WO2018113727A1

WO2018113727A1 - Method and apparatus for reducing the risk of dns hijacking

Info

Publication number: WO2018113727A1
Application number: PCT/CN2017/117689
Authority: WO
Inventors: 刘天; 张建新; 高永岗
Original assignee: 北京奇虎科技有限公司
Priority date: 2016-12-21
Filing date: 2017-12-21
Publication date: 2018-06-28
Also published as: CN106713309A

Abstract

Provided is a method and apparatus for reducing the risk of DNS hijacking. The method comprises: sending a dynamic configuration request to a Dynamic Host Configuration Protocol (DHCP) device in the local area network; receiving dynamic configuration information returned by the DHCP, wherein the dynamic configuration information comprises a main Domain Name System (DNS) server address; switching a dynamically configured on-line state to a static on-line state, wherein the dynamically configured on-line state is a state of receiving the dynamic configuration information sent by the DHCP device and accessing a network based on the dynamic configuration information, and the static on-line state is a state of accessing the network according to static security configuration information; the main DNS server address of the security configuration information being a DNS server address of a target wide area network; and accessing the network based on the security configuration information.

Description

Method and apparatus for reducing the risk of DNS hijacking

Cross-reference to related applications

This application claims priority to Chinese Patent Application No. 201611192329.8, entitled "A Method and Apparatus for Reducing the Risk of DNS Hijacking", filed on December 21, 2016, the entire contents of which are incorporated herein by reference. In the application.

Technical field

The present disclosure relates to the field of electronic technologies, and in particular, to a method and apparatus for reducing the risk of DNS hijacking.

Background technique

A common LAN DNS (Domain Name System) hijacking is a pseudo-DNS server where an attacker builds a malicious behavior in a local area network and invades the LAN's DHCP (Dynamic Host Configuration Protocol). The device modifies the DNS server address assigned by the DHCP device to the UE (User Equipment) to a pseudo DNS server address. Then, when the UE connects to the pseudo DNS server based on the DHCP dynamically allocated network configuration, there is a risk of hijacking.

Summary of the invention

In view of the above problems, the present disclosure has been made in order to provide a method and apparatus for reducing the risk of DNS hijacking that overcomes the above problems or at least partially solves the above problems.

In a first aspect, the present disclosure provides a method of reducing the risk of DNS hijacking, including:

Sending a dynamic configuration request to a dynamic host configuration protocol DHCP device in the local area network;

Receiving the dynamic configuration information returned by the DHCP, where the dynamic configuration information includes the DNS address of the primary domain name resolution system;

The state of the dynamic configuration is switched to the static Internet access state. The dynamic configuration of the Internet access state is to receive the dynamic configuration information sent by the DHCP device, and the status of the static network access is based on the static security configuration information. Status; the primary DNS server address of the security configuration information is the target WAN DNS server address;

Access the network based on security configuration information.

In a second aspect, the present disclosure provides an apparatus for reducing the risk of DNS hijacking, including:

a dynamic configuration requesting module, configured to send a dynamic configuration request to a dynamic host configuration protocol DHCP device in the local area network;

a receiving module, configured to receive dynamic configuration information returned by the DHCP, where the dynamic configuration information includes a DNS address of the primary domain name resolution system;

The switching module is configured to switch from the dynamic configuration to the static Internet access state, and dynamically configure the online state to receive the dynamic configuration information sent by the DHCP device, and access the network state based on the dynamic configuration information, and the static Internet access state is in accordance with the static security configuration. The status of the information access network; the primary DNS server address of the security configuration information is the target WAN DNS server address;

An access module, configured to access the network based on security configuration information.

In a third aspect, the present disclosure provides a computer program comprising:

Computer readable code, when the computer readable code is run on a computing device, causes the computing device to perform the above described method of reducing the risk of DNS hijacking.

In a fourth aspect, the present disclosure provides a computer readable medium, comprising:

A computer program for performing the above-described method of reducing the risk of DNS hijacking is stored.

The technical solution provided in the embodiments of the present disclosure has at least the following technical effects or advantages:

In the technical solution of the embodiment of the present disclosure, a dynamic configuration request is first sent to a DHCP device in a local area network, and dynamic configuration information returned by the DHCP is received, where the dynamic configuration information includes a primary DNS server address, and then dynamically switched to a static state. Internet status. The static Internet access status is the state of accessing the network according to the static security configuration information, and the primary DNS server address of the security configuration information is the target WAN DNS server address. Because the difficulty of hijacking a WAN DNS server is usually very large, and after the hijacking occurs, the maintenance personnel of the WAN DNS server can detect abnormalities and fix them quickly, so the risk of being hijacked by the WAN server is relatively lower when accessing the LAN DNS server. , more secure. Therefore, the present disclosure achieves the risk of reducing DNS hijacking.

The above description is only an overview of the technical solutions of the present disclosure, and the above-described and other objects, features and advantages of the present disclosure can be more clearly understood. Specific embodiments of the present disclosure are specifically described below.

BRIEF abstract

Various other advantages and benefits will become apparent to those skilled in the art from a The drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting. Throughout the drawings, the same reference numerals are used to refer to the same parts. In the drawing:

1 is a flow chart of a method for reducing the risk of DNS hijacking in an embodiment of the present disclosure;

2 is a schematic structural diagram of an apparatus for reducing a risk of DNS hijacking according to an embodiment of the present disclosure;

FIG. 3 schematically illustrates a block diagram of a computing device for performing a method of reducing DNS hijacking risk in accordance with an embodiment of the present disclosure;

FIG. 4 schematically illustrates a storage unit for maintaining or carrying program code that implements a method of reducing DNS hijacking risk in accordance with an embodiment of the present disclosure.

Preferred embodiment of the invention

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While the embodiments of the present invention have been shown in the drawings, the embodiments Rather, these embodiments are provided so that this disclosure will be more fully understood and the scope of the disclosure will be fully disclosed.

Embodiments of the present disclosure provide a method and apparatus for reducing the risk of DNS hijacking to reduce the risk of DNS hijacking. Please refer to FIG. 1 , which is a flowchart of a method for reducing the risk of DNS hijacking according to an embodiment of the present disclosure, where the method includes:

S101: Send a dynamic configuration request to a dynamic host configuration protocol DHCP device in the local area network.

S102: Receive dynamic configuration information returned by DHCP.

S103: Switching from the dynamic configuration to the static Internet access state, dynamically configuring the online state to receive the dynamic configuration information sent by the DHCP device, and accessing the network based on the dynamic configuration information, and the static Internet access state is accessed according to the static security configuration information. The status of the network; the primary DNS server address of the security configuration information is the target WAN DNS server address;

S104: Access the network based on the security configuration information.

Specifically, when the UE needs to access a local area network, a dynamic configuration request is sent to a DHCP (Dynamic Host Configuration Protocol) device in the local area network to request the DHCP device to configure dynamic configuration information for the UE. Then, after receiving the dynamic configuration request sent by the UE, the DHCP device configures dynamic configuration information for the UE according to the dynamic configuration policy, and returns the configured dynamic configuration information to the UE. Further, the UE receives the dynamic configuration information transmitted by the DHCP device in S102.

In an embodiment of the present disclosure, the dynamic configuration information includes a primary DNS server address. In the specific implementation process, the dynamic configuration information further includes a gateway address, an IP (Internet Protocol) address, a subnet mask, and a standby DNS server address.

Next, since it is impossible to confirm whether the DNS is hijacked at the time of the local area network, in S103, the UE switches the online state from the dynamically configured online state to the static online state.

Specifically, the UE in the embodiment of the present disclosure has two online access states, specifically a dynamically configured online state and a static online state. In the specific implementation process, other online access states may also be included, and the disclosure does not specifically limit the disclosure. The dynamic configuration of the online state is to receive the dynamic configuration information sent by the DHCP, and access the state of the network based on the dynamic configuration information. In other words, in the dynamic configuration of the Internet access state, the UE accesses the gateway indicated by the gateway address in the dynamic configuration information and the primary DNS server indicated by the primary DNS server address in the dynamic configuration information according to the IP address and the subnet mask in the dynamic configuration information. (or the standby DNS server indicated by the DNS server address). The static Internet access state is the state of accessing the network according to static security configuration information. The security configuration information in the implementation of the disclosure includes at least a primary DNS server address, and the primary DNS server address in the security configuration information is a known secure target wide area network DNS server address. Certainly, the security configuration information may further include an IP address, a subnet mask, a gateway address, and a backup DNS server address, and the disclosure does not specifically limit the disclosure.

Next, in S104, the network is accessed based on the security configuration information, and when accessing the DNS server, the WAN DNS server is accessed instead of the LAN DNS server.

Because the difficulty of hijacking a WAN DNS server is usually very large, and after the hijacking occurs, the maintenance personnel of the WAN DNS server can detect abnormalities and fix them quickly, so the risk of being hijacked by the WAN server is relatively lower when accessing the LAN DNS server. , more secure. Therefore, the present disclosure achieves the risk of reducing DNS hijacking.

As an optional implementation, before S103 of the embodiment of the present disclosure, the method further includes:

When the address of the primary DNS server in the dynamic configuration information is a local area network address, it is determined whether the gateway address in the dynamic configuration information and the primary DNS server address in the dynamic configuration information are consistent;

When the gateway address and the primary DNS server address in the dynamic configuration information are inconsistent, it is determined that there is a risk of the local area network DNS hijacking, and the step of switching from the dynamically configured online state to the static online state is performed.

Specifically, the UE obtains the primary DNS server address in the dynamic configuration information, and then determines whether the primary DNS server address is a local area network address. The determining whether the primary DNS server address in the dynamic configuration information is a local area network address is specifically determining whether the primary DNS address in the dynamic configuration information is an interval in Class A, Class B, or Class C. The address range of the ClassA interval is 10.0.0.0~10.255.255.255, the address range of the ClassB interval is 172.16.0.0-172.31.255.255, and the address range of the ClassC interval is 192.168.0.0-192.168.255.255. If the primary DNS server address of the dynamic configuration information is in any of the ClassA, ClassB, or ClassC, the primary DNS server address in the dynamic configuration information is the local area network address; otherwise, if the primary DNS server address in the dynamic configuration information is not In the ClassA, ClassB, and ClassC intervals, the primary DNS server address in the dynamic configuration information is not the LAN address.

Further, if the address of the primary DNS server configured by the DHCP device is a local area network address, the gateway address configured by the DHCP device is consistent with the address of the primary DNS server, for example, both are 192.168.1.1, and therefore, when the dynamic configuration information is The address of the primary DNS server is the local area network address, and the gateway address in the dynamic configuration information is the same as the address of the primary DNS server, indicating that the current local area network DNS server is normal and is less likely to be hijacked. Conversely, when the primary DNS server address in the dynamic configuration information is a local area network address, and the gateway address in the dynamic configuration information is inconsistent with the primary DNS server address, it indicates that the primary DNS server in the local area network is abnormal and may be hijacked. Therefore, in the embodiment S104 of the present disclosure, when the gateway address in the dynamic configuration information and the primary DNS server address in the dynamic configuration information are inconsistent, it is determined that the local area network DNS hijacking risk exists.

Further, when the UE determines that the local area network DNS hijacking risk exists, the user may output prompt information, such as text information indicating that the current local area network is at risk, or playing a warning tone, to prompt the user to timely handle the local area network DNS hijacking risk.

After determining the risk of DNS hazard in the LAN, if you continue to access the network in a dynamically configured state, the user may lose the property and steal the hidden information. Therefore, the UE performs S103 and switches from the dynamic configuration to the static state. And access the network according to the security configuration information.

As can be seen from the above description, when the primary DNS server address of the dynamic configuration information is a local area network address, the LAN security is detected by determining whether the gateway address in the dynamic configuration information is consistent with the primary DNS server address, and the gateway address and the primary DNS server are detected. When the inconsistency determines the existence of the local area network DNS hijacking risk, the technical effect of detecting the DNS hijacking risk in the local area network is realized. At the same time, when it is determined that there is a local area network DNS risk, the network is accessed according to the static Internet access state, thereby avoiding the problems of high power consumption and slow Internet access caused by frequent access of the UE to the WAN DNS server.

In the embodiment of the present disclosure, the security configuration information may be pre-stored default information. For example, the default secure IP address, subnet mask, gateway address, primary DNS server address (ie, target WAN DNS server address), and standby DNS server address are stored as security configuration information in advance, and then read again after switching to the static Internet access state. Take pre-stored security configuration information. Alternatively, the security configuration information can also be generated based on user input. For example, when the user knows that the current local area network has a DNS hijacking risk according to the prompt information, the user inputs a secure IP address, a subnet mask, a gateway address, a primary DNS server address (ie, a target WAN DNS server address), and a standby DNS server address, and then the UE. Generate security configuration information based on the IP address, subnet mask, gateway address, primary DNS server address, and standby DNS server address entered by the user. Alternatively, the security configuration information may also be generated according to the actual situation after switching to the static Internet access state.

Further, in combination with any of the foregoing embodiments, as an optional embodiment, after the dynamic configuration of the online state is switched to the static Internet access state, the method further includes:

Obtain the target WAN DNS server address;

Use the target WAN DNS server address as the primary DNS server address in the security configuration information.

Specifically, after switching to the static Internet access state, the UE acquires the target WAN DNS server address. The target wide area network DNS server may be any one of the one or more wide area network DNS servers currently accessible, and the UE obtains the address of any one of the wide area network DNS servers as the target wide area network DNS server address. Alternatively, in order to avoid connection to the WAN DNS server or the connection speed is slow, the address of the WAN DNS server closest to the UE may be obtained as the address of the target WAN DNS server according to the geographic location of each WAN DNS server. Alternatively, you can obtain the target WAN DNS server address by the following process:

Detecting network connectivity of one or more WAN DNS servers;

The address of the WAN DNS server that optimizes network connectivity is determined as the address of the target WAN DNS server.

Specifically, the UE detects network connectivity of one or more WAN DNS servers. The network connectivity in the embodiment of the present disclosure indicates the connection performance of the WAN DNS server to the UE. The network connectivity may include the time required for the WAN DNS server to access and access the WAN DNS server, and the bandwidth of the WAN DNS server. The load and geographical location of the WAN DNS server, etc., are not specifically limited in this disclosure.

The UE measures whether each WAN DNS server can access, access time, bandwidth, load, and geographic location, and thus obtains network connectivity of each WAN DNS server.

In the specific implementation process, there are various methods for obtaining network connectivity of each WAN DNS server, and those skilled in the art can select according to actual conditions, and the disclosure does not specifically limit the disclosure.

For example, the weights of the parameter types of the WAN DNS servers are set in advance, and then the weight of each WAN DNS server is calculated according to the parameters of each WAN DNS server, and then the weight of the WAN DNS server is used as the network connection of the WAN server of the WAN. Sex. For example, if the UE needs to measure whether the parameter type of the WAN DNS server is access, access time, and geographic distance, then a weight of 0.5 can be set for the parameter type that can be accessed, which is a parameter for time-consuming access. The type sets a weight of -0.3, which sets the weight of -0.2 for the parameter type of the geographic distance. The first WAN DNS server is measured, and the first WAN DNS server cannot be accessed. The access time expires (assuming the timeout period is 3 minutes, the timeout is calculated according to the timeout period), and the geographic distance is 10 km. The second WAN DNS server is measured, and the second WAN DNS server can be accessed, with an access time of 0.5 minutes and a geographic distance of 8 km. Therefore, the weight of the first WAN DNS server is 0*0.5-0.3*3-0.2*10=-2.9, and the weight of the second WAN DNS server is 1*0.5-0.3*0.5-0.2*8=- 1.25. It can be seen that the weight of the second WAN DNS server is greater than the weight of the first WAN DNS server, so the network connectivity of the second WAN DNS server is better than the network connectivity of the first WAN DNS server.

Next, in the embodiment of the present disclosure, the UE determines the address of the measured wide area network connectivity WAN server as the address of the target WAN DNS server.

It can be seen from the above description that the address of the WAN DNS server that optimizes network connectivity in one or more WAN DNS servers is used as the address of the target WAN DNS server, so that the UE can access the WAN DNS server with the best network connectivity, thereby reducing The chances of not being able to connect to a WAN DNS server or slow connection.

Further, after obtaining the target WAN DNS server address, the UE uses the address of the target WAN DNS server as the primary DNS server address in the security configuration information, and then the UE accesses the WAN DNS server when accessing the primary DNS server based on the security configuration information. Instead of accessing a local area network DNS server with a risk of hijacking.

Further, the security configuration information in the embodiment of the present disclosure further includes a backup DNS server address. There are also many possibilities for the standby DNS server address for security configuration information. Specifically, similar to the primary DNS server address, the standby DNS server address can also be pre-stored default information or an address entered by the user. Or, after switching to the static Internet access state, the UE determines the address of the WAN DNS server with the best network connectivity as the primary DNS server address of the security configuration information, and then connects the network connectivity to another WAN of the target WAN DNS server. The address of the DNS server is determined as the standby DNS server address in the security configuration information. Alternatively, after the dynamic configuration of the online state is switched to the static Internet access, the method further includes:

Extract the primary DNS server address or the standby DNS server address in the dynamic configuration information;

The primary DNS server address or the standby DNS server address in the dynamic configuration information is determined as the standby DNS server address in the security configuration information.

Specifically, another implementation manner of determining the address of the standby DNS server in the security configuration information is that after the UE switches to the static Internet access state, the primary DNS server address or the standby DNS server address in the dynamic configuration information is extracted, and then the UE extracts The primary DNS server address or the standby DNS server address of the dynamic configuration information to be determined is determined as the standby DNS server address of the security configuration information.

Further, in the specific implementation process, the primary DNS server in the local area network is generally more reliable than the standby DNS server, and is more easily found to be faulty and modified in time, so the primary DNS server address in the dynamic configuration information is determined as the security configuration information. The standby DNS server address is a preferred choice.

In addition, for the IP address, the subnet mask, and the gateway address in the security configuration information, the IP address, the subnet mask, and the gateway address in the dynamic configuration information may be directly used, and the disclosure does not specifically limit the disclosure.

Based on the same disclosure concept as the method for reducing the risk of DNS hijacking in the foregoing embodiment, the second aspect of the present disclosure further provides an apparatus for reducing the risk of DNS hijacking, as shown in FIG. 2, including:

The dynamic configuration requesting module 101 is configured to send a dynamic configuration request to a dynamic host configuration protocol DHCP device in the local area network;

The receiving module 102 is configured to receive dynamic configuration information returned by the DHCP, where the dynamic configuration information includes a DNS address of the primary domain name resolution system;

The switching module 103 is configured to switch from the dynamically configured online state to the static Internet access state, dynamically configure the online state to receive dynamic configuration information sent by the DHCP device, and access the network state based on the dynamic configuration information, and the static Internet access state is static security. Configure the status of the information access network; the primary DNS server address of the security configuration information is the target WAN DNS server address;

The access module 104 is configured to access the network based on the security configuration information.

Further, the device in the embodiment of the present disclosure further includes:

The judging module is configured to determine the gateway address in the dynamic configuration information and the primary DNS server in the dynamic configuration information when the primary DNS server address in the dynamic configuration information is a local area network address before the dynamic configuration of the online state is switched to the static Internet access state. Whether the addresses are consistent;

The first determining module is configured to determine that a local area network DNS hijacking risk exists when the gateway address and the primary DNS server address in the dynamic configuration information are inconsistent, and notify the switching module to switch from the dynamically configured online state to the static online state.

The obtaining module is configured to obtain a target WAN DNS server address after switching from a dynamically configured online state to a static online state;

The second determining module is configured to determine the target WAN DNS server address as the primary DNS server address in the security configuration information.

The obtaining module is configured to detect network connectivity of one or more wide area network DNS servers; and determine an address of the wide area network DNS server with optimal network connectivity as the target wide area network DNS server address.

The extracting module is configured to extract a primary DNS server address or a standby DNS server address in the dynamic configuration information after switching from the dynamically configured online state to the static online state;

The third determining module is configured to determine the primary DNS server address or the standby DNS server address in the dynamic configuration information as the standby DNS server address in the security configuration information.

The various changes and specific examples of the method for reducing the risk of DNS hijacking in the foregoing embodiment of FIG. 1 are also applicable to the apparatus for reducing the risk of DNS hijacking in this embodiment, and the foregoing detailed description of the method for reducing the risk of DNS hijacking is in the field. The method for implementing the device for reducing the risk of DNS hijacking in this embodiment can be clearly understood by the skilled person. Therefore, for the sake of brevity of the description, details are not described herein.

A third aspect of the present disclosure provides a computer program, and FIG. 3 illustrates a computing device that can implement a method of reducing DNS hijacking risk in accordance with the present disclosure. The computing device traditionally includes a processor 310 and a computer program product or computer readable medium in the form of a storage device 320. The storage device 320 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM. Storage device 320 has a storage space 330 that stores program code 331 for performing any of the method steps described above. For example, storage space 330 storing program code may include various program code 331 for implementing various steps in the above methods, respectively. The program code can be read from or written to one or more computer program products. These computer program products include program code carriers such as a hard disk, a compact disk (CD), a memory card, or a floppy disk. Such computer program products are typically portable or fixed storage units such as those shown in FIG. The storage unit may have storage segments, storage spaces, and the like that are similarly arranged to storage device 320 in the computing device of FIG. The program code can be compressed, for example, in an appropriate form. Typically, the storage unit includes computer readable code 331' for performing the method steps in accordance with the present disclosure, ie, code that can be read by a processor, such as 310, which when executed by the computing device causes the computing device Perform the various steps in the method described above.

In the technical solution of the embodiment of the present disclosure, a dynamic configuration request is first sent to a DHCP device in a local area network, and dynamic configuration information returned by the DHCP is received, where the dynamic configuration information includes a primary DNS server address, and then dynamically switched to a static state. Internet status. The static Internet access status is the status of accessing the network according to the static security configuration information, and the primary DNS server address of the security configuration information is the target WAN DNS server address. Because the difficulty of hijacking a WAN DNS server is usually very large, and after the hijacking occurs, the maintenance personnel of the WAN DNS server can detect abnormalities and fix them quickly, so the risk of being hijacked by the WAN server is relatively lower when accessing the LAN DNS server. , more secure. Therefore, the present disclosure achieves the risk of reducing DNS hijacking.

The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general purpose systems can also be used with the teaching based on the teachings herein. The structure required to construct such a system is apparent from the above description. Moreover, the present disclosure is not directed to any particular programming language. It is to be understood that the subject matter of the present disclosure, which is described herein, may be described in a particular language.

In the description provided herein, numerous specific details are set forth. However, it is understood that the embodiments of the present disclosure may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of the description.

In the description of the exemplary embodiments of the present disclosure, the various features of the present disclosure are sometimes grouped together into a single embodiment, Figure, or a description of it. However, the method disclosed is not to be interpreted as reflecting the intention that the claimed invention requires more features than those recited in the claims. Rather, as disclosed in the following claims, the disclosed aspects are less than all features of the single embodiments disclosed herein. Therefore, the claims following the specific embodiments are hereby explicitly incorporated into the specific embodiments, and each of the claims as a separate embodiment of the present disclosure.

Those skilled in the art will appreciate that the modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components. In addition to such features and/or at least some of the processes or units being mutually exclusive, any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined. Each feature disclosed in the specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or equivalent purpose.

In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features that are included in other embodiments and not in other features, combinations of features of different embodiments are intended to be within the scope of the present disclosure. And different embodiments are formed. For example, in the following claims, any one of the claimed embodiments can be used in any combination.

Various component embodiments of the present disclosure may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functionality of a gateway, proxy server, some or all of the components in accordance with embodiments of the present disclosure. The present disclosure may also be implemented as a device or device program (eg, a computer program and a computer program product) for performing some or all of the methods described herein. Such a program implementing the present disclosure may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

It should be noted that the above-described embodiments are illustrative of the present disclosure and are not intended to limit the scope of the disclosure, and those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as a limitation. The word "comprising" does not exclude the presence of the elements or steps that are not recited in the claims. The word "a" or "an" The present disclosure can be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means can be embodied by the same hardware item. The use of the words first, second, and third does not indicate any order. These words can be interpreted as names.

Claims

A method for reducing the risk of DNS hijacking, characterized by comprising:

Sending a dynamic configuration request to a dynamic host configuration protocol DHCP device in the local area network;

Receiving the dynamic configuration information returned by the DHCP, where the dynamic configuration information includes a DNS address of the primary domain name resolution system;

The dynamic configuration of the Internet access state is switched to the static Internet access state, and the dynamic configuration Internet access state is to receive the dynamic configuration information sent by the DHCP device, and based on the state of the dynamic configuration information accessing the network, the static Internet access state is The state of accessing the network according to the static security configuration information; the primary DNS server address of the security configuration information is the target WAN DNS server address;

Accessing the network based on the security configuration information.
The method of claim 1, further comprising: before switching from the dynamically configured online state to the static Internet access state, further comprising:

When the primary DNS server address in the dynamic configuration information is a local area network address, determining whether the gateway address in the dynamic configuration information and the primary DNS server address in the dynamic configuration information are consistent;

When the gateway address and the primary DNS server address in the dynamic configuration information are inconsistent, it is determined that there is a risk of the local area network DNS hijacking, and the step of switching from the dynamically configured online state to the static online state is performed.
The method according to claim 1 or 2, further comprising: after switching from the dynamically configured online state to the static Internet access state, further comprising:

Obtaining the target WAN DNS server address;

The target wide area network DNS server address is determined as the primary DNS server address in the security configuration information.
The method of claim 3, wherein obtaining the target WAN DNS server address comprises:

Detecting network connectivity of one or more WAN DNS servers;

The address of the wide area network DNS server that optimizes the network connectivity is determined as the target wide area network DNS server address.
The method according to claim 1 or 2, further comprising: after switching from the dynamically configured online state to the static Internet access state, further comprising:

Extracting a primary DNS server address or a standby DNS server address in the dynamic configuration information;

The primary DNS server address or the standby DNS server address in the dynamic configuration information is determined as the standby DNS server address in the security configuration information.
A device for reducing the risk of DNS hijacking, comprising:

a dynamic configuration requesting module, configured to send a dynamic configuration request to a dynamic host configuration protocol DHCP device in the local area network;

a receiving module, configured to receive dynamic configuration information returned by the DHCP, where the dynamic configuration information includes a DNS address of a primary domain name resolution system;

a switching module, configured to switch from a dynamically configured online state to a static online state, where the dynamically configured online state is to receive the dynamic configuration information sent by the DHCP device, and access the network based on the dynamic configuration information, The static Internet access state is a state of accessing the network according to the static security configuration information; the primary DNS server address of the security configuration information is the target WAN DNS server address;

An access module, configured to access the network based on the security configuration information.
The device of claim 6 wherein said device further comprises:

a judging module, configured to determine a gateway address and the dynamic configuration in the dynamic configuration information, when the primary DNS server address in the dynamic configuration information is a local area network address, before the dynamic configuration of the online state is switched to the static Internet access state Whether the address of the primary DNS server in the information is consistent;

a first determining module, configured to determine that a local area network DNS hijacking risk exists when the gateway address and the primary DNS server address in the dynamic configuration information are inconsistent, and notify the switching module to switch from a dynamically configured online state to a static online state. .
The device according to claim 6 or 7, wherein the device further comprises:

An obtaining module, configured to acquire the target WAN DNS server address after switching from a dynamically configured online state to a static online state;

And a second determining module, configured to determine the target wide area network DNS server address as a primary DNS server address in the security configuration information.
The apparatus according to claim 8, wherein said obtaining module is configured to detect network connectivity of one or more wide area network DNS servers; determining an address of said wide area network DNS server having said network connectivity as said Target WAN DNS server address.
The device according to claim 6 or 7, wherein the device further comprises:

An extraction module, configured to extract a primary DNS server address or a standby DNS server address in the dynamic configuration information after switching from a dynamically configured online state to a static online state;

And a third determining module, configured to determine a primary DNS server address or a standby DNS server address in the dynamic configuration information as a standby DNS server address in the security configuration information.
A computer program comprising computer readable code, when the computer readable code is run on a computing device, causing the computing device to perform the risk of reducing DNS hijacking according to any one of claims 1-5 method.
A computer readable medium storing the computer program of claim 11.