WO2019129154A1 - 业务请求处理方法及装置 - Google Patents

业务请求处理方法及装置 Download PDF

Info

Publication number
WO2019129154A1
WO2019129154A1 PCT/CN2018/124419 CN2018124419W WO2019129154A1 WO 2019129154 A1 WO2019129154 A1 WO 2019129154A1 CN 2018124419 W CN2018124419 W CN 2018124419W WO 2019129154 A1 WO2019129154 A1 WO 2019129154A1
Authority
WO
WIPO (PCT)
Prior art keywords
identifier
server
client
query
idgw
Prior art date
Application number
PCT/CN2018/124419
Other languages
English (en)
French (fr)
Inventor
郝振武
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to US16/958,982 priority Critical patent/US11451510B2/en
Priority to EP18894658.6A priority patent/EP3720100A4/en
Publication of WO2019129154A1 publication Critical patent/WO2019129154A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/256—NAT traversal
    • H04L61/2567—NAT traversal for reachability, e.g. inquiring the address of a correspondent behind a NAT server
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2521—Translation architectures other than single NAT servers
    • H04L61/2528—Translation at a proxy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2521—Translation architectures other than single NAT servers
    • H04L61/2525—Translation at a client
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4552—Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources

Definitions

  • the present invention relates to the field of communications, and in particular to a service request processing method and apparatus.
  • Moving Target Defense is a new type of network security protection idea. Through technical means, it implements a continuous dynamic transformation on the attack surface of the protected target presented to the attacker to confuse the attacker and thereby increase The cost and complexity of an attacker's successful attack reduces the probability of successful attack and improves system resiliency and security.
  • the idea of moving target defense is applied to the IP network.
  • the communication parameters here mainly refer to the IP address and communication port of the target host, wherein the IP address represents the identity of the host in the network, the communication port represents the different communication connection of the host, and the communication connection between the hosts can be established through the IP address and the port.
  • the IP address or IP address + port is collectively referred to as an identifier, which can identify the service portal provided by the host or host.
  • FIG. 1 is a block diagram of a client access server in the related art.
  • the client uses a domain name from a server (Domain Name Server, DNS for short).
  • DNS Domain Name Server
  • Obtain the IP address of the server then find the server through the IP address, and establish a connection through the open communication port of the server to obtain the services provided by the server.
  • the communication parameters of the terminal are generally changed, and the server needs to provide services for different terminals.
  • the IP address and communication port information in the network must be public and stable, which provides the attacker with convenience, and the attacker controls the
  • the client, or the compromised client uses the server's public IP address and port information to attack the server in a targeted manner.
  • the existing mobile target defense technology mainly protects the client.
  • the terminal For the server, if the communication parameters are randomly changed by a similar method, the terminal cannot find the entry of the server or the service, thereby affecting the normal service.
  • the embodiments of the present invention provide a service request processing method and apparatus, so as to at least solve the problem in the related art that a server affects a normal service by randomly changing parameters.
  • a service request processing method including: sending a query request for querying a server domain name to a domain name server DNS; receiving a query response returned according to the query request, wherein the query response carries a first identifier that identifies the gateway IDGW; and sends a service request to the IDGW according to the first identifier, where the service request is used by the IDGW to convert the first identifier into a second identifier of the server, and according to The second identifier forwards the service request to the server; and receives a service response message returned by the server in response to the service request.
  • a service request processing method including: receiving a query request of a query server domain name sent by a client; and returning a query response to the client according to the query request, where
  • the query response carries a first identifier that identifies the gateway IDGW, the first identifier is used by the client to send a service request to the IDGW, and the service request is used by the IDGW to convert the first identifier into
  • the second identifier of the server is forwarded to the server according to the second identifier, and the service response message returned by the server and sent to the client is forwarded to the client.
  • a service request processing method including: receiving a query request for querying a server domain name, and returning a query response to a domain name server DNS or a client according to the query request, wherein The query response carries a first identifier that identifies the gateway IDGW; receives a service request sent by the client according to the first identifier; converts the first identifier into a second identifier of the server, and according to the second The identifier forwards the service request to the server; and forwards a service response message returned by the server in response to the service request to the client.
  • a service request processing apparatus which is applied to a client, and includes: a first sending module, configured to send a query request for querying a server domain name to a domain name server DNS; and a first receiving module, Set to receive a query response that is returned according to the query request, where the query response carries a first identifier that identifies the gateway IDGW, and the second sending module is configured to send a service request to the IDGW according to the first identifier.
  • the service request is used by the IDGW to convert the first identifier into a second identifier of the server, and forward the service request to the server according to the second identifier; and the second receiving module sets Receiving a service response message returned by the server in response to the service request.
  • a service request processing apparatus is further provided, which is applied to a domain name server DNS, and includes: a third receiving module, configured to receive a query request for querying a server domain name sent by a client; and returning a module, setting Returning a query response to the client according to the query request, where the query response carries a first identifier that identifies a gateway IDGW, and the first identifier is used by the client to send a service request to the IDGW.
  • the service request is used by the IDGW to convert the first identifier into a second identifier of the server, and forward the service request to the server according to the second identifier, and return the response body of the server.
  • the service response message of the service request is forwarded to the client.
  • a service request processing apparatus is further provided, which is applied to the identifier gateway IDGW, and includes: a fourth receiving module, configured to receive a query request for querying a server domain name, and to request a domain name according to the query request
  • the server DNS or the client returns a query response, where the query response carries a first identifier that identifies the gateway IDGW
  • the fifth receiving module is configured to receive a service request sent by the client according to the first identifier.
  • a forwarding module configured to convert the first identifier into a second identifier of the server, and forward the service request to the server according to the second identifier; and the second forwarding module is configured to set the server The returned service response message in response to the service request is forwarded to the client.
  • a storage medium having stored therein a computer program, wherein the computer program is arranged to execute the steps of any one of the above method embodiments at runtime.
  • an electronic device comprising a memory and a processor, wherein the memory stores a computer program, the processor being arranged to run the computer program to perform any of the above The steps in the method embodiments.
  • the communication parameters of the server are transformed without affecting the normal service. Therefore, the problem that the server affects the normal service by randomly changing parameters in the related art can be solved, and the problem is achieved.
  • the target server performs active protection to improve the security of the entire server system.
  • FIG. 1 is a block diagram of a client access server in the related art
  • FIG. 2 is a block diagram showing the hardware structure of a terminal of a service request processing method according to an embodiment of the present invention
  • FIG. 3 is a flowchart 1 of a service request processing method according to an embodiment of the present invention.
  • FIG. 4 is a second flowchart of a service request processing method according to an embodiment of the present invention.
  • FIG. 5 is a third flowchart of a service request processing method according to an embodiment of the present invention.
  • FIG. 6 is a first schematic diagram of a service request processing method according to a preferred embodiment of the present invention.
  • FIG. 7 is a second schematic diagram of a service request processing method according to a preferred embodiment of the present invention.
  • FIG. 8 is a third schematic diagram of a service request processing method according to a preferred embodiment of the present invention.
  • FIG. 9 is a block diagram 1 of a service request processing apparatus according to an embodiment of the present invention.
  • FIG. 10 is a block diagram 2 of a service request processing apparatus according to an embodiment of the present invention.
  • FIG. 11 is a block diagram 3 of a service request processing apparatus according to an embodiment of the present invention.
  • Figure 12 is a block diagram of a service request processing system in accordance with an embodiment of the present invention.
  • terminal 10 may include one or more (only one of which is shown in FIG. 2) processor 102 (processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA). And a memory 104 configured to store data, optionally, the above terminal may further include a transmission device 106 for communication functions and an input and output device 108.
  • processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA).
  • a memory 104 configured to store data
  • the above terminal may further include a transmission device 106 for communication functions and an input and output device 108.
  • FIG. 2 is merely illustrative and does not limit the structure of the above terminal.
  • terminal 10 may also include more or fewer components than shown in FIG. 2, or have a different configuration than that shown in FIG. 2.
  • the memory 104 can be configured to store a computer program, such as a software program of a application software and a module, such as a computer program corresponding to the service request processing method in the embodiment of the present invention, and the processor 102 runs the computer program stored in the memory 104, thereby
  • a computer program such as a software program of a application software and a module, such as a computer program corresponding to the service request processing method in the embodiment of the present invention
  • the processor 102 runs the computer program stored in the memory 104, thereby
  • the above methods are implemented by performing various functional applications and data processing.
  • Memory 104 may include high speed random access memory, and may also include non-volatile memory such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory.
  • memory 104 may further include memory remotely located relative to processor 102, which may be connected to terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • Transmission device 106 is arranged to receive or transmit data via a network.
  • the above specific network example may include a wireless network provided by a communication provider of the terminal 10.
  • the transmission device 106 includes a Network Interface Controller (NIC) that can be connected to other network devices through a base station to communicate with the Internet.
  • the transmission device 106 can be a Radio Frequency (RF) module configured to communicate with the Internet wirelessly.
  • NIC Network Interface Controller
  • RF Radio Frequency
  • FIG. 3 is a flowchart 1 of a service request processing method according to an embodiment of the present invention. As shown in FIG. 3, the process includes the following steps:
  • Step S302 sending a query request for querying the server domain name to the domain name server DNS;
  • Step S304 receiving a query response returned according to the query request, where the query response carries a first identifier that identifies the gateway IDGW;
  • Step S306 sending a service request to the IDGW according to the first identifier, where the service request is used by the IDGW to convert the first identifier into a second identifier of the server, and according to the second identifier, Transmitting the service request to the server;
  • Step S308 receiving a service response message returned by the server and responding to the service request.
  • the foregoing operation may be a terminal, for example, a non-mobile terminal.
  • the problem that the server affects the normal service by randomly changing the parameters in the related art can be solved, and the target server is actively protected to improve the security of the entire server system.
  • the process of obtaining the second identifier is: when the IDGW or the DNS receives the domain name request, when the first identifier is selected, the server domain name is used to request the IP address of the server, that is, the second identifier, from the domain name server of the management server. IP address information in .
  • the query request carries a server domain name to be queried and an IP address of the client.
  • the request for sending the query server domain name to the DNS includes:
  • the query request is used by the DNS to select the IDGW according to the server domain name, randomly or in turn, and forward the query request to the selected IDGW
  • the IDGW selects a first identifier from the first identifier pool, establishes a mapping relationship between the IP address of the client, the first identifier, and the second identifier, and receives the identifier selected by the IDGW.
  • First identifier or,
  • the query request for sending the query server domain name to the domain name server DNS includes:
  • the first identifier and the second identifier are an IP address, or an IP address + a communication port.
  • the server domain name includes one of the following: a domain name of the service, a host name of the server, and a communication port of the service.
  • FIG. 4 is a second flowchart of a service request processing method according to an embodiment of the present invention. As shown in FIG. 4, the process includes the following steps:
  • Step S402 receiving a query request for the domain name of the query server sent by the client;
  • Step S404 the query response is returned to the client according to the query request, where the query response carries a first identifier that identifies the gateway IDGW, and the first identifier is used by the client to send to the IDGW.
  • a service request the service request is used by the IDGW to convert the first identifier into a second identifier of the server, and forward the service request to the server according to the second identifier, and return the server
  • a service response message responsive to the service request is forwarded to the client.
  • the query request carries a server domain name to be queried and an IP address of the client.
  • the returning the query response to the client according to the query request includes:
  • the query request is used by the IDGW to select a first identifier from the first identity pool, and establish an IP address, the first identifier, and the first The mapping relationship between the two identifiers;
  • the returning the query response to the client according to the query request includes:
  • the returning the query response to the client according to the query request includes:
  • response message is used by the client to redirect the query request to the IDGW, and the query request is used by the IDGW to select from a first identity pool a first identifier, establishing an IP address of the client, a mapping relationship between the first identifier and the second identifier;
  • the query response is returned to the client by the IDGW.
  • the first identifier and the second identifier are an IP address, or an IP address + a communication port.
  • the server domain name includes one of the following: a domain name of the service, a host name of the server, and a communication port of the service.
  • FIG. 5 is a flowchart 3 of a service request processing method according to an embodiment of the present invention. As shown in FIG. 5, the process includes the following steps:
  • Step S502 receiving a query request for querying the domain name of the server, and returning a query response to the DNS server or the client according to the query request, where the query response carries the first identifier of the identifier gateway IDGW;
  • Step S504 Receive a service request sent by the client according to the first identifier.
  • Step S506 converting the first identifier into a second identifier of the server, and forwarding the service request to the server according to the second identifier;
  • Step S508 forwarding a service response message returned by the server and responding to the service request to the client.
  • the query request carries the IP address of the client and one of the following information: a server domain name to be queried; a second identifier corresponding to the server domain name; the server domain name and a corresponding second identifier.
  • the receiving the query request for querying the domain name of the server, and returning the query response to the DNS or the client according to the query request includes:
  • the receiving the query request for querying the domain name of the server, and returning the query response to the DNS or the client according to the query request includes:
  • mapping relationship between the IP address of the client, the first identifier, and the second identifier, where the mapping relationship is that the DNS is established after selecting the first identifier. of;
  • the receiving the query request for querying the domain name of the server, and returning the query response to the DNS or the client according to the query request includes:
  • converting the first identifier to the second identifier of the server includes:
  • forwarding, by the server, a service response message that is sent to the client in response to the service request includes:
  • the method before the sending the service response message to the client, the method further includes: receiving, by the server, the service response message that carries the second identifier, according to the mapping relationship The second identifier is converted into the first identifier.
  • the first identifier and the second identifier are an IP address, or an IP address + a communication port.
  • the server domain name includes one of the following: a domain name of the service, a host name of the server, and a communication port of the service.
  • the embodiment of the present invention is applied to the mobile target defense of the server, and an Identity Gateway (IDGW) is added between the client and the server, and the DNS function is enhanced.
  • IDGW Identity Gateway
  • the method specifically includes:
  • the client sends a server domain name query request to the domain name server DNS, and the DNS dynamically resolves the domain name information of the same server to the identifier managed by the gateway IDGW, that is, the first identifier, and returns the same to the client; the client uses the first
  • the identifier is sent to the IDGW as the service request target, and the IDGW converts the first identifier into a service identifier of the server, that is, the second identifier, and forwards the request to the server; the response returned by the server is sent to the IDGW, and is converted by the IDGW. , sent to the client.
  • the identifier refers to an IP address, or an IP address plus a communication port, which can represent a service host address, or a service portal provided by the host;
  • the first identifier is an identifier managed by the IDGW, and multiple identifiers managed by the IDGW
  • the identification pool is formed in the form of an IP address pool or an (IP address + communication port) pool;
  • the second identifier is an IP address of the server, or an IP address of the server plus a communication port.
  • the domain name information of the server refers to a domain name of the service, or a host name of the server, and may further include a communication port of the service;
  • the selection policy of the first identifier is randomly selected from the service identifier pool managed by the IDGW according to the domain name information, the client information, the time, and the like of the server, and the client IP, the first identifier, and the second identifier are established.
  • the mapping relationship requires that the second identifier be uniquely determined by the first identifier or the client IP+first identifier.
  • the DNS sends a selection request for selecting the first identifier to the IDGW, and the IDGW performs a selection policy for selecting the first identifier and returns the response to the DNS; or the DNS uses the DNS iteration mechanism to enable the client to re-initiate the domain name query request to the IDGW, and the IDGW performs the selection process.
  • the policy is returned to the client; or the DNS executes the selection policy locally, and then sends the established mapping relationship to the IDGW; the DNS sends the selection request to the IDGW to carry the client IP information; the DNS resolution result is set to not cache, or the cache time Very short, such as 120 seconds.
  • the client uses the IP address in the first identifier as the destination address. If the first identifier contains the communication port information, the port information is used as the target port, otherwise the default service port is used.
  • the IDGW checks the service request according to the mapping relationship between the client IP, the first identifier, and the second identifier. If the client IP, the first identifier, and the record in the mapping relationship in the service request match, the conversion sending process is performed. Otherwise, the forwarding is refused to ensure that the first identifier is only accessed by the specified client; the IDGW converts the target IP address in the service request, that is, the IP address in the first identifier, into the IP address corresponding to the second identifier, or The target IP address and the destination port in the service request, that is, the IP address and the communication port in the first identifier are converted into the IP address and the communication port corresponding to the second identifier, and then forwarded to the server corresponding to the second identifier.
  • the IDGW After receiving the response from the server, the IDGW converts the source IP address in the response, that is, the IP address corresponding to the second identifier, into the IP address in the first identifier, or the source IP address and the source port in the response, that is, the first The IP address and the communication port corresponding to the second identifier are converted into the IP address and the communication port in the first identifier, and then forwarded to the terminal; if the client or the server actively releases the communication connection, or there is no service within a certain period of time, the IDGW actively releases The connection between the client and the server, the IDGW deletes the locally saved mapping relationship, and further informs that the DNS mapping relationship has been released.
  • FIG. 6 is a first schematic diagram of a service request processing method according to a preferred embodiment of the present invention.
  • both the first identifier and the second identifier are represented by an IP address identifier, and multiple IDGWs may exist in the network.
  • Each IDGW maintains an IP pool as the first identity pool. The range of the IP address pool cannot overlap.
  • IDGW1 uses 3.3.3.1-3.3.3.254
  • IDGW2 uses 3.3.4.1-3.3.4.254.
  • the IP address of the server providing the service is 4.4.4.4, that is, the second identifier is 4.4.4.4, and the default communication port is 80.
  • the access process is as follows:
  • Step 601 The client sends a domain name query (example.abc.com) request to the DNS.
  • a domain name query (example.abc.com) request to the DNS.
  • Step 602 After receiving the query request, the DNS selects an IDGW that provides the service.
  • Step 603 The DNS sends a domain name query request to the selected IDGW, where the domain name (example.abc.com) to be queried, or the second identifier (4.4.4.4) corresponding to the domain name, or both, and the IP address of the client are carried. address;
  • the DNS needs to query the corresponding second identifier from another DNS server of the local or management server domain name.
  • Step 604 After receiving the request, the IDGW selects the first identifier (such as 3.3.3.100) from the first identifier pool, and obtains the domain name (example.abc.com) corresponding to the second identifier by using the DNS service of the local or management server. .4.4), or obtain a second identifier from the request, thereby establishing a mapping relationship between (client IP address, first identifier, second identifier);
  • the first identifier such as 3.3.3.100
  • the domain name such as 3.3.3.100
  • the specific selection policy is to randomly select the first identifier that is not occupied from the first identifier pool, or randomly select a first identifier that is not in the (client IP, first identifier, second identifier) list from the first identifier pool. .
  • the former it is required to uniquely determine the corresponding second identifier from the first identifier; for the latter, the corresponding second identifier can be uniquely determined from the client IP and the first identifier, so that the first in the first identification pool of maintenance can be reduced.
  • the number of identifiers For the former, it is required to uniquely determine the corresponding second identifier from the first identifier; for the latter, the corresponding second identifier can be uniquely determined from the client IP and the first identifier, so that the first in the first identification pool of maintenance can be reduced. The number of identifiers.
  • Step 605 The IDGW returns the selected first identifier to the DNS.
  • Step 606 The DNS returns a query response to the client, and carries the first identifier of the domain name resolution result.
  • Step 611 The client uses the first identifier as the target IP address, and the port uses the default port to send the service request data packet to the IDGW.
  • Step 612 The IDGW queries the corresponding second identifier from the mapping relationship according to the client IP and the first identifier in the data packet, and then converts the first identifier into a second identifier, and sends the identifier to the server corresponding to the second identifier. Medium, does not replace the communication port in the packet;
  • the first identifier is not allocated to the client, and the user is considered to be an illegal data access, and the request is discarded.
  • the service request may also be recorded as a suspicious access.
  • Step 613 The server processes the service according to the service request, and returns a response data packet, where the source IP address in the response data packet is the second identifier.
  • Step 614 The IDGW converts the second identifier in the source IP address of the data packet into the first identifier according to the mapping relationship, and then sends the identifier to the client, and does not replace the communication port in the data packet during the conversion process.
  • a DNS iterative query mechanism may also be adopted.
  • the specific steps are as shown in steps 607-610.
  • Step 607 after selecting the IDGW in step 602, returning a response, informing the client to query the domain name to the IDGW;
  • Step 608 The client sends a domain name query request to the IDGW.
  • Step 609 the same as step 604, the IDGW selects the first identifier
  • Step 610 The IDGW returns a query response to the client, and carries the first identifier of the domain name resolution result.
  • the client must access the server through the IDGW, and the IP addresses of the servers obtained by different clients or the same client at different times are different, thereby hiding the information of the real server.
  • the IDGW can perform legality check.
  • the assigned IP address can only be accessed by the specified client. Even if the attacker hears the IP address and uses the IP address to access the server, the IDGW will refuse access.
  • the server is improved by the above measures. Security.
  • FIG. 7 is a second schematic diagram of a service request processing method according to a preferred embodiment of the present invention.
  • the first identifier and the second identifier are both represented by an IP address plus a communication port, that is, an IP:Port mode. Said.
  • each IDGW maintains one or more IPs, and uses IP:port as the first identity pool. Since an IP address has 65535 ports, the occupation of the IP address is reduced compared to Embodiment 1. For example, IDGW1 uses 3.3.3.1-3.3.3.2, and each address has 65,535 ports available, so that with 2 IP addresses, you can build more than 120,000 first identity pools.
  • the IP address of the server providing the service is 4.4.4.4
  • the communication port is 80
  • the second identifier is 4.4.4.4:80.
  • Step 701 The client sends a domain name query (example.abc.com) request to the DNS, where the communication port 80 of the server needs to be carried, and if not, the default port of the protocol is used;
  • a domain name query (example.abc.com) request to the DNS, where the communication port 80 of the server needs to be carried, and if not, the default port of the protocol is used;
  • Step 702 After receiving the query request, the DNS selects an IDGW that provides the service.
  • Step 703 The DNS sends a domain name query request to the selected IDGW, where the domain name (example.abc.com), the port, or the second identifier corresponding to the domain name, or the second identifier corresponding to the domain name, the domain name, and the port, and The IP address of the client;
  • the DNS needs to query the corresponding second identifier from another DNS server of the local or management server domain name.
  • Step 704 After receiving the request, the IDGW selects the first identifier from the first identifier pool, and obtains the domain name (example.abc.com) corresponding to the second identifier by using the DNS service of the management service, or obtains the second identifier from the request. Therefore, the mapping relationship between the client IP address, the first identifier, and the second identifier is established, where the first identifier and the second identifier are both an IP address and a port;
  • the domain name example.abc.com
  • the specific selection policy is to randomly select the first identifier that is not occupied from the first identifier pool, or randomly select a first identifier that is not in the (client IP, first identifier, second identifier) list from the first identifier pool. . Because the capacity of the first identification pool of this embodiment is large, it is recommended to directly adopt the foregoing manner.
  • Step 705 The IDGW returns a selected first identifier to the DNS, where the first identifier includes a communication port in addition to the IP address.
  • Step 706 The DNS returns a query response to the client, and carries the first identifier of the domain name resolution result.
  • Step 711 The client uses the IP address in the first identifier as the target IP address, and the communication port serves as the destination port, and sends a service request data packet to the IDGW.
  • Step 712 The IDGW queries the corresponding second identifier from the mapping relationship according to the client IP and the first identifier in the data packet, and then converts the first identifier into the second identifier, that is, the destination IP address of the data packet is replaced with the second identifier.
  • the IP address, the destination port is replaced with the communication port in the second identifier, and sent to the server corresponding to the second identifier;
  • Step 713 The server processes the service according to the service request, and returns a response data packet.
  • the source IP address in the response data packet is the second identifier IP address, and the source port is the communication port of the second identifier.
  • Step 714 The IDGW converts the second identifier in the source IP address of the data packet to the first identifier according to the mapping relationship, that is, the source IP address of the data packet is replaced with the IP address in the first identifier, and the destination port is replaced by the first identifier.
  • the communication port is then sent to the client.
  • the DNS iterative query mechanism can also be used.
  • the specific process is as shown in steps 707-710, which is similar to steps 607-610, and will not be described again.
  • the method described in this embodiment uses a port as a part of the identifier. Compared with the second embodiment, the port saves a large number of IP addresses. However, the terminal needs to carry the port when performing domain name resolution, and uses the port selected by the IDGW as the destination port.
  • the client must access the server through the IDGW, and the IP:port of the server acquired by different clients at different times is different, thereby hiding the information of the real server, and the IDGW will check the validity of the first allocation.
  • the identified IP:port can only be accessed by the specified client. If the attacker hears the IP address and port, the IDGW will refuse access to the server by using the IP address and port. The above measures improve the security of the server. .
  • FIG. 8 is a third schematic diagram of a service request processing method according to a preferred embodiment of the present invention.
  • the first identifier and the second identifier may adopt the second or third embodiment, and the difference from the previous one.
  • the DNS is stored in the first ID pool maintained by different IDGWs.
  • the IDGW and the first identifier are selected by the DNS, and the selected result is notified to the client, and the IDGW is also notified.
  • Step 801 The client sends a domain name query request to the DNS.
  • Step 802 The DNS selects the IDGW and the first identifier, and establishes a mapping relationship between the user IP, the first identifier, and the second identifier.
  • Step 803 the DNS sends the mapping relationship to the IDGW
  • Step 804 the IDGW saves the mapping relationship.
  • Step 805 the IDGW returns a response.
  • Step 806 the DNS returns a first identifier to the terminal.
  • the subsequent service request process is the same as steps 611-614, or steps 711-714.
  • the IDGW actively deletes the established or saved mapping relationship, and releases the first identifier into the first identity pool.
  • the DNS is also notified, and the mapping relationship established by the DNS deletion is also deleted.
  • the problem of fixed server information entry and information disclosure in the prior art can be overcome, and the portal of the server is randomized and dynamized, thereby making it difficult for an attacker to launch an attack, thereby increasing the attack cost and thereby improving the security of the network.
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation.
  • the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk,
  • the optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.
  • FIG. 9 is a block diagram 1 of a service request processing apparatus according to an embodiment of the present invention. As shown in FIG. 9, the application is applied to a client, including:
  • the first sending module 92 is configured to send a query request for querying the server domain name to the domain name server DNS;
  • the first receiving module 94 is configured to receive a query response that is returned according to the query request, where the query response carries a first identifier that identifies the gateway IDGW;
  • the second sending module 96 is configured to send a service request to the IDGW according to the first identifier, where the service request is used by the IDGW to convert the first identifier into a second identifier of the server, and according to the Deriving the second identifier to forward the service request to the server;
  • the second receiving module 98 is configured to receive a service response message returned by the server and responsive to the service request.
  • the query request carries a server domain name to be queried and an IP address of the client.
  • the first sending module 92 is further configured to:
  • the query request is used by the DNS to select the IDGW according to the server domain name, randomly or in turn, and forward the query request to the selected IDGW
  • the IDGW selects a first identifier from the first identifier pool, establishes a mapping relationship between the IP address of the client, the first identifier, and the second identifier, and receives the identifier selected by the IDGW.
  • First identifier or,
  • the first sending module 92 is further configured to:
  • FIG. 10 is a block diagram 2 of a service request processing apparatus according to an embodiment of the present invention.
  • the application to the domain name server DNS includes:
  • the third receiving module 102 is configured to receive a query request for querying a server domain name sent by the client;
  • the returning module 104 is configured to return a query response to the client according to the query request, where the query response carries a first identifier that identifies the gateway IDGW, and the first identifier is used by the client to
  • the IDGW sends a service request, where the service request is used by the IDGW to convert the first identifier into a second identifier of the server, and forwards the service request to the server according to the second identifier, where the The service response message returned by the server in response to the service request is forwarded to the client.
  • the query request carries a server domain name to be queried and an IP address of the client.
  • the returning module 104 is further configured to:
  • the query request is used by the IDGW to select a first identifier from the first identity pool, and establish an IP address, the first identifier, and the first The mapping relationship between the two identifiers;
  • the returning module 104 is further configured to:
  • the returning module 104 is further configured to:
  • response message is used by the client to redirect the query request to the IDGW, and the query request is used by the IDGW to select from a first identity pool a first identifier, establishing an IP address of the client, a mapping relationship between the first identifier and the second identifier;
  • the query response is returned to the client by the IDGW.
  • FIG. 11 is a block diagram 3 of a service request processing apparatus according to an embodiment of the present invention. As shown in FIG. 11, the application is applied to the identifier gateway IDGW, including:
  • the fourth receiving module 112 is configured to receive a query request for querying the domain name of the server, and return a query response to the domain name server DNS or the client according to the query request, where the query response carries a first identifier that identifies the gateway IDGW;
  • the fifth receiving module 114 is configured to receive a service request sent by the client according to the first identifier
  • the first forwarding module 116 is configured to convert the first identifier into a second identifier of the server, and forward the service request to the server according to the second identifier;
  • the second forwarding module 118 is configured to forward the service response message returned by the server in response to the service request to the client.
  • the query request carries the IP address of the client and one of the following information: a server domain name to be queried; the second identifier corresponding to the server domain name to be queried; a server domain name to be queried and the to-be-queried The second identifier corresponding to the server domain name of the query.
  • the fourth receiving module 112 is further configured to:
  • the fourth receiving module 112 is further configured to:
  • mapping relationship between the IP address of the client, the first identifier, and the second identifier, where the mapping relationship is established after the DNS selects the first identifier.
  • the fourth receiving module 112 is further configured to:
  • the second forwarding module 118 is further configured to: send the service response message to the client according to the IP address of the client.
  • each of the above modules may be implemented by software or hardware.
  • the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the above modules are in any combination.
  • the forms are located in different processors.
  • FIG. 12 is a block diagram of a service request processing system according to an embodiment of the present invention. As shown in FIG. 12, the method includes: a client, a domain name server DNS, an identification gateway IDGW, and a server. ,among them,
  • the client is configured to send a query request for querying a server domain name to the DNS;
  • the DNS is configured to return a query response to the client according to the query request, where the query response carries a first identifier of the IDGW;
  • the IDGW is configured to receive a sending service request sent by the client, convert the first identifier into a second identifier of the server, and forward the service request to the server according to the second identifier;
  • the server is configured to return, according to the service request, a service response message that responds to the service request to the client by using the IDGW.
  • the query request carries a server domain name to be queried and an IP address of the client.
  • the DNS is further configured to select the IDGW according to the server domain name, randomly or in a round-robin manner, and forward the query request to the selected IDGW;
  • the IDGW is further configured to set a first identifier that is selected from the first identifier pool, and establish a mapping relationship between the IP address of the client, the first identifier, and the second identifier, and send the first identifier to the server by using the DNS. Said client.
  • the DNS is further configured to select the IDGW and the first identifier according to the server domain name, randomly or in a round-robin manner, and establish a mapping relationship between the IP address of the client, the first identifier, and the second identifier, and The mapping relationship is sent to the selected IDGW; the query response is returned to the client.
  • the DNS is further configured to select the IDGW according to the server domain name, randomly or in a round-robin manner, and return a response message to the client to send the query request to the selected IDGW.
  • the client is further configured to redirect the query request to the IDGW according to the response message;
  • the IDGW is further configured to set a first identifier selected from the first identifier pool, establish a mapping relationship between the IP address of the client, the first identifier, and the second identifier, and return the query response to the client.
  • the IDGW is further configured to receive the service response message that is sent by the server and that carries the second identifier, and convert the second identifier into the first identifier according to the mapping relationship, according to the The first identifier sends the service response message to the client.
  • the first identifier and the second identifier are an IP address, or an IP address + a communication port.
  • the domain name information of the server includes one of the following: a domain name of the service, a host name of the server, and a communication port of the service.
  • the client uses the server domain name to initiate a service access, sends a domain name query request to the DNS, and further carries the port information of the server in the DNS query request; according to the first identifier information of the response returned by the DNS, the first identifier is used.
  • the IP address and the default communication port, or the IP address in the first identifier and the communication port in the first identifier send a service request to the IDGW, and receive a service response returned by the IDGW.
  • the IDGW is located between the client and the server, and is responsible for the maintenance and allocation of the first identifier, and the hiding of the second identifier, and the conversion of the first identifier and the second identifier, thereby providing security protection functions to the server, and the specific characteristics are as follows:
  • IDGW is responsible for managing the first identity pool
  • the conversion of the first identifier to the second identifier is performed according to the mapping relationship; when the corresponding service response is received, the conversion of the second identifier to the first identifier is performed according to the mapping relationship;
  • Embodiments of the present invention also provide a storage medium having stored therein a computer program, wherein the computer program is configured to perform the steps of any of the above method embodiments when executed.
  • the above storage medium may be arranged to store a computer program for performing the following steps:
  • S12 Receive a query response that is returned according to the query request, where the query response carries a first identifier that identifies the gateway IDGW.
  • S13 Send a service request to the IDGW according to the first identifier, where the service request is used by the IDGW to convert the first identifier into a second identifier of a server, and according to the second identifier Transmitting the service request to the server;
  • the storage medium is further arranged to store a computer program for performing the following steps:
  • the query response is returned to the client according to the query request, where the query response carries a first identifier that identifies the gateway IDGW, and the first identifier is used by the client to send a service to the IDGW.
  • Requesting the service request is used by the IDGW to convert the first identifier into a second identifier of the server, and forwarding the service request to the server according to the second identifier, and returning the response returned by the server
  • the service response message of the service request is forwarded to the client.
  • the storage medium is further arranged to store a computer program for performing the following steps:
  • the foregoing storage medium may include, but is not limited to, a USB flash drive, a Read-Only Memory (ROM), and a Random Access Memory (RAM).
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • An embodiment of the present invention further provides an electronic device including a memory and a processor, wherein the memory corresponds to the "memory 104" in FIG. 1, that is, the memory 104 in FIG. 1 can be used as a memory in the electronic device.
  • a memory program is stored in the memory, the processor being arranged to execute a computer program to perform the steps in any of the method embodiments described above.
  • the electronic device may further include a transmission device and an input and output device, wherein the transmission device is connected to the processor, and the input and output device is connected to the processor.
  • the foregoing processor may be configured to perform the following steps by using a computer program:
  • S12 Receive a query response that is returned according to the query request, where the query response carries a first identifier that identifies the gateway IDGW.
  • S13 Send a service request to the IDGW according to the first identifier, where the service request is used by the IDGW to convert the first identifier into a second identifier of a server, and according to the second identifier Transmitting the service request to the server;
  • the foregoing processor may be further configured to perform the following steps by using a computer program:
  • the query response is returned to the client according to the query request, where the query response carries a first identifier that identifies the gateway IDGW, and the first identifier is used by the client to send a service to the IDGW.
  • Requesting the service request is used by the IDGW to convert the first identifier into a second identifier of the server, and forwarding the service request to the server according to the second identifier, and returning the response returned by the server
  • the service response message of the service request is forwarded to the client.
  • the foregoing processor may be further configured to perform the following steps by using a computer program:
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.
  • the service request processing method and apparatus provided by the embodiments of the present invention have the following beneficial effects: solving the problem that the server affects the normal service by randomly changing parameters in the related art, and implementing active protection on the target server. To improve the security of the entire server system.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明提供了一种业务请求处理方法及装置，其中，该方法包括：向域名服务器DNS发送查询服务器域名的查询请求；接收根据所述查询请求返回的查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识；根据所述第一标识向所述IDGW发送业务请求，其中，所述业务请求用于所述IDGW将所述第一标识转换为服务器的第二标识，并根据所述第二标识将所述业务请求转发给所述服务器；接收所述服务器返回的响应所述业务请求的业务响应消息。通过本发明，解决了相关技术中针对服务器通过随机改变参数的方式影响正常业务的问题，实现了对目标服务器进行主动防护，提高整个服务器系统的安全性。

Description

业务请求处理方法及装置 技术领域
本发明涉及通信领域，具体而言，涉及业务请求处理方法及装置。
背景技术
移动目标防御(Moving Target Defense，简称MTD)是一种新型的网络安全防护思想，通过技术手段，对被保护目标呈现给攻击者的攻击面实施持续性的动态变换，以迷惑攻击者，从而增加攻击者实施成功攻击的代价和复杂度，降低其攻击成功的概率，提高系统弹性和安全性。
将移动目标防御的思想应用于IP网络，通过改变网络的通信参数，使得被攻击的目标的攻击面不断随机变化，让攻击者无法有效识别目标节点或服务入口，从上阻止网络攻击行为的发生。这里的通信参数，主要指目标主机的IP地址和通信端口，其中IP地址表示主机在网络中的身份，通信端口表示主机的不同通信连接，通过IP地址和端口能够建立主机之间的通信连接。本文中将IP地址、或IP地址+端口统一称为标识，能够标识主机或主机提供的服务入口。
互联网的典型业务访问模型是客户端-服务器方式，图1是相关技术中的客户端访问服务器的框图，如图1所示，客户端通过服务器的域名从域名服务器(Domain Name Server，简称DNS)获取服务器的IP地址，然后通过IP地址找到服务器，并通过服务器开放的通讯端口建立连接，获取服务器提供的业务。终端的通讯参数一般是变化的，而服务器为了给不同终端提供服务，在网络中的IP地址、通信端口信息必须是公开的，稳定的，这就给攻击者提供了方便，攻击者从控制的客户端，或者被攻破的客户端，利用服务器公开的IP地址和端口信息，有针对性地攻击服务器。
现有移动目标防御技术，主要是针对客户端进行防护，而对于服务器， 如果也采用类似方法随机改变其通信参数，将使终端无法找到服务器或者服务的入口，从而影响正常的业务。
针对相关技术中对于服务器通过随机改变参数的方式影响正常业务的问题，尚未提出解决方案。
发明内容
本发明实施例提供了业务请求处理方法及装置，以至少解决相关技术中对于服务器通过随机改变参数的方式影响正常业务的问题。
根据本发明的一个实施例，提供了一种业务请求处理方法，包括：向域名服务器DNS发送查询服务器域名的查询请求；接收根据所述查询请求返回的查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识；根据所述第一标识向所述IDGW发送业务请求，其中，所述业务请求用于所述IDGW将所述第一标识转换为服务器的第二标识，并根据所述第二标识将所述业务请求转发给所述服务器；接收所述服务器返回的响应所述业务请求的业务响应消息。
根据本发明的另一个实施例，还提供了一种业务请求处理方法，包括：接收客户端发送的查询服务器域名的查询请求；根据所述查询请求向所述客户端返回查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识，所述第一标识用于所述客户端向所述IDGW发送业务请求，所述业务请求用于所述IDGW将所述第一标识转换为服务器的第二标识，并根据所述第二标识将所述业务请求转发给所述服务器，将所述服务器返回的响应所述业务请求的业务响应消息转发给所述客户端。
根据本发明的又一个实施例，还提供了一种业务请求处理方法，包括：接收查询服务器域名的查询请求，并根据所述查询请求向域名服务器DNS或客户端返回查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识；接收所述客户端根据所述第一标识发送的业务请求；将所述第一标识转换为服务器的第二标识，并将根据所述第二标识将所述业务请求转发给所述服务器；将所述服务器返回的响应所述业务请求的业务响应消 息转发给所述客户端。
根据本发明的另一个实施例，还提供了一种业务请求处理装置，应用于客户端，包括：第一发送模块，设置为向域名服务器DNS发送查询服务器域名的查询请求；第一接收模块，设置为接收根据所述查询请求返回的查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识；第二发送模块，设置为根据所述第一标识向所述IDGW发送业务请求，其中，所述业务请求用于所述IDGW将所述第一标识转换为服务器的第二标识，并根据所述第二标识将所述业务请求转发给所述服务器；第二接收模块，设置为接收所述服务器返回的响应所述业务请求的业务响应消息。
根据本发明的又一个实施例，还提供了一种业务请求处理装置，应用于域名服务器DNS，包括：第三接收模块，设置为接收客户端发送的查询服务器域名的查询请求；返回模块，设置为根据所述查询请求向所述客户端返回查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识，所述第一标识用于所述客户端向所述IDGW发送业务请求，所述业务请求用于所述IDGW将所述第一标识转换为服务器的第二标识，并根据所述第二标识将所述业务请求转发给所述服务器，将所述服务器返回的响应所述业务请求的业务响应消息转发给所述客户端。
根据本发明的又一个实施例，还提供了一种业务请求处理装置，应用于标识网关IDGW，包括：第四接收模块，设置为接收查询服务器域名的查询请求，并根据所述查询请求向域名服务器DNS或客户端返回查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识；第五接收模块，设置为接收所述客户端根据所述第一标识发送的业务请求；第一转发模块，设置为将所述第一标识转换为服务器的第二标识，并将根据所述第二标识将所述业务请求转发给所述服务器；第二转发模块，设置为将所述服务器返回的响应所述业务请求的业务响应消息转发给所述客户端。
根据本发明的又一个实施例，还提供了一种存储介质，所述存储介质中存储有计算机程序，其中，所述计算机程序被设置为运行时执行上述任 一项方法实施例中的步骤。
根据本发明的又一个实施例，还提供了一种电子装置，包括存储器和处理器，所述存储器中存储有计算机程序，所述处理器被设置为运行所述计算机程序以执行上述任一项方法实施例中的步骤。
通过本发明，通过引入标识网关，在不影响正常业务的情况下，对服务器的通信参数进行变换，因此，可以解决相关技术中对于服务器通过随机改变参数的方式影响正常业务的问题，实现了对目标服务器进行主动防护，提高整个服务器系统的安全性。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是相关技术中的客户端访问服务器的框图；
图2是本发明实施例的一种业务请求处理方法的终端的硬件结构框图；
图3是根据本发明实施例的业务请求处理方法的流程图一；
图4是根据本发明实施例的业务请求处理方法的流程图二；
图5是根据本发明实施例的业务请求处理方法的流程图三；
图6是根据本发明优选实施例的业务请求处理方法的示意图一；
图7是根据本发明优选实施例的业务请求处理方法的示意图二；
图8是根据本发明优选实施例的业务请求处理方法的示意图三；
图9是根据本发明实施例的业务请求处理装置的框图一；
图10是根据本发明实施例的业务请求处理装置的框图二；
图11是根据本发明实施例的业务请求处理装置的框图三；
图12是根据本发明实施例的业务请求处理系统的框图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
实施例1
本申请实施例一所提供的方法实施例可以在移动终端、计算机终端或者类似的运算装置中执行。图2是本发明实施例的一种业务请求处理方法的终端的硬件结构框图。如图2所示，终端10可以包括一个或多个(图2中仅示出一个)处理器102(处理器102可以包括但不限于微处理器MCU或可编程逻辑器件FPGA等的处理装置)和设置为存储数据的存储器104，可选地，上述终端还可以包括用于通信功能的传输设备106以及输入输出设备108。本领域普通技术人员可以理解，图2所示的结构仅为示意，其并不对上述终端的结构造成限定。例如，终端10还可包括比图2中所示更多或者更少的组件，或者具有与图2所示不同的配置。
存储器104可设置为存储计算机程序，例如，应用软件的软件程序以及模块，如本发明实施例中的业务请求处理方法对应的计算机程序，处理器102通过运行存储在存储器104内的计算机程序，从而执行各种功能应用以及数据处理，即实现上述的方法。存储器104可包括高速随机存储器，还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器104可进一步包括相对于处理器102远程设置的存储器，这些远程存储器可以通过网络连接至终端10。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
传输装置106设置为经由一个网络接收或者发送数据。上述的网络具体实例可包括终端10的通信供应商提供的无线网络。在一个实例中，传 输装置106包括一个网络适配器(Network Interface Controller，简称为NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通讯。在一个实例中，传输装置106可以为射频(Radio Frequency，简称为RF)模块，其设置为通过无线方式与互联网进行通讯。
在本实施例中提供了一种运行于上述终端的业务请求处理方法，图3是根据本发明实施例的业务请求处理方法的流程图一，如图3所示，该流程包括如下步骤：
步骤S302，向域名服务器DNS发送查询服务器域名的查询请求；
步骤S304，接收根据所述查询请求返回的查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识；
步骤S306，根据所述第一标识向所述IDGW发送业务请求，其中，所述业务请求用于所述IDGW将所述第一标识转换为服务器的第二标识，并根据所述第二标识将所述业务请求转发给所述服务器；
步骤S308，接收所述服务器返回的响应所述业务请求的业务响应消息。
其中，执行上述操作的可以是终端，例如，非移动终端。
通过上述步骤，可以解决相关技术中对于服务器通过随机改变参数的方式影响正常业务的问题，实现了对目标服务器进行主动防护，提高整个服务器系统的安全性。
本发明实施例中，第二标识的获取过程为：IDGW或DNS接收到域名请求时，在选择第一标识时，同时使用服务器域名向管理服务器的域名服务器请求服务器的IP地址，即第二标识中的IP地址信息。
可选地，所述查询请求中携带有待查询的服务器域名以及客户端的IP地址。
可选地，所述向DNS发送查询服务器域名的查询请求包括：
向所述DNS发送所述查询请求，其中，所述查询请求用于所述DNS 根据所述服务器域名、随机或轮流的方式选择所述IDGW，并将所述查询请求转发给选择的所述IDGW，供所述IDGW从第一标识池中选取第一标识，建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系，并接收所述IDGW选取的所述第一标识；或者，
向所述DNS发送所述查询请求，其中，所述查询请求用于所述DNS选择IDGW以及第一标识，建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系，并将所述映射关系发送给选择的所述IDGW。
可选地，所述向域名服务器DNS发送查询服务器域名的查询请求包括：
向所述DNS发送所述查询请求，其中，所述查询请求用于所述DNS根据所述服务器域名、随机或轮流的方式选择所述IDGW；
接收所述DNS返回的响应消息，其中，所述响应消息用于指示向所述IDGW发送所述查询请求；
根据所述响应消息将所述查询请求重定向给所述IDGW，其中，所述查询请求用于所述IDGW从第一标识池中选取所述第一标识，建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系。
可选地，所述第一标识和所述第二标识为IP地址，或者，IP地址+通信端口。
可选地，所述服务器域名包括以下之一：服务的域名，服务器的主机名，服务的通信端口。
实施例2
根据本发明的另一个实施例，还提供了一种业务请求处理方法，图4是根据本发明实施例的业务请求处理方法的流程图二，如图4所示，该流程包括如下步骤：
步骤S402，接收客户端发送的查询服务器域名的查询请求；
步骤S404，根据所述查询请求向所述客户端返回查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识，所述第一标识用于所述客户端向所述IDGW发送业务请求，所述业务请求用于所述IDGW将所述第一标识转换为服务器的第二标识，并根据所述第二标识将所述业务请求转发给所述服务器，将所述服务器返回的响应所述业务请求的业务响应消息转发给所述客户端。
可选地，所述查询请求中携带有待查询的服务器域名以及所述客户端的IP地址。
可选地，所述根据所述查询请求向所述客户端返回查询响应包括：
根据所述服务器域名、随机或轮流的方式选择IDGW；
将所述查询请求转发给选择的所述IDGW，所述查询请求用于所述IDGW从第一标识池中选取第一标识，建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系；
接收所述IDGW选取的所述第一标识；
向所述客户端返回所述查询响应。
可选地，所述根据所述查询请求向所述客户端返回查询响应包括：
选择IDGW以及第一标识；
建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系，并将所述映射关系发送给选择的所述IDGW；
向所述客户端返回所述查询响应。
可选地，所述根据所述查询请求向所述客户端返回查询响应包括：
根据所述服务器域名、随机或轮流的方式选择IDGW；
向所述客户端返回响应消息，其中，所述响应消息用于所述客户端将所述查询请求重定向给所述IDGW，所述查询请求用于所述IDGW从第一标识池中选取的第一标识，建立所述客户端的IP地址、所述第一标识与 所述第二标识之间的映射关系；
通过所述IDGW向所述客户端返回所述查询响应。
可选地，所述第一标识和所述第二标识为IP地址，或者，IP地址+通信端口。
可选地，所述服务器域名包括以下之一：服务的域名，服务器的主机名，服务的通信端口。
实施例3
根据本发明的又一个实施例，还提供了一种业务请求处理方法，图5是根据本发明实施例的业务请求处理方法的流程图三，如图5所示，该流程包括如下步骤：
步骤S502，接收查询服务器域名的查询请求，并根据所述查询请求向域名服务器DNS或客户端返回查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识；
步骤S504，接收所述客户端根据所述第一标识发送的业务请求；
步骤S506，将所述第一标识转换为服务器的第二标识，并将根据所述第二标识将所述业务请求转发给所述服务器；
步骤S508，将所述服务器返回的响应所述业务请求的业务响应消息转发给所述客户端。
可选地，所述查询请求携带有所述客户端的IP地址以及以下信息之一：待查询的服务器域名；所述服务器域名对应的第二标识；所述服务器域名和对应的第二标识。
可选地，所述接收查询服务器域名的查询请求，并根据所述查询请求向DNS或客户端返回查询响应包括：
接收所述DNS发送的所述查询请求；
从第一标识池中选取的第一标识，建立所述客户端的IP地址、所述 第一标识与所述第二标识之间的映射关系；
通过所述DNS向所述客户端返回所述查询响应。
可选地，所述接收查询服务器域名的查询请求，并根据所述查询请求向DNS或客户端返回查询响应包括：
接收所述DNS发送的所述客户端的I P地址、所述第一标识与所述第二标识之间的映射关系，其中，所述映射关系是所述DNS在选取所述第一标识之后建立的；
通过所述DNS向所述客户端返回所述查询响应。
可选地，所述接收查询服务器域名的查询请求，并根据所述查询请求向DNS或客户端返回查询响应包括：
接收所述客户端根据响应消息重定向的所述查询请求，其中，所述响应消息是所述DNS接收到所述查询请求之后向所述客户端发送的；
根据所述查询请求从第一标识池中选取的第一标识，建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系；
向所述客户端返回所述查询响应。
可选地，将所述第一标识转换为服务器的第二标识包括：
根据所述映射关系将所述第一标识转换为所述第二标识。
可选地，将所述服务器返回的响应所述业务请求的业务响应消息转发给所述客户端包括：
根据所述客户端IP地址将所述业务响应消息发送给所述客户端。
可选地，在将所述业务响应消息发送给所述客户端之前，所述方法还包括：接收所述服务器返回的携带所述第二标识的所述业务响应消息；根据所述映射关系将所述第二标识转换为所述第一标识。
可选地，所述第一标识和所述第二标识为IP地址，或者，IP地址+通信端口。
可选地，所述服务器域名包括以下之一：服务的域名，服务器的主机名，服务的通信端口。
本发明实施例应用于服务器的移动目标防御，在客户端和服务器之间增加标识网关(Identity Gateway，简称IDGW)，并增强DNS功能，在客户端需要访问服务器时，具体包括：
客户端使向域名服务器DNS发送用服务器域名查询请求，DNS将同一个服务器的域名信息动态解析为标识网关IDGW管理的标识，即第一标识，并返回给客户端；客户端使用所述第一标识作为业务请求目标，将业务请求发送给IDGW；IDGW将所述第一标识转换为服务器的服务标识，即第二标识，将请求转发给服务器；服务器返回的响应发送到IDGW，经IDGW转换后，发送给客户端。
可选地，所述标识指IP地址，或IP地址加通讯端口，能够表示服务主机地址，或者主机提供的服务入口；所述第一标识，是IDGW所管理的标识，IDGW管理的多个标识构成标识池，具体形式是IP地址池，或者(IP地址+通信端口)池；所述第二标识，为服务器的IP地址，或者服务器的IP地址加通信端口。所述服务器的域名信息指服务的域名，或者服务器的主机名，并可进一步包括所述服务的通信端口；
第一标识的选取策略为根据所述服务器的域名信息、客户端信息、时间等因素，从IDGW管理的服务标识池中随机选取，并建立客户端IP、第一标识、第二标识之间的映射关系，要求通过第一标识，或者客户端IP+第一标识能够唯一确定第二标识。
DNS向IDGW发送选取第一标识的选取请求，由IDGW执行选取第一标识的选取策略，并返回给DNS；或者DNS使用DNS迭代机制，使客户端向IDGW重新发起域名查询请求，由IDGW执行选取策略，并返回给客户端；或者DNS在本地执行选取策略，然后将所建立的映射关系发送给IDGW；DNS向IDGW发送选取请求携带客户端IP信息；DNS解析结果设置为不缓存，或缓存时间很短，如120秒。
客户端将第一标识中的IP地址作为目标地址，如果第一标识中含有通信端口信息，则端口信息作为目标端口，否则使用默认的服务端口。
IDGW根据所述客户端IP、第一标识、第二标识之间的映射关系，检查业务请求，如果业务请求中的客户端IP、第一标识与映射关系中的记录匹配，则执行转换发送过程，否则拒绝转发，以保证该第一标识只有由指定的客户端访问；IDGW将业务请求中的目标IP地址，即第一标识中的IP地址，转换为第二标识对应的IP地址，或者将业务请求中的目标IP地址、目标端口，即第一标识中的IP地址和通信端口，转换为第二标识对应的IP地址、通信端口，然后转发给第二标识对应的服务器。
当IDGW接收到服务器的响应后，将响应中的源IP地址，即第二标识对应的IP地址，转换为第一标识中的IP地址，或者将响应中的源IP地址和源端口，即第二标识对应的IP地址和通信端口，转换为第一标识中的IP地址和通信端口，然后转发给终端；如果由于客户端或服务器主动释放通信连接，或者在一定时间内没有业务，IDGW主动释放客户端与服务器之间的连接，IDGW删除本地保存的映射关系，可以进一步通知DNS映射关系已经释放。
下面以具体示例对本发明实施例进行详细说明。
示例1
图6是根据本发明优选实施例的业务请求处理方法的示意图一，如图6所示，在本实施例，第一标识和第二标识都使用IP地址标识表示，网络中可以存在多个IDGW，每个IDGW维护有IP池作为第一标识池，IP地址池的范围不能重叠，比如IDGW1使用3.3.3.1-3.3.3.254，IDGW2使用3.3.4.1-3.3.4.254。
当客户端要访问互联网的业务时，如访问web网站example.abc.com，提供该业务的服务器的IP地址为4.4.4.4，即第二标识为4.4.4.4，默认通信端口为80，则业务访问过程如下：
步骤601，客户端向DNS发送域名查询(example.abc.com)请求；
步骤602，DNS收到查询请求后，选择提供服务的IDGW；
步骤603，DNS向选择的IDGW发送域名查询请求，其中携带需要查询的域名(example.abc.com)，或者域名对应的第二标识(4.4.4.4)，或者两者都携带，以及客户端的IP地址；
如果携带第二标识，DNS需要从本地或者管理服务器域名的其他DNS服务器查询对应的第二标识。
步骤604，IDGW收到请求后，从第一标识池中选取第一标识(如3.3.3.100)，并通过本地或管理服务器的DNS服务获取域名(example.abc.com)对应第二标识(4.4.4.4)，或者从请求中获取第二标识，从而建立(客户端IP地址，第一标识，第二标识)之间的映射关系；
具体选取策略是随机从第一标识池中选取没有被占用的第一标识，或者随机从第一标识池中选取一个不在(客户端IP，第一标识，第二标识)列表中的第一标识。对于前者，要求从第一标识能唯一确定对应第二标识；对于后者，从客户端IP和第一标识能唯一确定对应的第二标识，这样可以减少维护的第一标识池中的第一标识数量。
步骤605，IDGW向DNS返回选取的第一标识；
步骤606，DNS向客户端返回查询响应，携带域名解析结果第一标识；
步骤611，客户端使用第一标识作为目标IP地址，端口使用默认端口，向IDGW发送业务请求数据包；
步骤612，IDGW根据数据包中的客户端IP、第一标识从映射关系中查询对应的第二标识，然后将第一标识转换为第二标识，发送给第二标识对应的服务器，在转换过程中，不替换数据包中的通信端口；
如果没有查询到对应的第二标识，则说明第一标识没有分配给该客户端，认为这是个非法的数据访问，丢弃该请求，也可以作为可疑访问，记录该次业务请求。
步骤613，服务器根据业务请求处理业务，返回响应数据包，响应数 据包中的源IP地址为第二标识；
步骤614，IDGW根据映射关系，将数据包源IP地址中的第二标识转换为第一标识，然后发送给客户端，在转换过程中，不替换数据包中的通信端口。
在域名解析过程中，也可以采用DNS迭代查询机制，具体步骤如步骤607-610所示。
步骤607，在步骤602选择IDGW后，返回响应，通知客户端向IDGW去查询域名；
步骤608，客户端向IDGW发送域名查询请求；
步骤609，与步骤604相同，IDGW选取第一标识；
步骤610，IDGW向客户端返回查询响应，携带域名解析结果第一标识；
后续步骤同步骤611-614。
从上面的过程可以看到，客户端必须通过IDGW才能访问服务器，而且不同客户端，或者同一客户端在不同时间获取的服务器的IP地址都不同，从而隐藏真实服务器的信息。
同时IDGW能够进行合法性检查，分配的IP地址只能由指定的客户端访问，这样即使攻击者侦听到该IP地址，使用该IP地址访问服务器，IDGW会拒绝访问，通过上述措施提高了服务器的安全性。
示例2
图7是根据本发明优选实施例的业务请求处理方法的示意图二，如图7所示，在本实施例，第一标识和第二标识都使用IP地址加通信端口表示，即IP：Port方式表示。
网络中可以存在多个IDGW，每个IDGW维护有一个或多个IP，并使用IP：port作为第一标识池。因为一个IP地址有65535个端口，相比 于实施例1，减少对IP地址的占用。比如IDGW1使用3.3.3.1-3.3.3.2，每个地址都有65535个端口可用，这样使用2个IP地址，就可以构建容量有12万多个第一标识池。
当客户端要访问互联网的业务时，如访问web网站example.abc.com，提供该业务的服务器的IP地址为4.4.4.4，通信端口为80，即第二标识为4.4.4.4：80，则业务访问过程如下：
步骤701，客户端向DNS发送域名查询(example.abc.com)请求，其中需要携带服务器的通信端口80，如果不带，则使用该协议默认端口；
步骤702，DNS收到查询请求后，选择提供服务的IDGW；
步骤703，DNS向选择的IDGW发送域名查询请求，其中携带需要查询的域名(example.abc.com)、端口，或者域名对应的第二标识，或者域名、域名和端口对应的第二标识，以及客户端的IP地址；
如果携带第二标识，DNS需要从本地或者管理服务器域名的其他DNS服务器查询对应的第二标识。
步骤704，IDGW收到请求后，从第一标识池中选取第一标识，并通过管理服务的DNS服务获取域名(example.abc.com)对应第二标识，或者从请求中获取第二标识，从而建立(客户端IP地址，第一标识，第二标识)之间的映射关系，其中第一标识、第二标识都为IP地址+Port；
具体选取策略是随机从第一标识池中选取没有被占用的第一标识，或者随机从第一标识池中选取一个不在(客户端IP，第一标识，第二标识)列表中的第一标识。因为本实施例的第一标识池的容量大，建议直接采用前面方式。
步骤705，IDGW向DNS返回选取的第一标识，第一标识中除了IP地址，还包括通信端口；
步骤706，DNS向客户端返回查询响应，携带域名解析结果第一标识；
步骤711，客户端使用第一标识中的IP地址作为目标IP地址，通信 端口作为目的端口，向IDGW发送业务请求数据包；
步骤712，IDGW根据数据包中的客户端IP、第一标识从映射关系中查询对应的第二标识，然后将第一标识转换为第二标识，即数据包的目的IP替换为第二标识中的IP地址，目的端口替换为第二标识中的通信端口，发送给第二标识对应的服务器；
如果没有查询到对应的第二标识，则认为这是个非法的数据访问，丢弃该请求。
步骤713，服务器根据业务请求处理业务，返回响应数据包，响应数据包中的源IP地址为第二标识IP地址，源端口为第二标识的通信端口；
步骤714，IDGW根据映射关系，将数据包源IP地址中的第二标识转换为第一标识，即数据包的源IP替换为第一标识中的IP地址，目的端口替换为第一标识中的通信端口，然后发送给客户端。
在域名解析过程中，也可以采用DNS迭代查询机制，具体过程如步骤707-710所示，与步骤607-610类似，不再赘述。
该实施例所描述的方法将端口作为标识的一部分，与实施例二相比，节省了大量的IP地址，但需要终端在做域名解析时携带端口，并使用IDGW选择的端口作为目的端口。
从上面的过程可以看到，客户端必须通过IDGW访问服务器，而且不同客户端在不同时间获取的服务器的IP：port都不同，从而隐藏真实服务器的信息，同时IDGW会合法性检查，分配第一标识的IP：port只能由指定的客户端访问，如果攻击者侦听到该IP地址和端口，向使用该IP地址和端口访问服务器，IDGW会拒绝访问，通过上述措施提高了服务器的安全性。
示例3
图8是根据本发明优选实施例的业务请求处理方法的示意图三，如图 8所示，在本实施例，第一标识和第二标识可以采用实施例二或三的方式，与前面的区别主要是DNS保存有不同IDGW所维护的第一标识池，由DNS统一选取IDGW以及第一标识，并将选取的结果通知客户端的同时，也通知IDGW。
步骤801，客户端向DNS发送域名查询请求；
步骤802，DNS选择IDGW以及第一标识，建立(用户IP，第一标识、第二标识)之间的映射关系；
步骤803，DNS将映射关系发送到IDGW；
步骤804，IDGW保存映射关系；
步骤805，IDGW返回响应；
步骤806，DNS向终端返回第一标识；
后续业务请求过程同步骤611-614，或者步骤711-714。
在上述实施例中，当客户端或服务器主动释放连接，或者在建立的连接上长时间没有业务流，IDGW会主动删除建立或保存的映射关系，将第一标识重新释放到第一标识池中，在实施例四中，还将通知DNS，DNS删除建立的映射关系。
通过上述步骤，能够克服现有技术服务器服务入口固定、信息公开的问题，使得服务器的入口随机化、动态化，从而使攻击者很难发起攻击，提高攻击成本，从而提高网络的安全性。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例所 述的方法。
实施例4
在本实施例中还提供了一种业务请求处理装置，该装置用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。图9是根据本发明实施例的业务请求处理装置的框图一，如图9所示，应用于客户端，包括：
第一发送模块92，设置为向域名服务器DNS发送查询服务器域名的查询请求；
第一接收模块94，设置为接收根据所述查询请求返回的查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识；
第二发送模块96，设置为根据所述第一标识向所述IDGW发送业务请求，其中，所述业务请求用于所述IDGW将所述第一标识转换为服务器的第二标识，并根据所述第二标识将所述业务请求转发给所述服务器；
第二接收模块98，设置为接收所述服务器返回的响应所述业务请求的业务响应消息。
可选地，所述查询请求中携带有待查询的服务器域名以及客户端的IP地址。
可选地，所述第一发送模块92，还设置为：
向所述DNS发送所述查询请求，其中，所述查询请求用于所述DNS根据所述服务器域名、随机或轮流的方式选择所述IDGW，并将所述查询请求转发给选择的所述IDGW，供所述IDGW从第一标识池中选取第一标识，建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系，并接收所述IDGW选取的所述第一标识；或者，
向所述DNS发送所述查询请求，其中，所述查询请求用于所述DNS根据所述服务器域名、随机或轮流的方式选择所述IDGW以及第一标识，建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系，并将所述映射关系发送给选择的所述IDGW。
可选地，所述第一发送模块92，还设置为：
向所述DNS发送所述查询请求，其中，所述查询请求用于所述DNS根据所述服务器域名、随机或轮流的方式选择所述IDGW；
接收所述DNS返回的响应消息，其中，所述响应消息用于指示向所述IDGW发送所述查询请求；
根据所述响应消息将所述查询请求重定向给所述IDGW，其中，所述查询请求用于所述IDGW从第一标识池中选取所述第一标识，建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系。
实施例5
根据本发明的又一个实施例，还提供了一种业务请求处理装置，图10是根据本发明实施例的业务请求处理装置的框图二，如图10所示，应用于域名服务器DNS，包括：
第三接收模块102，设置为接收客户端发送的查询服务器域名的查询请求；
返回模块104，设置为根据所述查询请求向所述客户端返回查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识，所述第一标识用于所述客户端向所述IDGW发送业务请求，所述业务请求用于所述IDGW将所述第一标识转换为服务器的第二标识，并根据所述第二标识将所述业务请求转发给所述服务器，将所述服务器返回的响应所述业务请求的业务响应消息转发给所述客户端。
可选地，所述查询请求中携带有待查询的服务器域名以及所述客户端 的IP地址。
可选地，所述返回模块104，还设置为：
根据所述服务器域名、随机或轮流的方式选择所述IDGW；
将所述查询请求转发给选择的所述IDGW，所述查询请求用于所述IDGW从第一标识池中选取第一标识，建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系；
接收所述IDGW选取的所述第一标识；
向所述客户端返回所述查询响应。
可选地，所述返回模块104，还设置为：
根据所述服务器域名、随机或轮流的方式选择所述IDGW以及第一标识；
建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系，并将所述映射关系发送给选择的所述IDGW；
向所述客户端返回所述查询响应。
可选地，所述返回模块104，还设置为：
根据所述服务器域名、随机或轮流的方式选择所述IDGW；
向所述客户端返回响应消息，其中，所述响应消息用于所述客户端将所述查询请求重定向给所述IDGW，所述查询请求用于所述IDGW从第一标识池中选取的第一标识，建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系；
通过所述IDGW向所述客户端返回所述查询响应。
实施例6
根据本发明的又一个实施例，还提供了一种业务请求处理装置，图11是根据本发明实施例的业务请求处理装置的框图三，如图11所示，应用 于标识网关IDGW，包括：
第四接收模块112，设置为接收查询服务器域名的查询请求，并根据所述查询请求向域名服务器DNS或客户端返回查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识；
第五接收模块114，设置为接收所述客户端根据所述第一标识发送的业务请求；
第一转发模块116，设置为将所述第一标识转换为服务器的第二标识，并将根据所述第二标识将所述业务请求转发给所述服务器；
第二转发模块118，设置为将所述服务器返回的响应所述业务请求的业务响应消息转发给所述客户端。
可选地，所述查询请求携带有所述客户端的IP地址以及以下信息之一：待查询的服务器域名；待查询的服务器域名对应的所述第二标识；待查询的服务器域名和所述待查询的服务器域名对应的所述第二标识。
可选地，所述第四接收模块112，还设置为：
接收所述DNS发送的所述查询请求；
从第一标识池中选取的第一标识，建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系；
通过所述DNS向所述客户端返回所述查询响应。
可选地，所述第四接收模块112，还设置为：
接收所述DNS发送的所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系，其中，所述映射关系是所述DNS在选取所述第一标识之后建立的；
通过所述DNS向所述客户端返回所述查询响应。
可选地，所述第四接收模块112，还设置为：
接收所述客户端根据响应消息重定向的所述查询请求，其中，所述响应消息是所述DNS接收到所述查询请求之后向所述客户端发送的；
根据所述查询请求从第一标识池中选取的第一标识，建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系；
向所述客户端返回所述查询响应。
可选地，所述第二转发模块118，还设置为：根据所述客户端的IP地址将所述业务响应消息发送给所述客户端。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述各个模块以任意组合的形式分别位于不同的处理器中。
实施例7
本发明实施例还提供了一种业务请求处理系统，图12是根据本发明实施例的业务请求处理系统的框图，如图12所示，包括：客户端、域名服务器DNS、标识网关IDGW以及服务器，其中，
所述客户端，设置为向所述DNS发送查询服务器域名的查询请求；
所述DNS，设置为根据所述查询请求向所述客户端返回查询响应，其中，所述查询响应中携带有所述IDGW的第一标识；
所述IDGW，设置为接收所述客户端发送的发送业务请求，将所述第一标识转换为服务器的第二标识，并根据所述第二标识将所述业务请求转发给所述服务器；
所述服务器，设置为根据所述业务请求通过所述IDGW向所述客户端返回响应所述业务请求的业务响应消息。
可选地，所述查询请求携带有待查询的服务器域名以及所述客户端的IP地址。
可选地，所述DNS，还设置为根据所述服务器域名、随机或轮流的方式选择所述IDGW，将所述查询请求转发给选择的所述IDGW；
所述IDGW，还设置为从第一标识池中选取的第一标识，建立客户端 的IP地址、第一标识与第二标识的映射关系，并将所述第一标识通过所述DNS发送给所述客户端。
可选地，所述DNS，还设置为根据所述服务器域名、随机或轮流的方式选择所述IDGW以及第一标识，建立客户端的IP地址、第一标识与第二标识的映射关系，并将所述映射关系发送给选择的所述IDGW；向所述客户端返回所述查询响应。
可选地，所述DNS，还设置为根据所述服务器域名、随机或轮流的方式选择所述IDGW；向所述客户端返回向选择的所述IDGW发送所述查询请求的响应消息；
所述客户端，还设置为根据所述响应消息将所述查询请求重定向给所述IDGW；
所述IDGW，还设置为从第一标识池中选取的第一标识，建立客户端的IP地址、第一标识与第二标识的映射关系；向所述客户端返回所述查询响应。
可选地，所述IDGW，还设置为接收所述服务器返回的携带所述第二标识的所述业务响应消息，根据所述映射关系将所述第二标识转换为所述第一标识，根据所述第一标识将所述业务响应消息发送给所述客户端。
可选地，所述第一标识和所述第二标识为IP地址，或者，IP地址+通信端口。
可选地，所述服务器的域名信息包括以下之一：服务的域名，服务器的主机名，服务的通信端口。
下面对各个网元功能进行详细说明。
客户端：客户端使用服务器域名发起业务访问，向DNS发送域名查询请求，并可进一步在DNS查询请求中携带服务器的端口信息；根据DNS返回的响应的第一标识信息，使用第一标识中的IP地址和默认通信端口，或第一标识中的IP地址和第一标识中的通信端口，向IDGW发送业务请求，并接收IDGW返回的业务响应。
服务器：通过第二标识中的IP地址和通信端口向客户端提供业务。
DNS：对现有的DNS进行增强，支持以下特性：
接收到客户端发送的DNS查询请求，选择IDGW；
充当代理向选择的IDGW查询域名对应的第一标识，或者使用替代机制，指示客户端直接向选择IDGW发送DNS查询请求，或者根据解析策略，在IDGW管理的第一标识池中随机选取标识，通知IDGW选取结果；
将选择结果返回给客户端。
IDGW：位于客户端和服务器之间，负责第一标识的维护、分配，并实现第二标识的隐藏，以及第一标识和第二标识的转换，从而对服务器提供安全防护功能，具体特性如下：
1)IDGW负责管理第一标识池；
2)当收到来自DNS或客户端的域名查询请求，根据策略从第一标识池中随机选取第一标识，建立客户端、第一标识、第二标识之间的映射关系，并将选取结果通过DNS或直接返回给客户端；或者当接收到DNS的选取结果后，建立客户端、第一标识、第二标识之间的映射关系；
3)当接收到业务请求时，根据映射关系执行第一标识到第二标识的转换；当收到对应的业务响应时，根据映射关系执行第二标识到第一标识的转换；
4)维护映射关系，并对数据包进行权限控制，只转发符合映射关系的数据包。
实施例8
本发明的实施例还提供了一种存储介质，该存储介质中存储有计算机程序，其中，该计算机程序被设置为运行时执行上述任一项方法实施例中的步骤。
可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以 下步骤的计算机程序：
S11，向域名服务器DNS发送查询服务器域名的查询请求；
S12，接收根据所述查询请求返回的查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识；
S13，根据所述第一标识向所述IDGW发送业务请求，其中，所述业务请求用于所述IDGW将所述第一标识转换为服务器的第二标识，并根据所述第二标识将所述业务请求转发给所述服务器；
S14，接收所述服务器返回的响应所述业务请求的业务响应消息。
可选地，存储介质还被设置为存储用于执行以下步骤的计算机程序：
S21，接收客户端发送的查询服务器域名的查询请求；
S22，根据所述查询请求向所述客户端返回查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识，所述第一标识用于所述客户端向所述IDGW发送业务请求，所述业务请求用于所述IDGW将所述第一标识转换为服务器的第二标识，并根据所述第二标识将所述业务请求转发给所述服务器，将所述服务器返回的响应所述业务请求的业务响应消息转发给所述客户端。
可选地，存储介质还被设置为存储用于执行以下步骤的计算机程序：
S31，接收查询服务器域名的查询请求，并根据所述查询请求向域名服务器DNS或客户端返回查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识；
S32，接收所述客户端根据所述第一标识发送的业务请求；
S33，将所述第一标识转换为服务器的第二标识，并将根据所述第二标识将所述业务请求转发给所述服务器；
S34，将所述服务器返回的响应所述业务请求的业务响应消息转发给所述客户端。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只 读存储器(Read-Only Memory，简称为ROM)、随机存取存储器(Random Access Memory，简称为RAM)、移动硬盘、磁碟或者光盘等各种可以存储计算机程序的介质。
实施例9
本发明的实施例还提供了一种电子装置，包括存储器和处理器，其中，存储器与图1中的“存储器104”对应，即将图1中的存储器104可以作为该电子装置中的一种存储器，该存储器中存储有计算机程序，该处理器被设置为运行计算机程序以执行上述任一项方法实施例中的步骤。
可选地，上述电子装置还可以包括传输设备以及输入输出设备，其中，该传输设备和上述处理器连接，该输入输出设备和上述处理器连接。
可选地，在本实施例中，上述处理器可以被设置为通过计算机程序执行以下步骤：
S11，向域名服务器DNS发送查询服务器域名的查询请求；
S12，接收根据所述查询请求返回的查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识；
S13，根据所述第一标识向所述IDGW发送业务请求，其中，所述业务请求用于所述IDGW将所述第一标识转换为服务器的第二标识，并根据所述第二标识将所述业务请求转发给所述服务器；
S14，接收所述服务器返回的响应所述业务请求的业务响应消息。
可选地，在本实施例中，上述处理器还可以被设置为通过计算机程序执行以下步骤：
S21，接收客户端发送的查询服务器域名的查询请求；
S22，根据所述查询请求向所述客户端返回查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识，所述第一标识用于所述客户端向所述IDGW发送业务请求，所述业务请求用于所述IDGW将所述第 一标识转换为服务器的第二标识，并根据所述第二标识将所述业务请求转发给所述服务器，将所述服务器返回的响应所述业务请求的业务响应消息转发给所述客户端。
可选地，在本实施例中，上述处理器还可以被设置为通过计算机程序执行以下步骤：
S31，接收查询服务器域名的查询请求，并根据所述查询请求向域名服务器DNS或客户端返回查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识；
S32，接收所述客户端根据所述第一标识发送的业务请求；
S33，将所述第一标识转换为服务器的第二标识，并将根据所述第二标识将所述业务请求转发给所述服务器；
S34，将所述服务器返回的响应所述业务请求的业务响应消息转发给所述客户端。
可选地，本实施例中的具体示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
如上所述，本发明实施例提供的一种业务请求处理方法及装置具有以下有益效果：解决了相关技术中针对服务器通过随机改变参数的方式影响正常业务的问题，实现了对目标服务器进行主动防护，提高整个服务器系统的安全性。

Claims (25)

  1. 一种业务请求处理方法，包括：
    向域名服务器DNS发送查询服务器域名的查询请求；
    接收根据所述查询请求返回的查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识；
    根据所述第一标识向所述IDGW发送业务请求，其中，所述业务请求用于所述IDGW将所述第一标识转换为服务器的第二标识，并根据所述第二标识将所述业务请求转发给所述服务器；
    接收所述服务器返回的响应所述业务请求的业务响应消息。
  2. 根据权利要求1所述的方法，其中，所述查询请求中携带有待查询的服务器域名以及客户端的IP地址。
  3. 根据权利要求2所述的方法，其中，所述向域名服务器DNS发送查询服务器域名的查询请求包括：
    向所述DNS发送所述查询请求，其中，所述查询请求用于所述DNS根据所述服务器域名、随机或轮流的方式选择IDGW，并将所述查询请求转发给选择的所述IDGW，供所述IDGW从第一标识池中选取第一标识，建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系，并接收所述IDGW选取的所述第一标识；或者，
    向所述DNS发送所述查询请求，其中，所述查询请求用于所述DNS选择IDGW以及第一标识，建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系，并将所述映射关系发送给选择的所述IDGW。
  4. 根据权利要求2所述的方法，其中，所述向域名服务器DNS发送查询服务器域名的查询请求包括：
    向所述DNS发送所述查询请求，其中，所述查询请求用于所述DNS根据所述服务器域名、随机或轮流的方式选择所述IDGW；
    接收所述DNS返回的响应消息，其中，所述响应消息用于指示向所述IDGW发送所述查询请求；
    根据所述响应消息将所述查询请求重定向给所述IDGW，其中，所述查询请求用于所述IDGW从第一标识池中选取所述第一标识，建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系。
  5. 根据权利要求1至4中任一项所述的方法，其中，所述第一标识和所述第二标识为IP地址，或者，IP地址+通信端口。
  6. 根据权利要求1至4中任一项所述的方法，其中，所述服务器域名包括以下之一：服务的域名，服务器的主机名，服务的通信端口。
  7. 一种业务请求处理方法，包括：
    接收客户端发送的查询服务器域名的查询请求；
    根据所述查询请求向所述客户端返回查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识，所述第一标识用于所述客户端向所述IDGW发送业务请求，所述业务请求用于所述IDGW将所述第一标识转换为服务器的第二标识，并根据所述第二标识将所述业务请求转发给所述服务器，将所述服务器返回的响应所述业务请求的业务响应消息转发给所述客户端。
  8. 根据权利要求7所述的方法，其中，所述查询请求中携带有待查询的服务器域名以及所述客户端的IP地址。
  9. 根据权利要求8所述的方法，其中，所述根据所述查询请求向所述客户端返回查询响应包括：
    根据所述服务器域名、随机或轮流的方式选择所述IDGW；
    将所述查询请求转发给选择的所述IDGW，所述查询请求用于所述IDGW从第一标识池中选取第一标识，建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系；
    接收所述IDGW选取的所述第一标识；
    向所述客户端返回所述查询响应。
  10. 根据权利要求8所述的方法，其中，所述根据所述查询请求向所述客户端返回查询响应包括：
    选择IDGW以及第一标识；
    建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系，并将所述映射关系发送给选择的所述IDGW；
    向所述客户端返回所述查询响应。
  11. 根据权利要求8所述的方法，其中，所述根据所述查询请求向所述客户端返回查询响应包括：
    根据所述服务器域名、随机或轮流的方式选择所述IDGW；
    向所述客户端返回响应消息，其中，所述响应消息用于所述客户端将所述查询请求重定向给所述IDGW，所述查询请求用于所述IDGW从第一标识池中选取的第一标识，建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系；
    通过所述IDGW向所述客户端返回所述查询响应。
  12. 根据权利要求7至11中任一项所述的方法，其中，所述第一标识和所述第二标识为IP地址，或者，IP地址+通信端口。
  13. 根据权利要求7至11中任一项所述的方法，其中，所述服务器域名包括以下之一：服务的域名，服务器的主机名，服务的通信端口。
  14. 一种业务请求处理方法，包括：
    接收查询服务器域名的查询请求，并根据所述查询请求向域名服务器DNS或客户端返回查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识；
    接收所述客户端根据所述第一标识发送的业务请求；
    将所述第一标识转换为服务器的第二标识，并将根据所述第二标识将所述业务请求转发给所述服务器；
    将所述服务器返回的响应所述业务请求的业务响应消息转发给所述客户端。
  15. 根据权利要求14所述的方法，其中，所述查询请求携带有所述客户端的IP地址以及以下信息之一：
    待查询的服务器域名；
    待查询的服务器域名对应的所述第二标识；
    待查询的服务器域名和所述待查询的服务器域名对应的所述第二标识。
  16. 根据权利要求15所述的方法，其中，所述接收查询服务器域名的查询请求，并根据所述查询请求向DNS或客户端返回查询响 应包括：
    接收所述DNS发送的所述查询请求；
    从第一标识池中选取的第一标识，建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系；
    通过所述DNS向所述客户端返回所述查询响应。
  17. 根据权利要求15所述的方法，其中，所述接收查询服务器域名的查询请求，并根据所述查询请求向DNS或客户端返回查询响应包括：
    接收所述DNS发送的所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系，其中，所述映射关系是所述DNS在选取所述第一标识之后建立的；
    通过所述DNS向所述客户端返回所述查询响应。
  18. 根据权利要求15所述的方法，其中，所述接收查询服务器域名的查询请求，并根据所述查询请求向DNS或客户端返回查询响应包括：
    接收所述客户端根据响应消息重定向的所述查询请求，其中，所述响应消息是所述DNS接收到所述查询请求之后向所述客户端发送的；
    根据所述查询请求从第一标识池中选取的第一标识，建立所述客户端的IP地址、所述第一标识与所述第二标识之间的映射关系；
    向所述客户端返回所述查询响应。
  19. 根据权利要求16至18中任一项所述的方法，其中，将所述 第一标识转换为服务器的第二标识包括：
    根据所述映射关系将所述第一标识转换为所述第二标识。
  20. 根据权利要求16至18中任一项述的方法，其中，将所述服务器返回的响应所述业务请求的业务响应消息转发给所述客户端包括：
    根据所述客户端的IP地址将所述业务响应消息发送给所述客户端。
  21. 根据权利要求14至18中任一项所述的方法，其中，所述第一标识和所述第二标识为IP地址，或者，IP地址+通信端口。
  22. 根据权利要求14至18中任一项所述的方法，其中，所述服务器域名包括以下之一：服务的域名，服务器的主机名，服务的通信端口。
  23. 一种业务请求处理装置，应用于标识网关IDGW，包括：
    第四接收模块，设置为接收查询服务器域名的查询请求，并根据所述查询请求向域名服务器DNS或客户端返回查询响应，其中，所述查询响应中携带有标识网关IDGW的第一标识；
    第五接收模块，设置为接收所述客户端根据所述第一标识发送的业务请求；
    第一转发模块，设置为将所述第一标识转换为服务器的第二标识，并将根据所述第二标识将所述业务请求转发给所述服务器；
    第二转发模块，设置为将所述服务器返回的响应所述业务请求的业务响应消息转发给所述客户端。
  24. 一种存储介质，其特征在于，所述存储介质中存储有计算机程序，其中，所述计算机程序被设置为运行时执行所述权利要求1至6任一项中所述的方法，或者执行权利要求7至13任一项中所述的方法，或者执行权利要求14至22任一项中所述的方法。
  25. 一种电子装置，包括存储器和处理器，其特征在于，所述存储器中存储有计算机程序，所述处理器被设置为运行所述计算机程序以执行所述权利要求1至6任一项中所述的方法，或者执行权利要求7至13任一项中所述的方法，或者执行权利要求14至22任一项中所述的方法。
PCT/CN2018/124419 2017-12-27 2018-12-27 业务请求处理方法及装置 WO2019129154A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US16/958,982 US11451510B2 (en) 2017-12-27 2018-12-27 Method and apparatus for processing service request
EP18894658.6A EP3720100A4 (en) 2017-12-27 2018-12-27 METHOD AND DEVICE FOR SERVICE REQUEST PROCESSING

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201711444514.6 2017-12-27
CN201711444514.6A CN109981803B (zh) 2017-12-27 2017-12-27 业务请求处理方法及装置

Publications (1)

Publication Number Publication Date
WO2019129154A1 true WO2019129154A1 (zh) 2019-07-04

Family

ID=67066604

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/124419 WO2019129154A1 (zh) 2017-12-27 2018-12-27 业务请求处理方法及装置

Country Status (4)

Country Link
US (1) US11451510B2 (zh)
EP (1) EP3720100A4 (zh)
CN (1) CN109981803B (zh)
WO (1) WO2019129154A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111399934A (zh) * 2020-02-21 2020-07-10 中国建设银行股份有限公司 一种管理自动程序的方法和装置
CN111683063A (zh) * 2020-05-20 2020-09-18 北京吉安金芯信息技术有限公司 消息处理方法、系统、装置、存储介质及处理器
CN114973515A (zh) * 2022-01-25 2022-08-30 浙江浩瀚能源科技有限公司 充电桩即插即充功能测试方法、装置和存储介质
CN115334150A (zh) * 2022-08-15 2022-11-11 北京分贝通科技有限公司 一种数据转发的方法、装置、系统、电子设备及介质

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2020108730A1 (en) * 2018-11-26 2020-06-04 Telefonaktiebolaget Lm Ericsson (Publ) Domain name system queries
CN112565318A (zh) * 2019-09-25 2021-03-26 中兴通讯股份有限公司 一种服务器安全防御方法及系统、通信设备、存储介质
CN112073398B (zh) * 2020-08-27 2022-10-11 北京金山云网络技术有限公司 消息队列的处理方法、装置和系统、存储介质和电子装置
CN113194076B (zh) * 2021-04-16 2023-04-21 中盈优创资讯科技有限公司 一种安全控制器及其实现方法
CN113329029B (zh) * 2021-06-18 2022-10-14 上海纽盾科技股份有限公司 一种针对apt攻击的态势感知节点防御方法及系统
CN113392093A (zh) * 2021-07-09 2021-09-14 中国建设银行股份有限公司 一种业务处理方法、装置、电子设备及计算机可读介质
CN114125818B (zh) * 2021-11-23 2023-08-22 北京字节跳动网络技术有限公司 业务参数传输方法、装置、系统、电子设备和存储介质
CN115145587A (zh) * 2022-07-22 2022-10-04 中国农业银行股份有限公司 一种产品参数校验方法、装置、电子设备及存储介质
CN115412592B (zh) * 2022-08-19 2023-08-22 恒生电子股份有限公司 业务处理系统以及方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012048206A2 (en) * 2010-10-08 2012-04-12 Virginia Tech Intellectual Properties, Inc. Method and system for dynamically obscuring addresses in ipv6
CN104601456A (zh) * 2013-10-30 2015-05-06 华为终端有限公司 网关替换方法、网关及服务器
CN104853003A (zh) * 2015-04-30 2015-08-19 中国人民解放军国防科学技术大学 一种基于Netfilter的地址、端口跳变通信实现方法
CN106161670A (zh) * 2016-06-02 2016-11-23 黄小勇 地址转换处理方法和地址转换处理装置

Family Cites Families (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2950583B1 (en) * 2005-05-12 2020-06-03 Apple Inc. Using an access point name to select an access gateway node
US8279776B1 (en) * 2009-10-26 2012-10-02 Sprint Communications Company L.P. Network address translation based on a reverse domain name service
CN102480477B (zh) * 2010-11-30 2015-03-11 中国移动通信集团北京有限公司 一种客户端进行业务访问的方法、装置及系统
CN102611763A (zh) * 2011-01-25 2012-07-25 中国移动通信集团公司 Dns查询的方法及设备
CN102647482B (zh) * 2012-03-31 2015-05-06 北京奇虎科技有限公司 一种访问网站的方法和系统
US10447710B1 (en) * 2014-06-03 2019-10-15 Cryptonite, LLC Self-shielding dynamic network architecture
US10432576B2 (en) * 2014-06-19 2019-10-01 Instart Logic, Inc. User device to domain name resolver mapping
US9565147B2 (en) * 2014-06-30 2017-02-07 Go Daddy Operating Company, LLC System and methods for multiple email services having a common domain
CN104378363B (zh) * 2014-10-30 2017-09-15 中国科学院信息工程研究所 一种动态应用地址转换方法及其网关系统
CN104506511A (zh) * 2014-12-15 2015-04-08 蓝盾信息安全技术股份有限公司 一种sdn网络动态目标防御系统及方法
US9756015B2 (en) * 2015-03-27 2017-09-05 International Business Machines Corporation Creating network isolation between virtual machines
CN105141641B (zh) * 2015-10-14 2018-05-11 武汉大学 一种基于SDN的Chaos移动目标防御方法及系统
CN105429957A (zh) * 2015-11-02 2016-03-23 芦斌 一种基于sdn构架下的ip地址跳变安全通信方法
US10084756B2 (en) * 2015-12-30 2018-09-25 Argela Yazilim ve Bilisim Teknolojileri San. ve Tic. A.S. Anonymous communications in software-defined networks via route hopping and IP address randomization
CN106302525B (zh) * 2016-09-27 2021-02-02 黄小勇 一种基于伪装的网络空间安全防御方法及系统
US11294777B2 (en) * 2016-12-05 2022-04-05 Nutanix, Inc. Disaster recovery for distributed file servers, including metadata fixers
US10904288B2 (en) * 2017-04-18 2021-01-26 Perspecta Labs Inc. Identifying and deceiving adversary nodes and maneuvers for attack deception and mitigation

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012048206A2 (en) * 2010-10-08 2012-04-12 Virginia Tech Intellectual Properties, Inc. Method and system for dynamically obscuring addresses in ipv6
CN104601456A (zh) * 2013-10-30 2015-05-06 华为终端有限公司 网关替换方法、网关及服务器
CN104853003A (zh) * 2015-04-30 2015-08-19 中国人民解放军国防科学技术大学 一种基于Netfilter的地址、端口跳变通信实现方法
CN106161670A (zh) * 2016-06-02 2016-11-23 黄小勇 地址转换处理方法和地址转换处理装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3720100A4 *

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111399934A (zh) * 2020-02-21 2020-07-10 中国建设银行股份有限公司 一种管理自动程序的方法和装置
CN111683063A (zh) * 2020-05-20 2020-09-18 北京吉安金芯信息技术有限公司 消息处理方法、系统、装置、存储介质及处理器
CN111683063B (zh) * 2020-05-20 2023-02-17 北京吉安金芯信息技术有限公司 消息处理方法、系统、装置、存储介质及处理器
CN114973515A (zh) * 2022-01-25 2022-08-30 浙江浩瀚能源科技有限公司 充电桩即插即充功能测试方法、装置和存储介质
CN115334150A (zh) * 2022-08-15 2022-11-11 北京分贝通科技有限公司 一种数据转发的方法、装置、系统、电子设备及介质
CN115334150B (zh) * 2022-08-15 2024-01-19 北京分贝通科技有限公司 一种数据转发的方法、装置、系统、电子设备及介质

Also Published As

Publication number Publication date
EP3720100A4 (en) 2021-08-18
US11451510B2 (en) 2022-09-20
CN109981803A (zh) 2019-07-05
EP3720100A1 (en) 2020-10-07
CN109981803B (zh) 2022-04-29
US20200344208A1 (en) 2020-10-29

Similar Documents

Publication Publication Date Title
WO2019129154A1 (zh) 业务请求处理方法及装置
US20220124147A1 (en) Application relocation method and apparatus
EP3085064B1 (en) Countering security threats with domain name system
US7925027B2 (en) Secure address proxying using multi-key cryptographically generated addresses
US10158998B2 (en) Network path probing using available network connections
US20070094279A1 (en) Service provision in peer-to-peer networking environment
US20120110641A1 (en) Traffic steering system
WO2020083288A1 (zh) Dns服务器的安全防御方法及装置、通信设备及存储介质
WO2021057348A1 (zh) 一种服务器安全防御方法及系统、通信设备、存储介质
TWI674780B (zh) 網路服務系統及網路服務方法
CN102790808A (zh) 一种域名解析方法和系统、一种客户端
JP4638483B2 (ja) 無線ネットワーク内のサーバ情報を得るための方法および装置
JP5864598B2 (ja) ユーザにサービスアクセスを提供する方法およびシステム
WO2022033346A1 (zh) 网络切片管理系统、应用服务器和终端设备
CN106507414B (zh) 报文转发方法及装置
CN110830601A (zh) 分布式系统nat穿透方法、装置、设备及存储介质
CN104253798A (zh) 一种网络安全监控方法和系统
WO2014166078A1 (zh) 数据发送处理方法及路由器
CN109698869B (zh) 私网穿越方法、通信节点及存储介质
CN115250264B (zh) 基于dns-ip映射来控制与域名相关的网络流量
US10798195B2 (en) Fast roaming with shared services in enterprise fabric based networks
EP3989509A1 (en) Method for realizing network dynamics, system, terminal device and storage medium
KR20230015836A (ko) 멀티캐스트 브로드캐스트 서비스들을 위한 애플리케이션 기능 개시 멀티캐스트 세션 참여 절차
EP2550836B1 (en) Method and apparatus for home network access
KR102185665B1 (ko) All-IP 환경에서 IPv6 주소 기반의 통신을 위한 사용자 식별 서버, 단말, 방법, 및 기록 매체

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18894658

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018894658

Country of ref document: EP

Effective date: 20200701