WO2020083288A1

WO2020083288A1 - Safety defense method and apparatus for dns server, and communication device and storage medium

Info

Publication number: WO2020083288A1
Application number: PCT/CN2019/112547
Authority: WO
Inventors: 郝振武; 吴强; 谢大雄; 陆平
Original assignee: 中兴通讯股份有限公司
Priority date: 2018-10-26
Filing date: 2019-10-22
Publication date: 2020-04-30
Also published as: CN111107171A; CN111107171B

Abstract

Disclosed are a safety defense method and apparatus for a DNS server, and a communication device and a storage medium. The method comprises: according to a mobile domain name system (mDNS) Internet protocol (IP) address request of a client, dynamically allocating an mDNS IP address for the client; receiving a first domain name service request initiated by the client, wherein a destination address of the first domain name service request is the mDNS IP address; on the basis of the first domain name service request, sending a second domain name service request to the mDNS IP address replaced with a corresponding DNS server; and the DNS server providing a second domain name service response to the client based on a first domain name service response provided by the second domain name service request.

Description

DNS server security defense method and device, communication equipment and storage medium

Technical field

The present disclosure relates to the field of network technology, and in particular to a domain name system DNS (Domain Name System, DNS for short) server security defense method and device, communication equipment, and storage medium.

Background technique

A DNS server is a server that provides domain name services. The requesting end provides a resolution request carrying the domain name. After receiving the resolution request, the DNS server returns the Internet protocol (Internet Protocol, IP for short) address of the service server corresponding to the domain name to the requesting end. The access end uses the received IP address Access the business server to obtain the services provided by the business server. On the one hand, since the IP address is a relatively boring and professional string for ordinary users, on the other hand, a user needs to access many business servers, so it is almost impossible to remember the IP address of each business server, so domain name resolution The provision of services is very important. In the prior art, it is found that the DNS server that provides the domain name resolution service is very vulnerable to hacker attacks, resulting in DNS server security problems, and may also be associated with the security issues of the business server due to information leakage of the DNS server.

Summary of the invention

In view of this, the embodiments of the present disclosure are expected to provide a DNS server security defense method and device, a communication device, and a storage medium.

The technical solution of the present disclosure is implemented as follows:

In a first aspect, an embodiment of the present disclosure provides a DNS server security defense method, including:

According to the client's mobile domain name system (moving Domain Name System, referred to as mDNS) network protocol (Internet Protocol, referred to as IP) address request, dynamically assign mDNS IP address to the client;

Receiving a first domain name service request initiated by the client, where the destination address of the first domain name service request is the mDNS IP address;

Send a second domain name service request to the corresponding DNS server by replacing the mDNS IP address with the corresponding DNS server based on the first domain name service request;

The DNS server provides a second domain name service response to the client based on the first domain name service response provided by the second domain name service request.

In a second aspect, an embodiment of the present disclosure provides a DNS server security defense method, including:

Receive client configuration request;

Based on the configuration request, assigning a host network protocol IP address to the client;

A mobile domain name system mDNS IP address request sent to the domain name gateway based on the host IP address;

Receiving the mDNS IP address returned by the domain name gateway based on the mDNS IP address request;

Sending a configuration response carrying the host IP address and the mDNS IP address to the client.

In a third aspect, the implementation of the present disclosure provides a DNS server security defense device, including: a first allocation module configured to dynamically allocate a first mDNS IP address to the client according to the client's mDNS network protocol IP address request ;

A first receiving module, configured to receive a first domain name service request initiated by the client, wherein the destination address of the first domain name service request is the mDNS IP address;

The first sending module is configured to send a second domain name service request to the corresponding DNS server by replacing the mDNS IP address with the corresponding DNS server based on the first domain name service request;

The providing module is configured to provide the DNS server with a second domain name service response based on the first domain name service response provided by the second domain name service request to the client.

According to a fourth aspect, an embodiment of the present disclosure provides a DNS server security defense device, including:

The fourth receiving module is configured to receive the configuration request of the client;

A third allocation module, configured to allocate a host IP address to the client based on the configuration request;

The second sending module is configured to send a mobile domain name system mDNS IP address request to the domain name gateway based on the host IP address;

The fifth receiving module is configured to receive the mDNS IP address returned by the domain name gateway based on the mDNS IP address request;

The third sending module is configured to send a configuration response carrying the host IP address and the mDNS IP address to the client.

According to a fifth aspect, an embodiment of the present disclosure provides a communication device, including:

transceiver,

Memory,

A processor, respectively connected to the transceiver and the memory, is configured to control the transceiver of information by executing computer-executable instructions stored on the memory, and implement the first aspect and / or the second The security defense method of the DNS server provided by the aspect.

According to a sixth aspect, an embodiment of the present disclosure provides a computer storage medium that stores computer-executable instructions; after the computer-executable instructions are executed, the first aspect and / or the second aspect can be implemented DNS server security defense method.

The DNS server security defense method and apparatus, communication equipment, and storage medium provided by the embodiments of the present disclosure, when configuring the DNS server used by the client by the domain name gateway, the real IP address of the DNS server is hidden, but the client is assigned The DNS server cannot directly locate the mDNS IP address of the DNS server; on the one hand, the client can send a domain name service request through the mDNS IP address, and the domain name gateway sends a second domain name service request to the corresponding DNS server based on the first domain name service request. In this way, while ensuring the normal DNS service acquisition of the client, the real IP address of the DNS server is hidden, and the security of the DNS server is ensured; and the security of the domain name service request can be ensured through the verification based on the binding relationship, thereby achieving DNS service security defense request.

BRIEF DESCRIPTION

1 is a schematic structural diagram of a network system provided by an embodiment of the present disclosure;

FIG. 2 is a schematic flowchart of a first DNS server security defense method provided by an embodiment of the present disclosure;

FIG. 3 is a schematic flowchart of a second DNS server security defense method provided by an embodiment of the present disclosure;

4 is a schematic flowchart of a third DNS server security defense method provided by an embodiment of the present disclosure;

5 is a schematic structural diagram of a first type of DNS server security defense device provided by an embodiment of the present disclosure;

6 is a schematic structural diagram of a second type of DNS server security defense device provided by an embodiment of the present disclosure;

7 is a schematic flowchart of a fourth DNS server security defense method provided by an embodiment of the present disclosure;

8 is a schematic flowchart of a fifth DNS server security defense method provided by an embodiment of the present disclosure;

9 is a schematic flowchart of a sixth DNS server security defense method provided by an embodiment of the present disclosure;

10 is a schematic flowchart of a seventh DNS server security defense method provided by an embodiment of the present disclosure;

11 is a schematic flowchart of an eighth DNS server security defense method provided by an embodiment of the present disclosure;

12 is a schematic flowchart of a ninth DNS server security defense method provided by an embodiment of the present disclosure.

detailed description

The technical solution of the present disclosure will be further elaborated below with reference to the drawings and optional embodiments of the specification.

As shown in FIG. 1, this embodiment provides a network system for a defense method of a DNS server, including:

Added Domain Name Gateway (DNG), located on the routing path from the access gateway to the DNS server, and in a network, one or more domain name gateways can be deployed, and each domain name gateway is configured with mDNS IP address pools. These mDNS IP address pools do not overlap with each other. At the same time, it enhances the access configuration function, and can obtain the mDNS IP address from the domain name gateway as the DNS server IP address configuration to the client, and maintain this information. Other network functions, including clients, access gateways, DNS servers, and business servers are not affected. Therefore, the present disclosure has the characteristics of good compatibility with existing technologies and easy deployment.

Client: establish a connection with the access gateway, receive the host IP address and mDNS IP address assigned by the access configuration function, where the mDNS IP address serves as the virtual IP address of the DNS server; access the Internet through the access gateway and initiate the domain Business requests, access to business applications.

Access gateway: During the client access process, the client configuration parameters are obtained from the access configuration function and provided to the client, and the client access to the Internet function is realized, so that the client can access the DNS server and business server through the domain name gateway. .

Access configuration function: According to the client's access information, assign the host IP address to the client, select the domain name gateway, request the mDNS IP address from the domain name gateway, configure the assigned host IP address and the obtained mDNS IP address to the client, and Maintain the validity of the host configuration.

Domain name gateway: maintain the mDNS IP address pool, select mDNS IP addresses from the mDNS IP address pool for the client according to the request of the host configuration function, and in some embodiments, establish a binding between the client IP address and the mDNS IP address Define the relationship and maintain the validity of the mDNS IP address and binding relationship; when the client initiates a domain name request, check the validity of the request, if it is a normal request, send a business request to the DNS server, and return the result to the client, otherwise Reject the domain name service request, or use the DNS restricted function, or direct the domain name request to the honeypot system.

DNS server: resolve to the corresponding IP address according to the requested service domain name and return.

Service server: provides services to clients, and the correspondence between IP addresses and domain names is stored in the DNS server.

As shown in FIG. 2, this embodiment provides a DNS server security defense method, including:

Step S110: dynamically assign an mDNS IP address to the client according to the client's mDNS IP address request; the assigned mDNS IP address may be the first mDNS IP address; for example, the step S110 may include: initiating according to the in-configuration function The client's mDNS IP address request dynamically allocates the mDNS IP address for the client; the assigned mDNS IP address may be the first mDNS IP address.

Step S120: Receive a first domain name service request initiated by the client, where the destination address of the first domain name service request is the mDNS IP address;

Step S130: Based on the first domain name service request, send a second domain name service request to the corresponding DNS server with the mDNS IP address replaced by the corresponding DNS server;

Step S140: The DNS server provides a second domain name service response to the client based on the first domain name service response provided by the second domain name service request.

The security defense method of the DNS server provided in this embodiment may be applied to a domain name gateway, which may correspond to a physical gateway. For example, the physical gateway may be: an access gateway for a client to access the network, a typical connection The ingress gateway may include: a packet data gateway (Packet, data, GataWay, PGW for short), etc. Of course, in some embodiments, the domain name gateway may also be a specifically established gateway for maintaining the security of the DNS server. The gateway may be directly or indirectly connected to the access gateway. Thus, the client (installation and / or Application programs, software development tools, components or plug-ins running in the terminal) can be accessed to the domain name gateway through the access gateway. For example, during the process of accessing the network by the client, for example, during the process of establishing a connection with the access gateway, the client can request to allocate the IP address of the DNS server through the access gateway. In this case, the access gateway can pass the domain name gateway. The information exchange between assigns mDNS IP address to the client. In this embodiment, the mDNS IP address may be a virtual IP address of the DNS server, which is different from the real IP address of the DNS server (also referred to as DNS IP address in the embodiment of the present disclosure). In this way, the real IP address of the DNS server will not be disclosed in the entire network, nor will it be disclosed to the client; thereby enhancing the security of the real IP address of the DNS server, reducing the use of DNS disclosed in public networks by hackers The IP address of the server is aligned to launch an attack, thereby reducing the DNS server's own security problems, and at the same time reducing the security problems of the business server due to the IP address of the business server stored in the DNS server and other information, thereby improving the DNS server and Business server security.

In some embodiments, the mDNS IP address may be: a part of the current IP address within the IP address range of the network. When this part of the DNS IP address is used as the destination address, a data packet carrying the destination address (for example, the first Domain name service request) can ensure routing to the domain name gateway that assigns the mDNS IP address. In the embodiment of the present disclosure, the mDNS IP address is dynamically allocated to the client, and is not pre-allocated. Thus, compared with static allocation, the long-term consistency of the mDNS IP address due to static allocation can be avoided, resulting in illegal The client steals the mDNS IP address of the legitimate client and impersonates the legitimate client to access the corresponding DNS server to cause security problems. In some embodiments, the dynamic allocation may include: randomly selecting and assigning to all clients in all mDNS IP addresses; and randomly selecting and assigning to clients in some mDNS IP addresses. Here, it is only a limitation on dynamic allocation. When implemented, the dynamic allocation may include not only random selection allocation, but also selection allocation according to a certain allocation rule. The dynamic allocation here emphasizes that each allocation is dynamic and is not determined in advance. Thus, due to the dynamic allocation, the mDNS IP address allocated each time may be different.

In this embodiment, the mDNS IP address allocated to the client is returned to the client, for example, as one of the configuration parameters and the first host IP address is returned to the client, and subsequently, if the client needs a domain name During service, a domain name service request with a source address as the first host IP address and a destination address as the mDNS IP address is constructed, and the domain name service request is referred to as a first domain name service request in the embodiments of the present disclosure. Since the first domain name service request cannot substantially be routed to the DNS server request that the client wants to access, the first domain name service request is forwarded to the domain name gateway. After the domain name gateway receives the first domain name service request, for example, A pre-established binding relationship or a DNS server dynamically assigned to the client to construct a second domain name service request, the destination address of the second domain name service request is replaced, for example, the mDNS IP address is replaced with the real IP of the DNS server The address forwards the second domain name service request to the outside, so that the second domain name service request can be correctly routed to the DNS server.

In some embodiments, the step S110 may include: dynamically assigning a first mDNS IP address to the client according to the client's mobile domain name system mDNS network protocol IP address request;

As shown in FIG. 3, the method further includes:

Step S111: Establish a binding relationship between the first host IP address of the client and the first mDNS IP address;

Step S121: query the binding relationship according to the second mDNS IP address and the second host IP address of the DNS server corresponding to the client carried in the first domain name service request,

The step S130 may include a step S131; the step S131 may include: if the second mDNS IP address and the second host IP address are included in the binding relationship, correspond to the second mDNS IP address The DNS server sends a second domain name service request.

Of course, before generating the second domain name service request, it is necessary to verify whether the second host IP address and the second mDNS IP address carried in the first domain name service request have been established in the domain name gateway binding relationship, If a binding relationship has been established, it indicates that the first domain name service request of the client is legal, and the current first domain name service request is safe, and then the second domain name service request is constructed, otherwise the first name can be directly rejected The domain name service request initiates the domain name service, thereby once again improving the security provided by the DNS server and DNS service.

When the second mDNS IP address and the second host IP address are included in the binding relationship, the DNS server sends a second domain name service request to the corresponding DNS, the second domain name service request and the second A domain name service request carries the same domain name to be resolved; in this way, after the corresponding DNS server receives the second domain name service request, the IP address of the business server corresponding to the domain name to be resolved is queried locally or remotely, and the domain name may be The domain name of the business server to obtain the domain name resolution result. Carry the IP address of the business server in the domain name service response and return it to the client or the client's access gateway, so that the client can access the business server according to the obtained IP address of the business server, thereby obtaining business services from the business server. The business server here may include: social server, online shopping server, forum server, web server, video server, audio server, advertising server, content server, stock fund and other transaction providing server, education system server, medical system server, etc. A server that provides specific application services. Of course, the above is only an example, and the service server here is not limited to any one of the above.

In this way, on the one hand, it ensures that the client obtains the domain name service, on the other hand, it avoids the security problems caused by the exposure of the real IP address of the DNS server in the network.

In some embodiments, to improve security, the DNS server may also receive encrypted information of the client from the access gateway of the client. The encrypted information may include: a key and an encryption algorithm, etc., so that the access gateway The encrypted information is used to encrypt the first host IP address and the first mDNS IP address with the domain name gateway.

In some embodiments, the step S131 may include: replacing the second mDNS IP address in the first domain name service request with the DNS server's DNS IP address to form the second domain name service request; Sending the second domain name service request to the DNS server.

The DNS IP address here may be the real effective IP address of the DNS server, and is stored in the domain name gateway.

In some embodiments, if the domain name gateway is located on the routing path of the client and the DNS server, the source addresses of the second domain name service request and the first domain name service request are both the host IP of the client address.

If the domain name gateway is located on the routing path between the client and the DNS server, the information sent by the client to the DNS server and the information sent by the DNS server to the client will pass through the DNS server, so that the DNS server can intercept the first The domain name service request intercepts the domain name service response forwarded by the DNS server based on the second domain name service request, and may be forwarded to the corresponding client based on the first DNS server request sent by the client. For example, the method further includes: forming a request record according to the first domain name service request and the second domain name service request; the request record includes at least: the domain name to be resolved and the client's host IP address; The request record may further include: the domain name to be resolved, the client's host IP address, and the DNS IP address of the DNS server to which the second domain name service request is sent. Thus, at least based on the domain name to be resolved, the current first domain name response is determined to be forwarded The client, or, determines the host IP address corresponding to the client based on the domain name to be resolved, the client's host IP address, and the DNS server's DNS IP address, and forwards it to the corresponding client.

In some embodiments, the step S131 may include:

Replacing the first host IP address in the first domain name service request with the gateway IP address of the domain name gateway to form the second domain name service request including both the gateway IP address and the DNS IP address.

The domain name gateway is not necessarily set on the routing path of the message routing between the client and the DNS server. In order to ensure that both the first domain name service request and the first domain name service response pass through the domain name gateway, the destination address in the first domain name service request is replaced by The DNS IP address of the DNS server, and the source address in the first domain name service request is replaced with the gateway IP address of the domain name gateway. In this way, the destination address of the first domain name service response will be the gateway IP address of the domain name gateway. After the first domain name service, the domain name gateway forwards the IP address of the service server carried in the first domain name service response to the corresponding client, for example, based on the request record.

In some embodiments, the step SS140 may include:

Replacing the DNS IP address of the DNS server in the first domain name service response with the first mDNS IP address assigned to the client.

In some implementations, the source address of the first domain name service response may be the DNS IP address of the DNS server. To avoid exposure, the domain name gateway will delete the DNS IP address, for example, replace the DNS IP address with The first mDNS IP address assigned by the client mentioned above, in other embodiments, it is also possible to delete only the DNS IP address without replacing it. Of course, in the process of replacing the DNS IP address, it can also be directly replaced with the gateway IP address of the domain name gateway or other virtual IP addresses with no specific meaning. If the DNS IP address is replaced with the first mDNS IP address, it is convenient for the client to confirm the domain name service response corresponding to the domain name service request of the data packet that the client actually received according to the source address. In this way, the source address of the second domain name service response is different from the source address of the first domain name service response.

In other embodiments, if the first domain name service response does not carry a source address, the second domain name service response may respond to the first domain name service response, so that the DNS server may directly The first domain name service response is sent to the client as the second domain name service response. In short, after receiving the first domain name service response in this embodiment, the DNS server may provide the first domain name service response through operations such as DNS IP address replacement, DNS IP address deletion, and source address detection. The domain name resolution result of is sent to the client as the second domain name service response. The domain name resolution result may include: the IP address corresponding to the domain name requested for resolution.

In other embodiments, on the one hand, in order to improve the domain name resolution rate, and on the other hand, to reduce the compliance of the DNS server, the method further includes: constructing a second domain name service request carrying preset indication information, the preset indication The information indicates that the domain name service response hides the DNS IP address. Thus, the first domain name service response may not carry the source address (for example, the source address in the data packet of the domain name service response is empty), or carry the wrong source address, etc., In this way, the DNS server does not need to replace the source address, and can directly forward the first domain name service request as a second domain name service request, or after replacing the destination address of the first domain name service request with the client's host IP address Just forward it.

In some embodiments, the step S110 may include:

According to the mDNS IP address request of the client, the mDNS IP address is dynamically selected from the mDNS IP address pool, for example, the dynamically selected mDNS IP address is used as the first mDNS IP address.

In this embodiment, the domain name gateway is provided with an mDNS IP address pool, and multiple mDNS IP addresses are stored in the mDNS IP address pool, which can be allocated to different clients or clients at different time periods.

In this embodiment, the dynamically selected mDNS IP address is the mDNS IP address pool from the domain name gateway. The mDNS IP address pools contained in the mDNS IP address pools of different domain name gateways. In this way, the access gateway receives the first domain name service request carrying the mDNS IP address, and can easily determine the need to receive the first DNS address based on the mDNS IP address. Domain name gateway requested by the domain name service.

For example, the mDNS IP address may include: an mDNS IP address segment, the mDNS IP addresses in these address segments are continuous, and the mDNS IP address may be identified in the access gateway by the start address and the end address of the mDNS IP address segment In this way, once the access gateway receives the first domain name service request, it can determine the domain name gateway that needs to receive the first domain name service request according to the mDNS IP address segment to which the mDNS IP address carried in the request belongs.

In some embodiments, the step S110 may include one of the following:

According to the client's mDNS IP address request, randomly select the mDNS IP address assigned to the client from the mDNS IP address pool; since different clients may correspond to different host IP addresses, the mDNS in the mDNS IP address pool The address can be assigned to different clients, or a unique binding relationship can be established; therefore, in this embodiment, the domain name gateway can be randomly selected from the mDNS IP address pool;

According to the client's mDNS IP address request, the currently idle mDNS IP address is randomly selected from the mDNS IP address pool; in some implementations, the domain name gateway will also record the use status of the mDNS IP address, preferentially selecting unused IP addresses (That is, idle) mDNS IP address is assigned to the client;

According to the client's mDNS IP address request, if there is no idle mDNS IP address in the mDNS IP address pool, the mDNS IP address assigned to the client is randomly selected from the used mDNS IP address pool. If the idle mDNS IP address is preferentially selected, the first mDNS IP address can be selected from the used mDNS IP addresses.

In other implementations, if there is no idle mDNS IP address in the mDNS IP address pool, that is, each mDNS IP address in the mDNS IP address pool is occupied, then the established binding relationship is preferably selected Less mDNS IP address is assigned to the client. For example, mDNS IP address A has participated in the establishment of the first number of binding relationships, and mDNS IP address B has participated in the establishment of the second number of binding relationships; if the first number is less than the second number, the mDNS IP is preferentially selected Address A participates in the establishment of the binding relationship of the host IP address corresponding to the current client. In this way, when providing the domain name service, the problem of large access delay caused by a large number of centralized and parallel access by the client to the same binding relationship is avoided.

For example, in some embodiments, when the DNS server performs the legality verification, it may first query the binding relationship based on the second mDNS IP address carried in the first domain name service request, and then query When there is a first mDNS IP address corresponding to the second mDNS IP address, the first host IP address corresponding to the first mDNS IP address is extracted from one or more binding relationships corresponding to the first mDNS IP address. Matching the IP addresses of the two hosts can reduce unnecessary matching on the one hand and accelerate the verification efficiency on the other.

In some embodiments, the step S110 may include: according to the mDNS IP address request of the client, selecting a plurality of mDNS IP addresses allocated to the client from an mDNS IP address pool.

In this embodiment, if an attacker attacks one of the mDNS IP addresses as the DNS server ’s DNS IP address, after the domain name server ’s firewall attacks, it may block a certain mDNS IP address in order to allocate multiple mDNS IP addresses In this way, the client can also obtain the domain name service through the unblocked mDNS IP address.

In some embodiments, according to the number N of addresses carried in the mDNS IP address request, N N mDNS IP addresses allocated to the client are selected from an mDNS IP address pool.

In some embodiments, for example, the access configuration function may explicitly indicate how many mDNS IP addresses are allocated.

In some examples, the method further includes:

A DNS server corresponding to the domain name service system is allocated to the client; here, the DNS server may be allocated to the client according to the location information of the client, for example, based on the principle of geographic proximity A DNS server with a closer geographic location or a closer network location; in other embodiments, the DNS server can also be assigned to clients based on the current service of the DNS server, the corresponding number of clients, client online and offline status information, etc. .

The step S120 may include:

Establish a binding relationship between the first host IP address, the first mDNS IP address, and the DNS server's DNS IP address.

In this embodiment, the binding relationship includes not only the first host IP address and the first mDNS IP address, but also the DNS IP address of the DNS server assigned to the client. Thus, if the first domain name service request is received After that, the second domain name service request will be constructed based on the DNS IP address recorded in the binding relationship.

That is, if the second mDNS IP address and the second host IP address are included in the binding relationship, sending a second domain name service request to the DNS server corresponding to the second mDNS IP address includes: If the second mDNS IP address and the second host IP address are included in the binding relationship and the second host IP address and the second mDNS IP address have a bound DNS IP address, bind to The DNS domain name IP address of the second domain name service request.

In other embodiments, if the second mDNS IP address and the second host IP address are included in the binding relationship, the second domain name is sent to the DNS server corresponding to the second mDNS IP address The service request includes: if the second mDNS IP address and the second host IP address are included in the binding relationship and the second host IP address and the second mDNS IP address are not bound to DNS The IP address sends the second domain name service request to the default DNS server.

DNS servers in different geographic locations and / or different network locations may be connected to different DNS servers. The DNS server may set a DNS server that is closer to itself geographically or on the network as the default DNS server, or, depending on the DNS server Set the default DNS server for information such as the load status, or select a DNS server with strong domain name resolution capability as the default DNS server to ensure the rate and success rate of domain name service resolution. The parameter that reflects the strong domain name resolution capability may include at least one of the following:

The number of domain names stored by the DNS server;

Success rate of historical resolution of DNS server;

DNS server operating stability parameters.

The larger the number of domain names, the stronger the domain name resolution capability; if the historical resolution success rate is higher, the domain name resolution capability is stronger; if the DNS server's operational stability parameter is higher, the domain name resolution capability is greater Strong. In some embodiments, the default DNS server may be selected by combining location information, domain name resolution capabilities, and so on.

In some embodiments, the method further includes at least one of the following:

If the second mDNS IP address and the second host IP address are not in the binding relationship, provide a limited DNS service to the client; for example, only provide the client with some DNS with lower security performance requirements Services, for example, the first domain name service request will only be forwarded to the DNS server with lower security performance;

If the second mDNS IP address and the second host IP address are not in the binding relationship, direct the domain name service request to a predetermined system, wherein the predetermined system is used to attack the domain name service request Perform analysis; the predetermined system may be an attack location system, for example, using reverse tracking technology to locate the source client of the first domain name service request that may be attacked or the tampering terminal that transforms the domain name service request to form the first domain name service request; The predetermined system may be: a honeypot system; the honeypot system may be a system that uses honeypot technology to enhance protection capabilities. Honeypot technology is a technique to deceive the attacker. By arranging some hosts, network services or information as bait to induce the attacker to attack them, you can capture and analyze the attack behavior and understand the attacker's behavior. The tools and methods used to speculate on attack intentions and motives can enable the defenders to clearly understand the security threats they face, and enhance the security protection capabilities of the actual system through technical and management means;

If the second mDNS IP address and the second host IP address are not in the binding relationship, refuse to provide DNS services to the client. In some embodiments, if the DNS service can be directly rejected in the binding relationship, the domain name gateway will refuse to forward the domain name to be resolved in the first domain name service request.

In some embodiments, the mDNS IP address request also carries address lease information;

The method further includes: setting the validity period of the first mDNS IP address in the binding relationship according to the address lease period information.

In this embodiment, the length of the lease of the host IP address indicated by the address lease information, in this embodiment, the DNS server will set the first assigned to the client according to the lease indicated by the address lease information The validity period of the mDNS IP address. In some embodiments, the validity period may be equal to the lease period. In other embodiments, the validity period may be slightly longer than the validity period. The start period of the lease period and the validity period are the same. For users or clients, it may be remembered that the renewal of the mDNS IP address is required when the lease period expires, or there is a certain delay in the renewal of the host IP address If the renewal of the corresponding mDNS IP address is extracted after the validity period, if the validity period is equal to the lease period, the validity period will also expire once the lease period expires. Even if it is renewed, a new mDNS IP address needs to be re-assigned to the client. Therefore, in this implementation, in some embodiments, the validity period is slightly longer than the lease period, and the length of time that the optional validity period is longer than the lease period may be determined according to the delay time of the renewal of the host IP address, or may be random Set a fixed duration, for example, half a day, etc.

In some embodiments, the method further includes: receiving a lease renewal request;

According to the lease renewal request, the validity period of the first mDNS IP address is extended.

In some embodiments, the lease renewal request may be a request to continue leasing the corresponding first mDNS IP address. The lease renewal request may carry a lease renewal period, so the validity period may be extended according to the lease renewal period.

In other embodiments, the lease renewal request may only carry the lease renewal instruction but not the instruction to extend the duration of the lease renewal period. The domain name gateway may request to indicate the lease renewal period, or may extend a default period to re-determine Of validity. The default period may be a fixed period of time for the lease renewal negotiated between the access gateway and the domain name gateway. In some other embodiments, the extension of a default time limit forwards the updated validity period to the client or the client's access gateway to facilitate the client or the client's corresponding access gateway, before the updated validity period expires again Request a renewal or instruct to release the binding relationship, etc.

In some embodiments, the method further includes:

If the validity period expires, the binding relationship is deleted.

In other embodiments, the method further includes:

Send a deletion prompt to the client or the client's access gateway.

If the validity period expires, if the binding relationship is maintained, on the one hand, the utilization rate of the mDNS IP address in the binding relationship will be low; on the other hand, if the corresponding host IP address is allocated to other clients, it may lead to subsequent binding The relationship query verification error, so the binding relationship will be released in time. After the deletion of the binding relationship is completed, the method further includes sending a deletion prompt, which can be sent to the client or the client's access gateway, thereby triggering the client or the client's access gateway to update the client's Configuration parameters.

In some embodiments, the method further includes: receiving a release request; deleting the binding relationship between the first host IP address and the first mDNS IP address according to the release request, and releasing the first mDNS IP address.

The release request may be an active request to delete the binding relationship to release the first mDNS IP address in the binding relationship.

For example, if the client is offline, it means that the client may not need to request the domain name service through the domain name gateway, and can release the binding relationship, thereby improving the effective utilization rate of the mDNS IP address.

For another example, if the client migrates from one network area to another network area, it may need to access DNS servers or DNS servers in different network locations, and at this time, it may also request to release the binding relationship in the original network area.

In this embodiment, the network area is related to the location and / or affiliation of network nodes of the wireless network or the Internet. For example, the metropolitan area network covers a city's local area network, although some geographical areas are close to or belong to the same Large area, but the access network location belongs to a different network area. As another example, clients of different operators ’networks connected to the network may belong to different network areas. For example, if they connect to the network through a mobile network and connect to the network through a Unicom network, the domain name gateway of the same operator is preferentially assigned. And the DNS server provides related services for the client, so that the two clients located in the same geographical location will belong to different network areas.

In some embodiments, the method further includes: receiving an update request;

Delete the first binding relationship and establish the second binding relationship according to the update request; wherein, the first binding relationship is: the old first host IP address corresponding to the client and the first A binding relationship of an mDNS IP address; the second binding relationship is: a binding relationship between the new first host IP address corresponding to the client and the first mDNS IP address after the update; wherein, the Compared with the first binding relationship, at least the first host IP address is different in the second binding relationship.

In some instances, the domain name gateway will also receive an update request. The update request is to update the binding relationship. Since the host IP address bound by the client is changed, the binding relationship may need to be updated synchronously, so in some embodiments If an update request is received, it is necessary to delete the old first binding relationship and establish the second binding relationship. The update request may carry the need to delete the first binding relationship, and also carry a new host IP address. In other embodiments, the update request may only carry the old host IP address in the first binding relationship that needs to be deleted, and the updated new host IP address; in short, the domain name gateway may The update request updates the first binding relationship and establishes a new second binding relationship corresponding to the client.

As shown in FIG. 4, this embodiment provides a DNS server security defense method, including:

Step S210: Receive a configuration request from the client;

Step S220: Assign a host IP address to the client based on the configuration request;

Step S230: an mDNS IP address request sent to the domain name gateway based on the host IP address;

Step S240: Receive the mDNS IP address returned by the domain name gateway based on the mDNS IP address request;

Step S250: Send a configuration response carrying the host IP address and the mDNS IP address to the client.

The method provided in this embodiment can be applied to an access gateway. The access gateway may be a user equipment (User Equipment, referred to as UE), an Internet of Things terminal, an in-vehicle device, or an intelligent electrical appliance. The access equipment may include: base stations, wireless access hotspots (hotspot) and other equipment.

In this implementation, the configuration request of the client is received, for example, the configuration request may be: a configuration request based on Dynamic Host Configuration Protocol (Dynamic Host Configuration, referred to as DHCP), and the access gateway may send the configuration request to DHCP The server configures the host IP address by the DHCP server, so that the access gateway can implement dynamic allocation of the client's host IP address. In other implementations, the access configuration service function of the client may be directly set in the access gateway. In this way, the access gateway allocates the host IP address to the client by itself. In short, in this embodiment, dynamically assigning the host IP address to the client includes at least two ways, one is to dynamically assign the host IP address to the client through information interaction with the configuration server, and the other is to access the gateway The host IP address is dynamically allocated by itself. In an optional implementation process, the configuration request may be to configure various configuration parameters for the host, the configuration parameters including: the host IP address, the lease period of the host IP address, and the DNS IP address of the DNS server.

In some embodiments, the method further includes:

Set the lease period of the host IP address;

Sending lease period information indicating the lease period to the domain name gateway, wherein the lease period information is used by the domain name gateway to set the validity period of the mDNS IP address allocated to the client.

In this embodiment, the access gateway or the access configuration function entity independent of the access gateway sets the lease period of the host IP address for the client. The optional setting method may include at least one of the following:

Set the lease period of the host IP address according to the lease period instruction of the client;

According to the connection establishment type requested by the client, set the lease period of the host IP address, for example, the current client access is to establish a temporary session and a regular session other than the temporary session, and determine the lease period of the IP address, The first lease period corresponding to the relative temporary session may be slightly shorter than the second lease period of the regular session;

Set the lease period of the IP address of the host according to the contract data of the user identification used by the client;

The access gateway or the access configuration function entity independent of the access gateway sets the lease of the host IP address according to the local policy related to setting the lease period or the policy received from the policy control function (Policy Control Function, PCF for short) period.

In some embodiments, in order to facilitate the equivalent management or similar management of the use period of the host IP address and the use period of the mDNS IP address, the lease period of the host IP address and the validity period of the mDNS IP address are the same or approximately equivalent, but in another In some management systems in which different IP addresses are managed separately, the lease period of the host IP address and the validity period of the mDNS IP address may not be equal or approximately the same. In short, the previous periods of the two are not related, and special circumstances are not excluded. Under the equivalent.

In this embodiment, in order to realize the unified and cooperative management of the lease period of the host IP address and the validity period of the mDNS IP address, the lease period information is sent to the domain name gateway, and the lease period information indicates the lease period of the host IP address. To facilitate the domain name gateway to set the validity period of the mDNS IP address dynamically assigned to the client. In some embodiments, the domain name gateway will set the validity period of the mDNS IP address based on the lease period information to be slightly longer than the lease period of the host IP address.

In some embodiments, the method further includes:

Receiving a lease renewal request from the client;

Extend the lease period of the host IP address according to the lease renewal request;

Sending a lease renewal request to the domain name gateway, wherein the lease renewal request is used by the domain name gateway to extend the validity period of the mDNS IP address allocated to the client.

For example, for example, the client will automatically request the lease renewal of the host IP address before the lease of the host IP address expires or based on user instructions. In this way, the access configuration function entity embedded in the access gateway may be independent of the connection. The access configuration function entity entering the gateway will receive the client's lease renewal request, and then request to extend the lease of the host IP address according to the demand.

In some embodiments, the method further includes: when a preset condition is met, sending a release request to the domain name gateway, wherein the release request is used to delete the host IP address of the client and assign it to the The binding relationship between the client's mDNS and IP addresses.

In this embodiment, the access configuration function entity (which may be referred to as the access configuration function for short) will send a release request to the domain name gateway when the preset conditions are met. The sending of the release request will trigger the domain name gateway to release the corresponding binding In this way, it is equivalent to releasing the mDNS IP address assigned to the client in the domain name gateway.

In some embodiments, the meeting of the preset condition includes one of the following:

Receive the de-attach request that the client actively sends offline; the client will send the de-attach request when offline, for example, the UE will automatically send the de-attach request before shutting down, then the UE may use the original area at this time. During the offline process, the host IP address and / or mDNS IP address assigned to the UE still remain assigned to the UE, which will cause the problem of inefficient use of the IP address. Therefore, in this embodiment, if the base station on the network side , A network element such as a gateway detects a de-attach request actively sent offline by the client, and may be considered to satisfy one of the preset conditions;

The validity period of the location update of the client is detected to be overdue; the UE and other clients may have mobility. The UE involves various location update operations such as cell switching and tracking area update during the movement process. If the location is not updated for a long time, the UE may be currently It has been inactive for a long time, so it can be considered that the validity period of the location update is overdue at this time, and it can be considered that the corresponding binding relationship can be released, thereby releasing the host IP address and / or mDNS IP address;

Detecting that the lease period of the client's host IP address is overdue; detecting that the lease period of the client's host IP address is overdue, indicating that the lease period of the host's IP address has expired, if the lease needs to be renewed, the client may need to pay fees or reapply In order to avoid illegal use of IP addresses, etc., it can be considered that the above-mentioned preset conditions are satisfied.

It is detected that the client is offline. For example, in some embodiments, if a radio access network (Radio Access Network, RAN for short) such as a base station detects that the client is offline, it is considered that the client and host IP address and / or mDNS IP address are currently maintained It is not necessary, otherwise it will result in waste of IP address and / or mDNS IP address resources.

In some embodiments, the method further includes:

Receiving a lease renewal request from the client;

Assigning a new host IP address to the client according to the lease renewal request, and setting the lease period of the new host IP address according to the lease renewal request;

Sending the update request to the domain name gateway, wherein the update request is used by the domain name gateway to delete the old first binding relationship of the client and establish a second binding based on the new host IP address relationship.

In this embodiment, the access gateway will also receive the client's lease renewal request. The lease renewal request may be sent by the client or by the client's management device. In short, it can be received as Client request for renewal of host IP address and / or mDNS IP address.

Assign a new host IP address to the client according to the lease renewal request and set the lease period of the newly assigned host IP address. At the same time, an update request sent to the domain name gateway triggers the domain name gateway to delete the original old binding relationship , And establish a new binding relationship based on the new host IP address. At this time, the access gateway, domain name gateway, and client need to synchronize to store the new binding relationship.

In some embodiments, the method further includes:

Deploy one or more domain name gateways for the client according to the configuration request;

Record the information of the domain name gateway.

In this embodiment, the access gateway deploys one or more domain name gateways for the client based on the configuration request, and records the information of these domain name gateways, for example, records the identifiers, IP addresses, or location information of these domain name gateways Various information, in some embodiments, needs to be recorded corresponding to the client's identification, for example, one or more of the client's various device parameters and / or client parameters and location parameters select a suitable domain name gateway, for example, select geographic The domain name gateway that is relatively close in distance or network distance serves as the domain name gateway for the client to obtain the domain name service.

In some embodiments, the deploying one or more domain name gateways for the client according to the configuration request includes:

Deploy one or more domain name gateways for the client according to at least one of the client's user ID, device ID, location information, and selection strategy.

For example, a domain name gateway that can provide a service quality that suits the user ID is selected according to the user ID (International Mobile Subscriber Identity Code, IMSI for short).

The device identification may include: an international mobile phone equipment identification code (International Mobile Equipment Identity, referred to as IMEI), which can learn the device capability parameters of the device based on the device identification of the device, so as to select its device identification (for example, device capability ) The matching domain name gateway.

For example, based on the location information of the client, the nearest domain name gateway is selected to serve it.

The selection strategy may be a local strategy stored in the access gateway, or a remote strategy stored in the PCF or the contract database. In short, it may be used for the domain name gateway of the access configuration function.

By selecting a domain name gateway for the client, you can ensure the quality of service provided by the domain name service.

On the other hand, it is preferable to provide the client with two or more domain name gateways, at least one primary gateway, and a backup gateway corresponding to the primary gateway.

In some embodiments, the method further includes:

According to the number of domain name gateways deployed for the client, determine the number of the mDNS IP addresses dynamically requested by the domain name gateway for the client.

In this embodiment, the number of mDNS IP addresses configured for a corresponding client by a single domain name gateway may be determined according to the number of domain name gateways. For example, when there is only one domain name gateway, the domain name gateway can configure at least two mDNS IP addresses for the client. If there are multiple domain name gateways, a single domain name gateway can configure one mDNS IP address for the client.

As shown in FIG. 5, this embodiment provides a DNS server security defense device, including:

The first allocation module 110 is configured to dynamically allocate a first mDNS IP address to the client according to the client's mobile domain name system mDNS network protocol IP address request initiated by the access configuration function;

The first receiving module 120 is configured to receive a first domain name service request initiated by the client, wherein the destination address of the first domain name service request is the mDNS IP address;

The first sending module 130 is configured to send a second domain name service request to the corresponding DNS server by replacing the mDNS IP address with the corresponding DNS server based on the first domain name service request;

The providing module 140 is configured to provide the DNS server with a second domain name service response based on the first domain name service response provided by the second domain name service request to the client.

The first distribution module 110, the establishment module, the receiving module, the query module, the first sending module 130, and the providing module 140 provided in this embodiment may all be program modules, which can be executed by the processor to realize the functions of the foregoing modules.

The device can be used in a domain name gateway.

In some embodiments, the security defense device of the DNS server may include:

The first allocation module 110 is configured to dynamically allocate a first mDNS IP address to the client according to a client mobile domain name system mDNS network protocol IP address request initiated by the access configuration function;

The establishment module is configured to establish a binding relationship between the first host IP address of the client and the first mDNS IP address;

A receiving module, configured to receive a first domain name service request initiated by the client; wherein

The query module is configured to query the binding relationship according to the second mDNS IP address and the second host IP address of the DNS server corresponding to the client carried in the first domain name service request,

The first sending module 130 is configured to send the second domain name to the DNS server corresponding to the second mDNS IP address if the second mDNS IP address and the second host IP address are included in the binding relationship Request for service;

In some embodiments, the first sending module 130 is configured to replace the second mDNS IP address in the first domain name service request with the DNS server's DNS IP address to form the second Domain name service request; sending the second domain name service request to the DNS server.

In some embodiments, the first sending module 130 is configured to replace the first host IP address in the first domain name service request with a gateway IP address of a domain name gateway to form the gateway IP The address and the second domain name service request of the DNS IP address.

In some embodiments, the providing module 140 is configured to replace the DNS IP address of the DNS server in the first domain name service response with the first mDNS IP address assigned to the client.

In some embodiments, the first allocation module 110 is configured to dynamically select the first mDNS IP address from the mDNS IP address pool according to the client mDNS IP address request initiated by the access configuration function.

In some embodiments, the first distribution module 110 is configured to perform one of the following:

Randomly select the mDNS IP address from the mDNS IP address pool according to the mDNS IP address request of the client;

Randomly select the currently idle mDNS IP address from the mDNS IP address pool according to the client's mDNS IP address request;

According to the mDNS IP address request of the client, if there is no idle mDNS IP address in the mDNS IP address pool, the mDNS IP address is randomly selected from the used mDNS IP address pool.

In some embodiments, the first allocation module 110 is configured to select a plurality of mDNS IP addresses from an mDNS IP address pool according to the mDNS IP address request of the client.

In some embodiments, the first allocation module 110 is configured to select N of the mDNS IP addresses from the mDNS IP address pool according to the number N of addresses carried in the mDNS IP address request.

In some embodiments, the device further includes:

A second allocation module configured to allocate a corresponding DNS server of the domain name service system to the client;

The establishing module is configured to establish a binding relationship between the first host IP address, the first mDNS IP address, and the DNS IP address of the DNS server.

In some embodiments, the first sending module 130 is configured if the second mDNS IP address and the second host IP address are included in the binding relationship and the second host IP address and The second mDNS IP address has a bound DNS IP address, and sends the second domain name service request to the bound DNS DNS IP address.

In some embodiments, the first sending module 130 is configured if the second mDNS IP address and the second host IP address are included in the binding relationship and the second host IP address and The second mDNS IP address is not bound to the DNS IP address, and the second domain name service request is sent to the default DNS server.

In some embodiments, the device further includes at least one of the following:

The DNS service restricted providing module 140 is configured to provide a restricted DNS service to the client if the second mDNS IP address and the second host IP address are not in the binding relationship;

A guiding module, configured to guide the domain name service request to a predetermined system if the second mDNS IP address and the second host IP address are not in the binding relationship, wherein the predetermined system is used to Resolve attacks on domain name service requests;

The rejection module is configured to refuse to provide DNS services to the client if the second mDNS IP address and the second host IP address are not in the binding relationship.

The device also includes:

The setting module is configured to set the validity period of the first mDNS IP address in the binding relationship according to the address lease period information.

In some embodiments, the device further includes:

The first receiving module 120 is configured to receive the lease renewal request;

The first extension module is configured to extend the validity period of the first mDNS IP address according to the lease renewal request.

In some embodiments, the device further includes:

The first deletion module is configured to delete the binding relationship if the validity period expires.

In some embodiments, the device further includes:

The second receiving module is set to receive the release request;

The second deletion module is configured to delete the binding relationship between the first host IP address and the first mDNS IP address according to the release request, and release the first mDNS IP address.

In some embodiments, the device further includes:

The third receiving module is set to receive the update request;

The third deletion module is configured to delete the first binding relationship and establish the second binding relationship according to the update request; wherein, the first binding relationship is: the old first corresponding to the client before the update A binding relationship between a host IP address and the first mDNS IP address; the second binding relationship is: after the update, a new first host IP address corresponding to the client and the first mDNS IP address A binding relationship; wherein, the second binding relationship is different from the first binding relationship in that at least the first host IP address is different.

As shown in FIG. 6, this embodiment provides a DNS server security defense device, including:

The fourth receiving module 210 is configured to receive the configuration request of the client;

The third allocation module 220 is configured to allocate a host network protocol IP address to the client based on the configuration request;

The second sending module 230 is configured to send a mobile domain name system mDNS IP address request to the domain name gateway based on the host IP address;

The fifth receiving module 240 is configured to receive the mDNS IP address returned by the domain name gateway based on the mDNS IP address request;

The third sending module 250 is configured to send a configuration response carrying the host IP address and the mDNS IP address to the client.

The fourth receiving module 210, the second sending module 230, the fifth receiving module 240, and the third sending module 250 can all be program modules, which can be implemented by the processor to implement one or more of the aforementioned applications in access service functions Features.

In some embodiments, the device further includes:

The second setting module is set to set the lease period of the host IP address;

The sixth sending module is configured to send lease period information indicating the lease period to the domain name gateway, wherein the lease period information is used by the domain name gateway to set the mDNS assigned to the client The validity period of the address.

In some embodiments, the device further includes:

A sixth receiving module, configured to receive the lease renewal request of the client;

The second delay module is configured to extend the lease period of the host IP address according to the lease renewal request;

A seventh sending module is configured to send a lease renewal request to the domain name gateway, wherein the lease renewal request is used by the domain name gateway to extend the validity period of the mDNS IP address allocated to the client.

In some embodiments, the device further includes:

The eighth sending module is configured to send a release request to the domain name gateway when the preset conditions are met, wherein the release request is used to release the host IP address of the client and the mDNS IP address assigned to the client The binding relationship between.

Receiving a detach request actively sent offline by the client;

Detecting that the validity period of the location update of the client is overdue;

Detecting that the lease term of the client's host IP address has expired;

It is detected that the client is offline.

In some embodiments, the device further includes:

The seventh receiving module is configured to receive the lease renewal request of the client;

The third allocation module 220 is configured to allocate a new host IP address to the client according to the lease renewal request; and set the lease period of the new host IP address according to the lease renewal request;

The ninth sending module is configured to send an update request to the domain name gateway, wherein the update request is used by the domain name gateway to delete the old first binding relationship of the client and establish based on the new host The new host IP address establishes a second binding relationship.

In some embodiments, the device further includes:

A deployment module, configured to deploy one or more domain name gateways for the client according to the configuration request;

The recording module is configured to record the information of the domain name gateway.

In some embodiments, the deployment module is configured to deploy one or more domain name gateways for the client according to at least one of the client's user ID, device ID, location information, and selection strategy.

In some embodiments, the deployment module is configured to determine, according to the number of domain name gateways deployed for the client, the mDNS IP address dynamically requested by the domain name gateway for the client number.

The following provides several optional examples in combination with any of the above embodiments:

Example 1:

FIG. 7 is a flowchart of the mDNS IP address allocation process according to this example. Taking the external access configuration function as an example, a typical external access configuration function is a Dynamic Host Configuration Protocol (Dynamic Host Configuration, DHCP for short) server, as shown in FIG. 7 As shown, the process includes the following steps:

Step 301: The client accesses the access gateway, sends a DHCP request to the DHCP server through the access gateway, and requests the network to allocate parameters such as the host IP address and DNS IP address;

Step 302: The DHCP server allocates the host IP address to the client, sets the IP address lease, and selects the domain name gateway at the same time, and records the domain name gateway information serving the client;

One or more domain name gateways can be deployed in a network. The DHCP server selects one or more domain name gateways (usually two) based on the client's user ID, device ID, location information, and local policies. The purpose of the domain name gateway is to enhance the reliability of the service, using one of the domain name gateways as the main entrance and the other as the backup entrance.

You can indicate the number of mDNS IP addresses you want to request in the request. If you choose a domain name gateway, you can ask the domain name gateway to assign multiple mDNS IP addresses (may be 2). If you choose multiple domain name gateways, it is recommended to give each domain name gateway One mDNS IP address is required.

Step 303, the DHCP server sends an mDNS IP address request to the selected domain name gateway, which carries the host IP address, the lease period of the host IP address, and may carry user identification and other information;

If multiple domain name gateways are selected, step 303 needs to be repeated to send mDNS IP address requests to other domain name gateways.

Step 304, the domain name gateway selects the mDNS IP address from the local mDNS IP address pool, and establishes a binding relationship between (host IP address, mDNS IP address), and sets the validity period of the binding relationship according to the lease period of the IP address, Generally, the validity period is slightly longer than the lease period of the IP address.

The domain name gateway can allocate mDNS IP addresses according to the number of mDNS IP addresses indicated in the request, and one is assigned by default.

The mDNS IP address is randomly selected from the mDNS IP address pool, or preferentially to randomly select unused mDNS IP addresses. After all mDNS IP addresses have been occupied, then randomly select from the occupied mDNS.

In the above allocation process, one mDNS IP address is allowed to be assigned to multiple clients at the same time, but due to the corresponding different (host IP address, mDNS IP address) binding relationship, it will not affect the business, and can increase the mDNS IP address. Utilization, that is, mDNS IP addresses can be reused, can reduce the number of mDNS IP addresses in scenarios where the number of IP addresses is limited.

In the above process, you can choose the DNS server that serves the client, and add the DNS server IP address information to the binding relationship. If you do not select the DNS server, the default DNS server is used.

Step 305, the domain name gateway returns the selected mDNS IP address to the DHCP server;

Step 306, the DHCP server sends a DHCP response to the client through the access gateway, which carries parameters such as the host IP address, the lease period of the host IP address, and mDNS IP address, among which the mDNS IP address is sent to the client as the DNS IP address field parameter;

If multiple domain name gateways are selected in step 303, the DHCP server needs to wait for all domain name gateways to return the mDNS IP addresses, aggregate the mDNS IP addresses from different domain name gateways, and send them to the client as the primary and secondary DNS IP addresses. If the domain name gateway does not return or the allocation fails to be returned, select another domain name gateway to continue the request, or only send the mDNS IP address that returned success to the client.

After receiving the parameters, the client uses the domain name gateway corresponding to the mDNS IP address as the DNS server, and subsequently requests the domain name service from the domain name gateway.

Since the mDNS IP address is dynamically selected by the domain name gateway from the mDNS IP address pool, the DNS server IP address obtained by each client is not the same, and the DNS address obtained by the same client at different times is also different.

Step 307: When the client needs to access the service, it sends a domain name service request (corresponding to the first domain name service request) to the domain name gateway according to the mDNS IP address, where the domain name corresponding to the service is carried in the request message In the header domain of the IP address, the source IP address is the host IP address, and the destination IP address is the mDNS IP address; if the user wants to access the example.com service, a domain name service request (corresponding to the first domain name service request) is sent to the domain name gateway to Obtain the IP address corresponding to the example.com website.

Step 308, after receiving the domain name service request, the domain name gateway queries the local storage host IP address and the mDNS IP address binding relationship according to the host IP address and mDNS IP address carried in the request message, and if it hits, the request is considered legal, Then send the domain name service request to the DNS server, otherwise it is considered an illegal request, reject the domain name service request, or use the restricted DNS function, such as only allowing the resolution of the domain name corresponding to the business service with a lower security level, or direct the domain name service request to the honey Tank system to induce clients to visit and locate possible threats;

In the IP address header field part of the request message sent to the DNS server, the destination IP address is the DNS server IP address, that is, the destination IP address in step 307 is replaced by the mDNS IP address with the DNS server IP address, that is, the DNS IP address, regarding the source IP There are two ways to deal with addresses:

Method 1: The source IP address remains the same, which is still the client's host IP address. In this case, the domain name gateway acts as a DNS proxy function. This method requires that the domain name gateway must be on the path of the message, and the service request sent by the client and the DNS server service response pass through the same domain name gateway.

Method 2: The source IP address uses the interface IP address of the domain name gateway. At this time, the domain name gateway acts as a DNS cache function, and uses its own IP address to send the domain name service request to the DNS server. When the DNS service result is received, the mDNS IP address is used as the source The IP address sends a response message to the client and can cache the resolution result. When other clients access the same service server, the cached solution is sent to the client to improve the resolution efficiency.

The DNS server uses the default DNS server IP address configured by the domain name gateway, or the DNS server IP address stored in the binding relationship according to (host IP address, mDNS IP address).

Through the above process, it is ensured that the mDNS IP address can only be accessed by designated clients, and non-designated clients cannot be accessed.

Step 309, the DNS server performs the domain name service process and returns a DNS service response to the domain name gateway, which carries the domain name resolution result, that is, the IP address of the service server;

Step 310: The domain name gateway returns a service response to the client, which carries the IP address of the service server.

The client obtains the IP address corresponding to the business server, and will use the IP address to access the business server.

Through the above process, you can see that the client cannot directly access the DNS server, only through the domain name gateway, and the mDNS IP address obtained by each client is not the same, and the same client obtains the mDNS IP address at different times. Not the same, so the purpose of dynamically changing the IP address of the DNS server is reached, so that the DNS server can be protected.

Example 2

Figure 8 is a flowchart of the mDNS IP address redistribution process according to this example. Still taking the external DHCP server scenario as an example, when the client obtains the host IP address and the lease term is about to expire, the client sends a lease renewal to the access configuration function Apply to maintain the validity of the host network parameters, as shown in Figure 8, the process includes the following steps:

Step 401, the lease term of the host IP address is about to expire, and the client sends a DHCP lease renewal request to the DHCP server through the access gateway, which carries the host IP address being used;

Step 402, the DHCP server agrees to the client's lease renewal request, extends the lease period of the host's IP address, and queries the domain name gateway currently serving the client;

Step 403, the DHCP server sends an mDNS IP address refresh request to the queried domain name gateway to notify the domain name gateway to extend the validity period of the mDNS IP address, and the message carries the host IP address, mDNS IP address, and host IP address lease term;

Step 404, the domain name gateway extends the validity period of the mDNS IP address according to the lease period of the host IP address, and the validity period of the binding relationship (host IP address, mDNS IP address), for example, updating the validity period of the mDNS IP address and the binding relationship;

Step 405, the domain name gateway returns a refresh response;

In step 406, the DHCP server returns a DHCP response to the client for renewal confirmation.

When the domain name service is required, the client continues to allocate the host IP address to initiate a domain name service request to the domain name gateway specified by the mDNS IP address, as shown in steps 407 to 410, similar to steps 307 to 310 in FIG.

Through the above process, the domain name gateway can continue to provide domain name services to clients.

Example 4:

Figure 9 is a flow chart of the mDNS IP address redistribution process according to this example, still taking the external DHCP server scenario as an example, when the client obtains the host IP address and the lease term is about to expire, the client sends a lease renewal to the access configuration function Application, using this process, you can also reconfigure the host parameters for the terminal. As shown in Figure 9, the process includes the following steps:

Step 501, the lease of the host IP address expires soon, and the client sends a DHCP lease renewal request to the DHCP server through the access gateway, which carries the host IP address being used by the client;

Step 502, the DHCP server extends the IP address lease, or reassigns the host IP address to the client, sets the IP address lease, and selects the domain name gateway for the client again;

Step 503, the DHCP server requests the newly selected domain name gateway to allocate an mDNS IP address, and establish a new (host IP address, mDNS IP address) binding relationship, the process is the same as steps 303 to 305 in FIG. 3;

Step 504, the DHCP service sends an mDNS IP address release request to the original domain name gateway, the original domain name gateway releases the corresponding mDNS IP address, deletes the binding relationship between (host IP address, mDNS IP address), and then returns the mDNS IP address release response , The DHCP server deletes the domain name gateway record of the client service;

Step 505: The DHCP server sends a DHCP response to the client through the access gateway, which carries the newly allocated mDNS IP address.

When the domain name service needs to be used, the client initiates a domain name service request to the new domain name gateway specified by the newly allocated mDNS IP address, as shown in steps 506 to 509.

Through the above process, the mDNS IP address can be updated when the user is online, thereby enhancing the dynamics of the domain name service entry and strengthening the protection of the DNS server.

Example 5:

Figure 10 is a flow chart of the normal release process of the mDNS IP address according to this example. Still taking the external DHCP server scenario as an example, when the client shuts down the network, it will actively release the host IP address, and then release the corresponding mDNS IP address. As shown in Figure 10, the process includes the following steps:

Step 601, the client sends a DHCP release request to the DHCP server through the access gateway, which carries the IP address of the host being used;

Step 602, the DHCP server queries the domain name gateway being used by the client;

Step 603, the DHCP server sends an mDNS IP address release request to the domain name gateway, which carries the host IP address and mDNS IP address information;

Step 604, the domain name gateway releases the client's occupation of the mDNS IP address, and deletes the (host IP address, mDNS IP address) binding relationship;

Step 605, the domain name gateway returns a release response to the DHCP server;

Step 606: The DHCP server returns a DHCP release response to the client through the access gateway.

Through the above process, the domain name gateway releases the mDNS IP address in time to maintain the correct domain name service entry strategy.

Example 6:

Figure 11 is a flowchart of the mDNS IP address timeout release process according to this example. Still taking the external DHCP server scenario as an example, when the client leaves the network but does not send a DHCP release request, it needs to support the timeout release mechanism. As shown in Figure 11, the process includes the following steps:

Step 701 (not shown in FIG. 11), when the client does not send a lease renewal request within the specified lease period, the lease period timer in DHCP will overflow;

Step 702, the DHCP server actively releases the host IP address;

Step 703, the DHCP server sends an mDNS IP address release request to the domain name gateway, which carries the host IP address and mDNS IP address information;

Step 704, the domain name gateway releases the client's occupation of the mDNS IP address, and deletes the (host IP address, mDNS IP address) binding relationship;

Step 705, the domain name gateway returns a release response to the DHCP server;

If due to network reasons, the domain name gateway does not receive a refresh request or release request from the DHCP within the validity period of the mDNS IP address, in order to maintain the correct use of the mDNS IP address, the domain name gateway supports the timeout release function, as shown in steps 706 to 707 Show.

Step 706, when the domain name gateway does not receive a refresh request within the specified mDNS IP address validity period, the mDNS IP address validity period timer in the domain name gateway will overflow (that is, the lease period expires);

In step 707, the domain name gateway releases the client's occupation of the mDNS IP address and deletes the (host IP address, mDNS IP address) binding relationship.

Through the above process, the domain name gateway maintains the correct binding relationship.

Example 7:

Figure 12 is a flowchart of the mDNS IP address allocation process based on the built-in access configuration function of this example. This scenario is common in mobile networks. The access gateways of mobile networks, such as GGSN and PGW, have built-in access configuration functions. During the access process, configuration parameters are provided directly to the client. As shown in FIG. 8, the main difference between this process and FIG. 7 is that the IP address allocation, domain name gateway selection, and mDNS IP address allocation are completed during the access process. These information are sent to the access signaling shown in step 806 to For the terminal, take the 4G network as an example. At this time, the access gateway is the PGW, and the access configuration function is built in the PGW. As shown in FIG. 12, the process includes the following steps:

Step 801, the client accesses the mobile network and sends an attachment request to the access gateway (PGW);

Step 802, the built-in access configuration function of the access gateway allocates the host IP address to the client from the local IP address pool, selects the domain name gateway, and records the domain name gateway information serving the client, the validity of the host IP address and The status of the client in the mobile network is directly related;

Steps 803 to 805, the access gateway requests the mDNS IP address from the selected domain name gateway, the process is the same as steps 303 to 305 in FIG. 3;

Step 806, the access gateway sends an attachment response to the client, which carries parameters such as the host's IP address, mDNS IP address, etc., where the mDNS IP address is sent to the client as the DNS IP address field parameter;

Steps 807 to 810, when the client needs to access the service, the steps are the same as steps 307 to 310 of FIG.

The client obtains the IP address corresponding to the business server, and will use the IP address to access the business server, which belongs to the prior art and will not be repeated here.

It can be seen from the above process that, corresponding to the scenario where the access gateway has a built-in access configuration function, the access parameter configuration process is completed during the access process, and the host configuration parameters are transmitted using access signaling.

The maintenance of the mDNS IP address is similar to the external access parameter configuration function scenario, and mainly includes the following operations:

Extend the validity period of the mDNS IP address: The client updates the location within the validity period of the online status. The access gateway extends the client's online status and notifies the domain name gateway to extend the validity period of the mDNS IP address. The process is the same as steps 402 to 405 in FIG. 8.

Re-allocate mDNS IP address: The client updates the location within the validity period of the online status. The access gateway updates the host IP address or extends the client's online status. At the same time, it selects a new domain name gateway, requests the mDNS IP address from the new domain name gateway, and notifies the original The domain name gateway releases the mDNS IP address, and the process is the same as steps 502 to 504 in FIG. 9.

The normal release of the mDNS IP address: the client takes the initiative to go offline and sends a de-attach request to the access gateway. The access gateway notifies the domain name gateway to release the mDNS IP address and delete user access data. The process is the same as steps 602 to 605 in FIG.

mDNS overdue release: when the location update validity period expires, the access gateway detects that the user is offline, and will notify the domain name gateway to release the mDNS IP address, and delete the user access data; or when the mDNS IP address validity period expires, the domain name gateway releases mDNS IP address. The process is the same as the process shown in FIG.

It can be seen from the above process that the scenario of the built-in access configuration function is similar to the scenario of the external access configuration function. With the maintenance of the user's online status, the maintenance of the DNS IP address is achieved.

Example 8:

This example proposes a defense system and method applied to the DNS server. By introducing a domain name gateway, the DNS server IP address is transformed, thereby implementing active defense against the DNS server, increasing the difficulty of attackers, and reducing the probability of successful attacks. Thereby improving the security of the entire network. On the path from the access gateway to the DNS server, add the Domain Name Gateway (DNG), including:

A. The domain name gateway is configured with a mobile DNS server IP address (Moving DNS Sever IP address, referred to as mDNS IP address) address pool

B. While the client obtains or updates the host configuration parameters, the access configuration function requests the mDNS IP address from the domain name gateway. The domain name gateway selects the mDNS IP address from the mDNS IP address pool, and then returns to the access configuration function. The access configuration function will The mDNS IP address is assigned to the client as a DNS IP address;

C. The client uses the allocated mDNS IP address to send the domain name service request to the domain name gateway, and the domain name gateway sends the domain name service request to the DNS server, and sends the result returned by the DNS server to the client;

D. The client accesses the business server according to the domain name resolution result

Optionally: one or more domain name gateways are configured in the A1 network, and each domain name gateway is configured with a different mDNS IP address pool, and the mDNS IP address pool is composed of one or more IP address segments;

B0 host parameter configuration process uses DHCP protocol or access signaling;

When B1 has multiple domain name gateways in the network, the access configuration function needs to select one or more domain name gateways;

The B2 domain name gateway randomly assigns one or more mDNS IP addresses as the primary DNS IP address, or the primary and secondary DNS IP addresses, and preferentially selects the unoccupied mDNS IP addresses;

B3 carries the IP address assigned to the host and the lease of the IP address in the mDNS IP address request;

The B4 domain name gateway selects the mDNS IP address, and establishes the binding relationship between the host IP address and the mDNS IP address;

The B5 domain name gateway sets the validity period of the binding relationship according to the IP address lease period. During the validity period, the domain name gateway receives the refresh request sent by the access configuration function, and then extends the validity period; during the validity period, the domain name gateway receives the host configuration function. When the request is released, or when the validity period is exceeded, the domain name gateway deletes the binding relationship;

The service result returned by the B6 domain name gateway to the client carries one or more mDNS IP addresses, and the multiple mDNS IP addresses come from one or more domain name gateways;

After receiving the domain name service request from the client, the C1 domain name gateway checks the request message according to the binding relationship between the host IP address and the mDNS IP address, and if it matches the binding relationship, sends the domain name service request to the DNS server, otherwise rejects Business requests, or use restricted DNS functions, or direct domain name business requests to the honeypot system;

C2 When the domain name gateway queries DNS, the target address of the query request is the default DNS server IP address, or the DNS server IP address selected when assigning the mDNS IP address;

The C3 domain name gateway acts as a DNS proxy to send business requests to the DNS server using the client's host IP address, or acts as a DNS buffer to send business requests to the DNS server using the domain name gateway's IP address;

This example provides a system applied to the defense of a DNS server, including a client, an access gateway, an access configuration function, a domain name gateway, a DNS server, and a business server.

Client: Establish a connection with the access gateway, receive the host IP address and mDNS IP address assigned by the access configuration function, and use the mDNS IP address as the DNS server IP address to initiate domain name service requests and access business applications.

Access gateway: In the process of client access, the client configuration parameters are obtained from the access configuration function and provided to the client, and the client access to the Internet function is realized, so that the client can access the DNS server and service server.

Domain name gateway: maintain mDNS IP address pool, select mDNS IP address from mDNS IP address pool for clients according to the request of host configuration function, and establish the binding relationship between client IP address and mDNS IP address, maintain mDNS IP The validity of the address and the binding relationship; when the client initiates a domain name request, check the validity of the request, if it is a normal request, send a business request to the DNS server, and return the result to the client, otherwise reject the domain name business request , Or direct the domain name request to the honeypot system.

In a network, there are one or more domain name gateways. The mDNS IP address pool configured for each domain name gateway is composed of one or more IP address segments. It is recommended to use multiple IP address segments, which can enhance the selected mDNS IP The dynamic nature of the address confuses attackers.

An embodiment of the present disclosure provides a communication device, including:

The transceiver can correspond to various communication interfaces, for example, a network interface (network card) and / or a transceiver antenna, etc .;

The memory, which may include a storage medium, can be used for storing various data;

A processor, respectively connected to the transceiver and the memory, is configured to control the information transmission and reception of the transceiver by executing computer-executable instructions stored on the memory, and implement DNS provided by any of the foregoing technical solutions The security defense method of the server is, for example, the method shown in any of FIG. 2 to FIG. 5 and FIG. 8 to FIG. 12.

The processor may include a central processing unit, a microprocessor, a digital signal processor, a programmable array, an application specific integrated circuit, and the like.

The processor may be connected to the memory and the memory through a communication bus such as an integrated circuit bus. The communication device may be a device where an access configuration function such as the aforementioned domain name gateway or access gateway is located.

If the communication device is the aforementioned domain name gateway, it can execute one or more technical solutions in the defense method applied to the DNS server in the domain name gateway.

If the communication device is the aforementioned access gateway or an access configuration functional entity independent of the access gateway, it can execute one or more technical solutions in the defense method of the DNS server in the access gateway, for example, FIG. The method shown in any one of 2 to 5, and 8 to 12.

An embodiment of the present disclosure provides a computer storage medium that stores computer-executable instructions; after the computer-executable instructions are executed, the security defense method of the DNS server provided by any one of the foregoing technical solutions can be implemented, for example Used in devices with access configuration functions such as domain name gateways and access gateways. The storage medium includes: a mobile storage device, a read-only memory (ROM, Read to Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and other media that can store program codes. The computer storage medium may be a non-transitory storage medium.

In the several embodiments provided in this application, it should be understood that the disclosed device and method may be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the unit is only a division of logical functions. In actual implementation, there may be another division manner, for example, multiple units or components may be combined, or Can be integrated into another system, or some features can be ignored, or not implemented. In addition, the coupling or direct coupling or communication connection between the displayed or discussed components may be through some interfaces, and the indirect coupling or communication connection of the device or unit may be electrical, mechanical, or other forms of.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units; Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, the functional units in the embodiments of the present disclosure may all be integrated into one processing module, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above integration The unit can be implemented in the form of hardware, or in the form of hardware plus software functional units.

Those of ordinary skill in the art may understand that all or part of the steps to implement the above method embodiments may be completed by program instructions related hardware. The foregoing program may be stored in a computer-readable storage medium, and when the program is executed, The steps of the above method embodiments are included.

The above are only optional embodiments of the present disclosure, but the protection scope of the present disclosure is not limited to this, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present disclosure All should be covered by the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure shall be subject to the protection scope of the claims.

Claims

A DNS server security defense method, including:

According to the client's mobile domain name system mDNS network protocol IP address request, dynamically assign the mDNS IP address for the client;

Receiving a first domain name service request initiated by the client, where the destination address of the first domain name service request is the mDNS IP address;

Send a second domain name service request to the corresponding DNS server by replacing the mDNS IP address with the corresponding DNS server based on the first domain name service request;

The DNS server provides a second domain name service response to the client based on the first domain name service response provided by the second domain name service request.
The method of claim 1, wherein the method further comprises:

The dynamically assigning the mDNS IP address to the client according to the client's mobile domain name system mDNS network protocol IP address request includes:

According to the client's mobile domain name system mDNS network protocol IP address request, dynamically assign the first mDNS IP address for the client;

The method also includes:

Establishing a binding relationship between the first host IP address of the client and the first mDNS IP address;

Query the binding relationship according to the second mDNS IP address and the second host IP address of the DNS server corresponding to the client carried in the first domain name service request,

Based on the first domain name service request, sending a second domain name service request to the corresponding DNS server by replacing the mDNS IP address with the corresponding DNS server includes:

If the second mDNS IP address and the second host IP address are included in the binding relationship, send a second domain name service request to the DNS server corresponding to the second mDNS IP address.
The method according to claim 1, wherein

If the domain name gateway is located on the routing path of the client and the DNS server, the source addresses of the second domain name service request and the first domain name service request are both the client's host IP address.
The method according to claim 1, wherein

If the second mDNS IP address and the second host IP address are included in the binding relationship, sending a second domain name service request to the DNS server corresponding to the second mDNS IP address includes:

Replacing the first host IP address in the first domain name service request with the gateway IP address of the domain name gateway to form the second domain name service request including both the gateway IP address and the DNS IP address.
The method according to any one of claims 1 to 4, wherein

The providing the second domain name service response to the client by the DNS server based on the first domain name service response provided by the second domain name service request includes:

Replacing the DNS IP address of the DNS server in the first domain name service response with the mDNS IP address assigned to the client.
The method according to any one of claims 1 to 4, wherein

The dynamically assigning the mDNS IP address to the client according to the client's mobile domain name system mDNS network protocol IP address request includes:

According to the mDNS IP address request of the client, the mDNS IP address is dynamically selected from the mDNS IP address pool.
The method of claim 6, wherein the dynamically assigning an mDNS IP address to the client according to the client's mobile domain name system mDNS network protocol IP address request includes one of the following:

Randomly select the mDNS IP address from the mDNS IP address pool according to the mDNS IP address request of the client;

Randomly select the currently idle mDNS IP address from the mDNS IP address pool according to the client's mDNS IP address request;

According to the mDNS IP address request of the client, if there is no idle mDNS IP address in the mDNS IP address pool, the mDNS IP address is randomly selected from the used mDNS IP address pool.
The method according to claim 6, wherein the dynamically assigning an mDNS IP address to the client according to the client's mobile domain name system mDNS network protocol IP address request includes:

According to the mDNS IP address request of the client, multiple mDNS IP addresses are selected from the mDNS IP address pool.
The method according to claim 8, wherein

According to the mDNS IP address request of the client, selecting multiple mDNS IP addresses from the mDNS IP address pool includes:

According to the number N of addresses carried in the mDNS IP address request, select the N mDNS IP addresses from the mDNS IP address pool.
The method according to any one of claims 2 to 4, wherein

The method also includes:

Assigning a DNS server corresponding to the domain name service system to the client;

The establishment of a binding relationship between the first host IP address of the client and the first mDNS IP address includes:

Establish a binding relationship between the first host IP address, the first mDNS IP address, and the DNS server's DNS IP address.
The method of claim 10, wherein

If the second mDNS IP address and the second host IP address are included in the binding relationship, sending a second domain name service request to the DNS server corresponding to the second mDNS IP address includes:

If the second mDNS IP address and the second host IP address are included in the binding relationship and the second host IP address and the second mDNS IP address have a bound DNS IP address, bind to The DNS domain name IP address of the second domain name service request.
The method of claim 10, wherein

If the second mDNS IP address and the second host IP address are included in the binding relationship, sending a second domain name service request to the DNS server corresponding to the second mDNS IP address includes:

If the second mDNS IP address and the second host IP address are included in the binding relationship and the second host IP address and the second mDNS IP address are not bound to a DNS IP address, the default The DNS server sends the second domain name service request.
The method according to any one of claims 2 to 4, wherein the method further comprises at least one of the following:

If the second mDNS IP address and the second host IP address are not in the binding relationship, provide a limited DNS service to the client;

If the second mDNS IP address and the second host IP address are not in the binding relationship, direct the domain name service request to a predetermined system, wherein the predetermined system is used to attack the domain name service request To parse;

If the second mDNS IP address and the second host IP address are not in the binding relationship, refuse to provide DNS services to the client.
The method according to any one of claims 2 to 4, wherein

The mDNS IP address request also carries address lease information;

The method also includes:

According to the address lease period information, the validity period of the first mDNS IP address in the binding relationship is set.
The method according to claim 14, wherein the method further comprises:

Receive renewal request;

According to the lease renewal request, the validity period of the first mDNS IP address is extended.
The method according to claim 14, wherein the method further comprises:

If the validity period expires, the binding relationship is deleted.
The method according to any one of claims 2 to 4, wherein the method further comprises:

Receive a release request;

According to the release request, delete the binding relationship between the first host IP address and the first mDNS IP address, and release the first mDNS IP address.
The method according to any one of claims 2 to 4, wherein the method further comprises:

Receive an update request;

Delete the first binding relationship and establish the second binding relationship according to the update request; wherein, the first binding relationship is: the old first host IP address corresponding to the client and the first A binding relationship of an mDNS IP address; the second binding relationship is: a binding relationship between the new first host IP address corresponding to the client and the first mDNS IP address after the update; wherein, the Compared with the first binding relationship, at least the first host IP address is different in the second binding relationship.
A DNS server security defense method, including:

Receive client configuration request;

Based on the configuration request, assigning a host network protocol IP address to the client;

A mobile domain name system mDNS IP address request sent to the domain name gateway based on the host IP address;

Receiving the mDNS IP address returned by the domain name gateway based on the mDNS IP address request;

Sending a configuration response carrying the host IP address and the mDNS IP address to the client.
The method of claim 19, wherein the method further comprises:

Set the lease period of the host IP address;

Sending lease period information indicating the lease period to the domain name gateway, wherein the lease period information is used by the domain name gateway to set the validity period of the mDNS IP address allocated to the client.
The method of claim 20, wherein the method further comprises:

Receiving a lease renewal request from the client;

Extend the lease period of the host IP address according to the lease renewal request;

Sending a lease renewal request to the domain name gateway, wherein the lease renewal request is used by the domain name gateway to extend the validity period of the mDNS IP address allocated to the client.
The method according to claim 19 or 20, wherein the method further comprises:

When a preset condition is met, a release request is sent to the domain name gateway, where the release request is used to release the binding relationship between the client's host IP address and the mDNS IP address assigned to the client.
The method of claim 22, wherein

Satisfying the preset condition includes one of the following:

Receiving a detach request actively sent offline by the client;

Detecting that the validity period of the location update of the client is overdue;

Detecting that the lease term of the client's host IP address has expired;

It is detected that the client is offline.
The method according to claim 19 or 20, wherein the method further comprises:

Receiving a lease renewal request from the client;

Assign a new host IP address to the client according to the lease renewal request, and set the lease period of the new host IP address according to the lease renewal request;

Sending an update request to the domain name gateway, wherein the update request is used by the domain name gateway to delete the old first binding relationship of the client and establish a second host IP address based on the new host to establish a second Binding relationship.
The method according to claim 19 or 20, wherein the method further comprises:

Deploy one or more domain name gateways for the client according to the configuration request;

Record the information of the domain name gateway.
The method according to claim 25, wherein the deploying one or more domain name gateways for the client according to the configuration request includes:

Deploy one or more domain name gateways for the client according to at least one of the client's user ID, device ID, location information, and selection strategy.
The method of claim 25, wherein the method further comprises:

According to the number of domain name gateways deployed for the client, determine the number of the mDNS IP addresses dynamically requested by the domain name gateway for the client.
A DNS server security defense device, including:

The first allocation module is configured to dynamically allocate the first mDNS IP address to the client according to the client's mobile domain name system mDNS network protocol IP address request;

A first receiving module, configured to receive a first domain name service request initiated by the client, wherein the destination address of the first domain name service request is the mDNS IP address;

The first sending module is configured to send a second domain name service request to the corresponding DNS server by replacing the mDNS IP address with the corresponding DNS server based on the first domain name service request;

The providing module is configured to provide the DNS server with a second domain name service response based on the first domain name service response provided by the second domain name service request to the client.
A DNS server security defense device, including:

The fourth receiving module is configured to receive the configuration request of the client;

A third allocation module, configured to allocate a host network protocol IP address to the client based on the configuration request;

The second sending module is configured to send a mobile domain name system mDNS IP address request to the domain name gateway based on the host IP address;

The fifth receiving module is configured to receive the mDNS IP address returned by the domain name gateway based on the mDNS IP address request;

The third sending module is configured to send a configuration response carrying the host IP address and the mDNS IP address to the client.
A communication device, including:

transceiver,

Memory,

A processor, connected to the transceiver and the memory, respectively, is configured to control information transmission and reception of the transceiver by executing computer-executable instructions stored on the memory, and implement claims 1 to 18 or 19 The method provided in any one of 27.
A computer storage medium storing computer executable instructions; after the computer executable instructions are executed, the method provided in any one of claims 1 to 18 or 19 to 27 can be implemented.