in which communication with each response process 320 (1) -320 (N) is possible. Read data from the configured message queue. If there is data in the set queue, the main process 310 reads the data in the form defined in the message queue, converts the data into the defined form to store the cache information, and then updates the cache information. If there is no data, just do the following:

In each response process (320 (1) -320 (N)), after receiving information from an external name server, the obtained RR is converted into a structure defined in the message queue after the cache information is updated. The data is then sent to the main process 310 via the message queue.

As such, by recording the RR obtained only through the main process as cache information, it is possible to prevent an error of the NXT RR due to simultaneous access due to processes generated by multiple connections on TCP.

The present invention is not limited to the embodiments described above, and various modifications and changes can be made by those skilled in the art, which are included in the spirit and scope of the present invention as defined in the appended claims.

Therefore, according to the present invention as described above, when a secure domain name system that can handle the SIG RR function for the security function for hacking / cracking for naming service on the Internet can occur when multiple connections by TCP connection required Since the NXT RR error can be prevented, the introduction of such a function can provide a secure naming service by providing a security function for the naming service on the Internet.

Claims (4)

It includes a name server of a TCP connection structure including a plurality of response processes generated when a TCP connection is established to process a response to a query from an external name server, and a main process controlling the plurality of response processes. In a secure domain name system, wherein the name server controls the access of the zone information database for TCP query / response processing, Setting up a message queue for interprocess communication (IPC) between the plurality of response processes and the main process generated when the TCP connection is established; TCP in the secure domain name system, wherein the plurality of response processors and the main process transmit data of a specific structure to each other through the set message queue and update cache information of the zone information database. Zone information access control method for query / response processing. The method according to claim 1, wherein the interprocess communication is performed by a message passing method. A plurality of name servers having a transmission control protocol (TCP) connection structure, and updating the data for TCP query / response processing of the name server with cache information in a zone information database managed by the name server; In a naming service server having a secure TCP connection structure forming a connection structure of information, Setting up a message queue for interprocess communication (IPC) between a plurality of response processes and a main process generated when establishing multiple connections using the TCP connection structure; Naming having a secure transmission control protocol (TCP) connection structure, wherein the cache information of the zone information database is updated by mutually transmitting data of a specific structure through the set message queue between the plurality of response processors and the main process. Service server. 4. The naming service server of claim 3, wherein the interprocess communication is performed by a message passing method.