WO2010124549A1

WO2010124549A1 - Method, apparatus and system for obtaining public key

Info

Publication number: WO2010124549A1
Application number: PCT/CN2010/071521
Authority: WO
Inventors: 沈烁
Original assignee: 华为技术有限公司
Priority date: 2009-04-29
Filing date: 2010-04-02
Publication date: 2010-11-04
Also published as: CN101877693A

Abstract

The present invention relates to the field of communications. A method for obtaining public key is disclosed. The method includes: by establishing a Transmission Control Protocol (TCP) connection with a Domain Name System (DNS) server, sending a DNS request message to the DNS server through the connection in order to request the public key of a first domain; receiving a DNS response message from the DNS server through the connection, and obtaining the public key of the first domain according to the public key of the first domain carried in the response message. An apparatus and system for obtaining public key are also disclosed.

Description

Method, device and system for obtaining a public key. The present application claims priority to a Chinese patent application filed on April 29, 2009, the Chinese Patent Office, Application No. 200910106932.3, entitled "Method, Apparatus and System for Obtaining Public Keys" The entire contents of which are incorporated herein by reference. TECHNICAL FIELD The present invention relates to the field of communications, and in particular, to a method, apparatus, and system for obtaining a public key.

Background technique

DKIM (Domain Key Identified Mail) is an emerging e-mail verification standard that is widely used to prevent e-mail fraud, prevent spam, and prevent phishing.

In the DKIM scheme, each domain (such as ABC.com) has its own public/private key pair, and in the message (such as email) sent by the domain, it is generated by using the domain's own private key. signature. After receiving the message, the receiver uses the public key of the domain to verify the signature in the message to confirm that the message is indeed from the domain. If the receiver does not have the public key of the domain, you need to use the DNS (Domain Name System) Request message to obtain the public key of the domain from the DNS server.

In actual applications, DNS packets are usually transmitted using UDP (User Datagram Protocol). Therefore, when the receiver does not have the public key of the domain, it needs to establish a UDP connection with the DNS server and obtain the public key of the domain through the UDP packet.

However, in the prior art, DKIM only supports the RSA key system, and to increase the density, the RSA key is usually very long. When the length of the RSA public key of a domain is too long, the receiver cannot obtain the RSA public key of the domain through UDP packets. SUMMARY OF THE INVENTION In view of this, embodiments of the present invention provide the following solutions:

A method of obtaining a public key, the method comprising:

Establishing a transmission control protocol TCP connection with the domain name system DNS server; sending, by the TCP connection, a DNS request message to the DNS server, requesting to acquire a public key of the first domain; and receiving, by the TCP connection, the DNS server from the DNS server a DNS response message, wherein the DNS response message carries the public key of the first domain; and the public key of the first domain is obtained according to the DNS response message.

A device for obtaining a public key, the device comprising:

Establish a connection module for establishing a TCP connection with the DNS server;

a sending module, configured to send a DNS request packet to the DNS server by establishing a TCP connection established by the connection module, requesting to obtain a public key of the first domain;

a receiving module, configured to receive a DNS response message from the DNS server by establishing a TCP connection established by the connection module, where the DNS response message carries the public key of the first domain;

The obtaining module is configured to obtain a public key of the first domain according to the DNS response packet received by the receiving module.

A system for obtaining a public key, the system comprising:

a first device, configured to establish a TCP connection with the DNS server, send a DNS request message to the DNS server, request to acquire a public key of the first domain, and receive a DNS response message from the DNS server to obtain the The public key of the first domain carried in the DNS response packet;

The DNS server is configured to send, by using the TCP connection, a DNS response packet to the first device after receiving the DNS request packet, where the DNS response packet carries the public key of the first domain.

A method of obtaining a public key, the method comprising:

Establishing a communication connection with the DNS server; sending the DNS server to the DNS server through the communication connection A DNS request message, requesting to obtain a public key of the first domain; the public key is a key using a short key system; receiving a DNS response message from the DNS server through the communication connection; the DNS response message carries the first The public key of the domain; according to the DNS response packet, the public key of the first domain is obtained.

A device for obtaining a public key, the device comprising:

Establishing a connection module for establishing a communication connection with the DNS server;

a sending module, configured to send a DNS request packet to the DNS server by establishing a communication connection established by the connection module, requesting to acquire a public key of the first domain; the public key is a key using a short key system;

a receiving module, configured to receive a DNS response message from the DNS server by establishing a communication connection established by the connection module, where the DNS response message carries the public key of the first domain;

A system for obtaining a public key, the system comprising:

a first device, configured to establish a communication connection with the DNS server, send a DNS request message to the DNS server, request to obtain a public key of the first domain, and receive a DNS response message from the DNS server to obtain the The public key of the first domain carried in the DNS response packet; the public key is a key using a short key system;

The DNS server is configured to send a DNS response packet to the first device after receiving the DNS request packet, where the DNS response packet carries the public key of the first domain.

The method, the device and the system for obtaining a public key provided by the embodiment of the present invention can solve the problem that the public key of the domain cannot be obtained through the UDP packet in the prior art because the length of the public key of the domain is too long.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a schematic diagram of an application scenario according to an embodiment of the present invention;

2 is a flowchart of a method for obtaining a public key according to an embodiment of the present invention;

3 is a schematic diagram of an apparatus for acquiring a public key according to an embodiment of the present invention;

FIG. 4 is a schematic diagram of a sending module 310 in an apparatus for acquiring a public key according to an embodiment of the present invention; Figure

FIG. 5 is a schematic diagram of a system for obtaining a public key according to an embodiment of the present invention;

FIG. 6 is a schematic diagram of still another application scenario according to an embodiment of the present invention;

FIG. 7 is a flowchart of still another method for obtaining a public key according to an embodiment of the present invention;

Figure 8 (a) shows the format of the Question option in the DNS request message;

Figure 8 (b) shows the format of the Query Name field in the Question option.

FIG. 9 is a schematic diagram of another apparatus for obtaining a public key according to an embodiment of the present invention;

FIG. 10 is a schematic diagram of another sending module 910 in an apparatus for acquiring a public key according to an embodiment of the present disclosure;

FIG. 11 is a schematic diagram of another system for obtaining a public key according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE EMBODIMENTS In order to make the objects, the technical solutions and the advantages of the embodiments of the present invention more clearly, the embodiments of the present invention will be further described with reference to the accompanying drawings.

For ease of explanation, several embodiments of the present invention are specifically described below in combination with a more common scenario in practical applications.

As shown in Figure 1, the domain ABC.com has a key pair X1/X2 (public/private key). When the domain ABC.com sends a message (such as an email) to the user P, the message carries the signature. This signature is generated by domain ABC.com using its own private key X2. In this scenario, the domain ABC.com can use the RSA key or other key systems, which is not limited here.

After receiving the packet, user P needs to verify the signature to confirm that the packet is indeed from the domain ABC.com. For example, the user P can use the public key X1 corresponding to the private key X2 to sign the signature in the positive message. If the user P does not have the public key X1, the user needs to send a DNS request packet to the DNS server to request the public key X1.

Different from the solution in the prior art, in this scenario, a UDP connection is not established between the user P and the DNS server, and a TCP (Transfer Control Protocol) connection is directly established, and the user P connects to the DNS server through the TCP connection. Send the above DNS request message. Optionally, in this scenario, the domain ABC.con can use the RSA key, and other key systems can be used. Therefore, after receiving the packet from the domain ABC.com, the user P can carry the packet. Signature, knowing which key system ABC.com uses to generate the signature. Therefore, the DNS request packet sent by the user P to the DNS server may carry the type identifier of the public key requested to be obtained.

After receiving the DNS request packet, the DNS server sends a DNS Response (Response) message to the user P based on the TCP connection. The DNS response message carries the public key X1 of the domain ABC.com. For example, the DNS response packet may carry a resource record of the text (TXT) type of the public key X1 (RR, Resource Record, when the DNS request packet carries the type identifier of the public key obtained by the request, the DNS server may also be based on the type The public key of the corresponding type is carried in the DNS response packet and sent to the user P.

At this point, User P has obtained the public key X1 of the domain ABC.com. Then, the obtained public key X1 can be used to verify the signature in the message.

In this scenario, the user P communicates with the DNS server via TCP. Therefore, even if the length of the public key X1 exceeds the packet length specified by the protocol, the DNS server can pass the public key X1 through multiple TCP packets. Send to the user. The user P can receive the TCP packets in sequence according to the sequence number of the packets carried in the TCP packets, and obtain the public key X1. Therefore, in the prior art, the problem that the public key of the domain is too long to obtain the public key through the UDP packet is solved.

FIG. 2 is a flowchart of a method for obtaining a public key according to an embodiment of the present invention. As shown in FIG. 2, the method includes:

200, establishing a TCP connection with the DNS server;

210. Send a DNS request packet to the DNS server to obtain the public key of the first domain by using the TCP connection established in 200. In this embodiment, the public key may be an RSA key, or other secrets may be used. The key of the key system, which is not limited here;

And receiving a DNS response packet from the DNS server, where the DNS response packet is a response of the DNS server to the DNS request packet, where the DNS response packet carries the public key of the first domain. ;

230. Obtain a public key of the first domain according to the received DNS response packet. Optionally, in this embodiment, the DNS request packet sent to the DNS server may further carry the type identifier of the public key of the first domain that is requested to be obtained. In this way, the DNS server can carry the corresponding type of public key in the DNS response message.

Alternatively, in this embodiment, the DNS response packet may carry a TXT type resource record of the public key. At this time, the public key of the first domain is obtained according to the TXT type resource record of the first domain public key carried in the received DNS response message.

FIG. 3 is a schematic diagram of an apparatus for obtaining a public key according to an embodiment of the present invention. As shown in FIG. 3, the apparatus includes:

Establishing a connection module 300, configured to establish a TCP connection with the DNS server;

The sending module 310 is configured to send a DNS request packet to the DNS server to establish a public key of the first domain by establishing a TCP connection established by the connection module 300. In this embodiment, the public key may be an RSA key, The key may be a key of another key system, which is not limited herein; the receiving module 320 is configured to receive a DNS response from the DNS server by establishing a TCP connection established by the connection module 300, and the DNS response The message is the response of the DNS server to the DNS request message, and the DNS response message carries the public key of the first domain;

The obtaining module 330 is configured to obtain the public key of the first domain according to the DNS response packet received by the receiving module 320.

Optionally, as shown in FIG. 4, the sending module 310 may further include:

The identifier unit 311 is configured to: carry the type identifier of the public key of the first domain in the DNS request packet, and send, by the sending unit 312, the DNS request for sending the type identifier of the public key of the first domain to the DNS server. .

Optionally, the DNS response packet may carry a TXT type resource record of the public key. In this case, the obtaining module 330 is configured to use the TXT type of the first domain public key carried in the DNS response packet received by the receiving module 320. Resource record, get the public key of the first domain.

FIG. 5 is a schematic diagram of a system for obtaining a public key according to an embodiment of the present invention. As shown in FIG. 5, the system includes a first device and a DNS server, where:

The first device is configured to establish a TCP connection with the DNS server, send a DNS request message to the DNS server, request to obtain the public key of the first domain, and receive a DNS response from the DNS server. The packet obtains the public key of the first domain carried in the DNS response packet. In this embodiment, the public key may be an RSA key, or a key of another key system, and is not used here. limited;

The DNS server is configured to send a DNS response packet to the first device by using the TCP connection after receiving the DNS request packet, where the DNS response packet carries the public key of the first domain.

The method, device, and system for obtaining a public key provided by the foregoing embodiments of the present invention, because a UDP connection is not established with a DNS server, but is performed based on TCP, so even if the length of the public key of the domain exceeds the protocol The specified packet length can also obtain the public key of the domain through multiple TCP packets. Therefore, in the prior art, the problem that the public key of the domain is too long to obtain the public key through the UDP packet is solved.

In the following, another embodiment of the present invention will be specifically described by another scenario which is more common in practical applications.

As shown in Figure 6, domain ABC.com has a key pair Y1/Y2 (public/private key) and Z1/Z2 (public/private key), and when domain ABC.com sends a message to user Q (such as electronic In the case of a mail, a signature is generated using the private key of one of the keys, and is carried in the text. For example, the domain ABC.com uses the key pair to generate a signature for the private key Y2 in Y1/Y2 and carries it in the message sent to user Q. In this scenario, the key system used by the domain ABC.com is the short key system (also known as the short key algorithm).

In the present application, a short key can be understood as a key whose key length can be carried by a single UDP message and has a security strength greater than 80 and a bit strength greater than 0.1. Here, "per bit strength" refers to the ratio of the security strength of the key to the length of the key. The security strength of a given length of key is usually referred to as the amount of work required to break the key. Take the RSA key system as an example. The security strength and strength per bit of RSA keys of different lengths are shown in Table 1: Table 1

Key length (bits) security strength per bit strength

1024 80 0.078

2048 112 0.055

3072 128 0.042 The more common short key systems are: ECDSA (曰liptic Curve Digital Signature Algorithm), Lattice-Based Public-Key Cryptography, password-based public key cryptosystem (Password) -Based Public-Key Cryptography Using Identity-Based Public-Key Cryptography Using Pairing. Of course, other keys that meet the above requirements can also be understood as short keys. There is no limit here. In this scenario, the key pair Y1/Y2 and Z1/Z2 can be any one of the short key systems, which is not limited herein.

After receiving the message, the user Q needs to verify the signature to confirm that the message is indeed from the domain ABC.com. For example, the user Q can use the public key Y1 corresponding to the private key Y2 to sign the signature in the positive message. If the user Q does not have the public key Y1, the DNS server needs to send a DNS request packet to request the public key Y1.

In this scenario, a UDP connection can be established between the user Q and the DNS server, and the user Q sends the DNS request packet to the DNS server through the UDP connection; the TCP connection can also be established between the user Q and the DNS server, and the user Q connects through the TCP. The above-mentioned DNS request packet is sent to the DNS server. Of course, other communication connections may be used, which is not limited herein. When a TCP connection is established between the user Q and the DNS server, the specific process may refer to the process in which the user P communicates with the DNS server in FIG. 1 , and details are not described herein.

Optionally, in this scenario, the domain ABC.com has two pairs of public/private key pairs. Therefore, after receiving the packet from the domain ABC.com, the user Q can learn the signature carried in the packet. The domain ABC.com uses which key system to generate the signature. Therefore, the DNS request packet sent by the user Q to the DNS server may carry the type identifier of the public key requested to be obtained. For example, if the key pair Y1/Y2 is in the ECDSA key system, the DNS request message sent by the user Q to the DNS server carries the type identifier of the key system. This prevents the DNS server from sending another key pair Z1/Z2's public key Z1 to user Q, or both Y1 and Z1 to user Q.

After receiving the DNS request message, the DNS server sends a DNS response message to the user Q based on the communication connection, and the DNS response message carries the public key Y1 of the domain ABC.com. For example, the DNS response packet may carry a resource record of the type of the public key Υ1. When DNS When the request packet carries the type identifier of the public key to be obtained, the DNS server may also carry the public key of the corresponding type in the DNS response packet according to the type identifier of the public key carried in the DNS request packet, and send the message to the user Q. .

At this point, User Q has obtained the public key Y1 of the domain ABC.com. Then, the obtained public key Υ1 can be used to verify the signature in the message.

In this scenario, because the public key of the short key system is passed between the user Q and the DNS server, the length of the public key is not established regardless of whether the UDP connection or the TCP connection is established between the user Q and the DNS server. Will exceed the length of the message as specified in the agreement. Therefore, in the prior art, the problem that the public key of the domain is too long to obtain the public key through the UDP packet is solved.

FIG. 7 is a flowchart of still another method for obtaining a public key according to an embodiment of the present invention. As shown in FIG. 7, the method includes:

And establishing a communication connection with the DNS server. In this embodiment, the communication connection may be a UDP connection, a TCP connection, or another communication connection, which is not limited herein;

710. Send a DNS request packet to the DNS server to obtain the public key of the first domain by using the communication connection established in the 700. In this embodiment, the public key is a key that uses a short key system.

720. Receive, by using the TCP connection established in the 700, a DNS response packet from the DNS server, where the DNS response packet is a response of the DNS server to the DNS request packet, where the DNS response packet carries the public key of the first domain. ;

730. Obtain a public key of the first domain according to the received DNS response packet.

Optionally, in this embodiment, the DNS request packet sent to the DNS server may also carry the type identifier of the public key of the first domain that is requested to be obtained. In this way, the DNS server can carry the corresponding type of public key in the DNS response message.

Optionally, the Question option in the DNS request packet carries the type identifier of the public key of the first domain. As shown in Figure 8 (a), there are three fields in the Question option, namely Query Name, Query Type, and Query Class. The type identifier of the public key of the first domain in this embodiment may be carried in the Query Name field. For example, you can carry the following information in the Query Name field: ecdsa.Beijing._domainkey.ABC.com. Among them, "ecdsa" represents the public key of ecdsa type, "Beijing" is the selector identifier, "_domainkey" is the DKIM identifier, and "ABC.com" is the domain name. Specifically, reference may be made to the format shown in FIG. 8(b). Where count is a count bit, indicating the number of bits between the current count bit and the next count bit.

Of course, Figure 8 (a) and Figure 8 (b) only show an alternative representation of the type identification of the public key in the DNS request message. The manner of expressing the type identifier of the public key in the DNS request packet in this embodiment is not limited thereto.

FIG. 9 is a schematic diagram of another apparatus for obtaining a public key according to an embodiment of the present invention. As shown in FIG. 9, the apparatus includes:

The connection module 900 is configured to establish a communication connection with the DNS server. In this embodiment, the communication connection may be a UDP connection, a TCP connection, or another communication connection, which is not limited herein;

The sending module 910 is configured to send a DNS request packet to the DNS server to establish a public key of the first domain by establishing a communication connection established by the connection module 900. In this embodiment, the public key is a short key system. Key

The receiving module 920 is configured to receive a DNS response message from the DNS server by establishing a communication connection established by the connection module 900, where the DNS response message is a response of the DNS server to the DNS request message, where the DNS response message is carried. The public key of the first domain;

The obtaining module 930 is configured to obtain the public key of the first domain according to the DNS response packet received by the receiving module 920.

Optionally, as shown in FIG. 10, the sending module 910 may further include:

The identifier unit 911 is configured to: carry the type identifier of the public key of the first domain in the DNS request packet, and send, by the sending unit 912, the DNS request for sending the type identifier of the public key of the first domain to the DNS server. .

Optionally, the DNS response packet may carry a TXT type resource record of the public key. The obtaining module 930 is configured to obtain the public key of the first domain according to the resource record of the TXT type of the first domain public key carried in the DNS response message received by the receiving module 920.

FIG. 11 is a schematic diagram of another system for obtaining a public key according to an embodiment of the present invention. As shown in FIG. 11, the system includes a first device and a DNS server, where:

The first device is configured to establish a communication connection with the DNS server, send a DNS request packet to the DNS server, and request to obtain the public key of the first domain; receive the DNS response packet from the DNS server, and obtain the DNS response packet. In the embodiment, the public key is a key using a short key system; the communication connection may be a UDP connection, a TCP connection, or another communication connection, where Not limited;

The method, device and system for obtaining a public key provided by the above embodiment of the present invention, because of the public key transmitted between the DNS server and the short key system, the UDP is established between the DNS server and the DNS server. The connection is still a TCP connection, and the length of the public key does not exceed the length of the packet specified by the protocol. Therefore, in the prior art, the problem that the public key of the domain is too long to obtain the public key through the UDP packet is solved.

Through the description of the above embodiments, those skilled in the art can clearly understand that the embodiments of the present invention can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on the understanding, the technical solution of the embodiment of the present invention may be embodied in the form of a software product, where the computer software product may be stored in a storage medium, such as a ROM/RAM, a magnetic disk, an optical disk, etc., and includes a plurality of instructions for making a A computer device, or server, or other network device, performs the methods described in various embodiments of the present invention or in some portions of the embodiments.

The above are only the preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Rights request

A method for obtaining a public key, comprising:

Establish a transmission control protocol TCP connection with the domain name system DNS server;

Sending, by using the TCP connection, a DNS request packet to the DNS server, requesting obtaining a public key of the first domain;

Receiving, by the TCP connection, a DNS response packet from the DNS server; the DNS response packet carrying a public key of the first domain;

Obtaining a public key of the first domain according to the DNS response packet.

2. The method according to claim 1, wherein the DNS request message carries a type identifier of a public key of the first domain.

The method of claim 1 or 2, wherein the DNS response packet carries the public key of the first domain, specifically: the DNS response packet carries the first domain public key Resource record for the text type.

4. A device for obtaining a public key, comprising:

a sending module, configured to send a DNS request packet to the DNS server by using the TCP connection established by the establishing connection module, to obtain a public key of the first domain;

a receiving module, configured to receive, by using the TCP connection established by the establishing connection module, a DNS response packet from the DNS server, where the DNS response packet carries a public key of the first domain;

And an obtaining module, configured to acquire the public key of the first domain according to the DNS response packet received by the receiving module.

The device according to claim 4, wherein the sending module comprises: an identifying unit, configured to carry, in the DNS request packet, a type identifier of a public key of the first domain;

And a sending unit, configured to send, to the DNS server, the DNS request that carries the type identifier of the public key of the first domain.

6. A system for obtaining a public key, comprising: a first device, configured to establish a TCP connection with the DNS server, send a DNS request message to the DNS server, request to acquire a public key of the first domain, and receive a DNS response message from the DNS server. Obtaining the public key of the first domain carried in the DNS response packet;

The DNS server is configured to send the DNS response packet to the first device by using the TCP connection after receiving the DNS request packet, where the DNS response packet carries the first domain Public key.

7. A method for obtaining a public key, comprising:

Establish a communication connection with the DNS server;

Sending, by the communication connection, a DNS request packet to the DNS server, requesting to obtain a public key of the first domain; the public key is a key using a short key system;

Receiving, by the communication connection, a DNS response message from the DNS server; the DNS response message carrying a public key of the first domain;

8. The method according to claim 6, wherein the DNS request message carries a type identifier of a public key of the first domain.

The method according to claim 7 or 8, wherein the DNS response packet carries the public key of the first domain, specifically: the DNS response packet carries the first domain public key Resource record for the text type.

10. A device for obtaining a public key, comprising:

a sending module, configured to send a DNS request message to the DNS server by using the communication connection established by the establishing connection module, requesting to acquire a public key of the first domain; the public key is a key using a short key system;

a receiving module, configured to receive, by using the communication connection established by the establishing connection module, a DNS response packet from the DNS server, where the DNS response packet carries a public key of the first domain;

An obtaining module, configured to obtain, according to the DNS response packet received by the receiving module, The public key of the first domain.

The device according to claim 10, wherein the sending module comprises: an identifying unit, configured to carry, in the DNS request packet, a type identifier of a public key of the first domain;

12. A system for obtaining a public key, comprising:

a first device, configured to establish a communication connection with the DNS server, send a DNS request message to the DNS server, request to acquire a public key of the first domain, and receive a DNS response message from the DNS server. Obtaining a public key of the first domain carried in the DNS response packet; the public key is a key using a short key system;

The DNS server is configured to send the DNS response packet to the first device by using the communication connection after receiving the DNS request packet, where the DNS response packet carries the first domain Public key.