WO2014117600A1

WO2014117600A1 - Dns-based method and system for user authentication and domain name access control

Info

Publication number: WO2014117600A1
Application number: PCT/CN2013/089836
Authority: WO
Inventors: 延志伟
Original assignee: 中国科学院计算机网络信息中心
Priority date: 2013-01-31
Filing date: 2013-12-18
Publication date: 2014-08-07
Also published as: CN103078877A; CN103078877B

Abstract

Disclosed are a DNS-based method and system for user authentication and domain name access control. The method comprises: a service provider establishing an authentication server for a service provided by the service provider, and registering an IP address of the authentication server in a DNS server, and the DNS server establishing a CA resource record according to the IP address and an authentication protocol type; a user initiating a domain name query request to the DNS server, and the DNS server returning a CA resource record corresponding to the domain name to the user; the user accessing the authentication server and performing authentication according to the CA resource record; after the authentication succeeds, the authentication server returning, to the user, key information required by secure connection, and assigning an application server; and the user having access to an Internet resource by using the application server. In the present invention, a new resource record is introduced to the DNS system, the user is authenticated and the application server is assigned to the user, and the security and reliability of service providing are ensured by using separation of the service from the authentication.

Description

DNS-based user authentication and domain name access control method and system

Technical field

The invention belongs to the technical field of network technology and domain name system, and particularly relates to a DNS-based user authentication and domain name access control method, and a system using the same. Background technique

Internet entities are usually identified by a domain name, and DNS is a key link between a domain name and an actual IP address. Through DNS, users can achieve the ultimate communication through IP addresses by entering a friendly domain name.

In order to ensure the credibility of the IP address and domain name binding relationship, the IETF introduces the DNSSEC series of standards. DNSSEC can enable a domain operator to directly sign the DNS information through a specific mechanism. The key used is between the parent domain and the parent domain. There is a binding, and the intermediate entity can find an acceptable final trust anchor through this logic. With the help of DNSSEC, the IETF established the DANE working group to use DNSSEC to implement secure binding between user domain names and their keys, thus enabling users to securely authenticate services. However, this mechanism lacks the server-side authentication of users and the ability to differentiate services based on different users. Summary of the invention

The present invention provides a DNS-based user authentication and domain name access control method and system. By introducing a new resource record in the DNS system, the user is guided to perform authentication before the service is established, and the access address of the corresponding server is obtained according to the authentication result. Security key information, which implements the function of authenticating the access user and assigning the server according to the user.

To achieve the above object, the present invention adopts the following technical solutions:

A DNS-based user authentication and domain name access control method, the steps of which include:

1) The service provider establishes an authentication server for the service provided by the service provider, and registers the IP address of the authentication server in the DNS server, and the DNS server establishes the CA resource record according to the IP address and the type of the authentication protocol supported by the authentication server;

2) The user initiates a domain name query request to the DNS server, and the DNS server returns the CA resource record corresponding to the domain name to the user;

3) The user accesses the corresponding authentication server according to the obtained IP address in the CA resource record, and the authentication server authenticates the user by using the protocol type specified by the CA resource record;

4) After the authentication is successful, the authentication server returns the key information required for the secure connection to the user, and assigns an application server to the user; 5) The user initiates a secure connection through the application server and accesses Internet resources.

In the above method, the authentication protocol type may be RADIUS, Diameter, or the like.

In the above method, the CA (Certificate Authority) resource record includes an IP address and an authentication protocol of the authentication server; preferably, the format is:

Domain-name TTL CA Protocol® IP,

Domain-name indicates the domain name, TTL indicates the lifetime value (effective lifetime) of the resource record, Protocol is the authentication protocol used, and IP is the address of the authentication server. The meaning of the above record is: The service identified by the domain-name is authenticated by the authentication server with the IP address. The authentication protocol used is Protocol. The effective lifetime of the record is TTL.

In the above method, the key information may be key information used when accessing the https website, or key information used when establishing a secure connection such as SSL.

A DNS-based user authentication system for implementing the above method, comprising a DNS server and a client, further comprising an authentication server; the DNS server storing an IP address of the authentication server, and according to the IP address and the authentication The authentication protocol type supported by the server establishes a CA resource record; the DNS server receives the domain name query request of the user, and returns a CA resource record corresponding to the domain name to the user; the authentication server uses the protocol type specified by the CA resource record to perform the user Authentication, returning the key information required for a secure connection to the user after successful authentication, and assigning an application server to the user.

The invention introduces a new resource record in the DNS system, guides the user to perform authentication before the service establishment, and obtains an access address and security key information of the corresponding server according to the authentication result, thereby realizing authentication of the access user and assigning the server according to the user. The function. The invention supports the service provider's authentication to the user, and the separation of the service and the authentication ensures the security and reliability of the service provision; and the different users can be directed to different servers of the same service to serve as a differentiated service. DRAWINGS

1 is a flow chart of a DNS-based user authentication and domain name access control method of an embodiment.

2 is a schematic diagram of the composition and workflow of a DNS-based user authentication system of an embodiment. detailed description

The present invention will be described in detail below by way of specific embodiments and with reference to the accompanying drawings.

Figure 1 is a flow chart of DNS-based user authentication and secure connection using the system. FIG. 2 is a schematic diagram showing the composition and workflow of the DNS-based user authentication system in this embodiment. The system includes a DNS server, a client, an application server, and an authentication server.

The implementation process of this embodiment will be specifically described below with reference to FIGS. 1) The service provider deploys and establishes an authentication server for the service provided by the service provider, and registers the IP address of the authentication server in the DNS server, and the DNS server establishes a CA resource record according to the IP address and the type of the authentication protocol.

The domain name can have multiple resource records on the DNS. For example, the A record records the IPv4 server address of the domain name, the AAAA records the IPv6 server address where the domain name is stored, the TLSA record stores the public key information of the domain name, and the like. Record the authentication server information of the domain name.

2) The user to be authenticated wants to initiate a secure connection to the domain name such as www.example.cn, first sends a query request to the DNS server, and queries the address information of the domain name via DNS.

3) The DNS server returns the CA resource record corresponding to the domain name, which includes the authentication server address and the type of security authentication protocol supported by the authentication server, such as RADIUS and Diameter. The authentication protocol is determined by the service provider deploying the authentication server.

Specifically, if the DNS server finds that the domain name has a CA resource record, it responds to the CA resource record to the client, and the content of the CA resource record included in the response message is: www.example.com 100 CA Diameter® 1.1.1.1 The client is based on The CA resource record indicates that the application server to be accessed is deployed with the authentication server. The authentication protocol used is Diameter, the IP address of the server is 1.1.1.1, and the effective lifetime of the record is 100s.

The factor of life time setting is mainly the effective time of this resource record. For example, when deploying the authentication server, if the server address or authentication protocol type is updated every 100s, the TTL should be set to 100s.

4) In order to establish a secure connection, the user initiates an authentication process to the authentication server, and the protocol used is the protocol returned from the DNS.

Specifically, the client initiates a Diameter authentication request to the authentication server of 1.1.1.1, which carries the domain name that the client wants to access. The authentication server and the client exchange Diameter signaling to authenticate the identity of the client.

This certification process is in accordance with the standard procedures of the IETF's existing agreements.

5) After the authentication is successful, the authentication server assigns the client the application server and the key information needed to establish a secure connection with the server.

The key information may be key information used when accessing the https website, or key information to be used when establishing a secure connection such as SSL.

The authentication server assigns the appropriate application server IP to the user, for example, assigning different servers according to the user's identity, thereby obtaining different rights of content, that is, different users can be directed to different servers of the same service to differentiate the services.

In this example, the application server 1 corresponding to www.example.com is the domain name accessible by the VIP user, and the application server 2 is the domain name accessed by the ordinary user, as shown in FIG. 2 .

6) The client uses the key information to establish an SSL secure connection with the application server 2 assigned by the authentication server, thereby initiating a secure connection process and accessing the content corresponding to the domain name. The above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to be limiting, and those skilled in the art can make modifications or equivalents to the embodiments of the present invention without departing from the spirit and scope of the present invention. The scope of protection shall be as stated in the claims.

Claims

claims

1. A DNS-based user authentication and domain name access control method, the steps include:

1) The service provider establishes an authentication server for the services it provides and registers the IP address of the authentication server in the DNS server. The DNS server establishes a CA resource record based on the IP address and the authentication protocol type supported by the authentication server;

3) The user accesses the corresponding authentication server based on the IP address in the obtained CA resource record, and the authentication server uses the protocol type specified by the CA resource record to authenticate the user;

4) After successful authentication, the authentication server returns the key information required for secure connection to the user, and assigns an application server to the user;

5) The user initiates a secure connection through the application server and accesses Internet resources.

2. The method according to claim 1, characterized in that: the authentication protocol type is RADIUS or Diameter.

3. The method of claim 1, wherein the format of the CA resource record is Domain-name TTL CA Protocol® IP, where Domain-name represents the domain name, TTL is the life value of the resource record, and Protocol is the authentication protocol used, and IP is the address of the authentication server.

4. The method according to claim 3, characterized in that: the health value is 100s.

5. The method of claim 1, characterized in that: the key information is the key information used when accessing an https website, or the key information needed to establish a secure connection such as SSL.

6. The method of claim 1, characterized in that: the authentication server directs different users to different servers of the same service based on user identities.

7. A DNS-based user authentication system, including a DNS server and a client, characterized in that it also includes an authentication server; the DNS server stores the IP address of the authentication server, and performs authentication based on the IP address and the authentication server's support. The authentication protocol type establishes a CA resource record; the DNS server receives the user's domain name query request and returns the CA resource record corresponding to the domain name to the user; the authentication server uses the protocol type specified by the CA resource record to authenticate the user. After successful authentication, the key information required for secure connection is returned to the user, and an application server is assigned to the user.

8. The system of claim 7, wherein the format of the CA resource record is Domain-name TTL CA Protocol® IP, where Domain-name represents the domain name, TTL is the life value of the resource record, and Protocol is the authentication protocol used, and IP is the address of the authentication server.

9. The system according to claim 7, characterized in that: the key information is the key information used when accessing an https website, or the key information needed to establish a secure connection such as SSL.

10. The system according to claim 7, characterized in that: the authentication server directs different users to different servers of the same service based on user identities.