WO2015158194A1 - Dns安全系统及其故障处理方法 - Google Patents

Dns安全系统及其故障处理方法 Download PDF

Info

Publication number
WO2015158194A1
WO2015158194A1 PCT/CN2015/074614 CN2015074614W WO2015158194A1 WO 2015158194 A1 WO2015158194 A1 WO 2015158194A1 CN 2015074614 W CN2015074614 W CN 2015074614W WO 2015158194 A1 WO2015158194 A1 WO 2015158194A1
Authority
WO
WIPO (PCT)
Prior art keywords
dns
root node
authorization information
domain name
resolution
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2015/074614
Other languages
English (en)
French (fr)
Inventor
谭晓生
齐向东
濮灿
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Qihoo Technology Co Ltd
Qizhi Software Beijing Co Ltd
Original Assignee
Beijing Qihoo Technology Co Ltd
Qizhi Software Beijing Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Qihoo Technology Co Ltd, Qizhi Software Beijing Co Ltd filed Critical Beijing Qihoo Technology Co Ltd
Priority to US15/305,091 priority Critical patent/US9992156B2/en
Publication of WO2015158194A1 publication Critical patent/WO2015158194A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0654—Management of faults, events, alarms or notifications using network fault recovery
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0677—Localisation of faults
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service

Definitions

  • the present invention relates to the field of Internet applications, and in particular, to a DNS security system, and a method for applying the DNS security system for fault processing.
  • DNS is the abbreviation of Domain Name System. It is a core service of the Internet. It is a distributed database that can map domain names and IP addresses to each other, which makes it easier for people to access the Internet without having to go. Remember the IP number string that can be read directly by the machine.
  • the general structure of an Internet host domain name is: host name, third-level domain name, second-level domain name, top-level domain name.
  • the Internet's top-level domain name is registered and managed by the Internet Network Association domain name registration query committee responsible for network address allocation. It also assigns a unique IP address to each host on the Internet.
  • FIG. 1 shows a schematic diagram of an overall DNS architecture in accordance with the background art.
  • the DNS architecture is a hierarchical tree structure called the DNS namespace.
  • the top namespace is called the "root node.”
  • the entire DNS architecture forms a domain name hierarchy.
  • the path from the top-level domain to a sub-domain constitutes a domain name, for example, from the top-level domain .com to its secondary domain microsoft, to the microsoft sub-domain departmentA. Formed a domain name departmentA.microsoft.com.
  • the DNS root server is the "root" of the DNS tree name space, responsible for DNS resolution, and plays a key role in domain name resolution.
  • any form of standard domain name to be analyzed in accordance with the technical process, must be completed through the work of the global "hierarchical" domain name resolution system.
  • the first layer of the "hierarchical" domain name resolution system is the root server, which is responsible for managing the domain name information of countries all over the world.
  • the top-level domain name server that is, the database of the relevant national domain name management organization, such as CNNIC in China, and then to the next Level domain database and ISP (Internet Service Provider) cache server query.
  • ISP Internet Service Provider
  • the present invention has been made in order to provide a DNS security system and corresponding method of fault handling that overcomes the above problems or at least partially solves or alleviates the above problems.
  • a DNS security system comprising:
  • At least one client configured to initiate a DNS request
  • a root node configured to provide authorization information to the DNS request
  • the authorization information database is configured to store all DNS requests and corresponding authorization information of the specified area
  • the virtual root node is configured to invoke corresponding authorization information from the authorization information database to provide a resolution service for the corresponding client when the root node has a DNS resolution fault.
  • the virtual root node is started, and the virtual root node is used to invoke the authorization information stored in the authorization information database to provide a DNS resolution service to the client.
  • a computer program comprising computer readable code, when the computer readable code is run on a computing device, causing the computing device to perform according to any of the above A method of applying a DNS security system for troubleshooting.
  • a computer readable medium wherein the computer program described above is stored.
  • a virtual root node is set.
  • the virtual root node can implement the DNS resolution function instead of the root node.
  • the authorization information database stores all DNS requests and corresponding authorization information in the specified area, so that the virtual root node can have sufficient resources.
  • virtual The implementation of the root node is implemented on the basis of the authorization information database.
  • the client can provide DNS resolution function when the root node resolves the fault, which can reduce the DNS single point of failure and improve the DNS defense attack capability, and can also set access to the virtual root node. Permission control, shielding DNS attack data, improving the security and stability of DNS resolution. For a dangerous DNS attack, if the specific authorization information is not queried from the authorization information database, the virtual root node will not provide a resolution service for it, thus preventing DNS attacks.
  • FIG. 1 shows a schematic diagram of an overall DNS architecture according to the background art
  • FIG. 2 is a schematic structural diagram of a DNS security system according to an embodiment of the present invention.
  • FIG. 3 is a schematic diagram showing an authorization information database performing data backup on a local DNS server according to an embodiment of the present invention
  • FIG. 4 shows a specific architectural diagram of a DNS security system in accordance with one embodiment of the present invention
  • FIG. 5 is a block diagram showing another structure of a DNS security system according to an embodiment of the present invention.
  • FIG. 6 shows a process flow diagram of a method for troubleshooting using a DNS security system in accordance with one embodiment of the present invention
  • Figure 7 is a schematic block diagram of a computing device for performing a method of troubleshooting a DNS security system in accordance with the present invention.
  • Fig. 8 schematically shows a storage unit for holding or carrying program code implementing a method for performing troubleshooting of an application DNS security system according to the present invention.
  • FIG. 2 shows a schematic structural diagram of a DNS security system according to an embodiment of the present invention.
  • the DNS security system includes at least:
  • At least one client 210 configured to initiate a DNS request
  • the root node 220 is configured to provide authorization information for a DNS request initiated by any one of the clients 210;
  • the authorization information database 230 is configured to store all DNS requests and corresponding authorization information of the designated area;
  • the virtual root node 240 is configured to invoke the corresponding authorization information from the authorization information database 230 to provide a resolution service for the corresponding client 210 when the root node 220 has a DNS resolution failure.
  • a virtual root node is set.
  • the virtual root node can implement the DNS resolution function instead of the root node.
  • the authorization information database stores all DNS requests and corresponding authorization information in the specified area, so that the virtual root node can have sufficient resources.
  • the implementation of the virtual root node is implemented on the basis of the authorization information database.
  • the client can provide DNS resolution function when the root node resolves the fault, which can reduce the DNS single point of failure and improve the DNS defense attack capability, and can also set access to the virtual root node. Permission control, shielding DNS attack data, improving the security and stability of DNS resolution. For a dangerous DNS attack, if the specific authorization information is not queried from the authorization information database, the virtual root node will not provide a resolution service for it, thus preventing DNS attacks.
  • the processing of the DNS attack behavior is now described in detail.
  • the type of DNS behavior corresponding to the network data packet should be determined, and the processing entity that processes the network data packet is determined according to the determined type of DNS behavior, and then The network packet is forwarded to the determined processing body for processing.
  • the processing body may be composed of two layers, which are a kernel layer and an application layer, respectively.
  • the kernel layer includes the network layer, the driver layer, etc., and can implement functions such as cache and attack protection.
  • the application layer can perform basic parsing of network data packets, including the address after domain name resolution and the acquisition of data storage addresses.
  • the network data packet is divided into the kernel layer and the application layer respectively, and the DNS request can be processed according to the actual request, if a DNS request attack is encountered several million times a second. It can also be processed by a kernel with strong processing power, and a DNS request that requires relatively low timeliness can be processed by the application layer.
  • the kernel and the application layer are used to process DNS requests separately, and the large-volume DNS query can be realized in consideration of the huge processing capability of the kernel.
  • the modification or startup caused by the DNS request causes loading, since the kernel and the application layer are separately processed, one of them can use one of them to process the current DNS request, and the other continues to provide the external service. Therefore, the embodiment of the present invention improves the service processing capability of a single machine, greatly improves the processing capability and security protection capability of the system, and realizes dynamic domain name dynamic management and configuration, thereby realizing many customized complex functional requirements.
  • the processing entity may be determined to be a kernel, and when the DNS behavior type is a domain name resolution behavior, the processing entity may be determined to be an application layer.
  • cache and security protection can be implemented in the kernel module.
  • the kernel module can efficiently and stably process 98% of the resolution requests and Most of the attack protection.
  • the processing logic is relatively complex, and the basic parsing and management functions that are not so high in performance requirements are implemented in the application layer.
  • the kernel detects the network data packet, filters the DNS attack behavior carried in the network data packet, and forwards the filtered network data packet to the application layer for processing.
  • the kernel can start policies such as anti-DDOS attack policy, IP rate limit policy, and domain name rate limit policy.
  • policies such as anti-DDOS attack policy, IP rate limit policy, and domain name rate limit policy.
  • independent internal modules can be set for each policy in the kernel to implement different policies.
  • each network data packet has a signature code, and each signature code is unique. Therefore, the attribute of the DNS request of the network data packet can be judged according to the signature code, and the masquerading as a normal data packet can be discriminated. DNS attack operation. According to the following steps, it is determined whether the network packet carries the DNS attack behavior:
  • Step A calculating a signature of the network data packet
  • Step B determining whether the feature code is a signature code of the DNS attack behavior, and if so, executing step C, and if not, performing step D;
  • Step C if yes, determining that the network data packet carries the DNS attack behavior
  • Step D If no, it is determined that the network packet does not carry the DNS attack behavior.
  • the database usually stores a set of signature codes with known DNS attack behaviors.
  • the signatures calculated in step A are matched with the set of databases, and if the signatures calculated in step A exist. In the set, it is the DNS attack behavior, and vice versa.
  • the feature code may be determined according to domain name information such as IP or domain name, for example, calculating the number of network packets received from the same IP within a specified time to obtain a signature, and/or calculating a network packet received from the same domain within a specified time. number. If the number of network packets received from the same IP or the same domain name in one second is much larger than the number of packets that should be received, it proves that the IP address or domain name has been turned into an attack source. This is also the basic principle of the IP rate limiting policy and the domain name rate limiting policy. The IP address or domain name that proves to be the source of the attack, and then receive the network packet from this source, can be directly discarded or filtered to avoid being attacked by it, improving system security performance and processing efficiency.
  • domain name information such as IP or domain name
  • the network packet is sent to the application layer for processing.
  • the application layer can parse the network data packet, obtain the address information corresponding to the domain name, and obtain relevant data feedback to the client. And, the application layer can manage data such as domain name information to implement data management functions.
  • root nodes the number of root servers (ie, root nodes) is small and is mainly set in some areas, so other areas lack initiative and risk control functions in the process of domain name analysis.
  • the domain name system is the basic service of the Internet, and the root server is the basis of the entire domain name system.
  • the root server that controls the domain name resolution controls all the domain names and IP addresses. If the country with the root server suddenly blocks the domain name of a certain region, the website pointed to by these domain names will disappear from the Internet. Therefore, the establishment of a virtual root node is very important.
  • the virtual root node 240 is used for DNS resolution, in order to speed up the parsing speed, some commonly used DNS access records with relatively large amount of access, or some important domain names.
  • the DNS resolution record can be stored separately in the designated area of the authorization information database 230, so that the virtual root node 240 can quickly reply when queried in the authorization information database 230 to implement an emergency response. That is, in the authorization information database 230, the authorization information may include a DNS resolution record in which the storage access amount exceeds the access threshold, and/or a DNS resolution record of the important domain name.
  • the authorization information in the authorization information database 230 is matched with the process of parsing by the root node 220, and the domain name hierarchical space can be formed according to the mutual relationship of the authorization information, corresponding to the first level of the domain name space.
  • the data information in the authorization information database 230 can be updated in real time.
  • the real-time update here means that the new parsing record in the network is added to the authorization information database at intervals, or the part of the authorization information database that is not used for a long time can be deleted and deleted.
  • the authorization information database 230 is a mirror image of the Internet domain name hierarchy.
  • FIG. 3 is a diagram showing an authorization information database for data backup of a local DNS server according to an embodiment of the present invention.
  • the virtual root node 240 provides a DNS resolution service to the client 210 by means of a BGP (Border Gateway Protocol, a routing protocol used to connect to an independent system on the Internet).
  • BGP Border Gateway Protocol, a routing protocol used to connect to an independent system on the Internet.
  • the BGP mode may be anycast mode.
  • the virtual root node 240 controls the specified area range. In normal operation, the critical range of DNS requests may also be answered, but to ensure that the response of the area is normal, when a parsing exception occurs, the virtual root node Will 240 priority to ensure that the region's DNS normal response. To achieve this, the local area DNS request record or list may be set in the authorization information database 230 or the virtual root node 240. When the DNS request initiated by the client 210 exists in the record or list, then the priority is answered.
  • the virtual root node 240 can listen to the DNS data packet at the critical area exit of the designated area on the backbone network to determine whether a DNS resolution fault occurs. Specifically, taking China as an example, you can monitor DNS data packets at the exits of China, and monitor the correctness of DNS resolution records. Once the root node and other uncontrollable domain name resolution abnormalities are found, you can The corresponding request packet is transmitted to the virtual root node 240 for response, preventing the data from continuing to the foreign server and causing tampering.
  • the result of the root domain name resolution is generally not easily modified. If the currently returned parsing result does not match the pre-stored result in the history record, it proves that the parsing is falsified, and an alarm or manual intervention is required. In addition, if the authorization of a top-level domain is not working properly or the returned one is SERVFAIL, it can be judged directly that the analysis result is wrong.
  • a method for correcting the DNS result is: after the analytic result is falsified, the judgment is performed according to the alarm information, and the interface operation is clicked, and the system automatically switches to the DNS resolution of the virtual root node in batches.
  • the foregoing alarm information may be determined by combining the pre-collected illegal DNS IP and the legal DNS IP address whitelist list address.
  • the pre-collected malicious DNS IP address list may be a set of illegal DNS IP addresses pre-collected by the security vendor, and the pre-collection
  • the list of malicious DNS IP addresses can be a list of malicious DNS IP addresses pre-collected in the client database, or it can be a list of malicious DNS IP addresses downloaded from the website to the client database.
  • the pre-set legal DNS IP address whitelist may be pre-stored in the client database or downloaded from a website server (for example, a cloud security server).
  • the main security levels include “danger”, “warning” and “security”.
  • the security level is “dangerous”, which means the most threat to the user, the second is “warning”, and “safe”. The weakest.
  • the prompts on the interface can also be performed accordingly.
  • FIG. 4 shows a specific architectural diagram of a DNS security system in accordance with one embodiment of the present invention.
  • the virtual root node establishes a data link with the local DNS server and other DNS servers.
  • each DNS server in FIG. 4 can be regarded as at least one recursive DNS, and when the root node has a DNS resolution failure, the locally saved root node address is modified to point to the address of the virtual root node; or, Local domain name resolution is sent to the virtual root node.
  • the root node can be made to provide a domain name resolution service according to the data record stored in the authorization information database.
  • the local DNS server is provided with a cache, and the domain name resolution record is stored for a period of time.
  • the local DNS server first checks whether there is a cache of the domain name in its own space. If not, it sends a domain name resolution request to the root node (the root server). If the root node fails, the local DNS server does not view the cache of the domain name in its own space, and then sends a domain name resolution request for the domain name to the virtual root node.
  • FIG. 5 shows another structure of a DNS security system according to an embodiment of the present invention.
  • at least one recursive DNS 510 is added to FIG. 5 as compared to the DNS security system shown in FIG. Only one recursive DNS is illustrated in FIG. 5.
  • the embodiment of the present invention further provides a method for performing fault processing by using the DNS security system provided by any one of the above preferred embodiments or a combination thereof.
  • 6 shows a process flow diagram of a method for fault handling using a DNS security system in accordance with one embodiment of the present invention. Referring to FIG. 6, the flowchart includes at least steps S602 to S606:
  • Step S602 Obtain all DNS requests and corresponding authorization information of the specified area and store the same, and generate an authorization information database.
  • Step S604 determining whether the root node has a DNS resolution fault, and if so, triggering step S606, and if not, the process ends;
  • Step S606 If yes, the virtual root node is started, and the virtual root node is used to invoke the authorization information stored in the authorization information database to provide a DNS resolution service to the client.
  • the authorization information includes a DNS resolution record that stores access times exceeding an access threshold, and/or a DNS resolution record of important domain names.
  • the authorization information database forms a domain name hierarchy based on the relationship of the authorization information.
  • the authorization information database is a mirror image of the Internet domain name hierarchy.
  • the virtual root node is used to provide a DNS resolution service to the client, including: the virtual root node adopts a distributed deployment, and provides a DNS resolution service to the client through BGP.
  • the BGP mode includes the anycast mode.
  • determining whether the root node has a DNS resolution fault includes: listening to the DNS data packet at the critical area exit of the designated area in the backbone network to determine whether a DNS resolution fault occurs.
  • the above method further includes:
  • At least one recursive DNS modifies the saved root node address to point to the address of the virtual root node; or sends the local domain name resolution to the virtual root node.
  • a virtual root node is set.
  • the virtual root node can implement the DNS resolution function instead of the root node.
  • the authorization information database stores all DNS requests and corresponding authorization information in the specified area, so that the virtual root node can have sufficient resources.
  • the implementation of the virtual root node is implemented on the basis of the authorization information database.
  • the client can provide DNS resolution function when the root node resolves the fault, which can reduce the DNS single point of failure and improve the DNS defense attack capability, and can also set access to the virtual root node. Permission control, shielding DNS attack data, improving the security and stability of DNS resolution. For a dangerous DNS attack, if the specific authorization information is not queried from the authorization information database, the virtual root node will not provide a resolution service for it, thus preventing DNS attacks.
  • modules in the devices in the embodiments can be used. Adaptive changes are made and placed in one or more devices different from this embodiment.
  • the modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components.
  • any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined.
  • Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.
  • the various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof.
  • a microprocessor or digital signal processor may be used in practice to implement some or all of the functionality of some or all of the components of the DNS security system in accordance with embodiments of the present invention.
  • the invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein.
  • a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.
  • FIG. 7 illustrates a computing device that can implement a method of applying a DNS security system for troubleshooting in accordance with the present invention.
  • the computing device conventionally includes a processor 710 and a computer program product or computer readable medium in the form of a memory 720.
  • Memory 720 can be an electronic memory such as a flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, hard disk, or ROM.
  • Memory 720 has a memory space 730 for program code 731 for performing any of the method steps described above.
  • storage space 730 for program code may include various program code 731 for implementing various steps in the above methods, respectively.
  • These program codes can be from one or more computer program products Read or write to one or more computer program products.
  • Such computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks.
  • Such a computer program product is typically a portable or fixed storage unit as described with reference to FIG.
  • the storage unit may have storage segments, storage spaces, and the like that are similarly arranged to memory 720 in the computing device of FIG.
  • the program code can be compressed, for example, in an appropriate form.
  • the storage unit includes computer readable code 731', ie, code readable by a processor, such as 710, that when executed by a computing device causes the computing device to perform each of the methods described above step.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明提供了一种DNS安全系统及其故障处理方法。DNS安全系统包括：至少一个客户端，配置为发起DNS请求；根节点，配置为对所述DNS请求提供授权信息；授权信息数据库，配置为存储指定区域的所有DNS请求及对应的授权信息；虚拟根节点，配置为当所述根节点出现DNS解析故障时，从所述授权信息数据库中调用相应授权信息，为对应客户端提供解析服务。采用本发明能够提高DNS解析的安全性和稳定性。

Description

DNS安全系统及其故障处理方法 技术领域
本发明涉及互联网应用领域，尤其涉及一种DNS安全系统，以及应用该DNS安全系统进行故障处理的方法。
背景技术
DNS是域名系统(Domain Name System)的缩写，是因特网(Internet)一项核心服务，它作为可以将域名和IP地址相互映射的一个分布式数据库，能够使人更方便的访问互联网，而不用去记住能够被机器直接读取的IP数串。
Internet主机域名的一般结构为：主机名.三级域名.二级域名.顶级域名。Internet的顶级域名由Internet网络协会域名注册查询负责网络地址分配的委员会进行登记和管理，它还为Internet的每一台主机分配唯一的IP地址。
图1示出了根据背景技术的整体DNS架构的示意图。DNS架构是一个层次树状结构，这个树状结构称为DNS域名空间，最上面的域名空间被称为“根节点”。参见图1，整个DNS架构形成域名层次空间，从顶级域到某一个子域的路径就构成了一个域名，例如从顶级域.com到它的二级域microsoft，再到microsoft的子域departmentA就构成了一个域名departmentA.microsoft.com。
其中，DNS根服务器是DNS树型域名空间的“根”，负责DNS的解析，对于域名解析起着极其关键的作用。从理论上说，任何形式的标准域名要想被实现解析，按照技术流程，都必须经过全球“层级式”域名解析体系的工作才能完成。
“层级式”域名解析体系第一层就是根服务器，负责管理世界各国的域名信息，在根服务器下面是顶级域名服务器，即相关国家域名管理机构的数据库，如中国的CNNIC，然后再到下一级的域名数据库和ISP(Internet Service Provider，因特网服务供应商)的缓存服务器查询。一个域名必须首先经过根数据库的解析后，才能转到顶级域名服务器进行解析。如果DNS根节点不能访问，那么一切的域名解析都会 失败。
发明内容
鉴于上述问题，提出了本发明以便提供一种克服上述问题或者至少部分地解决或者减缓上述问题的DNS安全系统和相应的故障处理的方法。
根据本发明的一个方面，提供了一种DNS安全系统，包括：
至少一个客户端，配置为发起DNS请求；
根节点，配置为对所述DNS请求提供授权信息；
授权信息数据库，配置为存储指定区域的所有DNS请求及对应的授权信息；
虚拟根节点，配置为当所述根节点出现DNS解析故障时，从所述授权信息数据库中调用相应授权信息，为对应客户端提供解析服务。
根据本发明的另一个方面，提供了一种应用上述任一项所述的DNS安全系统进行故障处理的方法，包括：
获取指定区域的所有DNS请求及对应的授权信息并存储，生成授权信息数据库；
判断根节点是否出现DNS解析故障；
若是，启动虚拟根节点，利用所述虚拟根节点调用所述授权信息数据库中存储的授权信息，对客户端提供DNS解析服务。
根据本发明的又一个方面，提供了一种计算机程序，其包括计算机可读代码，当所述计算机可读代码在计算设备上运行时，导致所述计算设备执行根据上文任一个所述的应用DNS安全系统进行故障处理的方法。
根据本发明的再一个方面，提供了一种计算机可读介质，其中存储了上述的计算机程序。
本发明的有益效果为：
在本发明实施例中，设置了虚拟根节点，当根节点出现DNS解析故障时，虚拟根节点能够代替根节点实现DNS解析功能。为实现虚拟根节点这一功能，授权信息数据库中必须存储有足够的信息，即，授权信息数据库中存储指定区域内的所有DNS请求及对应的授权信息，这样虚拟根节点才能够有足够的资源对DNS请求进行应答。因此，虚 拟根节点的实现是在授权信息数据库的基础上实现的。结合新增的授权信息数据库以及虚拟根节点，能够在根节点解析故障的时候为客户端提供DNS解析功能，能够降低DNS单点故障和提高DNS防御攻击能力，同时还可以对虚拟根节点设置访问权限控制，屏蔽DNS的攻击数据，提高DNS解析的安全性及稳定性。对于危险DNS攻击，从授权信息数据库中查询不到具体的授权信息，则虚拟根节点不会为其提供解析服务，因此可以实现防止DNS攻击。
上述说明仅是本发明技术方案的概述，为了能够更清楚了解本发明的技术手段，而可依照说明书的内容予以实施，并且为了让本发明的上述和其它目的、特征和优点能够更明显易懂，以下特举本发明的具体实施方式。
附图说明
通过阅读下文优选实施方式的详细描述，各种其他的优点和益处对于本领域普通技术人员将变得清楚明了。附图仅用于示出优选实施方式的目的，而并不认为是对本发明的限制。而且在整个附图中，用相同的参考符号表示相同的部件。在附图中：
图1示出了根据背景技术的整体DNS架构的示意图；
图2示出了根据本发明一个实施例的DNS安全系统的结构示意图；
图3示出了根据本发明一个实施例授权信息数据库对本地DNS服务器进行数据备份的示意图；
图4示出了根据本发明一个实施例的DNS安全系统的具体架构图；
图5示出了根据本发明一个实施例的DNS安全系统的另一个结构示意图；
图6示出了根据本发明一个实施例的利用DNS安全系统进行故障处理的方法的处理流程图；
图7示意性地示出了用于执行根据本发明的应用DNS安全系统进行故障处理的方法的计算设备的框图；以及
图8示意性地示出了用于保持或者携带实现根据本发明的应用DNS安全系统进行故障处理的方法的程序代码的存储单元。
具体实施方式
下面结合附图和具体的实施方式对本发明作进一步的描述。
为解决上述技术问题，本发明实施例提供了一种DNS安全系统，用于在根节点结构故障时能够进行故障处理类的容灾处理。图2示出了根据本发明一个实施例的DNS安全系统的结构示意图。参见图2，DNS安全系统中至少包括：
至少一个客户端210，配置为发起DNS请求；
根节点220，配置为对任意一个客户端210发起的DNS请求提供授权信息；
授权信息数据库230，配置为存储指定区域的所有DNS请求及对应的授权信息；
虚拟根节点240，配置为当根节点220出现DNS解析故障时，从授权信息数据库230中调用相应授权信息，为对应客户端210提供解析服务。
在本发明实施例中，设置了虚拟根节点，当根节点出现DNS解析故障时，虚拟根节点能够代替根节点实现DNS解析功能。为实现虚拟根节点这一功能，授权信息数据库中必须存储有足够的信息，即，授权信息数据库中存储指定区域内的所有DNS请求及对应的授权信息，这样虚拟根节点才能够有足够的资源对DNS请求进行应答。因此，虚拟根节点的实现是在授权信息数据库的基础上实现的。结合新增的授权信息数据库以及虚拟根节点，能够在根节点解析故障的时候为客户端提供DNS解析功能，能够降低DNS单点故障和提高DNS防御攻击能力，同时还可以对虚拟根节点设置访问权限控制，屏蔽DNS的攻击数据，提高DNS解析的安全性及稳定性。对于危险DNS攻击，从授权信息数据库中查询不到具体的授权信息，则虚拟根节点不会为其提供解析服务，因此可以实现防止DNS攻击。
具体地，现对DNS攻击行为的处理进行详细描述。在本发明实施例中，对于接收的每个网络数据包，应判断出该网络数据包对应的DNS行为类型，并根据确定的DNS行为类型确定对该网络数据包进行处理的处理主体，进而将该网络数据包转至确定的处理主体进行处理。在本发明实施例中，处理主体可以由两层组成，分别是内核层、应用层。内核层包括网络层、驱动层等，可以实现高速缓存、攻击防护等功能， 而应用层可以对网络数据包进行基本解析，包括域名解析后的地址、数据存储地址的获取等。与现有技术中的DNS行为的处理方法相比较，将网络数据包分别划分至内核层和应用层处理，可以将DNS请求根据实际请求处理，若遇到一秒几百万次的DNS请求攻击，也可以由处理能力较强的内核对其进行处理，而遇见时效性要求相对较低的DNS请求，则可以由应用层处理。采用内核和应用层分别处理DNS请求，考虑到内核的巨大的处理能力，能够实现大流量的DNS查询。并且，因DNS请求所导致的修改或启动导致加载时，因内核和应用层是分别处理的，因此可以利用其中之一处理当前DNS请求，另一继续对外提供服务。因此，本发明实施例提高了单机的业务处理能力，大大提高系统的处理能力和安全防护能力的同时，还能实现快速域名动态管理和配置，进而实现很多定制化的复杂功能需求。
当DNS行为类型确定为攻击行为时，那么，可以确定处理主体为内核，而当DNS行为类型为域名解析行为时，可以确定处理主体为应用层。为了提升域名解析服务的响应速度、处理性能及安全防护能力，根据DNS的解析原理，在内核模块中可以实现高速缓存和安全防护，正常情况内核模块能高效、稳定地处理98％的解析请求和绝大部分的攻击防护。而处理逻辑相对复杂，对性能要求并不是那么高的基础解析和管理功能放在应用层实现。
因此，处理主体为内核时，由内核检测所述网络数据包，过滤将网络数据包中携带的DNS攻击行为；以及，将过滤后的网络数据包转发至应用层进行处理。内核检测网络数据包时，可以启动防DDOS攻击策略、IP限速策略、域名限速策略等策略，相应的，可以在内核中为每个策略设置独立的内部模块，用于实现不同策略。
此处需要说明的是，每个网络数据包都具备一个特征码，且每个特征码是独一无二的，因此，可以根据特征码判断网络数据包的DNS请求的属性，识破伪装成正常数据包的DNS攻击操作。现根据如下步骤判断所述网络数据包中是否携带有DNS攻击行为：
步骤A、计算网络数据包的特征码；
步骤B、判断特征码是否是DNS攻击行为的特征码，若是，执行步骤C，若否，执行步骤D；
步骤C、若是，则确定网络数据包中携带有DNS攻击行为；
步骤D、若否，则确定网络数据包中未携带有DNS攻击行为。
其中，数据库中通常存储有已知DNS攻击行为的特征码的集合，当需要校验时，将步骤A中计算出的特征码与数据库的集合进行匹配，若步骤A计算出的特征码存在所述集合中，则是DNS攻击行为，反之则不是。
其中，特征码可以根据IP或域名等域名信息确定，例如，计算指定时间内接收的来自同一IP的网络数据包数得到特征码，和/或计算指定时间内接收的来自同一域名的网络数据包数。若1秒内从同一IP或同一域名接收的网络数据包数远远大于应该接收的包数，就证明该IP地址或域名已被变成攻击源。这也是IP限速策略、域名限速策略的基本原理。被证明变为攻击源的IP地址或域名，之后再接收到来自这一源头的网络数据包，可以直接舍弃或过滤掉，避免被其攻击，提高系统安全性能及处理效率。
内核对攻击行为进行过滤之后，将网络数据包发至应用层进行处理。应用层可以对网络数据包进行解析，获取域名对应的地址信息，从而获取相关数据反馈给客户端。以及，应用层可以对域名信息等数据进行管理，实现数据管理功能。
目前全球仅有13台根服务器，且目前的分布是：主根服务器(A)美国1个，设置在弗吉尼亚州，辅根服务器(B至M)美国9个，瑞典、荷兰、日本各1个。由上述数据可知，根服务器(即根节点)数量较少，且主要设置在部分区域，那么其他区域在域名分析的过程中缺乏主动性和风险控制功能。
域名系统是互联网的基础服务，而根服务器更是整个域名系统的基础，控制了域名解析的根服务器，也就控制了相应的所有域名和IP地址。若存在根服务器的国家突然屏蔽某一地区的域名，那么这些域名所指向的网站就会从互联网上中消失。因此，虚拟根节点的设立十分重要。
在本发明实施例中，在根节点220DNS解析故障的情况下，使用虚拟根节点240进行DNS解析，为加快解析速度，某些常用的、访问量比较大的DNS解析记录，或者某些重要域名的DNS解析记录，可以单独存储在授权信息数据库230的指定区域中，以便虚拟根节点240到授权信息数据库230中查询时能够进行快速回复，实现紧急应答。 即，在授权信息数据库230中，授权信息可以包括存储访问量超过访问阈值的DNS解析记录，和/或，重要域名的DNS解析记录。
其中，需要说明的是，授权信息数据库230中的授权信息与根节点220解析的过程相匹配，能够根据授权信息的相互关系，组成域名层次空间，对应域名空间的第一级。并且，授权信息数据库230中的数据信息均能够实时更新。此处的实时更新是指每隔一段时间，会将网络中新的解析记录添加到授权信息数据库中，也可以将授权信息数据库中长期不使用的部分解析记录后移可删除。对于互联网而言，授权信息数据库230是互联网域名层次的镜像。图3示出了根据本发明一个实施例授权信息数据库对本地DNS服务器进行数据备份的示意图。
以中国为例，在采集DNS解析记录时，因根节点和国际域名的授权服务器都在国外，可以在中国骨干网出口进行抓包，将DNS解析记录进行提取分析，存储对应的DNS记录信息，保证抓取包的安全性和可靠性。
在本发明实施例中，虚拟根节点240采用分布式部署，通过BGP(Border Gateway Protocol，边界网关协议，用来连接Internet上独立系统的路由选择协议)方式对客户端210提供DNS解析服务。需要说明的是，优选地，BGP方式可以为任播(anycast)模式。
前文提及，虚拟根节点240控制的是指定区域范围，在正常运行情况下，临界范围的DNS请求也可能会被应答，但是为保证本区域的应答正常，当出现解析异常时，虚拟根节点会240优先保证本区域的DNS正常应答。为实现这一目的，可以在授权信息数据库230或虚拟根节点240中设置本区域DNS请求记录或列表，当客户端210发起的DNS请求在记录或列表中存在，那么优先对其进行应答。
为保证虚拟根节点240能够及时获知根节点解析故障，虚拟根节点240可以在骨干网对指定区域的临界区域出口处进行DNS数据报文的监听，以确定是否出现DNS解析故障。具体的，以中国为例，可以在中国对境外的出口处监听DNS数据报文，对DNS解析记录的正确性进行监控，一旦发现根节点和其他不可控的域名解析异常情况，在出口处可以将对应的请求包传送到虚拟根节点240进行应答，防止数据继续到国外服务器而导致被篡改。
根域名解析的结果一般是不会轻易修改，如果当前返回的解析结果与历史记录中预存的结果不匹配，则证明解析出现篡改，需要告警或采取人工干预。另外，如果当某个顶级域的授权无法正常工作或者返回的都为SERVFAIL也直接可以判断为解析结果错误。DNS的解析结果不正确的一种处理方法为：解析结果出现篡改后，根据告警信息进行判断，对界面操作点击，系统自动批量切换至虚拟根节点的DNS解析。
以上告警信息可以结合预先采集的非法DNS IP和合法的DNS IP地址白名单列表地址确定，例如预先收集的恶意DNS IP地址列表可以是由安全厂商预先收集的一组非法DNS IP地址，该预先收集的恶意DNS IP地址列表可以为客户端数据库中预先收集的恶意DNS IP地址列表，或者也可以为从网站上下载至客户端数据库中的恶意DNS IP地址列表。该预先设置的合法的DNS IP地址白名单列表可以预先存储在客户端数据库中，也可以从网站的服务器(例如：云安全服务器)上下载。
在具体实现中，主要的安全等级包括“危险”、“警告”和“安全”，其中，安全等级为“危险”的表示对用户的威胁最大，为“警告”的次之，为“安全”的最弱。界面上提示也可以据此进行。
图4示出了根据本发明一个实施例的DNS安全系统的具体架构图。参见图4，虚拟根节点会与本地DNS服务器以及其他DNS服务器间建立数据链路。为实现这一目的，图4中的各DNS服务器可以被视为至少一个递归DNS，在根节点出现DNS解析故障时，将本地保存的根节点地址修改为指向虚拟根节点的地址；或者，将本地的域名解析发送至虚拟根节点。从而能够使得根节点根据授权信息数据库存储的数据记录提供域名解析服务。
进一步，本地DNS服务器中设置有缓存，存储有之前一段时间内的域名解析记录。在域名解析过程中，本地DNS服务器会先在自己的空间内查看是否有这个域名的缓存，如果没有，就会向根节点(根服务器)发送这个域名的域名解析请求。若根节点故障，则本地DNS服务器在自己的空间内未查看到这个域名的缓存，则会向虚拟根节点发送这个域名的域名解析请求。
图5示出了根据本发明一个实施例的DNS安全系统的另一个结构 示意图，与图2所示的DNS安全系统相比，图5中增加了至少一个递归DNS 510。图5中仅仅示意了一个递归DNS，在实际应用中，可以存在多个，且每个递归DNS均可以为多个客户端进行服务。
在本发明实施例中，需要说明的是，若部分DNS服务器无法快速修复，会极大影响用户的感受体验，此时，客户端可以紧急将用户的DNS修改到能够正常运行的其他DNS服务器上，以保证用户能够正常使用网络。
基于同一发明构思，本发明实施例还提供了一种应用上述任意一个优选实施例或其组合所提供的DNS安全系统进行故障处理的方法。图6示出了根据本发明一个实施例的利用DNS安全系统进行故障处理的方法的处理流程图。参见图6，该流程图至少包括步骤S602至步骤S606：
步骤S602、获取指定区域的所有DNS请求及对应的授权信息并存储，生成授权信息数据库；
步骤S604、判断根节点是否出现DNS解析故障，若是，触发步骤S606，若否，流程结束；
步骤S606、若是，启动虚拟根节点，利用虚拟根节点调用授权信息数据库中存储的授权信息，对客户端提供DNS解析服务。
在一个优选的实施例中，授权信息包括存储访问量超过访问阈值的DNS解析记录，和/或，重要域名的DNS解析记录。
在一个优选的实施例中，授权信息数据库根据授权信息的相互关系形成域名层次空间。
在一个优选的实施例中，授权信息数据库为互联网域名层次的镜像。
在一个优选的实施例中，利用虚拟根节点对客户端提供DNS解析服务，包括：虚拟根节点采用分布式部署，通过BGP方式对客户端提供DNS解析服务。
在一个优选的实施例中，BGP方式包括anycast模式。
在一个优选的实施例中，判断根节点是否出现DNS解析故障，包括：在骨干网对指定区域的临界区域出口处进行DNS数据报文的监听，以确定是否出现DNS解析故障。
在一个优选的实施例中，上述方法还包括：
在根节点出现DNS解析故障时，至少一个递归DNS将保存的根节点地址修改为指向虚拟根节点的地址；或者，将本地的域名解析发送至虚拟根节点。
采用本发明实施例提供的DNS安全系统及其故障处理方法，能够达到如下有益效果：
在本发明实施例中，设置了虚拟根节点，当根节点出现DNS解析故障时，虚拟根节点能够代替根节点实现DNS解析功能。为实现虚拟根节点这一功能，授权信息数据库中必须存储有足够的信息，即，授权信息数据库中存储指定区域内的所有DNS请求及对应的授权信息，这样虚拟根节点才能够有足够的资源对DNS请求进行应答。因此，虚拟根节点的实现是在授权信息数据库的基础上实现的。结合新增的授权信息数据库以及虚拟根节点，能够在根节点解析故障的时候为客户端提供DNS解析功能，能够降低DNS单点故障和提高DNS防御攻击能力，同时还可以对虚拟根节点设置访问权限控制，屏蔽DNS的攻击数据，提高DNS解析的安全性及稳定性。对于危险DNS攻击，从授权信息数据库中查询不到具体的授权信息，则虚拟根节点不会为其提供解析服务，因此可以实现防止DNS攻击。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本发明的实施例可以在没有这些具体细节的情况下实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
类似地，应当理解，为了精简本公开并帮助理解各个发明方面中的一个或多个，在上面对本发明的示例性实施例的描述中，本发明的各个特征有时被一起分组到单个实施例、图、或者对其的描述中。然而，并不应将该公开的方法解释成反映如下意图：即所要求保护的本发明要求比在每个权利要求中所明确记载的特征更多的特征。更确切地说，如下面的权利要求书所反映的那样，发明方面在于少于前面公开的单个实施例的所有特征。因此，遵循具体实施方式的权利要求书由此明确地并入该具体实施方式，其中每个权利要求本身都作为本发明的单独实施例。
本领域那些技术人员可以理解，可以对实施例中的设备中的模块 进行自适应性地改变并且把它们设置在与该实施例不同的一个或多个设备中。可以把实施例中的模块或单元或组件组合成一个模块或单元或组件，以及此外可以把它们分成多个子模块或子单元或子组件。除了这样的特征和/或过程或者单元中的至少一些是相互排斥之外，可以采用任何组合对本说明书(包括伴随的权利要求、摘要和附图)中公开的所有特征以及如此公开的任何方法或者设备的所有过程或单元进行组合。除非另外明确陈述，本说明书(包括伴随的权利要求、摘要和附图)中公开的每个特征可以由提供相同、等同或相似目的的替代特征来代替。
此外，本领域的技术人员能够理解，尽管在此所述的一些实施例包括其它实施例中所包括的某些特征而不是其它特征，但是不同实施例的特征的组合意味着处于本发明的范围之内并且形成不同的实施例。例如，在下面的权利要求书中，所要求保护的实施例的任意之一都可以以任意的组合方式来使用。
本发明的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的软件模块实现，或者以它们的组合实现。本领域的技术人员应当理解，可以在实践中使用微处理器或者数字信号处理器(DSP)来实现根据本发明实施例的DNS安全系统中的一些或者全部部件的一些或者全部功能。本发明还可以实现为用于执行这里所描述的方法的一部分或者全部的设备或者装置程序(例如，计算机程序和计算机程序产品)。这样的实现本发明的程序可以存储在计算机可读介质上，或者可以具有一个或者多个信号的形式。这样的信号可以从因特网网站上下载得到，或者在载体信号上提供，或者以任何其他形式提供。
例如，图7示出了可以实现根据本发明的应用DNS安全系统进行故障处理的方法的计算设备。该计算设备传统上包括处理器710和以存储器720形式的计算机程序产品或者计算机可读介质。存储器720可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。存储器720具有用于执行上述方法中的任何方法步骤的程序代码731的存储空间730。例如，用于程序代码的存储空间730可以包括分别用于实现上面的方法中的各种步骤的各个程序代码731。这些程序代码可以从一个或者多个计算机程序产品 中读出或者写入到这一个或者多个计算机程序产品中。这些计算机程序产品包括诸如硬盘，紧致盘(CD)、存储卡或者软盘之类的程序代码载体。这样的计算机程序产品通常为如参考图8所述的便携式或者固定存储单元。该存储单元可以具有与图7的计算设备中的存储器720类似布置的存储段、存储空间等。程序代码可以例如以适当形式进行压缩。通常，存储单元包括计算机可读代码731’，即可以由例如诸如710之类的处理器读取的代码，这些代码当由计算设备运行时，导致该计算设备执行上面所描述的方法中的各个步骤。
本文中所称的“一个实施例”、“实施例”或者“一个或者多个实施例”意味着，结合实施例描述的特定特征、结构或者特性包括在本发明的至少一个实施例中。此外，请注意，这里“在一个实施例中”的词语例子不一定全指同一个实施例。
应该注意的是上述实施例对本发明进行说明而不是对本发明进行限制，并且本领域技术人员在不脱离所附权利要求的范围的情况下可设计出替换实施例。在权利要求中，不应将位于括号之间的任何参考符号构造成对权利要求的限制。单词“包含”不排除存在未列在权利要求中的元件或步骤。位于元件之前的单词“一”或“一个”不排除存在多个这样的元件。本发明可以借助于包括有若干不同元件的硬件以及借助于适当编程的计算机来实现。在列举了若干装置的单元权利要求中，这些装置中的若干个可以是通过同一个硬件项来具体体现。单词第一、第二、以及第三等的使用不表示任何顺序。可将这些单词解释为名称。
此外，还应当注意，本说明书中使用的语言主要是为了可读性和教导的目的而选择的，而不是为了解释或者限定本发明的主题而选择的。因此，在不偏离所附权利要求书的范围和精神的情况下，对于本技术领域的普通技术人员来说许多修改和变更都是显而易见的。对于本发明的范围，对本发明所做的公开是说明性的，而非限制性的，本发明的范围由所附权利要求书限定。

Claims (18)

  1. 一种DNS安全系统，包括：
    至少一个客户端，配置为发起域名系统DNS请求；
    根节点，配置为对所述DNS请求提供授权信息；
    授权信息数据库，配置为存储指定区域的所有DNS请求及对应的授权信息；
    虚拟根节点，配置为当所述根节点出现DNS解析故障时，从所述授权信息数据库中调用相应授权信息，为对应客户端提供解析服务。
  2. 根据权利要求1所述的系统，其中，所述授权信息包括存储访问量超过访问阈值的DNS解析记录，和/或，重要域名的DNS解析记录。
  3. 根据权利要求1或2所述的系统，其中，所述授权信息数据库，还配置为根据所述授权信息的相互关系，组成域名层次空间。
  4. 根据权利要求3所述的系统，其中，所述授权信息数据库为互联网域名层次的镜像。
  5. 根据权利要求1所述的系统，其中，所述虚拟根节点还配置为：采用分布式部署，通过边界网关协议BGP方式对所述客户端提供DNS解析服务。
  6. 根据权利要求5所述的系统，其中，所述BGP方式包括任播anycast模式。
  7. 根据权利要求1所述的系统，其中，所述虚拟根节点还配置为：在骨干网对所述指定区域的临界区域出口处进行DNS数据报文的监听，以确定是否出现DNS解析故障。
  8. 根据权利要求1至7任一项所述的系统，其中，所述系统还包括：
    至少一个递归DNS，配置为在所述根节点出现DNS解析故障时，将本地保存的根节点地址修改为指向所述虚拟根节点的地址；或者，将本地的域名解析发送至所述虚拟根节点。
  9. 一种应用权利要求1至8任一项所述的DNS安全系统进行故障处理的方法，包括：
    获取指定区域的所有域名系统DNS请求及对应的授权信息并存 储，生成授权信息数据库；
    判断根节点是否出现DNS解析故障；
    若是，启动虚拟根节点，利用所述虚拟根节点调用所述授权信息数据库中存储的授权信息，对客户端提供DNS解析服务。
  10. 根据权利要求9所述的方法，其中，所述授权信息包括存储访问量超过访问阈值的DNS解析记录，和/或，重要域名的DNS解析记录。
  11. 根据权利要求9或10所述的方法，其中，所述授权信息数据库根据所述授权信息的相互关系形成域名层次空间。
  12. 根据权利要求11所述的方法，其中，所述授权信息数据库为互联网域名层次的镜像。
  13. 根据权利要求9所述的方法，其中，利用所述虚拟根节点对客户端提供DNS解析服务，包括：所述虚拟根节点采用分布式部署，通过边界网关协议BGP方式对所述客户端提供DNS解析服务。
  14. 根据权利要求13所述的方法，其中，所述BGP方式包括任播anycast模式。
  15. 根据权利要求9所述的方法，其中，所述判断根节点是否出现DNS解析故障，包括：在骨干网对所述指定区域的临界区域出口处进行DNS数据报文的监听，以确定是否出现DNS解析故障。
  16. 根据权利要求9至15任一项所述的方法，其中，还包括：
    在所述根节点出现DNS解析故障时，至少一个递归DNS将保存的根节点地址修改为指向所述虚拟根节点的地址；或者，将本地的域名解析发送至所述虚拟根节点。
  17. 一种计算机程序，包括计算机可读代码，当所述计算机可读代码在计算设备上运行时，导致所述计算设备执行根据权利要求9至16中的任一项所述的应用DNS安全系统进行故障处理的方法。
  18. 一种计算机可读介质，其中存储了如权利要求17所述的计算机程序。
PCT/CN2015/074614 2014-04-18 2015-03-19 Dns安全系统及其故障处理方法 Ceased WO2015158194A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/305,091 US9992156B2 (en) 2014-04-18 2015-03-19 DNS security system and failure processing method

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410158695.6A CN103957286B (zh) 2014-04-18 2014-04-18 Dns安全系统及其故障处理方法
CN201410158695.6 2014-04-18

Publications (1)

Publication Number Publication Date
WO2015158194A1 true WO2015158194A1 (zh) 2015-10-22

Family

ID=51334509

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/074614 Ceased WO2015158194A1 (zh) 2014-04-18 2015-03-19 Dns安全系统及其故障处理方法

Country Status (3)

Country Link
US (1) US9992156B2 (zh)
CN (1) CN103957286B (zh)
WO (1) WO2015158194A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115834240A (zh) * 2022-12-27 2023-03-21 天翼安全科技有限公司 一种网络安全防护方法、装置、设备及介质

Families Citing this family (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103957286B (zh) 2014-04-18 2016-04-06 北京奇虎科技有限公司 Dns安全系统及其故障处理方法
CN104917851B (zh) * 2015-05-08 2019-01-22 成都亚信网络安全产业技术研究院有限公司 信息处理方法及dns缓存服务器
CN105245633A (zh) * 2015-10-19 2016-01-13 北京奇虎科技有限公司 一种安全域名系统及其故障处理方法
CN106899423A (zh) * 2015-12-21 2017-06-27 北京奇虎科技有限公司 域名系统的处理方法、装置及域名系统
CN106973122A (zh) * 2016-01-14 2017-07-21 中国移动通信集团浙江有限公司 一种基于云存储的域名系统及其应急解决方法
CN107872544A (zh) * 2016-09-28 2018-04-03 中兴通讯股份有限公司 一种域名解析方法、装置、网关及系统
CN107888642A (zh) * 2016-09-30 2018-04-06 中国电子科技集团公司信息科学研究院 一种标识解析装置、标识解析系统及标识解析方法
CN107995107A (zh) * 2018-01-05 2018-05-04 中国矿业大学(北京) 一种抗灾变校园网dns系统及其抗灾变方法
CN107920140A (zh) * 2018-01-05 2018-04-17 中国矿业大学(北京) 一种抗灾变校园网dns装置
CN110636006B (zh) * 2018-06-25 2021-11-02 中国电信股份有限公司 域名查询方法和系统、路由节点、控制节点和防护节点
CN109451013A (zh) * 2018-11-02 2019-03-08 郑州云海信息技术有限公司 一种远程配置客户机os的方法及系统
US11019022B1 (en) * 2020-01-28 2021-05-25 F5 Networks, Inc. Processing packets with returnable values
US11297033B2 (en) * 2020-07-02 2022-04-05 Afilias Limited System and method for generating current live and test versions of DNS data for HSM changes
US11233767B1 (en) * 2020-07-02 2022-01-25 Afilias Limited System and method for publishing DNS records of a domain including either signed or unsigned records
US11405353B2 (en) 2020-07-16 2022-08-02 Afilias Limited System and method for generating concurrently live and test versions of DNS data
US11218326B1 (en) * 2020-07-02 2022-01-04 Afilias Limited System and method for generating current live and test versions of DNS data for rollover
CN112134967B (zh) * 2020-09-30 2022-06-28 中国互联网络信息中心 一种基于共治链的域名解析方法及装置
CN115914398B (zh) * 2022-09-22 2026-04-03 阿里巴巴（中国）有限公司 Cdn节点回源调度系统、方法、服务器和存储介质
US12107820B2 (en) * 2022-11-28 2024-10-01 Microsoft Technology Licensing, Llc Host virtual machine domain name system (DNS) cache enabling DNS resolution during network connectivity issues
CN121462414A (zh) * 2024-08-01 2026-02-03 云智能资产控股（新加坡）私人股份有限公司 Dns容灾方法、dns容灾系统和电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101431539A (zh) * 2008-12-11 2009-05-13 华为技术有限公司 一种域名解析方法、系统及装置
CN103354525A (zh) * 2013-06-08 2013-10-16 中国科学院计算机网络信息中心 基于OpenFlow实现广域网任播负载均衡的系统和方法
CN103957286A (zh) * 2014-04-18 2014-07-30 上海聚流软件科技有限公司 Dns安全系统及其故障处理方法
CN103957285A (zh) * 2014-04-18 2014-07-30 上海聚流软件科技有限公司 提供根域名解析服务的方法和系统
CN103957284A (zh) * 2014-04-04 2014-07-30 上海聚流软件科技有限公司 Dns行为的处理方法、装置及系统

Family Cites Families (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030182447A1 (en) * 2001-05-31 2003-09-25 Schilling Frank T. Generic top-level domain re-routing system
US20060259723A1 (en) * 2004-11-16 2006-11-16 Petruzzo Stephen E System and method for backing up data
US7680876B1 (en) * 2006-12-14 2010-03-16 Cisco Technology, Inc. Highly available domain name system
US20080235383A1 (en) * 2007-03-22 2008-09-25 Eric Schneider Methods, Systems, Products, And Devices For Generating And Processing DNS Friendly Identifiers
US7836207B2 (en) * 2007-12-20 2010-11-16 Fast Health Corporation System and method for redirecting a website upon the occurrence of a disaster or emergency event
US7860982B2 (en) * 2008-03-14 2010-12-28 Microsoft Corporation Internet connectivity verification
US8073972B2 (en) * 2009-05-26 2011-12-06 Red Hat, Inc. System and method for location discovery based on DNS
US9525749B2 (en) * 2010-11-17 2016-12-20 Telefonaktiebolaget L M Ericsson (Publ) DNS server arrangement and method
US8612618B2 (en) * 2011-10-31 2013-12-17 King Fahd University Of Petroleum And Minerals Peer-to-peer DNS networking method
US9106695B2 (en) * 2012-03-14 2015-08-11 Daniel Kaminsky Method and system for user authentication using DNSSEC
US20150134730A1 (en) * 2012-04-30 2015-05-14 Nec Europe Ltd. Method for performing dns resolution in a network, content distribution system and client terminal for deployment in a content distribution system
US9246874B2 (en) * 2012-06-29 2016-01-26 Verizon Patent And Licensing Inc. Virtual domain name system
CN103152340B (zh) * 2013-02-28 2015-12-02 汉柏科技有限公司 一种跨资源访问的协议识别方法
CN103237089A (zh) * 2013-05-16 2013-08-07 广东睿江科技有限公司 基于dns轮询方式网页的修复方法、装置和服务器
US9614716B2 (en) * 2014-04-07 2017-04-04 International Business Machines Corporation Controller maintenance in a network-attached storage system

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101431539A (zh) * 2008-12-11 2009-05-13 华为技术有限公司 一种域名解析方法、系统及装置
CN103354525A (zh) * 2013-06-08 2013-10-16 中国科学院计算机网络信息中心 基于OpenFlow实现广域网任播负载均衡的系统和方法
CN103957284A (zh) * 2014-04-04 2014-07-30 上海聚流软件科技有限公司 Dns行为的处理方法、装置及系统
CN103957286A (zh) * 2014-04-18 2014-07-30 上海聚流软件科技有限公司 Dns安全系统及其故障处理方法
CN103957285A (zh) * 2014-04-18 2014-07-30 上海聚流软件科技有限公司 提供根域名解析服务的方法和系统

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115834240A (zh) * 2022-12-27 2023-03-21 天翼安全科技有限公司 一种网络安全防护方法、装置、设备及介质

Also Published As

Publication number Publication date
US9992156B2 (en) 2018-06-05
US20170048187A1 (en) 2017-02-16
CN103957286B (zh) 2016-04-06
CN103957286A (zh) 2014-07-30

Similar Documents

Publication Publication Date Title
CN103957286B (zh) Dns安全系统及其故障处理方法
CN103957285B (zh) 提供根域名解析服务的方法和系统
US11647043B2 (en) Identifying security actions based on computing asset relationship data
US11245716B2 (en) Composing and applying security monitoring rules to a target environment
WO2017067443A1 (zh) 一种安全域名系统及其故障处理方法
CN103607385B (zh) 基于浏览器进行安全检测的方法和装置
US9602530B2 (en) System and method for predicting impending cyber security events using multi channel behavioral analysis in a distributed computing environment
CN110677381B (zh) 渗透测试的方法及装置、存储介质、电子装置
CN103957284B (zh) Dns行为的处理方法、装置及系统
CN107347057B (zh) 入侵检测方法、检测规则生成方法、装置及系统
US20170366563A1 (en) Agentless ransomware detection and recovery
WO2017004620A1 (en) Threat intelligence system and method
US20170206252A1 (en) Nxd query monitor
US10462180B1 (en) System and method for mitigating phishing attacks against a secured computing device
CN106550056B (zh) 一种域名解析方法及装置
WO2017041666A1 (zh) 一种针对访问请求的处理方法和装置
US10320784B1 (en) Methods for utilizing fingerprinting to manage network security and devices thereof
CN115001724B (zh) 网络威胁情报管理方法、装置、计算设备及计算机可读存储介质
CN107332802B (zh) 一种防火墙策略监控方法及装置
CN107623693A (zh) 域名解析防护方法及装置、系统、计算设备、存储介质
CN105786927B (zh) 一种日志处理方法及装置
CN113194088B (zh) 访问拦截方法、装置、日志服务器和计算机可读存储介质
CN111092966B (zh) 域名系统、域名访问方法和装置
US12603896B2 (en) Agent prevention augmentation based on organizational learning
CN106899423A (zh) 域名系统的处理方法、装置及域名系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15780500

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 15305091

Country of ref document: US

122 Ep: pct application non-entry in european phase

Ref document number: 15780500

Country of ref document: EP

Kind code of ref document: A1