KR20110036418A - System and method for dns look-aside - Google Patents

Abstract

PURPOSE: A DNS(Domain Name System) look-aside apparatus is provided to exactly perform a reverse map a remote host IP address to a domain address which is used by a client. CONSTITUTION: A reverse mapping data collecting unit(110) extracts address mapping data from a DNS message. The reverse mapping data collecting unit collects reverse mapping data which is needed for changing IP address into a domain address. A reverse mapping data storage(130) stores reverse mapping data which is collected in the reverse mapping data collecting unit to a memory of a computer. A reverse mapping unit(120) offers the reverse mapping function of changing the IP address into the domain address using the reverse mapping data stored in the reverse mapping data storage.

Description

DS lookaside device and method {System and method for DNS Look-Aside}

The present invention relates to an apparatus and method for converting an IP address into a domain address, and more particularly, to reverse mapping data by detecting a DNS message used by a client in converting a domain address into an IP address using a local name server. And an apparatus and method for converting an IP address into a domain address using the reverse mapping data.

There are many hosts connected to the Internet, and these hosts are assigned IP addresses that uniquely identify each host. Computers identify counterpart hosts using numeric IP addresses, but humans do not easily identify hosts they want using only numeric IP addresses. Therefore, when a person assigns a domain address composed of characters that are easy to remember to a host, and a person enters the domain address into an application, the application converts the domain address into an IP address using a local name server and converts the converted IP into an IP address. The address is used to identify a particular host.

Converting a domain address, which is easy for a person to remember, to an IP address as in the above example is called forward mapping, and the main function of the Domain Name System (DNS) is this forward mapping. Servers that provide application services on the Internet must have a domain name system set up to enable forward mapping. If the domain name system is not configured to enable forward mapping, no one can access the server using the domain address.

On the other hand, sometimes an IP address is translated back into a domain address, which is called reverse mapping. Reverse mapping, unlike forward mapping, does not have to be configured. Even if you do not set up reverse mapping, there is no problem for a person to connect to the server using a domain address. Rather, for security reasons, reverse mapping is not deliberately set.

Reverse mapping is used in special purpose software and systems that need to translate a given IP address back to its corresponding domain address, rather than in a typical client application connecting to a remote server. Representative examples may include a network fire protection system and a network audit system installed in a local area network (LAN).

The network fire protection system installed in the LAN blocks harmful traffic from entering the LAN and prevents computers inside the LAN from accessing harmful external servers. Harmful external servers may be harmful websites or malicious servers installed against user interests and intentions to leak personal information to the outside. The network fire protection system is provided between the client and the external Internet to detect and block the allowance when the client attempts to connect to an external server existing on the Internet. At this time, since the network fire protection system is a process or a separate device that is separated from an application program that attempts to connect to an external server, the information that can be obtained when the network fire protection system detects a client's communication attempt is obtained from the client. It is limited to the IP address and port number, and to the server's IP address and port number. Network fire protection systems can enforce allow and block policies only with the IP addresses and port numbers of a given client and server, but it is possible to enforce more detailed allow and block policies using the actual domain address of the server the client is trying to access. So we use reverse mapping for this.

The network audit system installed in the LAN records the communication details of the computers located in the LAN and audits the leakage of personal information or corporate confidentiality. A network audit system, like a network fire protection system, is provided between the client and the external Internet to detect and record an attempt by the client to connect to an external server on the Internet. When the network audit system detects that the client is trying to connect to the outside, the information that can be obtained is limited to the client's IP address and port number and the server's IP address and port number. Therefore, when recording the address of a server that a client accesses, it is easier for human to understand if the server address is stored as a domain address rather than as a numeric IP address. Therefore, reverse mapping is used.

A reverse mapping process according to the prior art will be described with reference to FIG. 12. 12 is a block diagram illustrating a reverse mapping process according to the prior art. The reverse mapping client 510 which wants to convert an IP address into a corresponding domain address makes a reverse mapping query to the local name server 520. If the IP address that you want to change to the domain address is 208.77.188.166, 166.188.77.208.in-addr.arpa. Inquire by address. The local name server 520 receives the reverse mapping request and performs reverse mapping. In this case, the query is first made to the root name server 530, and then 208.in-addr.arpa. Query to name server 540 and again 208.in-addr.arpa. 188.77.208.in-addr.arpa using the referral returned by the name server 540. Query the name server 550, and then enter 188.77.208.in-addr.arpa. The name server 550 returns www.example.com, which is a domain address corresponding to the address 208.77.188.166, as an answer. At this time, the local name server 520 returns the answer to the reverse mapping client 510 and the reverse mapping process ends.

The problem of reverse mapping according to the prior art is as follows.

First, when reverse mapping of a specific host is not set, there is no problem in that there is no way of translating a corresponding domain address using an IP address. This is the case when reverse mapping is not configured for security reasons.

Another problem is that when a physical host with one IP address provides services to multiple domain addresses, the server attempted to access the IP address of the server acquired by the network fire protection system or network auditing system. It is impossible to exactly reverse map to a domain address.

Referring to FIG. 13 illustrating a server including a logical server serviced at various domain addresses in one physical server, one physical server 600 includes web servers 610 and 620 serviced at different domain addresses. There may be a mail server 630, an FTP server 640, and a malicious personal information collection server 650 that collects personal information for malicious purposes.

In the above situation, a web server (610, 620), a mail server (630), and an FTP server (640) in which a computer on a LAN is serving the physical host 600 by using a network fire protection system provided between a client and a server. Is allowed, but it is impossible to block only the connection to the malicious personal information collection server 650. The network fire protection system provided between the client and the server to detect when the client attempts to connect to the server may be implemented in the form of a driver in the same computer as the client. Internet protocol) layer may be implemented by monitoring traffic. Either way, when the network fire protection system detects that a client is connecting to an external server, the information it can obtain about the external server that the client is trying to connect to is the server's IP address, port number, and transport layer protocol (TCP or UDP). Therefore, in this case, even if the network firewall attempts reverse mapping using the IP address of a given server, multiple domain addresses serviced by one IP address are returned. It becomes impossible.

In other words, in the above example, the port number of the server collected when the network fire protection system detects the client's connection to the server can be used to guess the domain address of the service and the logical server to which the client is connecting. It will be apparent to those skilled in the art that can be easily changed by the server administrator, so guessing the domain address of the logical server and the service to which the client connects by the port number is not a fundamental solution.

As another problem, the reverse mapping according to the prior art is performed through a complex query process as described with reference to FIG. 12, in which a load is generated on various name servers including a local name server, and data between the various name servers. There is a problem that takes some time to exchange.

The present invention has been made to solve the problems of the prior art, the remote host IP address obtained when the client detects the connection to the remote host using a network firewall or network audit system, etc. The purpose is to provide an apparatus and method for correctly reverse mapping to the domain address used when attempting to connect to a local network.

The present invention for achieving the above object is a domain reverse mapping device for converting an IP address into a domain address, the client detects the DNS message used in the process of converting the domain address into an IP address using a local name server And extracting address mapping data including a domain address from which the client requests translation into an IP address and at least one IP address corresponding to the domain address, from the detected DNS message, and converting an IP address including the address mapping data into a domain. A reverse mapping data collector configured to collect reverse mapping data necessary to convert the address into an address; A reverse mapping data storage unit for storing the reverse mapping data collected by the reverse mapping data collecting unit in a storage device of a computer; And a reverse mapping unit for providing a reverse mapping function for converting an IP address into a domain address by using reverse mapping data stored in the reverse mapping data storage unit.

In addition, the present invention for achieving the above object is a domain reverse mapping method for converting an IP address to a domain address, the client uses a local name server DNS message used in the process of converting the domain address into an IP address Detects and extracts address mapping data including a domain address from which the client requests translation into an IP address and at least one IP address corresponding to the domain address, from the detected DNS message, and includes the IP address including the address mapping data Collecting reverse mapping data necessary for converting the information into a domain address, and storing the collected reverse mapping data in a storage device of a computer; And a reverse mapping step of performing reverse mapping to convert an IP address into a domain address by using the reverse mapping data collected in the reverse mapping data collection step.

According to the domain reverse mapping apparatus and method of the present invention, a client attempts to access a remote host's IP address obtained when the client detects the client's connection to a remote host using a network fire protection system or a network audit system. You can exactly reverse map to the domain address you used. In particular, when a client attempts to connect to a given remote host's IP address, even if the reverse mapping of the remote host to which the client is trying to connect is not configured, or even if multiple domain addresses that share the same IP address exist in one physical server. You can exactly reverse map to the domain address you used. It can also speed up domain reverse mapping.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. Prior to this, the terms or words used in this specification and claims should not be construed as being limited to the common or dictionary meanings, and the inventors properly define the concept of terms in order to best explain their invention. Based on the principle that it can be, it should be interpreted as meaning and concept corresponding to the technical idea of the present invention. Therefore, the embodiments described in the specification and the drawings shown in the drawings are only one of the most preferred embodiments of the present invention and do not represent all of the technical idea of the present invention, various modifications that can be replaced at the time of the present application It should be understood that there may be equivalents and variations.

1 is a block diagram illustrating a domain mapping apparatus according to a preferred embodiment of the present invention.

Referring to FIG. 1, the client 210 refers to an application program that attempts a network connection to a remote host (not shown) using a domain address such as www.example.com, or a computer system equipped with such an application. Specific examples thereof may include a web browser connected to a web server and receiving a web page.

The local name server 220 refers to a name server configured to be used by default when the client 210 converts a domain address into an IP address. The local name server may be set manually by a user of the client 210 computer, or may be automatically set using a DHCP server.

The domain reverse mapping apparatus 100 detects a DNS message used in the process of the client 210 converting a domain address into an IP address using the local name server 220, and builds reverse mapping data based on the DNS message. Performs reverse mapping to convert IP address to domain address using the data. The domain reverse mapping apparatus 100 may be implemented in a computer that is physically identical to the client 210, or may be implemented as an independent device that is physically separated from the client 210. In addition, only a part may be implemented in a computer that is physically identical to the client 210, and a part of the other may be implemented as an independent device physically separated from the client 210.

The reverse mapping client 230 is a software and system that wants to convert an IP address into a domain address. Examples of the reverse mapping client 230 may include a network fire protection system, a network audit system, a network traffic control system, and the like.

First, the client 210 looks at a general process of accessing a remote host (not shown) using a domain address. The client 210 first corresponds to a corresponding domain address using a local name server 220. Convert to an IP address. Upon successful completion of this forward mapping process, the client 210 obtains an IP address corresponding to a given domain address, and connects to the remote host using the IP address. The client 220 uses a socket function such as gethostbyname () to do this forward mapping. gethostbyname () sends a DNS query message to the local name server 220, and the local name server 220 performs this process by sending a DNS response message. DNS queries and responses between the client 210 and the local name server 220 are typically performed using UDP, but may also use TCP. Also, name server generally provides DNS service using port 53. The client 210 connects to a remote host (not shown) by passing the IP address returned from the name server as an input parameter of a socket function such as connect ().

The domain reverse mapping apparatus 100 includes a reverse mapping data collector 110 for collecting data necessary for converting an IP address into a domain address, and reverse mapping data for storing data collected by the reverse mapping data collector 110. The storage unit 130 and the reverse mapping unit 120 converts an IP address into a domain address using data stored in the reverse mapping data storage unit 130.

The reverse mapping data collection unit 110 detects a DNS message used in a forward mapping process between the client 210 and the local name server 220, and extracts address mapping data from the detected DNS message. And a client identifier extracting unit 113 for extracting an identifier capable of uniquely identifying the client 220, and a local message from the DNS message detecting unit 111. It further includes a local name server address extraction unit 114 for extracting the address of the local name server 220 to selectively detect only DNS messages exchanged with the name server 220.

The DNS message detector 111 is provided between the client 210 and the local name server 220 to detect the DNS message used in the forward mapping process. In order to detect DNS messages exchanged between the client 210 and the local name server 220, the client 210 is transmitted to port 53 of the remote host or transmitted from port 53 of the remote host to the client 210. Detect the packet. In general, since the DNS service is provided through UDP, only packets transmitted through UDP may be selectively detected. Of the DNS messages detected in the above process, in order to select only the DNS message used for forward mapping, the content of the message may be examined. 5, 6, and 7 illustrate a format of a DNS message, FIG. 6 illustrates a format of a header section of the DNS message format 300, and FIG. A diagram illustrating a format of a query section of the DNS message format 300. In order to screen the DNS query message transmitted for forward mapping from the client 210 to the local name server 220, the Query-Response bit (QR) field of the DNS message header format 310 is 0, and the OPCODE field is 0. The QTYPE field of the DNS query format 320 is 1 and the QCLASS field is 1. In order to select a DNS response message for the DNS query message transmitted from the local name server 220 to the client 210, the QR field of the DNS message header format 310 is 1, the OPCODE field is 0, and the RCODE is 0, ANCOUNT field is at least 1, the QTYPE field of the DNS query format 320 is 1, and the QCLASS field is 1. More preferably, the value of the ID field in the DNS message header format 310 of the DNS query message may be compared with the value of the ID field of the DNS reply message. The reason for matching the DNS request message with the DNS query message using the ID field of the DNS message header format 310 is that a malicious user falsely sends a DNS response message for a DNS query message that the client 210 did not request. To filter things out. If such a verification process is not necessary, the DNS message detector 111 may detect only the DNS response message. The DNS message format is disclosed in detail in RFC 1035.

The DNS message detector 111 may be implemented in a computer that is physically identical to the client 210 or may be implemented in an independent device physically separated from the client.

When the DNS message detector 111 is implemented in the same physical computer as the client 210, API hooking or a kernel mode driver may be used. In this regard, each implementation will be described under the Windows XP operating system.

API hooking is a way of monitoring and manipulating the parameters of a function called by a process by replacing the address of a function called by a running process with an arbitrary function address created by the developer, or by monitoring and manipulating the results of a function call. In order to implement the DNS message detector 111 through API hooking, a function used for forward mapping such as gethostbyname () and getaddrinfo () provided by the WS2_32.DLL module may be hooked. When an application's process calls these functions, it is possible to detect DNS queries and DNS responses by monitoring the parameters of the called function and the result of the function call within the hooking function.

In order to implement the DNS message detection unit 111 through the kernel mode driver, a filter driver installed on the transport layer driver provided by the Windows operating system and detecting the DNS message may be used. More specifically, the transport layer driver provided by the Windows operating system is tcpip.sys, which creates \ Device \ Tcp and \ Device \ Udp devices in the object namespace managed by the object manager. To detect DNS messages exchanged over UDP, filter devices can be installed on top of \ Device \ Udp devices. To detect DNS messages exchanged over TCP, filter devices can be installed on top of \ Device \ Tcp devices. Installing a filter driver on top of the transport layer driver enables the computer to monitor all traffic that communicates externally, including traffic sent from the client to port 53 on the remote host and port 53 on the remote host to the client. It is desirable to detect only traffic that is transmitted. In addition, it can be implemented using NDIS IM driver.

When the DNS message detection unit 111 is implemented as a device physically independent of the client 210, the DNS message detection unit 111 may include at least two network interface cards (NICs) and detect the DNS message using a device that operates as a transparent bridge. Can be. The advantage of detecting DNS messages using transparent bridge-type equipment is that it works transparently on both sides without any changes to the configuration of the client or local name server. For example, in the case of implementation with a device using Linux, a Linux system having at least two NICs is set to transparent bridge mode and between the client 210 and the local name server 220. To be provided. In addition, the libpcap library is used in the Linux system to detect the packet transmitted from the client 210 to the port 53 of the remote host and the packet transmitted from the port 53 of the remote host to the client 210. In general, since DNS mainly uses UDP as a transport layer protocol, it is sufficient to capture only UDP packets, but in some cases, TCP packets can also be captured. In addition to the above embodiment using a Linux system, it is also possible to implement using a network device capable of processing L7 according to the OSI reference model of ISO.

Packet capture using the API hooking, kernel driver, and libpcap library is well known to those skilled in the art, and thus a detailed description related to their implementation will be omitted.

The local name server address extractor 114 extracts the address of the local name server 220 which is basically set to be used when the client 210 performs DNS resolution. There may be one or more local name servers configured to be used by default when the client performs DNS resolution, and thus, the address of the local name server extracted by the local name server address extractor 114 may also be one or more. In addition, the address of the local name server 220 extracted using the local name server address extractor 114 may be expressed in at least one of IPv4 and IPv6. The reason for extracting the address of the local name server 220 is to allow the DNS message detector 111 to more accurately select only DNS messages. The DNS message detector 111 uses port 53 used by the name server as a DNS message detection condition when detecting DNS messages, and simultaneously matches the address of the local name server extracted by the local name server address extractor 114. By selectively detecting only DNS messages exchanged with the server, the accuracy of the DNS message detector 111 may be improved. In other words, when the DNS message detection unit 111 is implemented in an API hooking scheme in a computer system that is physically identical to the client 210, it is not necessary to separately provide a local name server address extraction unit 114. The reason for this is that API hooking functions such as gethostbyname () and getaddrinfo () basically recognize the address of the local name server automatically and always query only the local name server. However, when the DNS message detection unit 111 is implemented in the form of a kernel mode driver or as an independent device, the local name server address extraction unit 114 may be provided.

Local name server address extraction unit 114 is preferably implemented in the same computer system as the client. In the Windows environment, the address of the configured local name server can be known by querying the registry. More specifically, the DhcpNameServer and NameServer values of the HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ Tcpip \ Parameters \ Interfaces \ [interface names] registry key can be viewed. By doing this, you can get the address of the local name server. In a Linux environment, you can get the address of a local name server by reading the /etc/resolv.conf file. The format of the registry where local name server information is stored in Windows environment and /etc/resolv.conf file where local name server information is stored in Linux is the state-of-the-art technology disclosed in detail through MSDN help and man pages, respectively. Further details will be omitted.

The address mapping data extracting unit 112 includes a domain address queried by the client to the local name server to convert the DNS message detected by the DNS message detecting unit 111 into an IP address and at least one IP address corresponding thereto. Extract address mapping data. The domain address that the client wants to translate into an IP address may be detected in a DNS query message transmitted from the client 210 to the local name server 220, and the DNS answer transmitted from the local name server 220 to the client 210. It can also be detected from a message. Referring to FIG. 5, the DNS message format 300 includes a query section. The query section includes the same values in both the DNS query message and the DNS response message. Referring to FIG. 7, the DNS message format 300 includes a query section. Contains the domain address that the client wants to translate into an IP address. On the other hand, the IP address corresponding to the domain address must be extracted from the DNS response message. An IP address is written in the response section of the DNS message format 300, and the format of the response section is the same as the resource record format 330 of FIG. In this case, when there is more than one IP address corresponding to one domain address, the response section may include one or more resource records. Therefore, the address mapping data extracted by the address mapping data extractor 112 includes a domain address and at least one IP address corresponding thereto.

The client identifier extracting unit 113 extracts various identifiers that can uniquely identify the client 210. The reason for extracting an identifier that can uniquely identify a client is that a plurality of domain addresses may be mapped to one IP address. In this process, a client identifier is used as a search condition along with an IP address to be reverse mapped in a reverse mapping process. To get a more accurate reverse mapping result. An identifier that can uniquely identify the client may include a process identifier, a thread identifier, a module identifier, a host identifier, and the like. The client identifier extracting unit 113 preferably extracts the client identifier from the information associated with the detected DNS message at the time when the DNS message detecting unit 111 detects the DNS message. In addition, in order to extract the process identifier, the thread identifier, and the module identifier, it is preferable that the client identifier extracting unit 113 is provided in the same physical computer as the client 210.

The process identifier may be a process ID, a process handle, and the like, which may uniquely identify the client on a per-process basis. Examples of functions used to obtain a process identifier include GetCurrentProcessId (), GetCurrentProcess (), PsGetCurrentProcessId (), and PsGetProcessId ().

Thread identifiers are identifiers that uniquely identify a client on a per-thread basis, such as thread IDs and thread handles. Examples of functions used to get thread identifiers are GetCurrentThreadId (), GetCurrentThread (), PsGetCurrentThreadId (), and PsGetThreadId ().

The module identifier is an identifier that can uniquely identify a client by a module (EXE, DLL, etc.) and may include an absolute path or a handle of a module that attempted network communication. Examples of functions used to obtain module identifiers include GetModuleHandle () and GetModuleFileName ().

The host identifier is an identifier that uniquely identifies the client on a host basis. The host identifier may include an IP address, a MAC address, and a network interface number of the client. The host identifier can be obtained from the libpcap library by examining L2 and L3 headers according to ISO's OSI reference model.

Various methods of obtaining the above-mentioned client identifier are well known techniques known to those skilled in the art, and thus, further description thereof will be omitted.

The reverse mapping data storage unit 130 stores the address mapping data extracted by the address mapping data extracting unit 112, and more preferably the client identifier extracted by the client identifier extracting unit 113 to the address mapping data. Save with. 14 is an exemplary diagram of data stored in the reverse mapping data storage unit 130 according to a preferred embodiment of the present invention. Referring to FIG. 14, address mapping data 720 including an IP address and a domain address and a client identifier 710 for uniquely identifying a client are stored. It is possible to reverse-map an IP address to a domain address using only the address mapping data 720. However, as illustrated in FIG. 14, one IP address 192.168.0.100 may have multiple domain addresses (www.company1.com, www.company2. com, eve.hacker.com), it is preferable to perform accurate reverse mapping using the client identifier as an additional search condition. For example, if the IP address 192.168.0.100 is reverse mapped to the domain address using the reverse mapping data illustrated in FIG. 14, it is difficult to know exactly which domain address the client uses to connect to the remote host using the IP address alone. However, if the process ID of the client connecting to the remote host is 5000, it can be seen that the reverse mapping data 1 730 has the information. From this, the domain address used when the client connects to the remote host is www.company1. You can see that it was .com. As such, when the client identifier 710 information is used as an additional search condition along with the IP address, more accurate reverse mapping can be performed.

The reverse mapping data storage unit 130 may be implemented as a data structure on a main memory, a file on an auxiliary memory such as a hard disk, or implemented using a relational database management system (RDBMS). It may be implemented or may be implemented using a networked distributed system. In addition, the reverse mapping data storage 130 may be implemented in a computer system that is physically identical to the client 210, or may be implemented as an independent device that is physically separated from the client 210.

The reverse mapping unit 120 converts the IP address into a domain address using the data stored in the reverse mapping data storage 130. The reverse mapping unit 120 receives the reverse mapping request from the reverse mapping client 230 and returns a result again. The reverse mapping client 120 uses the data stored in the reverse mapping data storage 130. 230 includes a reverse mapping data retrieval unit 122 for retrieving data matching the search condition requested.

The interface unit 121 provides various interfaces for receiving a reverse mapping request from the reverse mapping client 230 and returning the result back to the reverse mapping client 230. The interface provided to the reverse mapping client 230 may simply use a variable or memory address promised with the reverse mapping client 230, may be in the form of a function promised with the reverse mapping client 230, a pipe, An IPC (Inter Process Communication) function such as a shared memory or a mail slot may be used, or may be in the form of network communication such as a socket.

The reverse mapping request received by the interface unit 121 includes an IP address that the reverse mapping client 230 wants to translate into a domain address, and more preferably, search conditions for one or more client identifiers that can uniquely identify the client. It may include.

The reverse mapping data retrieval unit 122 retrieves data matching the search condition of the reverse mapping request received by the interface unit 121 using the reverse mapping data storage unit 130. When retrieving the reverse mapping data, it is preferable to use the IP address included in the search condition of the reverse mapping request together with identifier information for uniquely identifying the client to retrieve the correct data. The reverse mapping data search unit 122 may search using a method such as sequential search, binary search, or structured query language (SQL) according to the type of data stored in the reverse mapping data storage unit 130. As such various search methods are well known to those skilled in the art to which the present invention pertains, further description thereof will be omitted.

Hereinafter, a domain reverse mapping method according to a preferred embodiment of the present invention will be described in detail with reference to FIGS. 2, 3, and 4.

2 is a flowchart illustrating a domain reverse mapping method according to a preferred embodiment of the present invention. Referring to FIG. 2, the reverse mapping data collection step S110 collects data necessary for reverse mapping and stores the collected data in the reverse mapping data storage 130. In the reverse mapping step S120, when the reverse mapping client 230 requests reverse mapping, reverse mapping is performed using the reverse mapping data collected in the reverse mapping data collection step S110.

3 is a flowchart specifically illustrating the reverse mapping data collection step (S110). Referring to FIG. 3, the reverse mapping data collection step S110 includes a DNS message detection step S112, an address mapping data extraction step S113, and a reverse mapping data storage step S115, and more preferably, a local name server. The method may further include an address extraction step S111 and a client identifier extraction step S114.

After extracting the address of the local name server 220 of the client 210 using the local name server address extractor 114 (S111), the DNS message is detected using the DNS message detector 111 (S112). In this case, it is preferable to selectively detect only DNS messages exchanged with the local name server by using the address information of the local name server extracted in the local name server address extraction step (S111). Address mapping data including a domain address and at least one IP address corresponding thereto is extracted from the DNS message detected in the DNS message detection step S112 (S113). Preferably, in order to improve the accuracy of the reverse mapping, an identifier for uniquely identifying the client is further extracted (S114). The reverse mapping data storage 130 stores the reverse mapping data including the address mapping data and the client identifier information in step S115. When the step S115 is completed, the process returns to step S112 and iteratively processes and continuously collects and accumulates reverse mapping data.

4 is a flowchart illustrating the reverse mapping step S120 in detail. Referring to FIG. 4, a reverse mapping request is received from a reverse mapping client 230 by using an interface unit 121 (S121), and reverse mapping data corresponding to reverse mapping data satisfying a search condition of the received reverse mapping request is received. The search is performed using the storage unit 130 (S122). When the search is completed, the result is returned to the reverse mapping client 230 (S123).

Hereinafter, a process of converting an IP address into a domain address will be described in detail with reference to FIGS. 9, 10, 11, and 14.

11 is a block diagram illustrating the operation of the domain reverse mapping apparatus. Referring to FIG. 11, the client 210 is a client that wants to connect to a www.example.com server, which may be a web browser. The client 210 first makes a DNS query to the local name server 220 to translate the www.example.com domain address into an IP address. Local name server 220 receives a DNS query from the client 210, root name server 240, com. Nameserver (250), example.com. The name server 260 is in turn queried to finally example.com. Receive the response containing the IP address from the name server 260. The local name server 220 is the example.com. The name server 260 sends the response sent to the client 210 to complete the DNS query process. In this case, the domain reverse mapping apparatus 100 detects a DNS message used in the forward mapping process between the client 210 and the local name server 220 and constructs data necessary for reverse mapping therefrom. The domain reverse mapping apparatus 100 preferably operates transparently to the client 210 and the local name server 220.

After the client 210 obtains an IP address corresponding to the www.example.com domain address, the client 210 makes a socket connection to the www.example.com web server using the IP address. The software and system 230 that monitors the remote host connection of the client 210 then detects the socket connection. Examples of such software and systems may include network fire protection systems, network auditing systems, network traffic control systems, and the like. The reverse mapping client converts IP addresses into domain addresses using the domain reverse device 100. (230). After the software and the system detect the socket connection of the client, obtain the IP address of the remote host to which the client 210 is to connect from the detected socket connection, and the obtained IP address to the domain reverse mapping device 100 Query and convert to domain address. The reverse mapping client 230 may perform a desired operation by using the domain address returned from the domain reverse mapping apparatus 100. For example, in the case of a network fire protection system, a more detailed allow and block policy may be performed with the translated domain address.In case of asking the user whether to allow communication using a pop-up window or the like, instead of the numeric IP address, You can query with a user-friendly domain address.

9 and 10, the format of the message used in the DNS query and DNS response in more detail, Figure 9 is the client 210 to the local name server 220 www.example.com domain address Is a DNS query message transmitted for forward mapping, and FIG. 10 is a DNS response message containing a response to the forward mapping query transmitted from the local name server 220 to the client 210. Both the DNS query message and the DNS response message follow the DNS message format 300 shown in FIG.

Resolving the DNS section of the DNS query message 410 with reference to FIG. 6, the ID is 0x7C30, QR is 0 for the query, OPCODE is 0 for the standard query, RD is 1 for the recursive query, QDCOUNT is 1, indicating that one query is included in the query section. Referring to FIG. 7, it can be seen that the domain address to be queried is www.example.com, QTYPE is 1 to query the A resource record, and QCLASS is 1 to query the IN class.

Interpreting the header section with the DNS response message 420 with reference to FIG. 6, the ID is 0x7C30, QR is 1 for the response, OPCODE is 0 for the standard query, and RD is 1 for the recursive query. RA indicates that a recursive query is supported by the local name server 220, 1, RCODE indicates 0 that no error occurred (i.e., success), and ANCOUNT returns 1 in the response section. Indicates that one resource record is included. The query section portion of the DNS response message 420 is the same as the DNS query message 410. Referring to Fig. 8, the contents of the response section are interpreted, where NAME is 0xC00C, indicating that it is a resource record for www.example.com, TYPE indicates that it is an A resource record of 1, CLASS indicates that it is an IN class, and RDLENGTH. Indicates that 4, 4 bytes of addresses are stored in the RDATA field, and RDATA is 0xD04DBCA6, indicating that the IP address is 208.77.188.166. A more detailed description of all fields of the DNS message is disclosed in RFC 1035.

As can be seen in the above example, since the query section has the same value in the DNS query message and the DNS response message, when the address mapping data extracting unit 112 extracts the domain address, either the DNS query message or the DNS response message is selected. You can use it.

Also, as you can see from the above example, the DNS message has an ID value to identify each query and response. To filter out malicious users intentionally sending response messages for unsolicited DNS query messages, the DNS message When the detection unit 111 detects and temporarily stores the DNS query message, when the DNS response message is detected, it is safe to compare the ID of the DNS response message with the ID of the DNS query message that is temporarily stored and to validate it. More preferred in terms of aspect.

As described above, specific embodiments of the present invention have been described through limited embodiments and drawings in a limited environment. However, the present invention is not limited to the specific platform, the specific operating system, the use of a specific function, the specific IP version, and the like, and should be understood by those skilled in the art to which the present invention pertains. It is obvious that various modifications and variations are possible within the scope of the equivalent claims.

The domain reverse mapping apparatus and method according to the present invention can be particularly useful in a network fire protection system, a network audit system, a network traffic control system, and the like.

When a network firewall system, especially a personal firewall installed in a personal PC, cannot determine whether the connection is allowed when an application attempts to connect to an external server, a query asking the user whether to allow the connection by using a pop-up window or the like It is common to allow or block access at the discretion of the user. At this time, the personal firewall presents to the user the server's IP address and the server's port number, which are the information obtained when the application program detects the server connection, and inquires whether to allow. However, ordinary users without computer expertise can't easily determine whether to allow or not see a dotted decimal notation presented by a personal firewall. This problem is a major cause of its ineffectiveness, although the personal firewall is a means to effectively prevent hacking and leakage of personal information. Applying the technical idea of the present invention, the personal firewall can reverse-mapped the IP address of the server to which the application is connecting to the domain address, and instead of the IP address consisting of numbers only to the PC user, By correctly presenting the domain address, PC users can easily determine whether to allow communication by looking at a familiar domain address.

In addition, when defining a communication permission and blocking rule using a network fire protection system, it may be possible to set a domain address to an address of a remote host to allow and block access without setting an IP address as in the prior art. In particular, when a plurality of domain addresses are provided to a single physical server sharing a single IP address, it is possible to set a differential allow and block policy for each domain address.

If the technical idea of the present invention is applied to a network auditing system that records a communication of a computer connected to a LAN to an external host and audits the leakage of personal information or corporate secrets, When you record the address, you will be able to record the domain address that the client actually attempted to connect to instead of the IP address of the remote host, so that you can perform a more accurate audit. In particular, the present invention is not limited to a specific application protocol (for example, HTTP) and has an advantage that the present invention can be applied to all application protocols.

If the technical idea of the present invention is applied to a network traffic control system that provides a service such as QoS (Quality of Service) by controlling the traffic that the computer connected to the LAN communicates with the outside, the traffic is controlled only by the IP address and port number of the server. Unlike conventional technologies, the domain address used when a client actually connects to a remote host may be used as a condition for determining traffic control, thereby enabling more granular and accurate traffic control.

In addition, when reverse mapping is required, queries are made with the domain reverse mapping apparatus 100 without having to query several name servers including the root name server to obtain a result at a time, thereby comparing the speed with the conventional reverse mapping. There is also an advantage.

In addition to the above industrial availability, those skilled in the art will readily appreciate that the present invention can be usefully used when network-related application software and related equipment need to convert the IP address of the remote host to which the client is connected to a domain address. Could be.

1 is a block diagram showing a domain reverse mapping apparatus according to a preferred embodiment of the present invention;

2 is a flowchart illustrating a domain reverse mapping method according to a preferred embodiment of the present invention;

3 is a flowchart illustrating a reverse mapping data collection step of FIG. 2;

4 is a flowchart illustrating a reverse mapping step of FIG. 2;

5 is a diagram illustrating a DNS message format;

6 is a diagram illustrating a DNS message header format used in the header section of FIG. 5;

7 is a diagram illustrating a DNS query format used in the query section of FIG. 5;

8 illustrates a resource record format used in a response section, an authentication section, and an additional section of FIG. 5;

9 is an exemplary diagram of a DNS query message for explaining a preferred embodiment of the present invention;

10 is an exemplary diagram of a DNS response message for explaining a preferred embodiment of the present invention;

11 is a block diagram for explaining the operation of the domain reverse mapping apparatus according to an embodiment of the present invention;

12 is a block diagram illustrating a reverse mapping process according to the prior art;

FIG. 13 is a block diagram illustrating one physical server providing a service to a plurality of domain addresses. FIG.

14 is an exemplary diagram of reverse mapping data for explaining a preferred embodiment of the present invention.

<Description of Symbols for Main Parts of Drawings>

100: domain reverse mapping device

110: reverse mapping data collection unit

120: reverse mapping unit

600: physical server

Claims (3)

A device that translates IP addresses into domain addresses. The client detects a DNS message used in the process of converting a domain address into an IP address using a local name server, and at least the domain address corresponding to the domain address requested by the client to the IP address and the domain address from the detected DNS message. A reverse mapping data collection unit configured to extract address mapping data including one or more IP addresses and collect reverse mapping data necessary for converting the IP address including the address mapping data into a domain address; A reverse mapping data storage unit for storing the reverse mapping data collected by the reverse mapping data collecting unit in a storage device of a computer; A reverse mapping unit for providing a reverse mapping function for converting an IP address into a domain address using reverse mapping data stored in the reverse mapping data storage unit; Die look lookaside device comprising a. The method of claim 1, Reverse mapping data collection unit, A DNS message detector for detecting a DNS message used by the client in converting a domain address into an IP address using a local name server; An address mapping data extracting unit extracting a domain address from which the client requests translation into an IP address and at least one IP address corresponding to the domain address from the DNS message detected by the DNS message detecting unit; Die look lookaside device comprising a. A method of converting an IP address into a domain address, The client detects a DNS message used in the process of converting a domain address into an IP address using a local name server, and at least the domain address corresponding to the domain address requested by the client to the IP address and the domain address from the detected DNS message. Extract address mapping data including one or more IP addresses, collect reverse mapping data necessary for converting the IP address including the address mapping data into a domain address, and convert the collected reverse mapping data into a storage device of a computer. Storing the reverse mapping data; A reverse mapping step of performing a reverse mapping to convert an IP address into a domain address using the reverse mapping data collected in the reverse mapping data collection step; Die Look look-side method comprising a.

Images