WO2018113731A1 - 降低dns劫持风险的方法和装置 - Google Patents

降低dns劫持风险的方法和装置 Download PDF

Info

Publication number
WO2018113731A1
WO2018113731A1 PCT/CN2017/117695 CN2017117695W WO2018113731A1 WO 2018113731 A1 WO2018113731 A1 WO 2018113731A1 CN 2017117695 W CN2017117695 W CN 2017117695W WO 2018113731 A1 WO2018113731 A1 WO 2018113731A1
Authority
WO
WIPO (PCT)
Prior art keywords
dns server
address
configuration information
area network
server address
Prior art date
Application number
PCT/CN2017/117695
Other languages
English (en)
French (fr)
Inventor
张建新
刘天
高永岗
Original Assignee
北京奇虎科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京奇虎科技有限公司 filed Critical 北京奇虎科技有限公司
Publication of WO2018113731A1 publication Critical patent/WO2018113731A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H04L61/5014—Internet protocol [IP] addresses using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]

Definitions

  • the present disclosure relates to the field of electronic technologies, and in particular, to a method and apparatus for reducing the risk of DNS hijacking.
  • a common LAN DNS (Domain Name System) hijacking is a pseudo-DNS server where an attacker builds a malicious behavior in a local area network and invades the LAN's DHCP (Dynamic Host Configuration Protocol).
  • the device modifies the DNS server address assigned by the DHCP device to the UE (User Equipment) to a pseudo DNS server address. Then, the UE is connected to the pseudo DNS server based on the dynamically configured network configuration of the DHCP, and there is a risk of hijacking.
  • the present disclosure has been made in order to provide a method and apparatus for reducing the risk of DNS hijacking that overcomes the above problems or at least partially solves the above problems.
  • the present disclosure provides a method of reducing the risk of DNS hijacking, including:
  • the state of the dynamic configuration is switched to the static Internet access state.
  • the dynamic configuration of the Internet access state is to receive the dynamic configuration information sent by the DHCP device, and the status of the static network access is based on the static security configuration information. Status; the primary DNS server address of the security configuration information is the target WAN DNS server address;
  • Access the network based on security configuration information.
  • the present disclosure provides an apparatus for reducing the risk of DNS hijacking, including:
  • a dynamic configuration requesting module configured to send a dynamic configuration request to a dynamic host configuration protocol DHCP device in the local area network
  • a first receiving module configured to receive dynamic configuration information returned by the DHCP device, where the dynamic configuration information includes an Internet Protocol IP address of the user equipment UE;
  • a sending module configured to send the IP address of the UE to the security server
  • a second receiving module configured to receive an optional wide area network DNS server address of the candidate wide area network DNS server that is determined by the security server to be based on the UE's IP address and belongs to the same carrier as the UE;
  • a first determining module configured to determine an alternate wide area network DNS server address as a target wide area network DNS server address
  • the switching module is configured to switch from the dynamic configuration to the static Internet access state, and dynamically configure the online state to receive the dynamic configuration information sent by the DHCP device, and access the network state based on the dynamic configuration information, and the static Internet access state is in accordance with the static security configuration.
  • the status of the information access network; the primary DNS server address of the security configuration information is the target WAN DNS server address;
  • An access module configured to access the network based on security configuration information.
  • the present disclosure provides a computer program comprising:
  • Computer readable code when the computer readable code is run on a computing device, causes the computing device to perform the above described method of reducing the risk of DNS hijacking.
  • the present disclosure provides a computer readable medium, comprising:
  • a computer program for performing the above-described method of reducing the risk of DNS hijacking is stored.
  • the dynamic configuration request is sent to the dynamic host configuration protocol DHCP device in the local area network, and then the dynamic configuration information returned by the DHCP device is received, where the dynamic configuration information includes the Internet Protocol IP address of the user equipment UE. And then sending the IP address of the UE to the security server, and receiving an alternative WAN DNS server address of the candidate WAN DNS server that the security server determines and sends based on the IP address of the UE and belongs to the unified operator of the UE, and the alternative WAN The DNS server address is determined as the target WAN DNS server address, and then the dynamic configuration of the Internet access state is switched to the static Internet access state.
  • the dynamic configuration of the Internet access state is to receive the dynamic configuration information sent by the DHCP device, and based on the state of the dynamic configuration information access network, the static Internet access
  • the status is the status of accessing the network according to the static security configuration information.
  • the primary DNS server address of the security configuration information is the target WAN DNS server address, and finally accesses the network based on the security configuration information. Because the difficulty of hijacking the WAN DNS server is usually very large, and after the hijacking occurs, the maintenance personnel of the WAN DNS server can detect the abnormality and fix it quickly, so the risk of the access target WAN DNS server being hijacked is relatively greater than the access to the local area network DNS server. Low and safer. Therefore, the present disclosure achieves the risk of reducing DNS hijacking. Further, since the target WAN DNS server and the UE belong to the same carrier, the delay of the UE accessing the target DNS server and the probability of accessing the network resource are small, thereby ensuring that the user can normally access the network under the static Internet access state.
  • 1 is a flow chart of a method for reducing the risk of DNS hijacking in an embodiment of the present disclosure
  • FIG. 2 is a schematic structural diagram of an apparatus for reducing a risk of DNS hijacking in an embodiment of the present disclosure
  • FIG. 3 is a block diagram schematically showing a computing device for performing a method of reducing a risk of DNS hijacking according to an embodiment of the present disclosure
  • FIG. 4 schematically illustrates a storage unit for maintaining or carrying program code that implements a method of reducing DNS hijacking risk in accordance with an embodiment of the present disclosure.
  • Embodiments of the present disclosure provide a method and apparatus for reducing the risk of DNS hijacking to reduce the risk of DNS hijacking. Please refer to FIG. 1 , which is a flowchart of a method for reducing the risk of DNS hijacking according to an embodiment of the present disclosure, where the method includes:
  • S101 Send a dynamic configuration request to a dynamic host configuration protocol DHCP device in the local area network.
  • S102 Receive dynamic configuration information returned by the DHCP device, where the dynamic configuration information includes an Internet Protocol IP address of the user equipment UE.
  • S103 Send the IP address of the UE to the security server.
  • S104 Receive an optional wide area network DNS server address of the candidate wide area network DNS server that is determined and sent by the security server according to the IP address of the UE and belongs to the same operator as the UE;
  • S105 Determine an alternate WAN DNS server address as the target WAN DNS server address
  • S106 Switching from the dynamic configuration to the static Internet access state, dynamically configuring the Internet access state to receive the dynamic configuration information sent by the DHCP device, and accessing the network based on the dynamic configuration information, and the static Internet access state is accessed according to the static security configuration information.
  • the status of the network; the primary DNS server address of the security configuration information is the target WAN DNS server address;
  • S107 Access the network based on the security configuration information.
  • a dynamic configuration request is sent to a DHCP (Dynamic Host Configuration Protocol) device in the local area network to request the DHCP device to configure dynamic configuration information for the UE. Then, after receiving the dynamic configuration request sent by the UE, the DHCP device configures dynamic configuration information for the UE according to the dynamic configuration policy, and returns the configured dynamic configuration information to the UE. Further, the UE receives the dynamic configuration information transmitted by the DHCP device in S102.
  • DHCP Dynamic Host Configuration Protocol
  • the dynamic configuration information includes an IP (Internet Protocol) address of the UE.
  • the dynamic configuration information further includes a subnet mask, a gateway address, a primary DNS server address, and a standby DNS server address.
  • the UE transmits the IP address of the UE to the security server, and switches to the static Internet access state in S106.
  • the security server is a server that provides network security services for the UE. After receiving the IP address of the UE reported by the UE, the security server determines the operator of the UE.
  • the operator of the UE refers to a merchant that operates the UE communication network, such as China Telecom, China Mobile, or China Unicom.
  • the security server stores a wide area network DNS server address of a plurality of wide area network DNS servers operated by each of the plurality of operators.
  • the WAN DNS server address corresponding to the WAN DNS server address stored in the security server is authenticated by the security server as a secure DNS server.
  • the security server is based on the carrier to which the UE belongs.
  • One or more addresses are selected from the operator's plurality of wide area network DNS server addresses as alternate WAN DNS server addresses, and the alternate WAN DNS server address is sent to the UE.
  • the UE receives an alternate WAN DNS server address sent by the security server.
  • the alternate DNS server address is determined as the target wide area network DNS server address.
  • the UE may directly determine the candidate wide area network DNS server address as the target wide area network DNS server address.
  • the UE may arbitrarily determine one of the multiple WAN DNS server addresses as the target WAN DNS server address, and may also determine an optimal candidate WAN address.
  • the DNS server address is the target WAN address. The person skilled in the art to which the present disclosure pertains may make selections according to actual conditions, and the present disclosure is not specifically limited. How to determine the optimal alternate WAN DNS server address from multiple alternate WAN DNS server addresses will be described in detail later.
  • the UE switches the Internet access state from the dynamic configuration state state to the static Internet access state.
  • the UE in the embodiment of the present disclosure has two online access states, specifically a dynamically configured online state and a static online state.
  • the dynamic configuration of the online state is to receive the dynamic configuration information sent by the DHCP, and access the state of the network based on the dynamic configuration information.
  • the UE accesses the gateway indicated by the gateway address in the dynamic configuration information and the master indicated by the primary DNS server address in the dynamic configuration information according to the IP address and subnet mask of the UE in the dynamic configuration information.
  • DNS server or standby DNS server indicated by the standby DNS server address).
  • the static Internet access status is the state of accessing the network according to static security configuration information.
  • the security configuration information in the implementation of the disclosure includes at least a primary DNS server address, and the primary DNS server address in the security configuration information is specifically a target wide area network DNS server address in the present disclosure.
  • the security configuration information may further include an IP address, a subnet mask, a gateway address, and a backup DNS server address of the UE, and the disclosure does not specifically limit the disclosure.
  • the security configuration information may be pre-stored default information.
  • the default secure IP address, subnet mask, gateway address, primary DNS server address (ie, target WAN DNS server address), and standby DNS server address are stored as security configuration information in advance, and then read again after switching to the static Internet access state.
  • the security configuration information can also be generated based on user input. For example, when the user knows that the current local area network has a DNS hijacking risk according to the prompt information, the user inputs a secure IP address, a subnet mask, a gateway address, a primary DNS server address (ie, a target WAN DNS server address), and a standby DNS server address, and then the UE.
  • Generate security configuration information based on the IP address, subnet mask, gateway address, primary DNS server address, and standby DNS server address entered by the user.
  • the security configuration information may also be generated according to the actual situation after switching to the static Internet access state.
  • S103 to S105 are described before S106, the execution order of S103 to S105 and S106 is not limited in a specific implementation process.
  • the UE may first execute S103, S104, and S105, and then execute S106.
  • S106 may be executed first, then S103, S104, and S105 may be executed, or S103 may be executed first, then S106 may be executed, then S104 and S105 may be executed, and may be simultaneously executed.
  • S103 to S105 and S106 the present disclosure is not specifically limited.
  • the network is accessed based on the security configuration information, and when the DNS server is accessed, the target wide area network DNS server is accessed instead of the local area network DNS server.
  • the present disclosure achieves the risk of reducing DNS hijacking.
  • the target WAN DNS server and the UE belong to the same carrier, the delay of the UE accessing the target DNS server and the probability of accessing the network resource are small, thereby ensuring that the user accesses the network normally under the static Internet access state.
  • the security server may arbitrarily select one of the WAN DNS server addresses from the WAN DNS server address of the WAN DNS server belonging to the same carrier as the UE, or may also be the WAN DNS belonging to the same carrier as the UE.
  • the WAN DNS server address of the WAN DNS server with the shortest path between the servers and the UE is the alternate WAN DNS server address.
  • the security server may arbitrarily select a plurality of WAN DNS server addresses from the WAN DNS server addresses of the WAN DNS servers belonging to the same carrier as the UE, or select the WAN DNS server addresses of the plurality of WAN DNS servers with the shortest path.
  • WAN DNS server address As an alternative WAN DNS server address.
  • determining the address of the candidate WAN DNS server in the S105 as the target WAN DNS server address may be implemented by the following process. :
  • the alternate wide area network DNS server address corresponding to the alternative wide area network DNS server that determines the optimal network connectivity is the target wide area network DNS server address.
  • the network connectivity in the embodiment of the present disclosure represents the connection performance of the candidate wide area network DNS server to the UE.
  • the UE can store the address of the WAN DNS server accessed in the static Internet state as the historical WAN DNS server address, and store the number of accesses to each historical WAN DNS server. Further, the UE indicates network connectivity by the number of accesses. The higher the number of accesses, the better the network connectivity; the fewer the access times, the worse the network connectivity. Therefore, the alternative WAN DNS server with the highest number of accesses is selected as the target WAN DNS server.
  • the historical wide area network DNS server address is specifically A, B, C, and D
  • the number of times the UE accesses the WAN server corresponding to A is 10 times
  • the number of accesses to the WAN server corresponding to the WAN is 3 times.
  • the number of accesses to the WAN DNS server corresponding to C is 12, and the number of access to the WAN DNS server corresponding to D is 8 times.
  • the optional WAN DNS server address is specifically B, C, D, and E, so the network connectivity of the WAN DNS server corresponding to B is 3, and the network connectivity of the WAN DNS server corresponding to C is 12, and the WAN corresponding to the WAN of D
  • the network connectivity of the server is 8, and the network connectivity of the WAN DNS server corresponding to E is zero. Therefore, it is determined that C is the target WAN DNS server address.
  • the access server may further send an acquisition request indicating that the current load amount and the saturation load are requested to be received by each of the candidate WAN DNS servers, and then receive each candidate WAN DNS server to the security server.
  • the current load and saturation load of the feedback represents the maximum amount of load that a WAN DNS server can carry.
  • the security server also sends the current load and saturation load of each alternate WAN DNS server to the UE.
  • the network connectivity is expressed by the saturation load ratio. The smaller the saturation load rate, the better the network connectivity; the larger the saturation load rate, the worse the network connectivity. Therefore, the alternative wide area network DNS server with the lowest load saturation rate is finally selected as the target wide area network DNS server.
  • the alternate WAN DNS server address is specifically B, C, D, and E.
  • the WAN DNS server saturation load corresponding to B is 1000
  • the current load is 500
  • the WAN DNS server saturation load corresponding to C is 1000.
  • the current load is 200
  • the WAN DNS server saturation load corresponding to D is 10000
  • the current load is 9000
  • the WAN DNS server saturation load corresponding to E is 100
  • the current load is 10. Therefore, the UE calculates that the current saturation rate of the WAN DNS server corresponding to B is 50%
  • the current saturation rate of the WAN server corresponding to C is 20%
  • the current saturation rate of the WAN server corresponding to D is 90%
  • the WAN server corresponding to the wide area network of E The current saturation rate is 10%. Therefore, determine E as the target WAN DNS server address.
  • the network connectivity of the candidate WAN DNS server corresponding to each candidate WAN DNS server address may be determined by the WAN response of the WAN server. :
  • the alternate WAN DNS server address corresponding to the alternate WAN DNS server that determines the optimal network connectivity is the target WAN DNS server address, including:
  • the UE after receiving the multiple candidate wide area network DNS server addresses sent by the security server, the UE sends a request to each candidate wide area network DNS server based on each alternate wide area network DNS server address, requesting an alternative WAN DNS server response. . If the alternate WAN DNS server answers, the UE obtains the response time of the alternate WAN DNS server. If the alternate WAN DNS server timeout is not answered, the UE may determine that the alternate WAN DNS server is not properly connected, and therefore does not use the alternate WAN DNS server address as the target WAN DNS server address.
  • the UE determines the candidate WAN DNS server address corresponding to the shortest response time from the candidate WAN server that responds successfully.
  • the method before switching from the dynamically configured online state to the static Internet access state, the method further includes:
  • the address of the primary DNS server in the dynamic configuration information is a local area network address, it is determined whether the gateway address in the dynamic configuration information and the primary DNS server address in the dynamic configuration information are consistent;
  • the gateway address and the primary DNS server address in the dynamic configuration information are inconsistent, it is determined that there is a risk of the local area network DNS hijacking, and the step of switching from the dynamically configured online state to the static online state is performed.
  • the UE obtains the primary DNS server address in the dynamic configuration information, and then determines whether the primary DNS server address is a local area network address.
  • the determining whether the primary DNS server address in the dynamic configuration information is a local area network address is specifically determining whether the primary DNS address in the dynamic configuration information is an interval in Class A, Class B, or Class C.
  • the address range of the ClassA interval is 10.0.0.0 ⁇ 10.255.255.255
  • the address range of the ClassB interval is 172.16.0.0-172.31.255.255
  • the address range of the ClassC interval is 192.168.0.0-192.168.255.255.
  • the primary DNS server address in the dynamic configuration information is the local area network address; otherwise, if the primary DNS server address in the dynamic configuration information is not In the ClassA, ClassB, and ClassC intervals, the primary DNS server address in the dynamic configuration information is not the LAN address.
  • the gateway address configured by the DHCP device is consistent with the address of the primary DNS server, for example, both are 192.168.1.1, and therefore, when the dynamic configuration information is The address of the primary DNS server is the local area network address, and the gateway address in the dynamic configuration information is the same as the address of the primary DNS server, indicating that the current local area network DNS server is normal and is less likely to be hijacked. Conversely, when the primary DNS server address in the dynamic configuration information is a local area network address, and the gateway address in the dynamic configuration information is inconsistent with the primary DNS server address, it indicates that the primary DNS server in the local area network is abnormal and may be hijacked. Therefore, in the embodiment of the present disclosure, when the gateway address in the dynamic configuration information and the primary DNS server address in the dynamic configuration information are inconsistent, it is determined that the local area network DNS hijacking risk exists.
  • the user may output prompt information, such as text information indicating that the current local area network is at risk, or playing a warning tone, to prompt the user to timely handle the local area network DNS hijacking risk.
  • prompt information such as text information indicating that the current local area network is at risk, or playing a warning tone
  • the UE After determining the risk of DNS hazard in the local area network, if you continue to access the network through the dynamic configuration of the Internet access status, the user may lose the property and steal the hidden information. Therefore, the UE performs S105 and switches from the dynamic configuration to the static Internet access state. And access the network according to the security configuration information.
  • the LAN security is detected by determining whether the gateway address in the dynamic configuration information is consistent with the primary DNS server address, and the gateway address and the primary DNS server are detected.
  • the inconsistency determines the existence of the local area network DNS hijacking risk
  • the technical effect of detecting the DNS hijacking risk in the local area network is realized.
  • the network is accessed according to the static Internet access state, thereby avoiding the problems of high power consumption and slow Internet access caused by frequent access of the UE to the WAN DNS server.
  • the security configuration information in the embodiment of the present disclosure further includes a backup DNS server address.
  • the standby DNS server address may be pre-stored default information or an address input by the user.
  • the UE determines the address of the alternate wide area network DNS server with optimal network connectivity as the primary DNS server address of the security configuration information, and then sets the network connectivity second only to the target WAN DNS server.
  • the address of an alternate WAN DNS server is determined as the alternate DNS server address in the security configuration information.
  • the method further includes:
  • the primary DNS server address or the standby DNS server address in the dynamic configuration information is determined as the standby DNS server address in the security configuration information.
  • another implementation manner of determining the address of the standby DNS server in the security configuration information is that after the UE switches to the static Internet access state, the primary DNS server address or the standby DNS server address in the dynamic configuration information is extracted, and then the UE extracts The primary DNS server address or the standby DNS server address of the dynamic configuration information to be determined is determined as the standby DNS server address of the security configuration information.
  • the primary DNS server in the local area network is generally more reliable than the standby DNS server, and is more easily found to be faulty and modified in time, so the primary DNS server address in the dynamic configuration information is determined as the security configuration information.
  • the standby DNS server address is a preferred choice.
  • the IP address, subnet mask, and gateway address of the UE in the security configuration information may also be directly used, and the disclosure does not specifically limit the disclosure. .
  • the second aspect of the present disclosure further provides an apparatus for reducing the risk of DNS hijacking, as shown in FIG. 2, including:
  • the dynamic configuration requesting module 101 is configured to send a dynamic configuration request to a dynamic host configuration protocol DHCP device in the local area network;
  • the first receiving module 102 is configured to receive dynamic configuration information returned by the DHCP device, where the dynamic configuration information includes an Internet Protocol IP address of the user equipment UE.
  • the sending module 103 is configured to send the IP address of the UE to the security server;
  • the second receiving module 104 is configured to receive an optional wide area network DNS server address of the candidate wide area network DNS server that is determined and sent by the security server based on the IP address of the UE and belongs to the same operator as the UE;
  • a first determining module 105 configured to determine an alternate wide area network DNS server address as a target wide area network DNS server address
  • the switching module 106 is configured to switch from the dynamically configured online state to the static Internet access state, dynamically configure the online state to receive dynamic configuration information sent by the DHCP device, and access the network state based on the dynamic configuration information, and the static Internet access state is static security.
  • the access module 107 is configured to access the network based on the security configuration information.
  • the first determining module 105 is configured to determine network connectivity of each candidate wide area network DNS server based on each candidate wide area network DNS server address; determine network connectivity.
  • the alternate WAN DNS server address corresponding to the optimal alternate WAN DNS server is the target WAN DNS server address.
  • the first determining module 105 is configured to request each candidate wide area network DNS server to obtain a response time of each alternate DNS server that returns a response; and determine an alternate wide area network DNS server with the shortest response time as the target DNS server. .
  • the device in the embodiment of the present disclosure further includes:
  • the judging module is configured to determine the gateway address in the dynamic configuration information and the primary DNS server in the dynamic configuration information when the primary DNS server address in the dynamic configuration information is a local area network address before the dynamic configuration of the online state is switched to the static Internet access state. Whether the addresses are consistent;
  • the second determining module is configured to determine that the local area network DNS hijacking risk exists when the gateway address and the primary DNS server address in the dynamic configuration information are inconsistent, and notify the switching module to switch from the dynamically configured online state to the static online state.
  • the device in the embodiment of the present disclosure further includes:
  • the extracting module is configured to extract a primary DNS server address or a standby DNS server address in the dynamic configuration information after switching from the dynamically configured online state to the static online state;
  • the third determining module is configured to determine the primary DNS server address or the standby DNS server address in the dynamic configuration information as the standby DNS server address in the security configuration information.
  • FIG. 3 illustrates a computing device that can implement a method of reducing DNS hijacking risk in accordance with the present disclosure.
  • the computing device traditionally includes a processor 310 and a computer program product or computer readable medium in the form of a storage device 320.
  • the storage device 320 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM.
  • Storage device 320 has a storage space 330 that stores program code 331 for performing any of the method steps described above.
  • storage space 330 storing program code may include individual program code 331 for implementing various steps in the above methods, respectively.
  • the program code can be read from or written to one or more computer program products.
  • These computer program products include program code carriers such as a hard disk, a compact disk (CD), a memory card, or a floppy disk.
  • Such computer program products are typically portable or fixed storage units such as those shown in FIG.
  • the storage unit may have storage segments, storage spaces, and the like that are similarly arranged to storage device 320 in the computing device of FIG.
  • the program code can be compressed, for example, in an appropriate form.
  • the storage unit includes computer readable code 331' for performing the method steps in accordance with the present disclosure, ie, code that can be read by a processor, such as 310, which when executed by the computing device causes the computing device Perform the various steps in the method described above.
  • the dynamic configuration request is sent to the dynamic host configuration protocol DHCP device in the local area network, and then the dynamic configuration information returned by the DHCP device is received, where the dynamic configuration information includes the Internet Protocol IP address of the user equipment UE. And then sending the IP address of the UE to the security server, and receiving an alternative WAN DNS server address of the candidate WAN DNS server that the security server determines and sends based on the IP address of the UE and belongs to the unified operator of the UE, and the alternative WAN The DNS server address is determined as the target WAN DNS server address, and then the dynamic configuration of the Internet access state is switched to the static Internet access state.
  • the dynamic configuration of the Internet access state is to receive the dynamic configuration information sent by the DHCP device, and based on the state of the dynamic configuration information access network, the static Internet access
  • the status is the status of accessing the network according to the static security configuration information.
  • the primary DNS server address of the security configuration information is the target WAN DNS server address, and finally accesses the network based on the security configuration information. Because the difficulty of hijacking the WAN DNS server is usually very large, and after the hijacking occurs, the maintenance personnel of the WAN DNS server can detect the abnormality and fix it quickly, so the risk of the access target WAN DNS server being hijacked is relatively greater than the access to the local area network DNS server. Low and safer. Therefore, the present disclosure achieves the risk of reducing DNS hijacking. Further, since the target WAN DNS server and the UE belong to the same carrier, the delay of the UE accessing the target DNS server and the probability of accessing the network resource are small, thereby ensuring that the user can normally access the network under the static Internet access state.
  • modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment.
  • the modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components.
  • any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined.
  • Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.
  • Various component embodiments of the present disclosure may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof.
  • a microprocessor or digital signal processor may be used in practice to implement some or all of the functionality of some or all of the gateways, proxy servers, systems in accordance with embodiments of the present disclosure.
  • the present disclosure may also be implemented as a device or device program (eg, a computer program and a computer program product) for performing some or all of the methods described herein.
  • Such a program implementing the present disclosure may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

Abstract

本公开实施例提供了一种降低DNS劫持风险的方法和装置，该方法包括：向局域网中的动态主机配置协议DHCP设备发送动态配置请求；接收DHCP设备返回的动态配置信息，动态配置信息中包括用户设备UE的互联网协议IP地址；将UE的IP地址发送至安全服务器；接收安全服务器基于UE的IP地址而确定并发送的与UE属于同一运营商的备选广域网DNS服务器的备选广域网DNS服务器地址；将备选广域网DNS服务器地址确定为目标广域网DNS服务器地址；由动态配置上网状态切换至静态上网状态；安全配置信息的主DNS服务器地址为目标广域网DNS服务器地址；基于安全配置信息接入网络。

Description

降低DNS劫持风险的方法和装置
相关申请的交叉参考
本申请要求于2016年12月21日提交中国专利局、申请号为201611193302.0、名称为“一种降低DNS劫持风险的方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本公开涉及电子技术领域，尤其涉及一种降低DNS劫持风险的方法和装置。
背景技术
一种常见的局域网DNS(域名解析系统，Domain Name System)劫持是攻击者在局域网络中搭建一台恶意行为的伪DNS服务器，并入侵该局域网的DHCP(动态主机配置协议，Dynamic Host Configuration Protocol)设备，将DHCP设备为UE(用户设备，User Equipment)分配的DNS服务器地址修改为伪DNS服务器地址。那么，UE基于DHCP动态分配的网络配置连接到伪DNS服务器，就存在劫持风险。
发明内容
鉴于上述问题，提出了本公开以便提供一种克服上述问题或者至少部分地解决上述问题的降低DNS劫持风险的方法和装置。
第一方面，本公开提供了一种降低DNS劫持风险的方法，包括：
向局域网中的动态主机配置协议DHCP设备发送动态配置请求；
接收DHCP设备返回的动态配置信息，动态配置信息中包括用户设备UE的互联网协议IP地址；
将UE的IP地址发送至安全服务器；
接收安全服务器基于UE的IP地址而确定并发送的与UE属于同一运营商的备选广域网DNS服务器的备选广域网DNS服务器地址；
将备选广域网DNS服务器地址确定为目标广域网DNS服务器地址；
由动态配置上网状态切换至静态上网状态，动态配置上网状态为接收DHCP设备发送的动态配置信息，并基于动态配置信息接入网络的状态，静态上网状态为按照静态的安全配置信息接入网络的状态；安全配置信息的主DNS服务器地址为目标广域网DNS服务器地址；
基于安全配置信息接入网络。
第二方面，本公开提供了一种降低DNS劫持风险的装置，包括：
动态配置请求模块，用于向局域网中的动态主机配置协议DHCP设备发送动态配置请求；
第一接收模块，用于接收DHCP设备返回的动态配置信息，动态配置信息中包括用户设备UE的互联网协议IP地址；
发送模块，用于将UE的IP地址发送至安全服务器；
第二接收模块，用于接收安全服务器基于UE的IP地址而确定并发送的与UE属于同一运营商的备选广域网DNS服务器的备选广域网DNS服务器地址；
第一确定模块，用于将备选广域网DNS服务器地址确定为目标广域网DNS服务器地址；
切换模块，用于由动态配置上网状态切换至静态上网状态，动态配置上网状态为接收DHCP设备发送的动态配置信息，并基于动态配置信息接入网络的状态，静态上网状态为按照静态的安全配置信息接入网络的状态；安全配置信息的主DNS服务器地址为目标广域网DNS服务器地址；
接入模块，用于基于安全配置信息接入网络。
第三方面，本公开提供了一种计算机程序，包括：
计算机可读代码，当计算机可读代码在计算设备上运行时，导致计算设备执行上述降低DNS劫持风险的方法。
第四方面，本公开提供了一种计算机可读介质，包括：
存储了上述执行上述降低DNS劫持风险的方法的计算机程序。
本公开实施例中的上述一个或多个技术方案，至少具有如下一种或多种技术效果：
在本公开实施例的技术方案中，首先向局域网中的动态主机配置协议 DHCP设备发送动态配置请求，进而接收DHCP设备返回的动态配置信息，动态配置信息中包括用户设备UE的互联网协议IP地址，然后将UE的IP地址发送至安全服务器，并接收安全服务器基于UE的IP地址而确定并发送的与UE属于统一运营商的备选广域网DNS服务器的备选广域网DNS服务器地址，并且将备选广域网DNS服务器地址确定为目标广域网DNS服务器地址，接着由动态配置上网状态切换至静态上网状态，动态配置上网状态为接收DHCP设备发送的动态配置信息，并基于动态配置信息接入网络的状态，静态上网状态为按照静态的安全配置信息接入网络的状态，安全配置信息的主DNS服务器地址为目标广域网DNS服务器地址，最后基于安全配置信息接入网络。由于劫持广域网DNS服务器的难度通常很大，并且在劫持发生后，广域网DNS服务器的维护人员能够及时发现异常且迅速修复，所以相对接入局域网DNS服务器，接入目标广域网DNS服务器被劫持的风险更低，安全性更高。所以，本公开实现了降低DNS劫持的风险。进一步，由于目标广域网DNS服务器与UE属于同一运营商，所以UE接入目标DNS服务器的时延和访问网络资源错误的几率较小，进而保障了用户在静态上网状态下能够正常接入网络。
附图概述
通过阅读下文优选实施方式的详细描述，各种其他的优点和益处对于本领域普通技术人员将变得清楚明了。附图仅用于示出优选实施方式的目的，而并不认为是对本公开的限制。而且在整个附图中，用相同的参考符号表示相同的部件。在附图中：
图1为本公开实施例中降低DNS劫持风险的方法流程图；
图2为本公开实施例中降低DNS劫持风险的装置结构示意图；图3示意性地示出了用于执行根据本公开实施例的降低DNS劫持风险的方法的计算设备的框图；以及
图4示意性地示出了用于保持或者携带实现根据本公开实施例的降低DNS劫持风险的方法的程序代码的存储单元。
本发明的较佳实施方式
下面将参照附图更详细地描述本公开的示例性实施例。虽然附图中显示了本公开的示例性实施例，然而应当理解，可以以各种形式实现本公开而不应被这里阐述的实施例所限制。相反，提供这些实施例是为了能够更透彻地理解本公开，并且能够将本公开的范围完整的传达给本领域的技术人员。
本公开实施例提供了一种降低DNS劫持风险的方法和装置，用以降低DNS劫持风险。请参考图1，为本公开实施例中降低DNS劫持风险的方法流程图，该方法包括：
S101：向局域网中的动态主机配置协议DHCP设备发送动态配置请求；
S102：接收DHCP设备返回的动态配置信息，动态配置信息中包括用户设备UE的互联网协议IP地址；
S103：将UE的IP地址发送至安全服务器；
S104：接收安全服务器基于UE的IP地址而确定并发送的与UE属于同一运营商的备选广域网DNS服务器的备选广域网DNS服务器地址；
S105：将备选广域网DNS服务器地址确定为目标广域网DNS服务器地址；
S106：由动态配置上网状态切换至静态上网状态，动态配置上网状态为接收DHCP设备发送的动态配置信息，并基于动态配置信息接入网络的状态，静态上网状态为按照静态的安全配置信息接入网络的状态；安全配置信息的主DNS服务器地址为目标广域网DNS服务器地址；
S107：基于安全配置信息接入网络。
具体来讲，在UE需要接入一局域网时，会向该局域网中的DHCP(动态主机配置协议，Dynamic Host Configuration Protocol)设备发送动态配置请求，以请求DHCP设备为UE配置动态配置信息。然后，DHCP设备在接收到UE发送的动态配置请求后，根据动态配置策略，为UE配置动态配置信息，并将配置出的动态配置信息返回UE。进而，UE在S102中接收DHCP设备发送的动态配置信息。
在本公开实施例中，动态配置信息包括UE的IP(互联网协议，Internet Protocol)地址。在具体实现过程中，动态配置信息还进一步包括子网掩码、网关地址、主DNS服务器地址和备DNS服务器地址。
接下来，由于无法确认此时局域网是否发生DNS劫持，所以S103中， UE将UE的IP地址发送至安全服务器，以及在S106中切换至静态上网状态。
在本公开实施例中，安全服务器是为UE提供网络安全服务的服务器。安全服务器接收UE上报的UE的IP地址后，确定出UE的运营商。在本公开实施例中，UE的运营商指的是运营UE通信网络的商家，例如中国电信、中国移动或中国联通等。在本公开实施例中，安全服务器存储有多个运营商中每个运营商所运营多个广域网DNS服务器的广域网DNS服务器地址。并且，安全服务器中存储的广域网DNS服务器地址所对应的广域网DNS服务器地址均被安全服务器鉴定为安全的DNS服务器。由于UE接入与自身不属于同一运营商的DNS服务器而访问网络时，容易出现时延较大，甚至访问网络资源错误的可能，所以，本公开实施例中，安全服务器根据UE所属的运营商，从该运营商的多个广域网DNS服务器地址中选择一个或多个地址作为备选广域网DNS服务器地址，并将备选广域网DNS服务器地址发送给UE。
接下来，S104中，UE接收安全服务器发送的备选广域网DNS服务器地址。然后，在S105中，将备选DNS服务器地址确定为目标广域网DNS服务器地址。具体来讲，当安全服务器向UE发送的备选广域网DNS服务器仅有一个时，UE可以直接将该备选广域网DNS服务器地址确定为目标广域网DNS服务器地址。而当安全服务器向UE发送的备选广域网DNS服务器地址有多个时，UE可以从多个备选广域网DNS服务器地址中任意确定一个为目标广域网DNS服务器地址，也可以确定最优的备选广域网DNS服务器地址为目标广域网地址。本公开所属领域的普通技术人员可以根据实际进行选择，本公开不做具体限制。在后文中将会详细介绍如何从多个备选广域网DNS服务器地址中确定最优的备选广域网DNS服务器地址。
在S106中，UE将上网状态由动态配置状态状态切换至静态上网状态。
具体来讲，本公开实施例中的UE具有两种上网状态，具体为动态配置上网状态和静态上网状态。在具体实现过程中，还可以包括其他上网状态，本公开不做具体限制。其中，动态配置上网状态为接收DHCP发送的动态配置信息，并基于动态配置信息接入网络的状态。换言之，在动态配置上网状态下，UE将按照动态配置信息中的UE的IP地址和子网掩码接入动态配置信息中网关地址所指示的网关和动态配置信息中主DNS服务器地址所指示的主DNS服务器(或备DNS服务器地址所指示的备DNS服务器)。而静态 上网状态则为按照静态的安全配置信息接入网络的状态。其中，本公开实施中的安全配置信息至少包括主DNS服务器地址，且安全配置信息中的主DNS服务器地址在本公开中具体为目标广域网DNS服务器地址。当然，安全配置信息还可以进一步包括UE的IP地址、子网掩码、网关地址和备DNS服务器地址，本公开不做具体限制。
在本公开实施例中，安全配置信息可以为预先存储的缺省信息。例如预先将默认安全的IP地址、子网掩码、网关地址、主DNS服务器地址(即目标广域网DNS服务器地址)和备DNS服务器地址存储为安全配置信息，在切换到静态上网状态后，再读取预先存储的安全配置信息。或者，安全配置信息也可以基于用户输入而生成。例如，用户根据提示信息获知当前局域网存在DNS劫持风险时，自行输入安全的IP地址、子网掩码、网关地址、主DNS服务器地址(即目标广域网DNS服务器地址)和备DNS服务器地址，进而UE根据用户输入的IP地址、子网掩码、网关地址、主DNS服务器地址和备DNS服务器地址生成安全配置信息。或者，安全配置信息也可以是切换到静态上网状态后根据实际情况而生成的。
本领域技术人员应当理解，尽管S103至S105记载在S106之前，但在具体实现过程中，S103至S105与S106的执行顺序不限定。换言之，UE可以先执行S103、S104和S105，再执行S106，也可以先执行S106，再执行S103、S104和S105，也可以先执行S103，再执行S106，接着执行S104和S105，还可以同时执行S103至S105和S106，本公开不做具体限制。
接下来，在S106中，基于安全配置信息接入网络，进而在接入DNS服务器时，将接入目标广域网DNS服务器，而不是接入局域网DNS服务器。
由于劫持广域网DNS服务器的难度通常很大，并且在劫持发生后，广域网DNS服务器的维护人员能够及时发现异常且迅速修复，所以相对接入局域网DNS服务器，接入广域网DNS服务器被劫持的风险更低，安全性更高。所以，本公开实现了降低DNS劫持的风险。
同时，由于目标广域网DNS服务器与UE属于同一运营商，所以UE接入目标DNS服务器的时延和访问网络资源错误的几率较小，进而保障了用户在静态上网状态下正常接入网络。
在具体实现过程中，安全服务器可以从与UE属于同一运营商的广域网 DNS服务器的广域网DNS服务器地址中任意选择一个为备选广域网DNS服务器地址，或者也可以从与UE属于同一运营商的广域网DNS服务器中选择与UE间路径最短的一个广域网DNS服务器的广域网DNS服务器地址为备选广域网DNS服务器地址。本公开所属领域的普通技术人员可以根据实际进行选择，本公开不做具体限制。
或者，安全服务器也可以从与UE属于同一运营商的广域网DNS服务器的广域网DNS服务器地址中任意选择多个为备选广域网DNS服务器地址，或者选择路径最短的多个广域网DNS服务器的广域网DNS服务器地址作为备选广域网DNS服务器地址。
作为一种可选的实施例，当安全服务器向UE发送的备选广域网DNS服务器地址包括多个时，S105中将备选广域网DNS服务器地址确定为目标广域网DNS服务器地址就具体可以通过如下过程实现：
基于每个备选广域网DNS服务器地址，确定每个备选广域网DNS服务器的网络连通性；
确定网络连通性最优的备选广域网DNS服务器对应的备选广域网DNS服务器地址为目标广域网DNS服务器地址。
其中，本公开实施例中的网络连通性表示备选广域网DNS服务器对于UE的连接性能。在本公开实施例中，根据备选广域网DNS服务器地址确定备选广域网DNS服务器的网络连通性有多种方式。
例如，由于曾经接入过的广域网DNS服务器可以优选接入，且接入次数越高，表示该广域网DNS服务器的网络连通性也越强。所以，UE可以将在静态上网状态下接入过的广域网DNS服务器的地址存储为历史广域网DNS服务器地址，并存储接入每个历史广域网DNS服务器的次数。进而UE以接入次数表示网络连通性。接入次数越高，网络连通性越优；接入次数越少，网络连通性越差。因此，最终选择接入次数最高的备选广域网DNS服务器为目标广域网DNS服务器。
举例来说，假设历史广域网DNS服务器地址具体为A、B、C和D，且UE接入A对应的广域网DNS服务器的次数为10次，接入B对应的广域网DNS服务器的次数为3次，接入C对应的广域网DNS服务器的次数为12次，接入D对应的广域网DNS服务器的次数为8次。此时备选广域网DNS 服务器地址具体为B、C、D和E，所以B对应的广域网DNS服务器的网络连通性为3，C对应的广域网DNS服务器的网络连通性为12，D对应的广域网DNS服务器的网络连通性为8，E对应的广域网DNS服务器的网络连通性为0。所以，确定C为目标广域网DNS服务器地址。
或者，安全服务器确定备选广域网DNS服务器地址之后，还可以进一步向各个备选广域网DNS服务器发送表示请求获取当前负载量和饱和负载量的获取请求，进而接收每个备选广域网DNS服务器向安全服务器反馈的当前负载量和饱和负载量。其中，饱和负载量表示一个广域网DNS服务器最多可承载的负载量。然后，安全服务器除了向UE发送备选广域网DNS服务器地址之外，还会将每个备选广域网DNS服务器的当前负载量和饱和负载量也发送给UE。进而，在本公开实施例中，UE可以根据广域网DNS服务器的当前负载量和饱和负载量计算负载饱和率，具体为负载饱和率＝当前负载量/饱和负载量。进而以饱和负载率表示网络连通性。饱和负载率越小，网络连通性越优；饱和负载率越大，网络连通性越差。因此，最终选择负载饱和率最小的备选广域网DNS服务器为目标广域网DNS服务器。
举例来说，假设备选广域网DNS服务器地址具体为B、C、D和E，B对应的广域网DNS服务器饱和负载量为1000，当前负载量为500，C对应的广域网DNS服务器饱和负载量为1000，当前负载量为200，D对应的广域网DNS服务器饱和负载量为10000，当前负载量为9000，E对应的广域网DNS服务器饱和负载量为100，当前负载量为10。所以，UE计算出B对应的广域网DNS服务器当前饱和率为50％，C对应的广域网DNS服务器当前饱和率为20％，D对应的广域网DNS服务器当前饱和率为90％，E对应的广域网DNS服务器当前饱和率为10％。所以，确定E为目标广域网DNS服务器地址。
或者，作为一种可选的实施例，还可以备选广域网DNS服务器的应答实际表示网络连通性，那么，确定每个备选广域网DNS服务器地址对应的备选广域网DNS服务器的网络连通性，包括：
请求每个备选广域网DNS服务器应答，以获得每个应答的备选DNS服务器的应答时间；
确定网络连通性最优的备选广域网DNS服务器对应的备选广域网DNS 服务器地址为目标广域网DNS服务器地址，包括：
确定应答时间最短的备选广域网DNS服务器为目标DNS服务器。
具体来讲，UE在接收到安全服务器发送的多个备选广域网DNS服务器地址后，基于每个备选广域网DNS服务器地址，向每个备选广域网DNS服务器发送请求，请求备选广域网DNS服务器应答。如果备选广域网DNS服务器应答，则UE获取该备选广域网DNS服务器的应答时间。如果备选广域网DNS服务器超时未应答，则UE可以确定该备选广域网DNS服务器无法正常连接，因此不会将该备选广域网DNS服务器地址作为目标广域网DNS服务器地址。
接下来，由于应答时间越短，表示广域网DNS服务器应答速度快，时延小，所以UE从应答成功的备选广域网DNS服务器中，确定最短应答时间所对应的备选广域网DNS服务器地址。
进一步，作为一种可选的实施例，在由动态配置上网状态切换至静态上网状态之前，还包括：
当动态配置信息中的主DNS服务器地址为局域网地址时，判断动态配置信息中的网关地址和动态配置信息中的主DNS服务器地址是否一致；
当网关地址和动态配置信息中的主DNS服务器地址不一致时，确定存在局域网DNS劫持风险，执行由动态配置上网状态切换至静态上网状态的步骤。
具体来讲，UE获取动态配置信息中的主DNS服务器地址，然后判断该主DNS服务器地址是否为局域网地址。其中，判断动态配置信息中的主DNS服务器地址是否为局域网地址，具体为通过判断动态配置信息中的主DNS地址是否为ClassA、ClassB或ClassC中的一个区间。其中，ClassA区间的地址范围为10.0.0.0～10.255.255.255，ClassB区间的地址范围为172.16.0.0-172.31.255.255，ClassC区间的地址范围为192.168.0.0-192.168.255.255。如果动态配置信息的主DNS服务器地址位于ClassA、ClassB或ClassC中的任意一个区间中，则表示动态配置信息中的主DNS服务器地址为局域网地址；反之，如果动态配置信息中的主DNS服务器地址不在ClassA、ClassB和ClassC区间中，则表示动态配置信息中的主DNS服务器地址不为局域网地址。
进一步，如果DHCP设备所配置的主DNS服务器地址为局域网地址，则通常请求下，DHCP设备所配置的网关地址与主DNS服务器地址是一致的，例如都是192.168.1.1，因此，当动态配置信息中的主DNS服务器地址为局域网地址，且动态配置信息中的网关地址和主DNS服务器地址一致，表示目前局域网DNS服务器正常，被劫持的可能性较低。反之，当动态配置信息中的主DNS服务器地址为局域网地址，而动态配置信息中的网关地址和主DNS服务器地址不一致，则表示局域网中的主DNS服务器异常，可能被劫持。所以，在本公开实施例中，当动态配置信息中的网关地址和动态配置信息中的主DNS服务器地址不一致时，将确定当前存在局域网DNS劫持风险。
进一步，当UE确定存在局域网DNS劫持风险时，可以向用户输出提示信息，例如显示“当前局域网存在风险”的文字信息、或者播放警告音等，以提示用户及时对局域网DNS劫持风险进行处理。
在确定存在局域网DNS劫持风险后，如果继续以动态配置上网状态接入网络，可能导致用户财产损失、隐身信息被盗等危险，所以此时UE执行S105，由动态配置上网状态切换至静态上网状态，并且按照安全配置信息接入网络。
由上述描述可以看出，在动态配置信息的主DNS服务器地址为局域网地址时，通过判断动态配置信息中的网关地址是否与主DNS服务器地址一致来检测局域网安全，并在网关地址与主DNS服务器不一致时确定存在局域网DNS劫持风险，就实现了在局域网中检测DNS劫持风险的技术效果。同时，在确定存在局域网DNS风险时再按照静态上网状态接入网络，避免了UE频繁接入广域网DNS服务器而带来的功耗高和上网速度慢等问题。
进一步，本公开实施例中的安全配置信息还包括备DNS服务器地址。对于安全配置信息的备DNS服务器地址，也有多种可能。具体来讲，备DNS服务器地址可以为预先存储的缺省信息，或者用户输入的地址。或者，在切换到静态上网状态之后，UE将网络连通性最优的备选广域网DNS服务器的地址确定为安全配置信息的主DNS服务器地址，然后将网络连通性仅次于目标广域网DNS服务器的另一个备选广域网DNS服务器的地址确定为安全配置信息中的备DNS服务器地址。或者，由动态配置上网状态切换至静态上网之后，还可以进一步包括：
提取动态配置信息中的主DNS服务器地址或者备DNS服务器地址；
将动态配置信息中的主DNS服务器地址或者备DNS服务器地址确定为安全配置信息中的备DNS服务器地址。
具体来讲，确定安全配置信息中的备DNS服务器地址的另一种实现方式为，UE在切换到静态上网状态后，提取动态配置信息中的主DNS服务器地址或备DNS服务器地址，然后将提取到的动态配置信息的主DNS服务器地址或备DNS服务器地址确定为安全配置信息的备DNS服务器地址。
进一步，在具体实现过程中，局域网中的主DNS服务器比备DNS服务器通常更可靠，且更容易发现故障而被及时进行修改，所以将动态配置信息中的主DNS服务器地址确定为安全配置信息中的备DNS服务器地址为较佳选择。
另外，对于安全配置信息中的UE的IP地址、子网掩码和网关地址等，也可以直接使用动态配置信息中的UE的IP地址、子网掩码和网关地址，本公开不做具体限制。
基于与前述实施例中降低DNS劫持风险的方法同样的公开构思，本公开第二方面还提供一种降低DNS劫持风险的装置，如图2所示，包括：
动态配置请求模块101，用于向局域网中的动态主机配置协议DHCP设备发送动态配置请求；
第一接收模块102，用于接收DHCP设备返回的动态配置信息，动态配置信息中包括用户设备UE的互联网协议IP地址；
发送模块103，用于将UE的IP地址发送至安全服务器；
第二接收模块104，用于接收安全服务器基于UE的IP地址而确定并发送的与UE属于同一运营商的备选广域网DNS服务器的备选广域网DNS服务器地址；
第一确定模块105，用于将备选广域网DNS服务器地址确定为目标广域网DNS服务器地址；
切换模块106，用于由动态配置上网状态切换至静态上网状态，动态配置上网状态为接收DHCP设备发送的动态配置信息，并基于动态配置信息接入网络的状态，静态上网状态为按照静态的安全配置信息接入网络的状态；安全配置信息的主DNS服务器地址为目标广域网DNS服务器地址；
接入模块107，用于基于安全配置信息接入网络。
具体来讲，当备选广域网DNS服务器地址包括多个时，第一确定模块105用于基于每个备选广域网DNS服务器地址，确定每个备选广域网DNS服务器的网络连通性；确定网络连通性最优的备选广域网DNS服务器对应的备选广域网DNS服务器地址为目标广域网DNS服务器地址。
具体来讲，第一确定模块105用于请求每个备选广域网DNS服务器应答，以获得每个返回应答的备选DNS服务器的应答时间；确定应答时间最短的备选广域网DNS服务器为目标DNS服务器。
进一步，本公开实施例中的装置还包括：
判断模块，用于在由动态配置上网状态切换至静态上网状态之前，当动态配置信息中的主DNS服务器地址为局域网地址时，判断动态配置信息中的网关地址和动态配置信息中的主DNS服务器地址是否一致；
第二确定模块，用于当网关地址和动态配置信息中的主DNS服务器地址不一致时，确定存在局域网DNS劫持风险，并通知切换模块由动态配置上网状态切换至静态上网状态。
更进一步，本公开实施例中的装置还包括：
提取模块，用于在由动态配置上网状态切换至静态上网状态之后，提取动态配置信息中的主DNS服务器地址或者备DNS服务器地址；
第三确定模块，用于将动态配置信息中的主DNS服务器地址或者备DNS服务器地址确定为安全配置信息中的备DNS服务器地址。
前述图1实施例中的降低DNS劫持风险的方法的各种变化方式和具体实例同样适用于本实施例的降低DNS劫持风险的装置，通过前述对降低DNS劫持风险的方法的详细描述，本领域技术人员可以清楚的知道本实施例中降低DNS劫持风险的装置的实施方法，所以为了说明书的简洁，在此不再详述。
本公开第三方面提供了一种计算机程序，图3示出了可以实现根据本公开的降低DNS劫持风险的方法的计算设备。该计算设备传统上包括处理器310和以存储设备320形式的计算机程序产品或者计算机可读介质。存储设备320可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。存储设备320具有存储用于执行上述方法中的任何方法步骤的程序代码331的存储空间330。例如，存储程序代码 的存储空间330可以包括分别用于实现上面的方法中的各种步骤的各个程序代码331。这些程序代码可以从一个或者多个计算机程序产品中读出或者写入到这一个或者多个计算机程序产品中。这些计算机程序产品包括诸如硬盘、紧致盘(CD)、存储卡或者软盘之类的程序代码载体。这样的计算机程序产品通常为例如图4所示的便携式或者固定存储单元。该存储单元可以具有与图3的计算设备中的存储设备320类似布置的存储段、存储空间等。程序代码可以例如以适当形式进行压缩。通常，存储单元包括用于执行根据本公开的方法步骤的计算机可读代码331＇，即可以由诸如310之类的处理器读取的代码，当这些代码由计算设备运行时，导致该计算设备执行上面所描述的方法中的各个步骤。
本公开实施例中的上述一个或多个技术方案，至少具有如下一种或多种技术效果：
在本公开实施例的技术方案中，首先向局域网中的动态主机配置协议DHCP设备发送动态配置请求，进而接收DHCP设备返回的动态配置信息，动态配置信息中包括用户设备UE的互联网协议IP地址，然后将UE的IP地址发送至安全服务器，并接收安全服务器基于UE的IP地址而确定并发送的与UE属于统一运营商的备选广域网DNS服务器的备选广域网DNS服务器地址，并且将备选广域网DNS服务器地址确定为目标广域网DNS服务器地址，接着由动态配置上网状态切换至静态上网状态，动态配置上网状态为接收DHCP设备发送的动态配置信息，并基于动态配置信息接入网络的状态，静态上网状态为按照静态的安全配置信息接入网络的状态，安全配置信息的主DNS服务器地址为目标广域网DNS服务器地址，最后基于安全配置信息接入网络。由于劫持广域网DNS服务器的难度通常很大，并且在劫持发生后，广域网DNS服务器的维护人员能够及时发现异常且迅速修复，所以相对接入局域网DNS服务器，接入目标广域网DNS服务器被劫持的风险更低，安全性更高。所以，本公开实现了降低DNS劫持的风险。进一步，由于目标广域网DNS服务器与UE属于同一运营商，所以UE接入目标DNS服务器的时延和访问网络资源错误的几率较小，进而保障了用户在静态上网状态下能够正常接入网络。
在此提供的算法和显示不与任何特定计算机、虚拟系统或者其它设备固 有相关。各种通用系统也可以与基于在此的示教一起使用。根据上面的描述，构造这类系统所要求的结构是显而易见的。此外，本公开也不针对任何特定编程语言。应当明白，可以利用各种编程语言实现在此描述的本公开的内容，并且上面对特定语言所做的描述是为了披露本公开的最佳实施方式。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本公开的实施例可以在没有这些具体细节的情况下实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
类似地，应当理解，为了精简本公开并帮助理解各个公开方面中的一个或多个，在上面对本公开的示例性实施例的描述中，本公开的各个特征有时被一起分组到单个实施例、图、或者对其的描述中。然而，并不应将该公开的方法解释成反映如下意图：即所要求保护的本公开要求比在每个权利要求中所明确记载的特征更多的特征。更确切地说，如下面的权利要求书所反映的那样，公开方面在于少于前面公开的单个实施例的所有特征。因此，遵循具体实施方式的权利要求书由此明确地并入该具体实施方式，其中每个权利要求本身都作为本公开的单独实施例。
本领域那些技术人员可以理解，可以对实施例中的设备中的模块进行自适应性地改变并且把它们设置在与该实施例不同的一个或多个设备中。可以把实施例中的模块或单元或组件组合成一个模块或单元或组件，以及此外可以把它们分成多个子模块或子单元或子组件。除了这样的特征和/或过程或者单元中的至少一些是相互排斥之外，可以采用任何组合对本说明书(包括伴随的权利要求、摘要和附图)中公开的所有特征以及如此公开的任何方法或者设备的所有过程或单元进行组合。除非另外明确陈述，本说明书(包括伴随的权利要求、摘要和附图)中公开的每个特征可以由提供相同、等同或相似目的的替代特征来代替。
此外，本领域的技术人员能够理解，尽管在此的一些实施例包括其它实施例中所包括的某些特征而不是其它特征，但是不同实施例的特征的组合意味着处于本公开的范围之内并且形成不同的实施例。例如，在下面的权利要求书中，所要求保护的实施例的任意之一都可以以任意的组合方式来使用。
本公开的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的软件模块实现，或者以它们的组合实现。本领域的技术人员应当 理解，可以在实践中使用微处理器或者数字信号处理器(DSP)来实现根据本公开实施例的网关、代理服务器、系统中的一些或者全部部件的一些或者全部功能。本公开还可以实现为用于执行这里所描述的方法的一部分或者全部的设备或者装置程序(例如，计算机程序和计算机程序产品)。这样的实现本公开的程序可以存储在计算机可读介质上，或者可以具有一个或者多个信号的形式。这样的信号可以从因特网网站上下载得到，或者在载体信号上提供，或者以任何其他形式提供。
应该注意的是上述实施例对本公开进行说明而不是对本公开进行限制，并且本领域技术人员在不脱离所附权利要求的范围的情况下可设计出替换实施例。在权利要求中，不应将位于括号之间的任何参考符号构造成对权利要求的限制。单词“包含”不排除存在未列在权利要求中的元件或步骤。位于元件之前的单词“一”或“一个”不排除存在多个这样的元件。本公开可以借助于包括有若干不同元件的硬件以及借助于适当编程的计算机来实现。在列举了若干装置的单元权利要求中，这些装置中的若干个可以是通过同一个硬件项来具体体现。单词第一、第二、以及第三等的使用不表示任何顺序。可将这些单词解释为名称。

Claims (12)

  1. 一种降低DNS劫持风险的方法，其特征在于，包括：
    向局域网中的动态主机配置协议DHCP设备发送动态配置请求；
    接收所述DHCP设备返回的动态配置信息，所述动态配置信息中包括用户设备UE的互联网协议IP地址；
    将所述UE的IP地址发送至安全服务器；
    接收所述安全服务器基于所述UE的IP地址而确定并发送的与所述UE属于同一运营商的备选广域网DNS服务器的备选广域网DNS服务器地址；
    将所述备选广域网DNS服务器地址确定为目标广域网DNS服务器地址；
    由动态配置上网状态切换至静态上网状态，所述动态配置上网状态为接收所述DHCP设备发送的所述动态配置信息，并基于所述动态配置信息接入网络的状态，所述静态上网状态为按照静态的安全配置信息接入网络的状态；所述安全配置信息的主DNS服务器地址为所述目标广域网DNS服务器地址；
    基于所述安全配置信息接入网络。
  2. 如权利要求1所述的方法，其特征在于，当所述备选广域网DNS服务器地址包括多个时，将所述备选广域网DNS服务器地址确定为目标广域网DNS服务器地址，包括：
    基于每个所述备选广域网DNS服务器地址，确定每个所述备选广域网DNS服务器的网络连通性；
    确定网络连通性最优的所述备选广域网DNS服务器对应的所述备选广域网DNS服务器地址为所述目标广域网DNS服务器地址。
  3. 如权利要求2所述的方法，其特征在于，确定每个所述备选广域网DNS服务器地址对应的备选广域网DNS服务器的网络连通性，包括：
    请求每个所述备选广域网DNS服务器应答，以获得每个返回应答的所述备选DNS服务器的应答时间；
    确定网络连通性最优的所述备选广域网DNS服务器对应的所述备选广域网DNS服务器地址为所述目标广域网DNS服务器地址，包括：
    确定所述应答时间最短的所述备选广域网DNS服务器为所述目标DNS 服务器。
  4. 如权利要求1所述的方法，其特征在于，在由动态配置上网状态切换至静态上网状态之前，还包括：
    当所述动态配置信息中的主DNS服务器地址为局域网地址时，判断所述动态配置信息中的网关地址和所述动态配置信息中的主DNS服务器地址是否一致；
    当所述网关地址和所述动态配置信息中的主DNS服务器地址不一致时，确定存在局域网DNS劫持风险，执行所述由动态配置上网状态切换至静态上网状态的步骤。
  5. 如权利要求1或4所述的方法，其特征在于，在由动态配置上网状态切换至静态上网状态之后，还包括：
    提取所述动态配置信息中的主DNS服务器地址或者备DNS服务器地址；
    将所述动态配置信息中的主DNS服务器地址或者备DNS服务器地址确定为所述安全配置信息中的备DNS服务器地址。
  6. 一种降低DNS劫持风险的装置，其特征在于，包括：
    动态配置请求模块，用于向局域网中的动态主机配置协议DHCP设备发送动态配置请求；
    第一接收模块，用于接收所述DHCP设备返回的动态配置信息，所述动态配置信息中包括用户设备UE的互联网协议IP地址；
    发送模块，用于将所述UE的IP地址发送至安全服务器；
    第二接收模块，用于接收所述安全服务器基于所述UE的IP地址而确定并发送的与所述UE属于同一运营商的备选广域网DNS服务器的备选广域网DNS服务器地址；
    第一确定模块，用于将所述备选广域网DNS服务器地址确定为目标广域网DNS服务器地址；
    切换模块，用于由动态配置上网状态切换至静态上网状态，所述动态配置上网状态为接收所述DHCP设备发送的所述动态配置信息，并基于所述动态配置信息接入网络的状态，所述静态上网状态为按照静态的安全配置信息接入网络的状态；所述安全配置信息的主DNS服务器地址为所述目标广域网DNS服务器地址；
    接入模块，用于基于所述安全配置信息接入网络。
  7. 如权利要求6所述的装置，其特征在于，当所述备选广域网DNS服务器地址包括多个时，所述第一确定模块用于基于每个所述备选广域网DNS服务器地址，确定每个所述备选广域网DNS服务器的网络连通性；确定网络连通性最优的所述备选广域网DNS服务器对应的所述备选广域网DNS服务器地址为所述目标广域网DNS服务器地址。
  8. 如权利要求7所述的装置，其特征在于，所述第一确定模块用于请求每个所述备选广域网DNS服务器应答，以获得每个返回应答的所述备选DNS服务器的应答时间；确定所述应答时间最短的所述备选广域网DNS服务器为所述目标DNS服务器。
  9. 如权利要求6所述的装置，其特征在于，所述装置还包括：
    判断模块，用于在由动态配置上网状态切换至静态上网状态之前，当所述动态配置信息中的主DNS服务器地址为局域网地址时，判断所述动态配置信息中的网关地址和所述动态配置信息中的主DNS服务器地址是否一致；
    第二确定模块，用于当所述网关地址和所述动态配置信息中的主DNS服务器地址不一致时，确定存在局域网DNS劫持风险，并通知所述切换模块由动态配置上网状态切换至静态上网状态。
  10. 如权利要求6或9所述的装置，其特征在于，所述装置还包括：
    提取模块，用于在由动态配置上网状态切换至静态上网状态之后，提取所述动态配置信息中的主DNS服务器地址或者备DNS服务器地址；
    第三确定模块，用于将所述动态配置信息中的主DNS服务器地址或者备DNS服务器地址确定为所述安全配置信息中的备DNS服务器地址。
  11. 一种计算机程序，包括计算机可读代码，当所述计算机可读代码在计算设备上运行时，导致所述计算设备执行根据权利要求1-5中的任一项所述的降低DNS劫持风险的方法。
  12. 一种计算机可读介质，其中存储了如权利要求11所述的计算机程序。
PCT/CN2017/117695 2016-12-21 2017-12-21 降低dns劫持风险的方法和装置 WO2018113731A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201611193302.0 2016-12-21
CN201611193302.0A CN106713311B (zh) 2016-12-21 2016-12-21 一种降低dns劫持风险的方法和装置

Publications (1)

Publication Number Publication Date
WO2018113731A1 true WO2018113731A1 (zh) 2018-06-28

Family

ID=58939644

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/117695 WO2018113731A1 (zh) 2016-12-21 2017-12-21 降低dns劫持风险的方法和装置

Country Status (2)

Country Link
CN (1) CN106713311B (zh)
WO (1) WO2018113731A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106506544B (zh) * 2016-12-21 2019-07-05 北京奇虎科技有限公司 一种局域网dns劫持检测的方法和装置
CN106713309A (zh) * 2016-12-21 2017-05-24 北京奇虎科技有限公司 一种降低dns劫持风险的方法和装置
CN106713311B (zh) * 2016-12-21 2021-01-15 北京奇虎科技有限公司 一种降低dns劫持风险的方法和装置
CN108777709A (zh) * 2018-05-31 2018-11-09 康键信息技术（深圳）有限公司 网站访问方法、装置、计算机设备和存储介质
CN109495567B (zh) * 2018-11-16 2020-12-29 网宿科技股份有限公司 一种静态路由的部署方法、设备及系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102624914A (zh) * 2012-03-22 2012-08-01 北京快网科技有限公司 通过Web方式探测客户端使用的本地DNS服务器的方法
WO2013034195A1 (en) * 2011-09-09 2013-03-14 Telefonaktiebolaget L M Ericsson (Publ) Differentiated handling of data traffic with user-class dependent adaptation of network address lookup
CN103546590A (zh) * 2013-10-18 2014-01-29 北京奇虎科技有限公司 一种dns服务器的选择方法与装置
CN103973704A (zh) * 2014-05-23 2014-08-06 北京奇虎科技有限公司 基于wifi设备的域名解析方法、装置及系统
CN106713309A (zh) * 2016-12-21 2017-05-24 北京奇虎科技有限公司 一种降低dns劫持风险的方法和装置
CN106713311A (zh) * 2016-12-21 2017-05-24 北京奇虎科技有限公司 一种降低dns劫持风险的方法和装置

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7571460B2 (en) * 2004-08-06 2009-08-04 Time Warner Cable, Inc. System and method for affecting the behavior of a network device in a cable network
CN104468866B (zh) * 2014-12-26 2017-11-21 陈晨 一种无线局域网中多网关终端快速漫游方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2013034195A1 (en) * 2011-09-09 2013-03-14 Telefonaktiebolaget L M Ericsson (Publ) Differentiated handling of data traffic with user-class dependent adaptation of network address lookup
CN102624914A (zh) * 2012-03-22 2012-08-01 北京快网科技有限公司 通过Web方式探测客户端使用的本地DNS服务器的方法
CN103546590A (zh) * 2013-10-18 2014-01-29 北京奇虎科技有限公司 一种dns服务器的选择方法与装置
CN103973704A (zh) * 2014-05-23 2014-08-06 北京奇虎科技有限公司 基于wifi设备的域名解析方法、装置及系统
CN106713309A (zh) * 2016-12-21 2017-05-24 北京奇虎科技有限公司 一种降低dns劫持风险的方法和装置
CN106713311A (zh) * 2016-12-21 2017-05-24 北京奇虎科技有限公司 一种降低dns劫持风险的方法和装置

Also Published As

Publication number Publication date
CN106713311A (zh) 2017-05-24
CN106713311B (zh) 2021-01-15

Similar Documents

Publication Publication Date Title
WO2018113731A1 (zh) 降低dns劫持风险的方法和装置
US9912560B2 (en) Method and device for checking health of link
CN107528862B (zh) 域名解析的方法及装置
WO2018228302A1 (zh) 用于虚拟网络链路检测的方法及装置
US20150229641A1 (en) Migration of a security policy of a virtual machine
US20180146008A1 (en) Implementing Decoys in Network Endpoints
CN109314664B (zh) 僵尸主控机发现设备和方法
CN108270778B (zh) 一种dns域名异常访问检测方法及装置
US20230024475A1 (en) Security aware load balancing for a global server load balancing system
JP6483819B2 (ja) ドメイン名システムのリソース枯渇攻撃を識別する装置及び方法
US9350754B2 (en) Mitigating a cyber-security attack by changing a network address of a system under attack
US8929225B2 (en) Customer edge device problem identification
WO2018113727A1 (zh) 降低dns劫持风险的方法和装置
WO2018113729A1 (zh) 局域网dns劫持检测的方法和装置
US10033690B2 (en) Communication method, wireless access point, wireless controller and communication system
CN108848076B (zh) 一种用于通过用户设备检测dns劫持的方法与设备
CN104009999A (zh) 防止arp欺骗的方法、装置及网络接入服务器
KR101491322B1 (ko) 자기 구성 근거리 네트워크 보안
US10623421B2 (en) Detecting IP address theft in data center networks
CN106470249A (zh) Gateway-whois域名注册查询方法和装置
EP3602370A1 (en) Triggered scanning using provided configuration information
KR101445255B1 (ko) 부하 분산 설정을 자동으로 제공하기 위한 방법, 장치, 시스템 및 컴퓨터 판독 가능한 기록 매체
WO2020103578A1 (zh) 域名查询方法及相关产品
US20170289099A1 (en) Method and Device for Managing Internet Protocol Version 6 Address, and Terminal
US10375014B2 (en) System and method for minimizing broadcast communications when allocating network addresses

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17884315

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17884315

Country of ref document: EP

Kind code of ref document: A1