WO2023041039A1 - 基于dns解析的安全访问控制方法、系统、装置及设备 - Google Patents

基于dns解析的安全访问控制方法、系统、装置及设备 Download PDF

Info

Publication number
WO2023041039A1
WO2023041039A1 PCT/CN2022/119324 CN2022119324W WO2023041039A1 WO 2023041039 A1 WO2023041039 A1 WO 2023041039A1 CN 2022119324 W CN2022119324 W CN 2022119324W WO 2023041039 A1 WO2023041039 A1 WO 2023041039A1
Authority
WO
WIPO (PCT)
Prior art keywords
resolution
domain name
security
target
target terminal
Prior art date
Application number
PCT/CN2022/119324
Other languages
English (en)
French (fr)
Inventor
胡金涌
Original Assignee
上海云盾信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 上海云盾信息技术有限公司 filed Critical 上海云盾信息技术有限公司
Publication of WO2023041039A1 publication Critical patent/WO2023041039A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B19/00—Programme-control systems
    • G05B19/02—Programme-control systems electric
    • G05B19/04—Programme control other than numerical control, i.e. in sequence controllers or logic controllers
    • G05B19/042—Programme control other than numerical control, i.e. in sequence controllers or logic controllers using digital processors

Definitions

  • Embodiments of the present disclosure relate to but are not limited to a security access control method, system, device, computer-readable storage medium and electronic device based on DNS resolution.
  • the DNS system is the domain name resolution system, and the DNS service is a core service on the Internet. Any access needs to find the corresponding service IP through DNS resolution before obtaining the corresponding resources, so the DNS resolution result directly determines the host accessed by the user.
  • enterprises or individuals implement security access control by deploying various security devices such as DDoS, WAF, IDS, IPS and Internet behavior management.
  • various security devices such as DDoS, WAF, IDS, IPS and Internet behavior management.
  • the above-mentioned various safety devices need to be maintained, which is difficult and expensive to maintain. Therefore, how to reduce the maintenance difficulty and cost of security devices and ensure the security of Internet access has become an urgent technical problem to be solved.
  • the present disclosure provides a security access control method, system, device, computer-readable storage medium and electronic equipment based on DNS resolution.
  • a security access control method based on DNS resolution which is applied to security access service edge nodes, and the method includes:
  • a DNS resolution-based security access control method is provided, which is applied to a cloud security management platform, and the method includes:
  • a security access control method based on DNS resolution is provided, which is applied to a target terminal, and the method includes:
  • the traffic diversion strategy includes an address of a secure access service edge node assigned to the target terminal to provide domain name resolution services
  • the response information is generated by the secure access service edge node by performing resolution control on the domain name resolution request according to a security resolution policy, wherein the security resolution policy is consistent with the associated with the target user corresponding to the target terminal.
  • a DNS resolution-based security access control system comprising:
  • the cloud security management platform is configured to configure a traffic diversion strategy and a security resolution strategy for the domain name resolution request for the target user, and send the traffic diversion strategy to the security access service edge node and the target terminal corresponding to the target user respectively, and send the traffic strategy to the target terminal corresponding to the target user.
  • the secure access service edge node is configured to perform resolution control on the target domain name to be resolved in the domain name resolution request from the target terminal according to the security resolution policy.
  • a DNS resolution-based security access control device which is set at a security access service edge node, and the device includes:
  • the request analysis module is configured to determine the identification information of the target terminal and the target domain name to be resolved according to the domain name resolution request from the target terminal;
  • the policy determination module is configured to determine a security analysis policy associated with the target user corresponding to the target terminal according to the identification information of the target terminal;
  • the resolution control module is configured to perform resolution control on the target domain name according to the security resolution policy.
  • a security access control device based on DNS resolution which is set on a cloud security management platform, and is characterized in that it includes:
  • the strategy configuration module is configured to configure a traffic diversion strategy and a security resolution strategy for domain name resolution requests for target users;
  • the first sending module is configured to send the traffic diversion strategy to the security access service edge node and the target terminal corresponding to the target user, so that the target terminal sends a domain name resolution request to the security server according to the traffic diversion strategy.
  • Access service edge nodes
  • the second sending module is configured to send the security resolution policy to the security access service edge node, so that the security access service edge node performs the target domain name to be resolved in the domain name resolution request according to the security resolution policy Perform analysis control.
  • a security access control device based on DNS resolution which is set on a target terminal, including:
  • a strategy acquisition module configured to acquire a traffic diversion strategy for domain name resolution requests, the diversion strategy including the address of a secure access service edge node assigned to the target terminal to provide domain name resolution services;
  • the request sending module is configured to send the generated domain name resolution request to the secure access service edge node according to the drainage strategy
  • the response receiving module is configured to receive the response information sent by the security access service edge node, the response information is generated by the security access service edge node by performing resolution control on the domain name resolution request according to the security resolution policy, wherein the The security resolution policy is associated with the target user corresponding to the target terminal.
  • a computer-readable storage medium on which a computer program is stored.
  • the program is executed by a processor, one of the aforementioned first, second, or third aspects can be realized.
  • a security access control method based on DNS resolution.
  • an electronic device comprising:
  • the processor is configured to execute the instructions, so as to implement a security access control method based on DNS resolution as described in the aforementioned first aspect, second aspect or third aspect.
  • This disclosure configures traffic drainage policies and security resolution policies for target users through the cloud security management platform, and sends the traffic drainage policies to the edge node of the security access service and the target terminal corresponding to the target user, so that the target terminal can resolve the domain name according to the traffic drainage policy
  • the request is diverted to the edge node of the secure access service, and the security resolution policy is sent to the edge node of the security access service at the same time, so that the edge node of the security access service can control the resolution of the target domain name to be resolved in the domain name resolution request according to the security resolution policy, realizing a A new and efficient domain name access security management mode; this domain name access security management mode does not need to configure and manage many security devices, and improves network communication security at a lower cost.
  • the cloud security management platform is used as the management center to configure personalized drainage strategies and security analysis strategies for each target user.
  • the management center of the security cloud gateway for multiple users it has strong flexibility and The business expansion capability is suitable for domain name access in various scenarios, and can meet the security and convenience requirements for domain name access at the same time.
  • the target terminal directly sends the domain name resolution request to the secure access service edge node according to the traffic diversion strategy, and the secure access service edge node checks and filters according to the category of the target domain name to be resolved in the domain name resolution request, Then adopt different disposal methods to deal with it, realize the secure access control to the domain name, and the operation is simple and efficient.
  • each distributed node in the CDN network can provide the target user with DNS resolution service, that is, each distributed node can perform domain name resolution on the domain name resolution request sent by the target terminal, and can analyze the domain name The parsing request performs parsing control, so as to ensure the security of the Internet access of the target terminal.
  • the deployment of distributed edge nodes for secure access services allows target terminals to access edge nodes for secure access services nearby, significantly reducing the time delay for information to reach edge nodes for secure access services, making user experience more be greatly improved.
  • Fig. 1 is a schematic diagram showing the composition of a security access control system based on DNS resolution according to an exemplary embodiment
  • Fig. 2 is a schematic diagram of an interactive process in which the system shown in Fig. 1 implements a security access control method based on DNS resolution;
  • Fig. 3 shows the setting content of different handling methods taken according to different threat categories according to an exemplary embodiment
  • Fig. 4 shows the setting content of different handling methods taken according to different content categories according to an exemplary embodiment
  • Fig. 5 shows the setting content of the target user's traffic diversion strategy and security analysis strategy according to an exemplary embodiment
  • FIG. 6 is a schematic diagram of the composition of the secure access service edge node in the system shown in FIG. 1;
  • Fig. 7 is a schematic diagram of the process of determining the target user in the DNS resolution-based security access control method shown in Fig. 2;
  • Fig. 8 is a schematic composition diagram of an electronic device according to an exemplary embodiment.
  • a security access control system based on DNS resolution mainly includes a cloud security management platform 10, a security access service edge node 20 and a target terminal 30, wherein:
  • the cloud security management platform 10 is configured to configure a traffic diversion strategy and a security resolution strategy for domain name resolution requests for the target user, and send the traffic diversion strategy to the secure access service edge node 20 and the target terminal 30 corresponding to the target user respectively, and send The security resolution policy is sent to the security access service edge node 20;
  • the secure access service edge node 20 is configured to perform resolution control on the target domain name to be resolved in the domain name resolution request from the target terminal 30 according to the security resolution policy provided by the cloud security management platform 10 .
  • the target terminal 30 is configured to send the domain name resolution request to the secure access service edge node 20 according to the diversion policy.
  • the target terminal 30 may be an office device such as a desktop computer in a branch office, or it may be a BYOD (Bring Your Own Device) device, that is, an enterprise employee carries his own device for office work, such as a personal computer, a mobile phone, a tablet, etc. It is not limited by time, place, equipment, personnel, and network environment. By installing enterprise application software on personal devices, employees can use relevant enterprise resources.
  • the target terminal 30 may also be a personal mobile terminal, such as a smart phone, which is not specifically limited in the present disclosure.
  • FIG. 2 is a schematic diagram of an interactive process in which the above system implements a secure access control method based on DNS resolution. As shown in Figure 2, the interaction process is completed jointly by the cloud security management platform 10, the secure access service edge node 20 and the target terminal 30. The method mainly includes the following steps:
  • the cloud security management platform 10 configures a traffic diversion strategy and a security resolution strategy for domain name resolution requests for the target user;
  • the cloud security management platform 10 sends the traffic diversion strategy to the secure access service edge node 20 and the target terminal 30 corresponding to the target user;
  • the cloud security management platform 10 sends the security resolution policy to the security access service edge node 20;
  • the target terminal 30 receives the traffic diversion strategy for domain name resolution requests provided by the cloud security management platform, wherein the traffic diversion strategy includes the address of the secure access service edge node 20 assigned to the target terminal 30 to provide domain name resolution services;
  • the target terminal 30 sends the generated domain name resolution request to the secure access service edge node 20 according to the traffic diversion policy;
  • the secure access service edge node 20 receives the domain name resolution request sent by the target terminal 30;
  • the secure access service edge node 20 determines the identification information of the target terminal 30 and the target domain name to be resolved according to the domain name resolution request;
  • the secure access service edge node 20 determines the target user corresponding to the target terminal 30 according to the identification information of the target terminal 30, and then determines the corresponding relationship between the target user and the security resolution policy provided by the cloud security management platform 10 in advance.
  • the secure access service edge node 20 performs resolution control on the target domain name according to the security resolution policy
  • the secure access service edge node 20 feeds back to the target terminal 30 response information generated by performing resolution control on the domain name resolution request;
  • the secure access service edge node 20 outputs a resolution log to the cloud security management platform 10, where the resolution log records the resolution result of the target domain name;
  • the cloud security management platform 10 receives the analysis log sent by the secure access service edge node 20, and analyzes and/or visualizes the analysis result in the analysis log.
  • the target user can be understood as the smallest unit that needs to implement a security resolution policy.
  • the target user may be, for example, an enterprise institution, a home network, or an individual user.
  • each target user corresponds to a user account, and the user account may be registered by the user itself, or allocated by the operator through the cloud security management platform 10 .
  • one target user may correspond to at least one target terminal, and "at least one" in this disclosure refers to one, two or any number of more than two, for example, an enterprise organization may have a A terminal device or multiple terminal devices, or a home network may have one terminal device or multiple terminal devices.
  • the cloud security management platform 10 may also respond to the access request sent by the target terminal 30, and verify the target terminal based on the access request, Only after the verification is passed, the target terminal is allowed to access, and the target terminal is queried for the traffic diversion strategy and security analysis strategy corresponding to the target user, and then the query traffic diversion strategy is issued to the security access service edge node 20 and the target user.
  • the target terminal 30 corresponding to the user sends the security resolution policy to the security access service edge node 20 .
  • the secure access service edge node 20 may be a distributed node in a distributed network that provides various services.
  • the distributed network may be a CDN (Content Delivery Network, content distribution network) network
  • the CDN network may include a plurality of distributed nodes (ie, edge nodes), in the embodiments of the present disclosure, each distributed node in the CDN network may provide DNS resolution services for target users, that is, each distributed node can The domain name resolution is performed on the domain name resolution request sent by the target terminal, and the resolution control of the domain name resolution request can be performed, so as to ensure the security of the Internet access of the target terminal.
  • distributed nodes can also provide other services, such as access control services, firewalls, DDoS, WAF, IDS, IPS, and online behavior management.
  • the distributed network may also be an SD-WAN network.
  • the distributed network can also be a server cluster composed of multiple servers according to the distributed architecture, and the distributed node is any server in the server cluster.
  • the distributed network can also be an edge cloud network, which can be based on the core of cloud computing technology and edge computing capabilities, and a cloud computing platform built on edge infrastructure to form an edge location
  • the edge cloud network may include multiple edge nodes (that is, distributed nodes), so as to provide services on the edge of the network closer to the terminal.
  • the embodiments of the present disclosure do not limit what kind of network the distributed network is, and a network with a distributed architecture composed of any number of computing devices is applicable to the present disclosure.
  • the access request sent by the user to the cloud security management platform 10 through the target terminal 30 may include the identity information of the target terminal, so that the cloud security management platform 10 can configure corresponding traffic flow through query according to the identity information of the target terminal Strategy.
  • the identity information of the target terminal may be identity information corresponding to the target terminal, and the corresponding target terminal can be determined based on the identity information.
  • the identity information of the target terminal may be information such as an IP address, a MAC address, or a device number of the target terminal.
  • the identity information of the target terminal may also be the identity information of the user using the target terminal, such as the user's contact number, ID number, social account number and other information, which is not specifically limited in the present disclosure.
  • the traffic diversion strategy may include domain name information (ie, service domain name) of a secure access service edge node assigned to the target user.
  • the subsequent secure access service edge node can determine the target user corresponding to the domain name according to the correspondence between the identity information of the target terminal and the service domain name of the secure access service edge node.
  • the cloud security management platform can assign a corresponding secure access service edge node to each target user, and generate a DNS resolution service domain name of the secure access service edge node for the target user, and the service domain name is the same as the target user.
  • One-to-one correspondence so that the target user can be determined according to the DNS resolution service domain name of the secure access service edge node accessed by the target user.
  • a secure access service edge node may have multiple service domain names for multiple target users, that is, it may have a different DNS resolution service domain name corresponding to each target user.
  • the service edge node can serve multiple target users, and can also provide multiple services for one target user, which improves the resource utilization rate of the secure access service edge node.
  • the access request sent by the target terminal 30 to the cloud security management platform 10 includes not only the identity information of the target terminal, but also the traffic diversion strategy for the domain name resolution request set by the target user , that is, it also includes the address of the secure access service edge node 20 designated by the target user to provide the domain name resolution service.
  • the traffic diversion strategy can be set by the target users themselves, or can be configured for the target users by the operator on the cloud security management platform 10 . The present disclosure does not specifically limit this.
  • target terminals belonging to the same target user may correspond to the same traffic diversion policy and security resolution policy, and in some cases, target terminals belonging to the same target user may also correspond to different traffic diversion policies or security resolution policies.
  • Analysis strategy for example, when an employee belonging to a certain branch is on a business trip, according to the location information of the target terminal used by the employee, it is determined that the edge node of the security access service that is closest to the target terminal or has the best network quality is different from that of the branch.
  • the secure access service edge node 20 that provides domain name resolution services in the traffic diversion strategy may preferably belong to the same area as the target terminal geographically and be far away from the target terminal.
  • the nearest secure access service edge node so as to reduce the time delay for information to reach the secure access service edge node, so that the user experience can be greatly improved.
  • the secure access service edge node 20 may also be a secure access service node with the best or better network quality with the target terminal, thereby reducing the network delay for information to reach the secure service edge node.
  • the ways in which the cloud security management platform 10 distributes traffic diversion policies and security resolution policies may include active distribution or passive distribution, as well as direct distribution or indirect distribution.
  • the cloud security management platform 10 can actively issue traffic drainage policies and security resolution policies to the secure access service edge node 20, and the cloud security management platform 10 can also passively issue traffic drainage in response to the access request sent by the target user through the target terminal 30 policy to the target terminal 30.
  • the cloud security management platform 10 may directly deliver the traffic drainage policy and the security resolution policy to the secure access service edge node 20, and the cloud security management platform 10 may also first deliver the traffic drainage policy and the security resolution policy to the configuration manager 40, and then Issued by the configuration manager 40 to the secure access service edge node 20 (that is, indirectly issued).
  • the present disclosure does not make special limitations on the way of issuing the traffic diversion policy and the security resolution policy.
  • the cloud security management platform 10 and the configuration manager 40 may be different servers independent of each other, and the cloud security management platform 10 may download information such as a configured traffic drainage strategy and a security resolution strategy to the configuration management server 40. sent by the configuration management server 40 to the corresponding secure access service edge node 20 and the target terminal.
  • the cloud security management platform 10 and the configuration manager 40 can also be the same server or in the same system, that is, users or administrators can configure the corresponding drainage strategy in the interface provided by the cloud security management platform 10 and the relevant configuration information of the security resolution policy, after the interface provided by the cloud security management platform 10 receives the relevant configuration information, it can send the relevant configuration information to the configuration manager 40 for storage, so that the relevant configuration information can be sent later To the corresponding security access service edge node 20 and the target terminal.
  • the target terminal 30 corresponding to the target user may be a network outlet of a branch office, or a terminal device of an individual user (hereinafter referred to as a user terminal device).
  • the user terminal device may include, but not limited to, one or more of electronic devices with network connection functions and data access functions, such as smart phones, tablet computers, laptop computers, desktop computers, smart wearable devices, or Internet of Things devices. Therefore, the identification information of the target terminal 30 can be the public network egress address of the branch office, or the virtual address of the client in the established drainage tunnel, that is, the target terminal can establish the target terminal and secure access based on the received traffic drainage strategy.
  • the drainage tunnel between service edge nodes for example, is based on the GRE protocol, IPsec protocol, etc., so as to ensure the accuracy and security of the drainage results.
  • the cloud security management platform 10 may also display a target user configuration interface in response to a configuration request for the target user, wherein the configuration interface includes multiple information configuration options; and then based on a plurality of the information
  • the editing information received by the configuration option determines the public network egress address, internal network address, traffic diversion strategy, and security analysis strategy corresponding to the target user.
  • the intranet address is used to establish the drainage tunnel. For example, for a branch office, based on the intranet address of the branch office and the address of the edge node of the security access service assigned to the branch office, a traffic drainage tunnel is established to realize traffic drainage.
  • each secure access service edge node 20 deployed in a distributed manner form a secure cloud.
  • each secure access service edge node 20 can be connected to at least one target terminal 30, and each secure access service edge node 20 pre-stores traffic diversion policies and security analysis configured for each target user obtained from the cloud security management platform 10 Strategy.
  • each secure access service edge node 20 is run with secure DNS software, and the secure DNS software supports multiple types of DNS resolution protocols, which may include but not limited to UDP, TCP, DoT (DNS over TLS ) and DoH (DNS over HTTPS), that is, the secure DNS software can only support one of the above-mentioned DNS resolution protocols, or can support two or more of the above-mentioned DNS resolution protocols Any number of more than one species, which is not specifically limited in the present disclosure. Therefore, the secure access service edge node can support the processing of domain name resolution requests from various types of target terminals. The benefits of greater accuracy or safety.
  • the domain name resolution request may be directly sent by the target terminal to the secure access service edge node, or may be indirectly sent by the target terminal through an intermediate server
  • the intermediate server can be a gateway server, Local DNS, etc.
  • the identification information of the target terminal 30 and the target domain name to be resolved are determined.
  • the identification information of a target terminal 30 may include at least one of a public network egress address of the target terminal 30 and a request mode of a domain name resolution request.
  • the secure access service edge node 20 can determine from which target terminal 30 the received domain name resolution request comes from, thereby determining the target user corresponding to the target terminal 30, and then determining Security resolution policy associated with this target user. Since the mapping relationship between the identification information of the target terminal 30 and the target user corresponding to the target terminal 30 is pre-stored on the secure access service edge node 20, when the secure access service edge node 20 receives a domain name resolution request of a target terminal 30 , the identification information of the target terminal 30 is obtained, and then the target user corresponding to the target terminal 30 is obtained in the mapping relationship.
  • the security resolution policy pre-saved on the secure access service edge node 20 is associated with the target user corresponding to the target terminal 30, so when the target user is determined, the security resolution of the target user corresponding to the target terminal 30 can be obtained Strategy.
  • the identification information of the target terminal may include both the public network egress address of the target terminal and the request mode of the domain name resolution request.
  • the secure access service edge node determines the target user corresponding to the target terminal according to the identification information of the target terminal, including at least the following three ways:
  • the request method for sending the resolution request is not DoT or DoH, and the public network egress address of the target terminal is an IPv4 address, determine the target user corresponding to the target terminal according to the public network egress address of the target terminal;
  • the request method for sending the resolution request is not DoT or DoH, and the public network egress address of the target terminal is not an IPv4 address, determine the address corresponding to the target terminal according to the IPv6 address of the security access service edge node allocated for the target terminal Target users.
  • the security resolution policy includes at least one of domain name classification resolution policy, security threat resolution policy and custom resolution policy. It should be noted that regardless of the domain name classification resolution strategy, security threat resolution strategy or custom resolution strategy, they can contain multiple rules, where each rule corresponds to a matching condition and a disposition action. When the matching condition is met, the security access The service edge node executes corresponding disposal actions.
  • the secure access service edge node performs resolution control on the target domain name according to the domain name classification resolution strategy, including:
  • the security access service edge node determines a handling method for the target domain name, where the handling method includes allowing the target domain name to be resolved.
  • the security access service edge node can analyze the target domain name and return the resolved target node IP.
  • the target node IP can be the IP of the security access service edge node, or It is the IP of other secure access service edge nodes; when the secure access service edge node does not provide cache services or does not store resources corresponding to the target domain name, the secure access service edge node can further query and access the original server corresponding to the target domain name IP address, the original server may be the source server corresponding to the target domain name or a server storing resources corresponding to the target domain name, etc.
  • the disposal method also includes prohibiting the resolution of the target domain name or observing the resolution of the target domain name. The observation of the resolution of the target domain name refers to allowing the resolution of the target domain name and recording the current resolution log.
  • the beneficial effect brought about by this is that before the DNS server responds to the analysis result, the type of the requested domain name is analyzed and judged, and different disposal methods are adopted according to different types to deal with it (that is, respond to different analysis results), and the domain name Safe access control, simple and efficient operation.
  • the security access service edge node When the security resolution policy includes a security threat resolution policy, the security access service edge node performs resolution control on the target domain name according to the security threat resolution policy, including:
  • the treatment method includes allowing the resolution of the target domain name, prohibiting the resolution of the target domain name, or observing the resolution of the target domain name.
  • the observation of the resolution of the target domain name refers to allowing the resolution of the target domain name and recording The current parsing log.
  • the beneficial effect brought about by this is that by judging whether the target domain name to be resolved belongs to threat categories such as viruses, C2, phishing emails, and mining, the disposal method for such domain names (for example, blocking access to such domain names) can be implemented, satisfying Security requirements for domain name access.
  • the secure access service edge node performs resolution control on the target domain name according to the custom resolution strategy, including:
  • the pre-stored custom domain name database determine whether the target domain name belongs to the custom domain name type in the custom domain name database
  • a treatment method for the target domain name is determined, and the treatment method includes allowing resolution of the target domain name, prohibiting resolution of the target domain name, or replacing the target domain name.
  • the traffic diversion policy and the security resolution policy are configured for the target user through the cloud security management platform, and the traffic diversion policy is sent to the security access service edge node and the target terminal corresponding to the target user respectively, so that the target terminal will
  • the domain name resolution request is diverted to the edge node of the secure access service, and at the same time, the security resolution policy is sent to the edge node of the secure access service, so that the edge node of the secure access service can control the resolution of the target domain name to be resolved in the domain name resolution request according to the security resolution policy, realizing A brand-new and efficient domain name access security management mode has been established; this domain name access security management mode does not need to configure and manage numerous security devices, and improves network communication security at a lower cost.
  • a multi-tenant cloud security access control system has a cloud security management platform, multiple distributed security access service edge nodes DNS, and multiple target terminals of different types.
  • the operator of the cloud security management platform or the security manager of the target user first establishes at least one of domain name classification database, security threat database and custom domain name database on the cloud security management platform.
  • the domain name classification database can be used to record the category to which each domain name belongs
  • the security threat database can be used to record the security threat type of the domain name
  • the custom domain name database can be used to record the custom information of the domain name.
  • operators can modify the data in these databases when necessary, for example, add, delete or modify domain names and domain name classifications in the domain name classification database, and update the data in the security threat database according to the latest threat intelligence wait.
  • the target user can be understood as an organization (such as an enterprise, group or individual) identified on the cloud security management platform, which is the smallest unit that needs to implement security resolution policies.
  • the target user may be, for example, an enterprise institution, a home network, or an individual user.
  • the security resolution strategy includes at least one of a domain name classification resolution strategy, a security threat resolution strategy and a custom resolution strategy.
  • security resolution policies can be set for home networks to help parents prevent minors from browsing the content of inappropriate websites (such as pornographic websites).
  • the security analysis policy can be set for enterprises to avoid the threat of phishing emails and ransomware, and the security analysis policy can be set for individual users’ mobile devices to avoid the threat of DNS hijacking.
  • a special security parsing policy can be set for an enterprise organization to prohibit access to specific URLs to obtain resources.
  • the following table shows the security resolution policy adopted in this embodiment.
  • FIG. 3 and Figure 4 show exemplary security resolution policies in this embodiment.
  • FIG. 3 shows different handling methods taken according to different threat categories
  • FIG. 4 shows different handling ways taken according to different content categories.
  • the handling methods include allow, prohibit, and observe (analysis is allowed but the current analysis log is recorded).
  • allow office applications, information applications, office365; prohibit: video applications, game applications, large bandwidth download applications, virus Trojan horse phishing domain names.
  • the security resolution strategy in this embodiment also includes a custom resolution strategy, for example, adopts a corresponding handling method for the classification of the custom domain name, and the handling method includes allowing, blocking, rewriting, and the like. For example, resolve www.example.com to cname.demo.com through domain name rewriting.
  • the operator of the cloud security management platform or the security manager of the target user will synchronize the established database and security analysis policy to the edge node of the security access service, so that the edge node of the security access service can
  • the security resolution policy performs resolution control.
  • operators or security managers of target users also need to set corresponding drainage policies for each target user.
  • the operator or the security manager of the target user also needs to assign the address of the edge node of the secure access service for providing domain name resolution service to each target user, so that the domain name resolution request initiated by the target user can be diverted to the corresponding secure access
  • the service edge node performs resolution control.
  • the cloud security management platform responds to the configuration request for the target user, and displays the target user configuration interface as shown in Figure 5, the configuration interface includes a plurality of information configuration options; and then based on a plurality of the information configuration
  • the option receives the editing information, and determines the public network egress address, internal network address, traffic diversion strategy, and security analysis strategy corresponding to the target user.
  • the intranet address is used to establish the drainage tunnel. For example, for a certain branch, based on the intranet address of the branch and the address of the secure access service edge node assigned to the branch, a traffic drainage tunnel is established to realize traffic diversion from the branch to the secure access service edge node. In other words, the branch office sends the newly generated domain name resolution request to the corresponding security access service edge node through the established drainage tunnel for resolution control.
  • the DNS server address corresponding to the branch office may also point to the address of the corresponding secure access service edge node, Then, according to the address of the secure access service edge node, the generated domain name resolution request is sent to the secure access service edge node.
  • the address assigned to an enterprise includes an IPv4 address (such as 134.43.34.1), an IPv6 address (such as 2a03:54c1:34::310c), or a domain name (such as kjfaueo.xiueorijl-gateway.com, through this domain name, It can be further resolved to the secure access service edge node that provides domain name resolution service).
  • IPv4 address such as 134.43.34.1
  • IPv6 address such as 2a03:54c1:34::310c
  • a domain name such as kjfaueo.xiueorijl-gateway.com
  • the operator or the security manager of the target user will synchronize the set diversion strategy to the edge node of the security access service and the target terminal used by the target user, so that the target user can pass the domain name sent by the target terminal
  • the resolution request can be diverted to the corresponding secure access service edge node for resolution control, that is, to realize the diversion of the domain name resolution request.
  • the cloud security management platform can also automatically match the traffic diversion strategy and security analysis strategy suitable for the target user through query according to the characteristics or identity of the target user. I won't go into details here.
  • the system of this embodiment includes a plurality of security access service edge nodes (hereinafter referred to as security edge nodes) deployed in a distributed manner.
  • security edge nodes each secure edge node runs secure DNS software to implement secure access control for DNS resolution.
  • the secure DNS software supports multiple types of DNS resolution protocols, such as UDP, TCP, DoT (DNS over TLS ), DoH (DNS over HTTPS), which can support domain name resolution requests from various types of target terminals.
  • the system of this embodiment further includes a configuration manager for configuring the security edge node.
  • the configuration manager sends the information issued by the cloud security management platform Information such as the database, security resolution policy, and traffic drainage policy are sent to each secure access service edge node, and the traffic drainage policy is delivered to the corresponding target terminal.
  • the configuration manager according to the target user configuration interface received from the cloud security management platform for the database and/or The update information of the security resolution policy is to update the database and/or the security resolution policy stored on each service edge node accordingly.
  • the database issued by the cloud security management platform includes at least one of the domain name classification database, security threat database, and custom domain name database, and the security analysis policy and traffic drainage policy information issued by the cloud security management platform often
  • the security resolution strategy includes at least one of domain name classification resolution strategies, security threat resolution strategies, and custom resolution strategies.
  • the above traffic diversion strategy includes the address of the security access service edge node that provides domain name resolution service allocated by the cloud security management platform to the target user.
  • each secure access service edge node may include a load balancer and at least one security server, wherein the load balancer is used to forward the domain name resolution request to one of the security servers.
  • Each security server runs a protocol processing module, a threat identification module, a domain name grouping module, a custom parsing module and a policy engine module, etc.
  • the policy engine module receives the configuration information from the configuration manager and provides the configuration information to other functional modules, wherein the configuration information includes the database issued by the cloud security management platform to the configuration manager, the security resolution policy and the traffic diversion Policy and other information, and other functional modules perform corresponding domain name resolution control processing on domain name resolution requests based on these configuration information.
  • Described protocol processing module supports several types of DNS resolution protocols, for example, UDP, TCP, DoT (DNS over TLS), DoH (DNS over HTTPS), and can perform various types of target terminals (such as user terminals) according to the DNS resolution protocol. or the network egress of the branch office) to resolve the domain name resolution request, so as to determine which target terminal (target user) sends the domain name resolution request and the target domain name to be resolved.
  • DNS resolution protocols for example, UDP, TCP, DoT (DNS over TLS), DoH (DNS over HTTPS)
  • target terminals such as user terminals
  • the protocol processing module of the security server when receiving a domain name resolution request sent by a user through a target terminal, the protocol processing module of the security server first analyzes the domain name resolution request to determine the target terminal sending the domain name resolution request The identification information of the target terminal and the target domain name to be resolved, wherein the identification information of the target terminal includes the public network egress address of the target terminal and/or the request mode of the domain name resolution request. Then, the protocol processing module of the security server determines the target user corresponding to the target terminal according to the identification information of the target terminal, and then determines the A security resolution policy associated with the target user corresponding to the target terminal.
  • the protocol processing module of the security server identifying information of the target terminal, and determining the target user corresponding to the target terminal, comprising the following steps:
  • the security server determines the target user according to the service domain name (such as HTTPS domain name) of the edge node of the security access service requested, otherwise enter 2 or 3;
  • the service domain name such as HTTPS domain name
  • the security server determines the target user according to the public network egress IP v4 address of the target terminal;
  • the security server determines the target user according to the IPv6 address of the security access service edge node assigned to the target user.
  • the threat identification module identifies the threat category of the target domain name to be parsed according to the pre-stored security threat database, that is, judges whether the target domain name to be parsed belongs to threat categories such as viruses, C2, phishing emails, and mining, and based on the target user's associated
  • the security threat resolution strategy in the security resolution strategy is used to implement the processing methods for such domain names; wherein, the processing methods include allowing the resolution of the target domain name, prohibiting the resolution of the target domain name, or observing the resolution of the target domain name, and the observation of the resolution of the target domain name means allowing Resolve the target domain name and record the parsing log.
  • the domain name classification module loads the domain name classification data (i.e. the data of the domain name classification database) issued by the cloud security management platform through the policy engine module, and identifies the content category (such as the entertainment category) of the target domain name to be requested by an efficient data search method. , information, games, etc.), and then based on the classification resolution strategy in the security resolution policy associated with the target user to implement the disposal method for this type of domain name; wherein, the disposal method includes allowing the resolution of the target domain name and prohibiting the resolution of the target domain name.
  • the domain name or the observed and resolved target domain name, the observation of the resolved target domain name means that the target domain name is allowed to be resolved and the current resolution log is recorded.
  • the self-defined analysis module determines whether the target domain name to be resolved belongs to the self-defined domain name category in the self-defined domain name database according to the pre-stored self-defined domain name database, and according to the judgment result, based on the security resolution policy associated with the target user Customize the resolution policy to implement the disposal method for this type of domain name; wherein, the disposal method includes allowing the resolution of the target domain name, prohibiting the resolution of the target domain name, or replacing the target domain name.
  • Replacing the target domain name can include the following two implementation methods:
  • the secure access service edge node returns a cname record to the target terminal, where the record value is a new domain name, and the target terminal initiates a domain name resolution request again according to the new domain name;
  • the security service edge node directly performs resolution according to the new domain name, and returns the resolution result of the new domain name to the target terminal, such as the IP address obtained according to the resolution of the new domain name.
  • the security server will feed back the response information generated by performing resolution control on the domain name resolution request to the target terminal. For example, when the handling method is prohibiting domain name resolution, the security server sends prompt information for prompting prohibition of resolution to the target terminal.
  • the secure access service edge node 20 can also output a parsing log to the cloud security management platform 10, the parsing log records the parsing result of the target domain name, and the format of the parsing log is configurable.
  • the DNS server outputs the resolution logs shown in the table below.
  • the request logs that hit the blocking mode will be recorded, and the other logs will not be recorded by default because the volume of other logs is relatively large, and the statistical output will be aggregated at a certain time interval (such as once every 5 minutes), which can be used for the allowed and observed modes request log.
  • Each log includes but not limited to the following fields:
  • request_id The unique identifier of the request, such as f5e50d9d8785d6db09d99475cc5426a4 node_id
  • the identifier of the edge node such as dx-zhejiang-jinhua-8
  • Request timestamp such as 2021-06-04 12:34:09 server_addr Edge node VIP remote_addr Client public network egress IP location_id Branch logo enterprise_id enterprise id rule_id
  • the id of the access control rule action Disposition actions (allow, prohibit, observe) request_time
  • the time spent processing the request qmethod DNS resolution methods such as tcp, udp, dot, doh qname
  • the domain name to be resolved qtype The requested record type, such as A, AAAA, TXT, MX, etc. domain_category Domain grouping type
  • the cloud security management platform 10 may analyze and/or visualize the analysis result in the analysis log.
  • the cloud security management platform can aggregate, count, and analyze these logs in various dimensions, and display visual analysis views of each dimension on the platform to facilitate intuitive acquisition of attacks and threats, and connect corresponding threat events to the SIEM platform.
  • the management platform provides but is not limited to the types of data analysis and visualization shown in Table 3 below:
  • This embodiment provides a security access control device based on DNS resolution, which is set on a security access service edge node.
  • the device has the function of executing the above method example, and the function may be realized by hardware, or may be realized by hardware executing corresponding software.
  • the device can include:
  • the request analysis module is configured to determine the identification information of the target terminal and the target domain name to be resolved according to the domain name resolution request from the target terminal;
  • the policy determination module is configured to determine a security analysis policy associated with the target user corresponding to the target terminal according to the identification information of the target terminal;
  • the resolution control module is configured to perform resolution control on the target domain name according to the security resolution policy.
  • This embodiment provides a security access control device based on DNS resolution, which is set on a target terminal, and is characterized in that it includes:
  • a strategy acquisition module configured to acquire a traffic diversion strategy for domain name resolution requests, the diversion strategy including the address of a secure access service edge node assigned to the target terminal to provide domain name resolution services;
  • the request sending module is configured to send the generated domain name resolution request to the secure access service edge node according to the drainage strategy
  • the response receiving module is configured to receive the response information sent by the security access service edge node, the response information is generated by the security access service edge node by performing resolution control on the domain name resolution request according to the security resolution policy, wherein the The security resolution policy is associated with the target user corresponding to the target terminal.
  • This embodiment provides a computer-readable medium on which a computer program is stored.
  • the program is executed by a processor, various steps of the method for secure access control based on DNS resolution as described in the above-mentioned embodiments are implemented.
  • the computer program can be stored in a computer-readable storage medium.
  • the computer program When executed by a processor, the steps in the above-mentioned various method embodiments can be realized.
  • the computer program includes computer program code, and the computer program code may be in the form of source code, object code, executable file or some intermediate form.
  • the computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a removable hard disk, a magnetic disk, an optical disk, a computer memory, and a read-only memory (ROM, Read-Only Memory) , Random Access Memory (RAM, Random Access Memory), electrical carrier signal, telecommunication signal and software distribution medium, etc.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • electrical carrier signal telecommunication signal and software distribution medium
  • the computer-readable medium may contain appropriate additions or subtractions as required by legislation and patent practice in jurisdictions, for example, in some jurisdictions, computer-readable Reading media excludes electrical carrier signals and telecommunication signals.
  • Fig. 8 is a schematic structural diagram of an electronic device according to an embodiment of the present disclosure.
  • the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory.
  • the memory may include a memory, such as a high-speed random-access memory (Random-Access Memory, RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.
  • RAM random-Access Memory
  • non-volatile memory such as at least one disk memory.
  • the electronic device may also include hardware required by other services.
  • the processor, the network interface and the memory can be connected to each other through an internal bus, which can be an ISA (Industry Standard Architecture, industry standard architecture) bus, a PCI (Peripheral Component Interconnect, peripheral component interconnection standard) bus or an EISA (Extended Industry Standard Architecture, extended industry standard architecture) bus, etc.
  • the bus can be divided into address bus, data bus, control bus and so on. For ease of representation, only line segments are used in FIG. 8 , but it does not mean that there is only one bus or one type of bus.
  • Memory for storing programs.
  • the program may include program code, and the program code includes computer operation instructions.
  • Storage which can include internal memory and nonvolatile storage, provides instructions and data to the processor.
  • the processor reads the corresponding computer program from the non-volatile memory into the memory and runs it.
  • the processor executes the program stored in the memory to execute all the steps in a security access control method based on DNS resolution as shown in FIG. 2 .
  • the communication bus mentioned in the above device may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus or the like.
  • PCI Peripheral Component Interconnect
  • EISA Extended Industry Standard Architecture
  • the communication bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.
  • the communication interface is used for communication between the electronic device and other devices.
  • the bus includes hardware, software, or both, and is used to couple the above-mentioned components to each other.
  • a bus may include Accelerated Graphics Port (AGP) or other graphics bus, Enhanced Industry Standard Architecture (EISA) bus, Front Side Bus (FSB), HyperTransport (HT) interconnect, Industry Standard Architecture (ISA) bus, Infinity Wideband Interconnect, Low Pin Count (LPC) Bus, Memory Bus, Micro Channel Architecture (MCA) Bus, Peripheral Component Interconnect (PCI) Bus, PCI-Express (PCI-X) Bus, Serial Advanced Technology Attachment (SATA ) bus, Video Electronics Standards Association local (VLB) bus or other suitable bus or a combination of two or more of these.
  • a bus may comprise one or more buses, where appropriate.
  • the memory may include a random access memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-Volatile Memory, NVM), such as at least one disk memory.
  • RAM Random Access Memory
  • NVM non-Volatile Memory
  • the memory may also be at least one storage device located far away from the aforementioned processor.
  • Memory may include mass storage for data or instructions.
  • the memory may include a Hard Disk Drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a Universal Serial Bus (USB) drive or two or more a combination of the above.
  • Storage may include removable or non-removable (or fixed) media, where appropriate.
  • the memory is non-volatile solid-state memory.
  • the memory includes read only memory (ROM).
  • the ROM may be mask programmed ROM, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), electrically rewritable ROM (EAROM), or flash memory or A combination of two or more of the above.
  • the above-mentioned processor can be a general-purpose processor, including a central processing unit (Central Processing Unit, CPU), a network processor (Network Processor, NP), etc.; it can also be a digital signal processor (Digital Signal Processing, DSP), dedicated integrated Circuit (Application Specific Integrated Circuit, ASIC), Field-Programmable Gate Array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.
  • CPU Central Processing Unit
  • NP Network Processor
  • DSP Digital Signal Processing
  • ASIC Application Specific Integrated Circuit
  • FPGA Field-Programmable Gate Array
  • FPGA Field-Programmable Gate Array
  • the devices, devices, systems, modules or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions.
  • a typical implementing device is a computer.
  • the computer can be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet A computer, a wearable device, or a combination of any of these devices.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions
  • the device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.
  • each embodiment in this specification is described in a related manner, the same and similar parts of each embodiment can be referred to each other, and each embodiment focuses on the differences from other embodiments.
  • the description is relatively simple, and for relevant parts, please refer to part of the description of the method embodiments.
  • This disclosure configures traffic drainage policies and security resolution policies for target users through the cloud security management platform, and sends the traffic drainage policies to the edge node of the security access service and the target terminal corresponding to the target user, so that the target terminal can resolve the domain name according to the traffic drainage policy
  • the request is diverted to the edge node of the secure access service, and the security resolution policy is sent to the edge node of the security access service at the same time, so that the edge node of the security access service can control the resolution of the target domain name to be resolved in the domain name resolution request according to the security resolution policy, realizing a A new and efficient domain name access security management mode; this domain name access security management mode does not need to configure and manage many security devices, and improves network communication security at a lower cost.
  • the cloud security management platform is used as the management center to configure personalized drainage strategies and security analysis strategies for each target user.
  • the management center of the security cloud gateway for multiple users it has strong flexibility and The business expansion capability is suitable for domain name access in various scenarios, and can meet the security and convenience requirements for domain name access at the same time.
  • the target terminal directly sends the domain name resolution request to the secure access service edge node according to the traffic diversion strategy, and the secure access service edge node checks and filters according to the category of the target domain name to be resolved in the domain name resolution request, Then adopt different disposal methods to deal with it, realize the secure access control to the domain name, and the operation is simple and efficient.
  • each distributed node in the CDN network can provide the target user with DNS resolution service, that is, each distributed node can perform domain name resolution on the domain name resolution request sent by the target terminal, and can analyze the domain name The parsing request performs parsing control, so as to ensure the security of the Internet access of the target terminal.
  • the deployment of distributed edge nodes for secure access services allows target terminals to access edge nodes for secure access services nearby, significantly reducing the time delay for information to reach edge nodes for secure access services, making user experience more be greatly improved.

Landscapes

  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Engineering & Computer Science (AREA)
  • Automation & Control Theory (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种DNS解析的安全访问控制方法、系统、装置、计算机可读存储介质和电子设备，方法包括：通过云安全管理平台（10）为目标用户配置针对域名解析请求的引流策略和安全解析策略（101），将引流策略分别发送至安全访问服务边缘节点（20）以及目标用户对应的目标终端（30）（102），将安全解析策略发送至安全访问服务边缘节点（20）（103）；目标终端（30）根据引流策略将域名解析请求发送给对应的安全访问服务边缘节点（20）（105）；安全访问服务边缘节点（20）根据云安全管理平台（10）提供的安全解析策略对来自目标终端（30）的域名解析请求中待解析的目标域名进行解析控制（109）。

Description

基于DNS解析的安全访问控制方法、系统、装置及设备
本公开基于2021年09月18日提交中国专利局、申请号为202111110888.0，发明名称为“基于DNS解析的安全访问控制方法、系统、装置及设备”的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本公开作为参考。
技术领域
本公开实施例涉及但不限于一种基于DNS解析的安全访问控制方法、系统、装置、计算机可读存储介质和电子设备。
背景技术
DNS系统即域名解析系统，DNS服务是互联网上的一项核心服务。任何访问都需要先通过DNS解析找到对应的服务IP，才能获取到相应的资源，因此DNS解析结果直接决定用户所访问到的主机。为了保证互联网访问的安全性，企业或者个人通过部署各类安全设备如DDoS、WAF、IDS、IPS以及上网行为管理等进行安全访问控制。然而，上述各类安全设备需要进行维护，维护难度以及维护成本较高。因此，如何降低安全设备的维护难度以及维护成本，并且保证互联网访问的安全性，成为了亟待解决的技术问题。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
为克服相关技术中存在的问题，本公开提供一种基于DNS解析的安全访问控制方法、系统、装置、计算机可读存储介质和电子设备。
根据本公开的第一方面，提供一种基于DNS解析的安全访问控制方法，应用于安全访问服务边缘节点，所述方法包括：
根据来自目标终端的域名解析请求，确定所述目标终端的标识信息和待解析的目标域名；
根据所述目标终端的标识信息，确定与所述目标终端对应的目标用户相关联的安全解析策略；
根据所述安全解析策略，对所述目标域名进行解析控制。
根据本公开的第二方面，提供一种基于DNS解析的安全访问控制方法，应用于云安 全管理平台，所述方法包括：
为目标用户配置针对域名解析请求的引流策略和安全解析策略；
将所述引流策略分别发送至安全访问服务边缘节点以及所述目标用户对应的目标终端，以使所述目标终端根据所述引流策略将域名解析请求发送至所述安全访问服务边缘节点；
将所述安全解析策略发送至所述安全访问服务边缘节点，以使所述安全访问服务边缘节点根据所述安全解析策略对所述域名解析请求中待解析的目标域名进行解析控制。
根据本公开的第三方面，提供一种基于DNS解析的安全访问控制方法，应用于目标终端，所述方法包括：
获取针对域名解析请求的引流策略，所述引流策略包括为所述目标终端分配的提供域名解析服务的安全访问服务边缘节点的地址；
根据所述引流策略，将生成的域名解析请求发送给所述安全访问服务边缘节点；
接收由所述安全访问服务边缘节点发送的响应信息，所述响应信息由所述安全访问服务边缘节点根据安全解析策略对所述域名解析请求进行解析控制生成，其中，所述安全解析策略与所述目标终端对应的目标用户相关联。
根据本公开的第四方面，提供一种基于DNS解析的安全访问控制系统，所述系统包括：
云安全管理平台，设置为为目标用户配置针对域名解析请求的引流策略和安全解析策略，并将所述引流策略分别发送至安全访问服务边缘节点和所述目标用户对应的目标终端，以及将所述安全解析策略发送至所述安全访问服务边缘节点；
安全访问服务边缘节点，设置为根据所述安全解析策略对来自所述目标终端的域名解析请求中待解析的目标域名进行解析控制。
根据本公开的第五方面，提供一种基于DNS解析的安全访问控制装置，设置于安全访问服务边缘节点，所述装置包括：
请求分析模块，设置为根据来自目标终端的域名解析请求，确定所述目标终端的标识信息和待解析的目标域名；
策略确定模块，设置为根据所述目标终端的标识信息，确定与所述目标终端对应的目标用户相关联的安全解析策略；
解析控制模块，设置为根据所述安全解析策略，对所述目标域名进行解析控制。
根据本公开的第六方面，提供一种基于DNS解析的安全访问控制装置，设置于云安 全管理平台，其特征在于，包括：
策略配置模块，设置为为目标用户配置针对域名解析请求的引流策略和安全解析策略；
第一发送模块，设置为将所述引流策略分别发送至安全访问服务边缘节点以及所述目标用户对应的目标终端，以使所述目标终端根据所述引流策略将域名解析请求发送至所述安全访问服务边缘节点；
第二发送模块，设置为将所述安全解析策略发送至所述安全访问服务边缘节点，以使所述安全访问服务边缘节点根据所述安全解析策略对所述域名解析请求中待解析的目标域名进行解析控制。
根据本公开的第七方面，提供一种基于DNS解析的安全访问控制装置，设置于目标终端，包括：
策略获取模块，设置为获取针对域名解析请求的引流策略，所述引流策略包括为所述目标终端分配的提供域名解析服务的安全访问服务边缘节点的地址；
请求发送模块，设置为根据所述引流策略，将生成的域名解析请求发送给所述安全访问服务边缘节点；
响应接收模块，设置为接收由所述安全访问服务边缘节点发送的响应信息，所述响应信息由所述安全访问服务边缘节点根据安全解析策略对所述域名解析请求进行解析控制生成，其中，所述安全解析策略与所述目标终端对应的目标用户相关联。
根据本公开的第八方面，提供一种计算机可读存储介质，其上存储有计算机程序，该程序被处理器执行时，实现如前述第一方面、第二方面或第三方面所述的一种基于DNS解析的安全访问控制方法。
根据本公开的第九方面，提供一种电子设备，其包括：
处理器；
用于存储所述处理器可执行指令的存储器；
其中，所述处理器被配置为执行所述指令，以实现如前述第一方面、第二方面或第三方面所述的一种基于DNS解析的安全访问控制方法。
本公开的上述技术方案具有如下有益效果：
1、本公开通过云安全管理平台为目标用户配置引流策略和安全解析策略，并将引流策略分别发送至安全访问服务边缘节点以及目标用户对应的目标终端，以使目标终端根据引流策略将域名解析请求引流至安全访问服务边缘节点，同时将安全解析策略发送至安全 访问服务边缘节点，以使安全访问服务边缘节点根据安全解析策略对域名解析请求中待解析的目标域名进行解析控制，实现了一种全新、高效的域名访问安全管理模式；这种域名访问安全管理模式无需配置和管理众多的安全设备，以较低的成本提高了网络通信安全性。
2、在本公开的实施例中，云安全管理平台作为管理中心，为各目标用户配置个性化的引流策略和安全解析策略，作为针对多用户的安全云网关的管理中心，具备强大的弹性和业务扩展能力，能够适合于多种场景下的域名访问，能够同时满足对域名访问的安全性和便利性的需求。
3、在本公开的实施例中，目标终端根据引流策略将域名解析请求直接发送到安全访问服务边缘节点，安全访问服务边缘节点根据域名解析请求中待解析的目标域名的类别进行检查和过滤，进而采取不同的处置方式进行应对，实现对域名的安全访问控制，操作简单高效。
4、在本公开的实施例中，CDN网络中的各个分布式节点可以为目标用户提供DNS解析服务，即各分布式节点能够对目标终端所发送的域名解析请求进行域名解析，并且能够对域名解析请求进行解析控制，从而保证目标终端的互联网访问的安全性。
5、在本公开的实施例中，分布式的安全访问服务边缘节点的部署允许目标终端可以就近接入安全访问服务边缘节点，显著降低信息到达安全访问服务边缘节点的时间延迟，使得用户体验感得以大幅度地提升。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图说明
为了更清楚地说明本公开实施例的技术方案，下面将对实施例描述中所使用的附图作简单地介绍，下面描述中的附图仅仅是本公开的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。构成本公开的一部分的附图用来提供对本公开的进一步理解，本公开的示意性实施例及其说明用于解释本公开，并不构成对本公开的不当限定。在附图中：
图1是根据一示例性实施例示出的一种基于DNS解析的安全访问控制系统的组成示意图；
图2是图1所示系统实施一种基于DNS解析的安全访问控制方法的交互过程的示意图；
图3是根据一示例性实施例示出的根据不同的威胁类别而采取的不同的处置方式的设置内容；
图4是根据一示例性实施例示出的根据不同的内容类别而采取的不同的处置方式的设置内容；
图5是根据一示例性实施例示出的目标用户的引流策略和安全解析策略的设置内容；
图6是图1所示系统中的安全访问服务边缘节点的组成示意图；
图7是图2所示的基于DNS解析的安全访问控制方法中确定目标用户的过程的示意图；
图8是根据一示例性实施例示出的电子设备的组成示意图。
具体实施方式
下面将结合本公开实施例中的附图，对本公开实施例中的技术方案进行清楚、完整地描述，所描述的实施例是本公开的一部分实施例，而不是全部的实施例。基于本公开中的实施例，本领域普通技术人员在没有做出创造性劳动的前提下所获得的所有其他实施例，都属于本公开保护的范围。
如图1所示，本实施例提供的一种基于DNS解析的安全访问控制系统，该系统主要包括云安全管理平台10、安全访问服务边缘节点20和目标终端30，其中：
云安全管理平台10，设置为为目标用户配置针对域名解析请求的引流策略和安全解析策略，并将引流策略分别发送至安全访问服务边缘节点20和所述目标用户对应的目标终端30，以及将安全解析策略发送至安全访问服务边缘节点20；
安全访问服务边缘节点20，设置为根据云安全管理平台10提供的安全解析策略对来自目标终端30的域名解析请求中待解析的目标域名进行解析控制。
目标终端30，设置为根据引流策略将域名解析请求发送给安全访问服务边缘节点20。
其中，目标终端30可以是分支机构中的办公设备例如台式电脑等，其也可以是BYOD(BringYour Own Device)设备，即由企业员工携带自己的设备进行办公，例如个人电脑、手机、平板等，其不受时间、地点、设备、人员、网络环境的限制，通过在个人设备上安装企业的应用软件，从而可以使员工使用企业的相关资源。目标终端30还可以是隶属于个人的移动终端，例如智能手机等，本公开对此不作特殊限定。
图2是上述系统实施基于DNS解析的安全访问控制方法的交互过程的示意图。如图2所示，该交互过程由云安全管理平台10、安全访问服务边缘节点20和目标终端30三方共 同完成，该方法主要包括以下步骤：
101，云安全管理平台10为目标用户配置针对域名解析请求的引流策略和安全解析策略；
102，云安全管理平台10将引流策略分别发送至安全访问服务边缘节点20以及目标用户对应的目标终端30；
103，云安全管理平台10将安全解析策略发送至安全访问服务边缘节点20；
104，目标终端30接收云安全管理平台提供的针对域名解析请求的引流策略，其中，所述引流策略包括为目标终端30分配的提供域名解析服务的安全访问服务边缘节点20的地址；
105，目标终端30根据所述引流策略将生成的域名解析请求发送给安全访问服务边缘节点20；
106，安全访问服务边缘节点20接收目标终端30发来的域名解析请求；
107，安全访问服务边缘节点20根据所述域名解析请求，确定目标终端30的标识信息和待解析的目标域名；
108，安全访问服务边缘节点20根据目标终端30的标识信息，确定目标终端30对应的目标用户，然后再根据云安全管理平台10预先提供的目标用户与安全解析策略之间的对应关系，确定与目标终端30对应的目标用户相关联的安全解析策略；
109，安全访问服务边缘节点20根据所述安全解析策略，对所述目标域名进行解析控制；
110，安全访问服务边缘节点20向目标终端30反馈对域名解析请求进行解析控制生成的响应信息；
111，安全访问服务边缘节点20向云安全管理平台10输出解析日志，所述解析日志记录对所述目标域名的解析结果；
112，云安全管理平台10接收安全访问服务边缘节点20发送的解析日志，并对所述解析日志中的解析结果进行分析和/或可视化处理。
下面详细地说明上述方法的各个步骤以及其中可选的或可替换的实施方式。
在本公开的实施例中，目标用户可理解为需要实施安全解析策略的最小单元。如图1所示，在本实施例中，目标用户可以是例如企业机构、家庭网络或个人用户等。通常，每个目标用户对应有用户账号，该用户账号可以是由用户自行注册的，也可以是由运营人员通过云安全管理平台10进行分配的。在示例性实施方式中，一个目标用户可以对应于至 少一个目标终端，本公开所述的“至少一个”即为一个、两个或者两个以上的任意数量，例如，一个企业机构可以具有一台终端设备或者多台终端设备、或者一个家庭网络可以具有一台终端设备或者多台终端设备等。
在一些实施例中，在为目标用户配置引流策略和安全解析策略之前，云安全管理平台10还可以响应于目标终端30发来的接入请求，基于该接入请求对该目标终端进行验证，只有当验证通过以后才允许该目标终端接入，并为目标终端查询与该目标用户对应的引流策略和安全解析策略，再将查询到的引流策略下发给安全访问服务边缘节点20以及与目标用户对应的目标终端30，以及将安全解析策略下发给安全访问服务边缘节点20。
在示例性实施方式中，安全访问服务边缘节点20可以是提供各种服务的分布式网络中的分布式节点，在一示例中，该分布式网络可以为CDN(Content Delivery Network，内容分发网络)网络，该CDN网络中可以包括多个分布式节点(即边缘节点)，在本公开的实施例中，CDN网络中的各个分布式节点可以为目标用户提供DNS解析服务，即各分布式节点能够对目标终端所发送的域名解析请求进行域名解析，并且能够对域名解析请求进行解析控制，从而保证目标终端的互联网访问的安全性。除此以外，分布式节点还可以提供其他服务，例如访问控制服务、防火墙、DDoS、WAF、IDS、IPS以及上网行为管理等。
在其他实施例中，分布式网络也可以是SD-WAN网络。除此以外，分布式网络还可以为多台服务器按照分布式架构组成的服务器集群，分布式节点为该服务器集群中的任一服务器。
在另一示例中，分布式网络也可以为边缘云网络，该边缘云网络可以是基于云计算技术的核心和边缘计算的能力，构筑在边缘基础设施之上的云计算平台，以形成边缘位置的计算、网络、存储、安全等能力全面的弹性云平台。该边缘云网络中可以包括多个边缘节点(即分布式节点)，从而在更靠近终端的网络边缘上提供服务。本公开实施例并不限制分布式网络具体为何种网络，任意多台计算设备组成的分布式架构的网络均适用于本公开。
在一些实施例中，由用户通过目标终端30向云安全管理平台10发送的接入请求可以包括目标终端的身份信息，以供云安全管理平台10根据目标终端的身份信息通过查询配置相应的引流策略。在示例性实施方式中，所述目标终端的身份信息可以是与目标终端相对应的身份信息，基于该身份信息即可确定对应的目标终端。例如，目标终端的身份信息可以是目标终端的IP地址、MAC地址或者设备编号等信息。在其他示例中，目标终端的身份信息也可以是使用该目标终端的用户的身份信息，例如该用户的联系电话、身份证号 码、社交账号等信息，本公开对此不作特殊限定。
在本公开一示例性实施例中，该引流策略可以包括为目标用户分配的安全访问服务边缘节点的域名信息(即服务域名)。如此，后续安全访问服务边缘节点能够根据目标终端的身份信息与安全访问服务边缘节点的服务域名之间的对应关系，确定与该域名对应的目标用户。具体地，云安全管理平台可以为每个目标用户分配对应的安全访问服务边缘节点，并针对于该目标用户生成该安全访问服务边缘节点的DNS解析服务域名，该服务域名与该目标用户为一对一对应关系，从而可以根据该目标用户所访问的安全访问服务边缘节点的DNS解析服务域名，确定该目标用户。
在示例性实施方式中，一个安全访问服务边缘节点针对于多个目标用户，可以具有多个服务域名，即可以对应于每个目标用户具有不同的DNS解析服务域名，由此，在一个安全访问服务边缘节点中可以服务多个目标用户，也可以为一个目标用户提供多种服务，提高了安全访问服务边缘节点的资源利用率。
又或者，在一些实施例中，由目标终端30向云安全管理平台10发送的接入请求，不仅包括目标终端的身份信息，而且还包括目标用户为自己设定的针对域名解析请求的引流策略，即，还包括由目标用户自己指定提供域名解析服务的安全访问服务边缘节点20的地址。换言之，引流策略既可以由目标用户自行设置，也可以由运营人员在云安全管理平台10上为目标用户进行配置。本公开对此不作特殊限定。
在示例性实施方式中，属于同一目标用户的目标终端可以对应于相同的引流策略和安全解析策略，而在某些情况下，属于同一目标用户的目标终端也可以对应于不同的引流策略或安全解析策略，例如属于某一分支机构的员工在外出差，根据该员工所使用的目标终端的位置信息，确定距离该目标终端最近或者网络质量最优的安全访问服务边缘节点不同于该分支机构所对应的引流策略中的安全访问服务边缘节点，则可以对该引流策略对应修改，将原安全访问服务边缘节点替换为实际最近或者网络最优的安全访问服务边缘节点，以保证目标终端的接入质量。
对于运营人员在云安全管理平台10上为目标用户配置引流策略的情况，该引流策略中提供域名解析服务的安全访问服务边缘节点20可以优选在地理位置上与目标终端同属一个区域并距离目标终端最近的安全访问服务边缘节点，以此降低信息到达安全访问服务边缘节点的时间延迟，使得用户体验感得以大幅度地提升。此外，安全访问服务边缘节点20也可以是与目标终端之间网络质量最优或者较优的安全访问服务节点，从而降低信息到达安全服务边缘节点的网络延迟。
另外还应当说明的是，云安全管理平台10下发引流策略和安全解析策略的方式可以包括主动下发或被动下发，以及直接下发或间接下发。例如，云安全管理平台10可以主动下发引流策略和安全解析策略给安全访问服务边缘节点20，云安全管理平台10也可以响应于目标用户通过目标终端30发来的接入请求被动下发引流策略给目标终端30。又或者，云安全管理平台10可以直接下发引流策略和安全解析策略给安全访问服务边缘节点20，云安全管理平台10也可以先将引流策略和安全解析策略下发至配置管理器40，再由配置管理器40下发至安全访问服务边缘节点20(即间接下发)。总之，本公开对于下发引流策略和安全解析策略的方式不作特殊限定。
在示例性实施方式中，云安全管理平台10和配置管理器40可以是相互独立的不同服务器，云安全管理平台10可以将配置好的引流策略以及安全解析策略等信息向配置管理服务器40进行下发，以使配置管理服务器40发送至对应的安全访问服务边缘节点20和目标终端。在另一实施例中，云安全管理平台10和配置管理器40也可以是同一服务器或者处于同一系统中，即用户或者管理人员可以在云安全管理平台10所提供的界面中配置对应的引流策略和安全解析策略的相关配置信息，云安全管理平台10所提供的界面在接收到相关配置信息之后，可以将该相关配置信息发送至配置管理器40进行存储，从而在后续可以将相关配置信息发送给对应的安全访问服务边缘节点20和目标终端。
此外还应当说明的是，与目标用户对应的目标终端30既可以是分支机构的网络出口，也可以是个人用户的终端设备(以下简称为用户终端设备)。该用户终端设备可以包括但不限于智能手机、平板电脑、便携式电脑、台式计算机、智能穿戴式设备或物联网设备等具有网络连接功能以及数据访问功能的电子设备中的一种或多种。因此，目标终端30的标识信息既可以是分支机构的公网出口地址，也可以是建立的引流隧道中的客户端的虚拟地址，即目标终端可以基于接收到的引流策略，建立目标终端与安全访问服务边缘节点之间的引流隧道，例如基于GRE协议、IPsec协议等，从而保证引流结果的准确性以及安全性。
在一些可实施的方式中，云安全管理平台10还可以响应于针对目标用户的配置请求，显示目标用户配置界面，其中，所述配置界面包括多个信息配置选项；然后基于多个所述信息配置选项接收到的编辑信息，确定所述目标用户对应的公网出口地址、内网地址、引流策略以及安全解析策略。其中，内网地址是用于建立引流隧道的。例如，对于分支机构，基于分支机构的内网地址以及分配给分支机构的安全访问服务边缘节点的地址，建立引流隧道从而实现引流。
在本公开的实施例中，分布式部署的多个安全访问服务边缘节点20组成了一个安全云。其中，每个安全访问服务边缘节点20可以与至少一个目标终端30连接，并且每个安全访问服务边缘节点20上预存有从云安全管理平台10获取的为各目标用户配置的引流策略和安全解析策略。此外，每个安全访问服务边缘节点20上均运行有安全DNS软件，所述安全DNS软件支持多种类型的DNS解析协议，该DNS解析协议可以包括但不限于UDP、TCP、DoT(DNS over TLS)和DoH(DNS over HTTPS)中的一种或多种，即该安全DNS软件可以只支持以上所述的DNS解析协议的一种，也可以支持以上所述的DNS解析协议的两种或两种以上的任意数量，本公开对此不作特殊限定。由此，安全访问服务边缘节点能够支持处理来自多种类型的目标终端的域名解析请求，具有较大的灵活性，也能适应不同应用场景的需求，兼容各种不同DNS协议，进而得到解析更精准或者安全性更高的好处。
当安全访问服务边缘节点20接收到一个目标终端30发来的域名解析请求时，该域名解析请求可以是由目标终端直接发送给安全访问服务边缘节点，也可以是由目标终端通过中间服务器间接发送给安全访问服务边缘节点，其中中间服务器可以是网关服务器、Local DNS等。根据该域名解析请求，确定目标终端30的标识信息和待解析的目标域名。在本公开的实施例中，一个目标终端30的标识信息可以包括该目标终端30的公网出口地址和域名解析请求的请求方式中的至少一种。通过该目标终端30的标识信息，安全访问服务边缘节点20可以判断出接收到的域名解析请求是来自哪一个目标终端30的域名解析请求，从而确定与该目标终端30对应的目标用户，进而确定与该目标用户相关联的安全解析策略。由于在安全访问服务边缘节点20上预先保存了目标终端30的标识信息与目标终端30所对应的目标用户的映射关系，因此当安全访问服务边缘节点20接收到一个目标终端30的域名解析请求时，获取到该目标终端30的标识信息，而后在映射关系中获取该目标终端30对应的目标用户。而在安全访问服务边缘节点20上预先保存的安全解析策略是与目标终端30对应的目标用户相关联的，因此当确定了目标用户时，就可以获取到目标终端30对应的目标用户的安全解析策略。
在本公开一示例性实施例中，目标终端的标识信息可以同时包括目标终端的公网出口地址和域名解析请求的请求方式。在这种情况下，在步骤108中，安全访问服务边缘节点根据所述目标终端的标识信息，确定所述目标终端对应的目标用户，包括以下至少三种方式：
若域名解析请求的请求方式是DoT或DoH时，根据所述安全访问服务边缘节点的服 务域名确定目标终端对应的目标用户；
若发送解析请求的请求方式不是DoT或DoH，且所述目标终端的公网出口地址是IPv4地址时，根据所述目标终端的公网出口地址确定所述目标终端对应的目标用户；
若发送解析请求的请求方式不是DoT或DoH，且所述目标终端的公网出口地址不是IPv4地址时，根据为所述目标终端分配的安全访问服务边缘节点的IPv6地址确定所述目标终端对应的目标用户。
由此，针对不同情况设定不同的目标用户确定策略，可以保证目标用户确定的准确性，避免特殊情况无法识别的问题出现。同时，基于安全访问服务边缘节点进行DNS解析，其能够基于目标终端的真实地址解析得到对应的服务节点，保证了解析结果的准确性，避免了传统DNS解析策略中通过目标终端对应的Local DNS服务器的地址信息进行解析，易造成解析结果出现偏差的情况发生，例如，A地区的目标终端对应的Local DNS服务器出现故障，则将该目标终端的DNS解析请求发送至邻近地区的B地区的Local DNS服务器进行解析，则导致解析结果与B地区较为相关，从而影响了对目标终端的服务质量。
在一些实施例中，安全解析策略包括域名分类解析策略、安全威胁解析策略和自定义解析策略中的至少一种。应当说明的是，无论域名分类解析策略、安全威胁解析策略还是自定义解析策略，它们都可以包含多条规则，其中，每条规则对应有匹配条件和处置动作，当匹配条件满足时，安全访问服务边缘节点执行相应的处置动作。
当安全解析策略包括域名分类解析策略时，安全访问服务边缘节点根据域名分类解析策略对所述目标域名进行解析控制，包括：
根据预存的域名分类数据库，确定所述目标域名所对应的内容类别；
根据所述内容类别，确定对所述目标域名的处置方式，所述处置方式包括允许解析目标域名。当安全访问服务边缘节点提供cache服务时，安全访问服务边缘节点经过对该目标域名进行解析，可以返回解析得到的目标节点IP，该目标节点IP可以为本安全访问服务边缘节点的IP，也可以为其他安全访问服务边缘节点的IP；当安全访问服务边缘节点未提供cache服务或者未存储有目标域名对应资源的时候，安全访问服务边缘节点可以进一步查询并访问该目标域名所对应的原始服务器的IP地址，该原始服务器可以是该目标域名对应的源服务器或者存储有该目标域名对应资源的服务器等等。所述处置方式还包括禁止解析目标域名或观察解析目标域名，所述观察解析目标域名是指允许解析目标域名且记录当次解析日志。
这带来的有益效果是，在DNS服务器响应解析结果之前，对请求的域名的类型进行 分析判断，根据不同的类型采取不同的处置方式进行应对(即，响应不同的解析结果)，实现对域名的安全访问控制，操作简单高效。
当安全解析策略包括安全威胁解析策略时，安全访问服务边缘节点根据安全威胁解析策略对所述目标域名进行解析控制，包括：
根据预存的安全威胁数据库，确定所述目标域名对应的威胁类别；
根据所述威胁类别，确定对所述目标域名的处置方式，所述处置方式包括允许解析目标域名、禁止解析目标域名或观察解析目标域名，所述观察解析目标域名是指允许解析目标域名且记录当次解析日志。
这带来的有益效果是，可以通过判断待解析的目标域名是否属于病毒、C2、钓鱼邮件、挖矿等威胁类别，来实施针对此类域名的处置方式(例如阻止访问此类域名)，满足对域名访问的安全性的需求。
当安全解析策略包括自定义解析策略时，安全访问服务边缘节点根据自定义解析策略对所述目标域名进行解析控制，包括：
根据预存的自定义域名数据库，确定所述目标域名是否属于所述自定义域名数据库中的自定义域名类型；
根据判断结果，确定对所述目标域名的处置方式，所述处置方式包括允许解析目标域名、禁止解析目标域名或更换目标域名。
这带来的有益效果是，配置个性化的访问解析策略，实现强大的弹性和扩展能力，能够满足各种场景下的域名访问需求。
在本实施例中，通过云安全管理平台为目标用户配置引流策略和安全解析策略，并将引流策略分别发送至安全访问服务边缘节点以及目标用户对应的目标终端，以使目标终端根据引流策略将域名解析请求引流至安全访问服务边缘节点，同时将安全解析策略发送至安全访问服务边缘节点，以使安全访问服务边缘节点根据安全解析策略对域名解析请求中待解析的目标域名进行解析控制，实现了一种全新、高效的域名访问安全管理模式；这种域名访问安全管理模式无需配置和管理众多的安全设备，以较低的成本提高了网络通信安全性。
实施例二
为了使本领域技术人员深入理解上述实施例中的边缘节点的工作原理，下面结合一个具体应用实例来说明系统的组成结构和工作流程。
在本实施例中，一个多租户的云安全访问控制系统具有一个云安全管理平台，多个分布式部署的安全访问服务边缘节点DNS，以及多个不同类型的目标终端。
为了实现域名解析的安全管理，云安全管理平台的运营人员或目标用户的安全管理人员首先在云安全管理平台上建立域名分类数据库、安全威胁数据库和自定义域名数据库中的至少一种数据库。其中，域名分类数据库可以用于记录各个域名所属的类别，安全威胁数据库可以用于记录域名的安全威胁类型，自定义域名数据库可以用于记录域名的自定义信息。在建立这些数据库后，运营人员可以在必要时对这些数据库中的数据进行修改，例如，在域名分类数据库中增加、删除或修改域名及域名分类，根据最新的威胁情报更新安全威胁数据库中的数据等。
此外，运营人员或目标用户的安全管理人员还可以在云安全管理平台上为目标用户设置相应的安全解析策略。在此，所述目标用户可理解为云安全管理平台上标识的一个组织(如企业、团体或者个人)，是需要实施安全解析策略的最小单元。在本实施例中，目标用户可以是例如企业机构、家庭网络或个人用户等。相应地，由于各个目标用户的特点不同，因此需要为这些目标用户分别设置各自对应的安全解析策略。所述安全解析策略包括域名分类解析策略、安全威胁解析策略和自定义解析策略中的至少一种。例如，以域名分类解析策略为例，可以针对家庭网络设置安全解析策略，以帮助家长阻止未成年人浏览不良网站(如色情网站)的内容。以安全威胁解析策略为例，可以针对企业机构设置安全解析策略，以免受钓鱼邮件、勒索病毒的威胁，可以针对个人用户的移动设备设置安全解析策略，以免受DNS劫持的威胁。以自定义解析策略为例，可以针对企业机构设置专门的安全解析策略，以禁止访问特定的网址来获取资源。
下面以表格形式示出了本实施例所采用的安全解析策略。
图3和图4所示是本实施例示例性的安全解析策略。其中，图3示出了根据不同的威胁类别而采取的不同的处置方式；图4示出了根据不同的内容类别而采取的不同的处置方式。
在本实施例的安全解析策略中，根据威胁类别、内容类别等不同而采取不同的处置方式，所述处置方式中包括允许、禁止、观察(允许解析但记录当次解析日志)。例如，允许：办公类应用、资讯类应用、office365；禁止：视频类应用、游戏类应用、大带宽下载类应用、病毒木马钓鱼类域名。此外，在本实施例的安全解析策略中，还包括自定义解析策略，例如，针对自定义域名分类采取相应的处置方式，所述处置方式包括放行、阻断、改写等。例如，通过域名改写将www.example.com解析到cname.demo.com。
表一
Figure PCTCN2022119324-appb-000001
在建立好数据库以及安全解析策略之后，云安全管理平台的运营人员或目标用户的安全管理人员将建立好的数据库和安全解析策略同步至安全访问服务边缘节点，以使安全访问服务边缘节点能够根据安全解析策略进行解析控制。
如图5所示，除了上述安全解析策略之外，运营人员或目标用户的安全管理人员还需要为各个目标用户设置相应的引流策略。换言之，运营人员或目标用户的安全管理人员还需要为各个目标用户分配用于提供域名解析服务的安全访问服务边缘节点的地址，以使目标用户发起的域名解析请求能够被引流至相应的安全访问服务边缘节点进行解析控制。
在本实施例中，云安全管理平台响应于针对目标用户的配置请求，显示如图5所示的目标用户配置界面，所述配置界面包括多个信息配置选项；然后基于多个所述信息配置选项接收到编辑信息，确定所述目标用户对应的公网出口地址、内网地址、引流策略以及安全解析策略。其中，内网地址是用于建立引流隧道的。例如，对于某一分支机构，基于该分支机构的内网地址以及分配给该分支机构的安全访问服务边缘节点的地址，建立引流隧道从而实现从该分支机构到安全访问服务边缘节点的引流。换言之，分支机构将新生成的域名解析请求通过所建立的引流隧道发送至对应的安全访问服务边缘节点出进行解析控制。
在另一示例中，当该分支机构需要将生成的域名解析请求发送给对应的安全访问服务边缘节点时，也可以将该分支机构对应的DNS服务器地址指向对应的安全访问服务边缘节点的地址，然后根据所述安全访问服务边缘节点的地址，将生成的域名解析请求发送至所述安全访问服务边缘节点。
例如，为某企业机构分配的地址包含IPv4地址(如134.43.34.1)、IPv6地址(如2a03:54c1:34::310c)，或者一个域名(如kjfaueo.xiueorijl-gateway.com，通过这个域名，可以进一步解析到提供域名解析服务的安全访问服务边缘节点)。
在设置好引流策略之后，运营人员或目标用户的安全管理人员将设置好的引流策略分别同步至安全访问服务边缘节点和目标用户使用的目标终端，以使目标用户通过所述目标终端发送的域名解析请求能够被引流至相应的安全访问服务边缘节点进行解析控制，即，实现对域名解析请求的引流。
应当说明的是，在上述步骤中，虽然运营人员或目标用户的管理人员在云安全管理平台上通过手动的方式为目标用户配置引流策略和安全解析策略，但是本公开的技术方案可以不限于此。例如，云安全管理平台也可以根据目标用户的特点或身份通过查询自动匹配适合该目标用户的引流策略和安全解析策略。此处不做赘述。
本实施例的系统包括多个分布式部署的安全访问服务边缘节点(以下简称安全边缘节点)。通常，每个安全边缘节点上均运行有安全DNS软件，用于实现对DNS解析的安全访问控制，所述安全DNS软件支持多种类型的DNS解析协议，如UDP、TCP、DoT(DNS over TLS)，DoH(DNS over HTTPS)，能够支持处理来自多种类型的目标终端的域名解析请求。此外，本实施例的系统还包括用于配置安全边缘节点的配置管理器。在该系统中，通过云安全管理平台的目标用户配置界面首先将接收到的最新的数据库、安全解析策略和引流策略等信息发送给配置管理器，然后配置管理器将云安全管理平台下发的数据库、安全解析策略和引流策略等信息发送给每个安全访问服务边缘节点，并将引流策略下发到对应的目标终端。在此，一种较为有益的方式是，在根据所述安全解析策略对待解析的目标域名进行解析控制控制之前，配置管理器根据来自云安全管理平台的目标用户配置界面接收的针对数据库和/或安全解析策略的更新信息，对每个服务边缘节点上存储的数据库和/或安全解析策略进行相应的更新。
在本实施例中，云安全管理平台下发的数据库包括域名分类数据库、安全威胁数据库和自定义域名数据库中的至少一种数据库，云安全管理平台下发的安全解析策略和引流策略的信息往往记录有多个目标用户以及每个目标用户各自对应的安全解析策略和引流策略，其中，所述安全解析策略包括域名分类解析策略、安全威胁解析策略和自定义解析策略中的至少一种，所述引流策略包括云安全管理平台为目标用户分配的提供域名解析服务的安全访问服务边缘节点的地址。
如图6所示，每个安全访问服务边缘节点可以包含一个负载均衡器和至少一个安全服 务器，其中，负载均衡器用于将域名解析请求转发给一个所述安全服务器。每个安全服务器上均运行有协议处理模块、威胁识别模块、域名分组模块、自定义解析模块和策略引擎模块等。
下面分别详细说明所述安全服务器上各模块的功能和作用。
所述策略引擎模块接收来自配置管理器的配置信息并将所述配置信息提供其他各个功能模块，其中，所述配置信息包括云安全管理平台下发给配置管理器的数据库、安全解析策略和引流策略等信息，其他各个功能模块则根据这些配置信息对域名解析请求进行相应的域名解析控制处理。
所述协议处理模块支持种类型的DNS解析协议，例如，UDP、TCP、DoT(DNS over TLS)，DoH(DNS over HTTPS)，能够根据DNS解析协议对来自各种类型的目标终端(如用户终端或分支机构的网络出口)的域名解析请求进行解析处理，从而确定是哪个目标终端(目标用户)发送所述域名解析请求以及待解析的目标域名。
在本实施例中，当接收到某个用户通过目标终端发来的域名解析请求时，安全服务器的协议处理模块首先对所述域名解析请求进行解析，以确定发送所述域名解析请求的目标终端的标识信息以及待解析的目标域名，其中，所述目标终端的标识信息包括目标终端的公网出口地址和/或域名解析请求的请求方式。然后，安全服务器的协议处理模块根据所述目标终端的标识信息，确定所述目标终端对应的目标用户，然后再根据从策略引擎模块获取的各个目标用户与安全解析策略之间的对应关系，确定与所述目标终端对应的目标用户相关联的安全解析策略。
在本实施例中，如图7所示，当所述目标终端的标识信息包括目标终端的公网出口地址和/或域名解析请求的请求方式时，安全服务器的协议处理模块根据所述目标终端的标识信息，确定所述目标终端对应的目标用户，包括以下步骤：
①当通过DoH或DoT方式解析时，安全服务器根据所请求的安全访问服务边缘节点的服务域名(如HTTPS域名)确定目标用户，否则进入②或③；
②当发送解析请求的请求方式不是DoT或DoH，且所述目标终端的公网出口地址是IPv4地址时，安全服务器根据目标终端的公网出口IP v4地址确定目标用户；
③当发送解析请求的请求方式不是DoT或DoH，且所述目标终端的公网出口地址不是IPv4地址时，安全服务器根据分配给目标用户的安全访问服务边缘节点的IPv6地址确定目标用户。
所述威胁识别模块根据预存的安全威胁数据库识别待解析的目标域名的威胁类别，即 判断待解析的目标域名是否属于病毒、C2、钓鱼邮件、挖矿等威胁类别，并基于目标用户相关联的安全解析策略中的安全威胁解析策略来实施针对此类域名的处置方式；其中，所述处置方式包括允许解析目标域名、禁止解析目标域名或观察解析目标域名，所述观察解析目标域名是指允许解析目标域名且记录当次解析日志。
所述域名分类模块通过策略引擎模块加载云安全管理平台下发的域名分类数据(即域名分类数据库的数据)，并通过高效的数据查找法来识别待请求的目标域名的内容类别(如娱乐类、资讯类、游戏类等)，进而基于目标用户相关联的安全解析策略中的分类解析策略来来实施针对此类域名的处置方式；其中，所述处置方式包括允许解析目标域名、禁止解析目标域名或观察解析目标域名，所述观察解析目标域名是指允许解析目标域名且记录当次解析日志。
所述自定义解析模块根据预存的自定义域名数据库，确定待解析的目标域名是否属于所述自定义域名数据库中的自定义域名类别，根据判断结果，基于目标用户相关联的安全解析策略中的自定义解析策略来实施针对此类域名的处置方式；其中，所述处置方式包括允许解析目标域名、禁止解析目标域名或更换目标域名。
更换目标域名可以包括以下两种实现方式：
1、安全访问服务边缘节点向目标终端返回一个cname记录，其中，记录值为新的域名，由目标终端根据新的域名再次发起域名解析请求；
2、安全服务边缘节点直接根据新的域名进行解析，并向目标终端返回新的域名的解析结果，例如根据新的域名解析得到的IP地址等。
此外，在示例性实施方式中，安全服务器会向目标终端反馈对域名解析请求进行解析控制生成的响应信息。例如，当处置方式为禁止解析域名时，安全服务器向所述目标终端发送用于提示禁止解析的提示信息。
除上述步骤外，安全访问服务边缘节点20还可以向云安全管理平台10输出解析日志，所述解析日志记录对所述目标域名的解析结果，所述解析日志的格式是可配置的。
例如，DNS服务器输出下表所示的解析日志。在默认情况下只有命中阻断模式的请求日志才会记录，其他日志量因为比较大，默认不记录，并按一定的时间间隔(如5分钟一次)聚合统计输出，可针对允许和观察模式下的请求记录日志。每条日志都包含但不限于如下字段：
表二
字段名称 含义
request_id 请求的唯一标示符，如f5e50d9d8785d6db09d99475cc5426a4
node_id 边缘节点的标示符，如dx-zhejiang-jinhua-8
timestamp 请求时间戳，如2021-06-0412:34:09
server_addr 边缘节点vip
remote_addr 客户端公网出口IP
location_id 分支机构标示
enterprise_id 企业id
rule_id 访问控制规则的id
action 处置动作(允许、禁止、观察)
request_time 处理请求消耗的时间
qmethod DNS解析方式，如tcp、udp、dot，doh
qname 待解析的域名
qtype 请求的记录类型，如A，AAAA，TXT，MX等
domain_category 域名分组类型
另一方面，云安全管理平台10在接收到安全访问服务边缘节点20发送的解析日志后，可以对所述解析日志中的解析结果进行分析和/或可视化处理。
例如，云安全管理平台可以对这些日志进行各维度的聚合、统计、分析，在平台展示各维度可视化分析视图，方便直观获取攻击和威胁情况，并将相应的威胁事件对接到SIEM平台，云安全管理平台提供了但不局限于如下表三所示类型的数据分析与可视化：
表三
Figure PCTCN2022119324-appb-000002
实施例三
下述为本公开装置实施例，可以用于执行本公开方法实施例。对于本公开装置实施例中未披露的细节，请参照本公开方法实施例。
本实施例提供一种基于DNS解析的安全访问控制装置，设置于安全访问服务边缘节点上。该装置具有执行上述方法示例的功能，功能可以由硬件实现，也可以由硬件执行相应的软件实现。该装置可以包括：
请求分析模块，设置为根据来自目标终端的域名解析请求，确定所述目标终端的标识信息和待解析的目标域名；
策略确定模块，设置为根据所述目标终端的标识信息，确定与所述目标终端对应的目标用户相关联的安全解析策略；
解析控制模块，设置为根据所述安全解析策略，对所述目标域名进行解析控制。
实施例四
下述为本公开装置实施例，可以用于执行本公开方法实施例。对于本公开装置实施例中未披露的细节，请参照本公开方法实施例。
本实施例提供了一种基于DNS解析的安全访问控制装置，设置于目标终端，其特征在于，包括：
策略获取模块，设置为获取针对域名解析请求的引流策略，所述引流策略包括为所述目标终端分配的提供域名解析服务的安全访问服务边缘节点的地址；
请求发送模块，设置为根据所述引流策略，将生成的域名解析请求发送给所述安全访问服务边缘节点；
响应接收模块，设置为接收由所述安全访问服务边缘节点发送的响应信息，所述响应信息由所述安全访问服务边缘节点根据安全解析策略对所述域名解析请求进行解析控制生成，其中，所述安全解析策略与所述目标终端对应的目标用户相关联。
实施例五
本实施例提供一种计算机可读介质，其上存储有计算机程序，该程序被处理器执行时，实现如上述实施例所述的一种基于DNS解析的安全访问控制方法的各个步骤。
应当说明的是，本公开实现上述实施例方法中的全部或部分流程，可以通过计算机程序来指令相关的硬件来完成，所述的计算机程序可存储于一计算机可读存储介质中，该计算机程序在被处理器执行时，可实现上述各个方法实施例的步骤。其中，所述计算机程序包括计算机程序代码，所述计算机程序代码可以为源代码形式、对象代码形式、可执行文件或某些中间形式等。所述计算机可读介质可以包括：能够携带所述计算机程序代码的任何实体或装置、记录介质、U盘、移动硬盘、磁碟、光盘、计算机存储器、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、电载波信号、电信信号以及软件分发介质等。当然，还有其他方式的可读存储介质，例如量子存储器、石墨烯存储器等等。在示例性实施方式中，所述计算机可读介质包含的内容可以根据司法管辖区内立法和专利实践的要求进行适当的增减，例如在某些司法管辖区，根据立法和专利实践，计算机可读介质不包括电载波信号和电信信号。
实施例六
图8是本公开的一个实施例电子设备的结构示意图。如图8所示，在硬件层面，该电 子设备包括处理器，可选地还包括内部总线、网络接口、存储器。其中，存储器可能包含内存，例如高速随机存取存储器(Random-Access Memory，RAM)，也可能还包括非易失性存储器(non-volatile memory)，例如至少1个磁盘存储器等。当然，该电子设备还可能包括其他业务所需要的硬件。
处理器、网络接口和存储器可以通过内部总线相互连接，该内部总线可以是ISA(Industry Standard Architecture，工业标准体系结构)总线、PCI(Peripheral Component Interconnect，外设部件互连标准)总线或EISA(Extended Industry Standard Architecture，扩展工业标准结构)总线等。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图8中仅用线段表示，但并不表示仅有一根总线或一种类型的总线。
存储器，用于存放程序。具体地，程序可以包括程序代码，所述程序代码包括计算机操作指令。存储器可以包括内存和非易失性存储器，并向处理器提供指令和数据。处理器从非易失性存储器中读取对应的计算机程序到内存中然后运行。处理器执行存储器所存放的程序，以执行如图2所示的一种基于DNS解析的安全访问控制方法中的全部步骤。
上述设备提到的通信总线可以是外设部件互连标准(Peripheral Component Interconnect，PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，EISA)总线等。该通信总线可以分为地址总线、数据总线、控制总线等。为便于表示，图中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。通信接口用于上述电子设备与其他设备之间的通信。
总线包括硬件、软件或两者，用于将上述部件彼此耦接在一起。举例来说，总线可包括加速图形端口(AGP)或其他图形总线、增强工业标准架构(EISA)总线、前端总线(FSB)、超传输(HT)互连、工业标准架构(ISA)总线、无限带宽互连、低引脚数(LPC)总线、存储器总线、微信道架构(MCA)总线、外围组件互连(PCI)总线、PCI-Express(PCI-X)总线、串行高级技术附件(SATA)总线、视频电子标准协会局部(VLB)总线或其他合适的总线或者两个或更多个以上这些的组合。在合适的情况下，总线可包括一个或多个总线。尽管本公开实施例描述和示出了特定的总线，但本公开考虑任何合适的总线或互连。
存储器可以包括随机存取存储器(Random Access Memory，RAM)，也可以包括非易失性存储器(Non-Volatile Memory，NVM)，例如至少一个磁盘存储器。可选的，存储器还可以是至少一个位于远离前述处理器的存储装置。
存储器可以包括用于数据或指令的大容量存储器。举例来说而非限制，存储器可包括硬盘驱动器(Hard Disk Drive，HDD)、软盘驱动器、闪存、光盘、磁光盘、磁带或通用串 行总线(Universal Serial Bus，USB)驱动器或者两个或更多个以上这些的组合。在合适的情况下，存储器可包括可移除或不可移除(或固定)的介质。在特定实施例中，存储器是非易失性固态存储器。在特定实施例中，存储器包括只读存储器(ROM)。在合适的情况下，该ROM可以是掩模编程的ROM、可编程ROM(PROM)、可擦除PROM(EPROM)、电可擦除PROM(EEPROM)、电可改写ROM(EAROM)或闪存或者两个或更多个以上这些的组合。
上述的处理器可以是通用处理器，包括中央处理器(Central Processing Unit，CPU)、网络处理器(Network Processor，NP)等；还可以是数字信号处理器(Digital Signal Processing，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field-Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。
应当说明的是，本领域的技术人员可以清楚地了解到，为了描述的方便和简洁，仅以上述各功能单元、模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能单元、模块完成，即将所述装置的内部结构划分成不同的功能单元或模块，以完成以上描述的全部或者部分功能。实施例中的各功能单元、模块可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中，上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。另外，各功能单元、模块的具体名称也只是为了便于相互区分，并不用于限制本公开的保护范围。上述系统中单元、模块的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
上述实施例阐明的装置、设备、系统、模块或单元，具体可以由计算机芯片或实体实现，或者由具有某种功能的产品来实现。一种典型的实现设备为计算机。具体的，计算机例如可以为个人计算机、膝上型计算机、车载人机交互设备、蜂窝电话、相机电话、智能电话、个人数字助理、媒体播放器、导航设备、电子邮件设备、游戏控制台、平板计算机、可穿戴设备或者这些设备中的任何设备的组合。
虽然本公开提供了如实施例或流程图所述的方法操作步骤，但基于常规或者无创造性的手段可以包括更多或者更少的操作步骤。实施例中列举的步骤顺序仅仅为众多步骤执行顺序中的一种方式，不代表唯一的执行顺序。在实际中的装置或终端产品执行时，可以按照实施例或者附图所示的方法顺序执行或者并行执行(例如并行处理器或者多线程处理的 环境，甚至为分布式数据处理环境)。
本公开是参照根据本公开实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
应当说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
本说明书中的各个实施例均采用相关的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于装置、电子设备及可读存储介质实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
以上所述仅为本公开的实施例而已，并非用于限定本公开的保护范围。凡在本公开的精神和原则之内所作的任何修改、等同替换、改进等，均包含在本公开的保护范围内。
工业实用性
1、本公开通过云安全管理平台为目标用户配置引流策略和安全解析策略，并将引流策略分别发送至安全访问服务边缘节点以及目标用户对应的目标终端，以使目标终端根据引流策略将域名解析请求引流至安全访问服务边缘节点，同时将安全解析策略发送至安全访问服务边缘节点，以使安全访问服务边缘节点根据安全解析策略对域名解析请求中待解析的目标域名进行解析控制，实现了一种全新、高效的域名访问安全管理模式；这种域名访问安全管理模式无需配置和管理众多的安全设备，以较低的成本提高了网络通信安全性。
2、在本公开的实施例中，云安全管理平台作为管理中心，为各目标用户配置个性化的引流策略和安全解析策略，作为针对多用户的安全云网关的管理中心，具备强大的弹性和业务扩展能力，能够适合于多种场景下的域名访问，能够同时满足对域名访问的安全性和便利性的需求。
3、在本公开的实施例中，目标终端根据引流策略将域名解析请求直接发送到安全访问服务边缘节点，安全访问服务边缘节点根据域名解析请求中待解析的目标域名的类别进行检查和过滤，进而采取不同的处置方式进行应对，实现对域名的安全访问控制，操作简单高效。
4、在本公开的实施例中，CDN网络中的各个分布式节点可以为目标用户提供DNS解析服务，即各分布式节点能够对目标终端所发送的域名解析请求进行域名解析，并且能够对域名解析请求进行解析控制，从而保证目标终端的互联网访问的安全性。
5、在本公开的实施例中，分布式的安全访问服务边缘节点的部署允许目标终端可以就近接入安全访问服务边缘节点，显著降低信息到达安全访问服务边缘节点的时间延迟，使得用户体验感得以大幅度地提升。

Claims (28)

  1. 一种基于DNS解析的安全访问控制方法，应用于安全访问服务边缘节点，所述方法包括：
    根据来自目标终端的域名解析请求，确定所述目标终端的标识信息和待解析的目标域名；
    根据所述目标终端的标识信息，确定与所述目标终端对应的目标用户相关联的安全解析策略；
    根据所述安全解析策略，对所述目标域名进行解析控制。
  2. 根据权利要求1所述的方法，在根据来自目标终端的域名解析请求，确定所述目标终端的标识信息和待解析的目标域名之前，所述方法还包括：
    接收来自目标终端的域名解析请求，所述域名解析请求为根据预先设定的引流策略引流至所述安全访问服务边缘节点。
  3. 根据权利要求2所述的方法，其中，所述目标终端包括用户终端和/或分支机构的网络出口；所述引流策略包括云安全管理平台为所述目标终端分配的提供域名解析服务的安全访问服务边缘节点的地址，以使所述目标终端发送的域名解析请求被引流至所述安全访问服务边缘节点进行解析控制。
  4. 根据权利要求2所述的方法，其中，所述目标终端的标识信息包括目标终端的公网出口地址和域名解析请求的请求方式中的至少一种；
    根据所述目标终端的标识信息，确定与所述目标终端对应的目标用户相关联的安全解析策略，包括：
    根据所述目标终端的标识信息，确定所述目标终端对应的目标用户；
    根据预先存储的目标用户与安全解析策略之间的对应关系，确定与所述目标终端对应的目标用户相关联的安全解析策略。
  5. 根据权利要求4所述的方法，其中，所述目标终端的标识信息包括目标终端的公网出口地址和域名解析请求的请求方式；
    根据所述目标终端的标识信息，确定所述目标终端对应的目标用户，包括：
    若域名解析请求的请求方式是DoT或DoH时，根据所述安全访问服务边缘节点的服务域名确定目标终端对应的目标用户；
    若发送解析请求的请求方式不是DoT或DoH，且所述目标终端的公网出口地址是IPv4地址时，根据所述目标终端的公网出口地址确定所述目标终端对应的目标用户；
    若发送解析请求的请求方式不是DoT或DoH，且所述目标终端的公网出口地址不是IPv4地址时，根据为所述目标终端分配的安全访问服务边缘节点的IPv6地址确定所述目标终端对应的目标用户。
  6. 根据权利要求1所述的方法，其中，根据所述安全解析策略，对所述目标域名进行解析控制，包括：
    根据预存的安全威胁数据库，确定所述目标域名对应的威胁类别；
    根据所述威胁类别，确定对所述目标域名的处置方式，所述处置方式包括允许解析目标域名、禁止解析目标域名或观察解析目标域名，所述观察解析目标域名是指允许解析目标域名且记录当次解析日志。
  7. 根据权利要求1所述的方法，其中，根据所述安全解析策略，对所述目标域名进行解析控制，包括：
    根据预存的域名分类数据库，确定所述目标域名所对应的内容类别；
    根据所述内容类别，确定对所述目标域名的处置方式，所述处置方式包括允许解析目标域名、禁止解析目标域名或观察解析目标域名，所述观察解析目标域名是指允许解析目标域名且记录当次解析日志。
  8. 根据权利要求1所述的方法，其中，根据所述安全解析策略，对所述目标域名进行解析控制，包括：
    根据预存的自定义域名数据库，确定所述目标域名是否属于所述自定义域名数据库中的自定义域名类型；
    根据判断结果，确定对所述目标域名的处置方式，所述处置方式包括允许解析目标域名、禁止解析目标域名或更换目标域名。
  9. 根据权利要求6至8中任一项所述的方法，在根据所述安全解析策略，对所述目标域名进行解析控制之前，所述方法还包括：
    根据来自云安全管理平台的针对安全解析策略的更新信息，对预先存储的安全解析策略进行更新。
  10. 根据权利要求6至8中任一项所述的方法，在确定对所述目标域名的处置方式之后，还包括：
    当处置方式为禁止解析域名时，向所述目标终端发送用于提示禁止解析的提示信息。
  11. 根据权利要求1所述的方法，还包括：
    向云安全管理平台输出解析日志，所述解析日志记录对所述目标域名的解析结果。
  12. 一种基于DNS解析的安全访问控制方法，应用于云安全管理平台，所述方法包括：
    为目标用户配置针对域名解析请求的引流策略和安全解析策略；
    将所述引流策略分别发送至安全访问服务边缘节点以及所述目标用户对应的目标终端，以使所述目标终端根据所述引流策略将域名解析请求发送至所述安全访问服务边缘节点；
    将所述安全解析策略发送至所述安全访问服务边缘节点，以使所述安全访问服务边缘节点根据所述安全解析策略对所述域名解析请求中待解析的目标域名进行解析控制。
  13. 根据权利要求12所述的方法，其中，所述为目标用户配置针对域名解析请求的引流策略和安全解析策略，包括：
    响应于针对目标用户的配置请求，显示目标用户配置界面，所述配置界面包括多个信息配置选项；
    基于多个所述信息配置选项接收到的编辑信息，确定所述目标用户对应的公网出口地址、内网地址、引流策略以及安全解析策略。
  14. 根据权利要求12所述的方法，其中，所述目标终端包括用户终端和/或分支机构的网络出口；所述引流策略包括云安全管理平台为所述目标终端分配的提供域名解析服务的安全访问服务边缘节点的地址，以使所述目标终端发送的域名解析请求被引流至所述安全访问服务边缘节点进行解析控制。
  15. 根据权利要求12所述的方法，其中，所述安全解析策略包括域名分类解析策略、安全威胁解析策略和自定义解析策略中的至少一种。
  16. 根据权利要求15所述的方法，还包括：
    建立域名分类数据库、安全威胁数据库和自定义域名数据库中的至少一种数据库，并将所述数据库同步至所述安全访问服务边缘节点，以供所述安全访问服务边缘节点根据所述数据库对所述目标域名进行解析控制。
  17. 根据权利要求12所述的方法，还包括：
    接收由所述安全访问服务边缘节点发送的解析日志，并对所述解析日志中的解析结果进行分析和/或可视化处理。
  18. 一种基于DNS解析的安全访问控制方法，应用于目标终端，所述方法包括：
    获取针对域名解析请求的引流策略，所述引流策略包括为所述目标终端分配的提供域名解析服务的安全访问服务边缘节点的地址；
    根据所述引流策略，将生成的域名解析请求发送给所述安全访问服务边缘节点；
    接收由所述安全访问服务边缘节点发送的响应信息，所述响应信息由所述安全访问服务边缘节点根据安全解析策略对所述域名解析请求进行解析控制生成，其中，所述安全解析策略与所述目标终端对应的目标用户相关联。
  19. 根据权利要求18所述的方法，其中，所述目标终端包括用户终端和/或分支机构的网络出口。
  20. 根据权利要求18所述的方法，其中，获取针对域名解析请求的引流策略，包括：
    向云安全管理平台发送接入请求，所述接入请求包括目标终端的身份信息；
    接收由所述云安全管理平台发送的针对域名解析请求的引流策略，所述引流策略由所述云安全管理平台根据所述目标终端的身份信息进行查询而得到。
  21. 根据权利要求20所述的方法，其中，根据所述引流策略，将生成的域名解析请求发送给所述安全访问服务边缘节点，包括：
    将所述目标终端对应的DNS服务器地址指向所述安全访问服务边缘节点的地址；
    根据所述安全访问服务边缘节点的地址，将生成的域名解析请求发送至所述安全访问服务边缘节点。
  22. 一种基于DNS解析的安全访问控制系统，包括：
    云安全管理平台，设置为为目标用户配置针对域名解析请求的引流策略和安全解析策略，并将所述引流策略分别发送至安全访问服务边缘节点和所述目标用户对应的目标终端，以及将所述安全解析策略发送至所述安全访问服务边缘节点；
    安全访问服务边缘节点，设置为根据所述安全解析策略对来自所述目标终端的域名解析请求中待解析的目标域名进行解析控制。
  23. 根据权利要求22所述的系统，还包括：
    目标终端，设置为根据所述引流策略将域名解析请求发送给所述安全访问服务边缘节点。
  24. 一种基于DNS解析的安全访问控制装置，设置于安全访问服务边缘节点，所述装置包括：
    请求分析模块，设置为根据来自目标终端的域名解析请求，确定所述目标终端的标识信息和待解析的目标域名；
    策略确定模块，设置为根据所述目标终端的标识信息，确定与所述目标终端对应的目标用户相关联的安全解析策略；
    解析控制模块，设置为根据所述安全解析策略，对所述目标域名进行解析控制。
  25. 一种基于DNS解析的安全访问控制装置，设置于云安全管理平台，包括：
    策略配置模块，设置为为目标用户配置针对域名解析请求的引流策略和安全解析策略；
    第一发送模块，设置为将所述引流策略分别发送至安全访问服务边缘节点以及所述目标用户对应的目标终端，以使所述目标终端根据所述引流策略将域名解析请求发送至所述安全访问服务边缘节点；
    第二发送模块，设置为将所述安全解析策略发送至所述安全访问服务边缘节点，以使所述安全访问服务边缘节点根据所述安全解析策略对所述域名解析请求中待解析的目标域名进行解析控制。
  26. 一种基于DNS解析的安全访问控制装置，设置于目标终端，包括：
    策略获取模块，设置为获取针对域名解析请求的引流策略，所述引流策略包括为所述目标终端分配的提供域名解析服务的安全访问服务边缘节点的地址；
    请求发送模块，设置为根据所述引流策略，将生成的域名解析请求发送给所述安全访问服务边缘节点；
    响应接收模块，设置为接收由所述安全访问服务边缘节点发送的响应信息，所述响应信息由所述安全访问服务边缘节点根据安全解析策略对所述域名解析请求进行解析控制生成，其中，所述安全解析策略与所述目标终端对应的目标用户相关联。
  27. 一种计算机可读存储介质，其上存储有计算机程序，其中，该程序被处理器执行时，实现如权利要求1-21中任一项所述的一种基于DNS解析的安全访问控制方法。
  28. 一种电子设备，其中，其包括：
    处理器；
    用于存储所述处理器可执行指令的存储器；
    其中，所述处理器被配置为执行所述指令，以实现如权利要求1-21中任一项所述的一种基于DNS解析的安全访问控制方法。
PCT/CN2022/119324 2021-09-18 2022-09-16 基于dns解析的安全访问控制方法、系统、装置及设备 WO2023041039A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111110888.0 2021-09-18
CN202111110888.0A CN115826444A (zh) 2021-09-18 2021-09-18 基于dns解析的安全访问控制方法、系统、装置及设备

Publications (1)

Publication Number Publication Date
WO2023041039A1 true WO2023041039A1 (zh) 2023-03-23

Family

ID=85516039

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/119324 WO2023041039A1 (zh) 2021-09-18 2022-09-16 基于dns解析的安全访问控制方法、系统、装置及设备

Country Status (2)

Country Link
CN (1) CN115826444A (zh)
WO (1) WO2023041039A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117082029A (zh) * 2023-10-18 2023-11-17 联通在线信息科技有限公司 基于线路缓存的访问方法、装置、电子设备和存储介质

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116723172A (zh) * 2023-08-07 2023-09-08 北京安迪盟科技有限责任公司 域名访问控制方法、装置、计算机存储介质及电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150180892A1 (en) * 2013-12-21 2015-06-25 Akamai Technologies Inc. Countering security threats with the domain name system
CN107147751A (zh) * 2017-05-11 2017-09-08 上海红阵信息科技有限公司 域名解析方法及装置
CN108886540A (zh) * 2018-06-13 2018-11-23 深圳前海达闼云端智能科技有限公司 域名解析方法、装置及计算机可读存储介质
CN112954089A (zh) * 2021-04-12 2021-06-11 平安科技（深圳）有限公司 一种解析数据的方法、装置、设备以及存储介质
CN113301077A (zh) * 2020-05-20 2021-08-24 阿里巴巴集团控股有限公司 云计算服务部署与分流方法、系统、设备及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150180892A1 (en) * 2013-12-21 2015-06-25 Akamai Technologies Inc. Countering security threats with the domain name system
CN107147751A (zh) * 2017-05-11 2017-09-08 上海红阵信息科技有限公司 域名解析方法及装置
CN108886540A (zh) * 2018-06-13 2018-11-23 深圳前海达闼云端智能科技有限公司 域名解析方法、装置及计算机可读存储介质
CN113301077A (zh) * 2020-05-20 2021-08-24 阿里巴巴集团控股有限公司 云计算服务部署与分流方法、系统、设备及存储介质
CN112954089A (zh) * 2021-04-12 2021-06-11 平安科技（深圳）有限公司 一种解析数据的方法、装置、设备以及存储介质

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117082029A (zh) * 2023-10-18 2023-11-17 联通在线信息科技有限公司 基于线路缓存的访问方法、装置、电子设备和存储介质
CN117082029B (zh) * 2023-10-18 2024-02-27 联通在线信息科技有限公司 基于线路缓存的访问方法、装置、电子设备和存储介质

Also Published As

Publication number Publication date
CN115826444A (zh) 2023-03-21

Similar Documents

Publication Publication Date Title
US11588828B2 (en) Systems and methods for automated retrieval, processing, and distribution of cyber-threat information
US20230421590A1 (en) Rule-Based Network-Threat Detection
US11362987B2 (en) Fully qualified domain name-based traffic control for virtual private network access control
US10764320B2 (en) Structuring data and pre-compiled exception list engines and internet protocol threat prevention
WO2023041039A1 (zh) 基于dns解析的安全访问控制方法、系统、装置及设备
US9342691B2 (en) Internet protocol threat prevention
US9071575B2 (en) Method and system for abuse route aggregation and distribution
US10944721B2 (en) Methods and systems for efficient cyber protections of mobile devices
US9942130B2 (en) Selective routing of network traffic for remote inspection in computer networks
CN112217771B (zh) 基于租户信息的数据转发方法及数据转发装置
CN109088909B (zh) 一种基于商户类型的服务灰度发布方法及设备
WO2023274295A1 (zh) 基于云的互联网访问控制方法、装置、介质、设备和系统
CN110968848B (zh) 基于用户的权限管理方法、装置及计算设备
WO2020238971A1 (zh) 文件共享方法、装置、系统、服务器、终端及存储介质
CN114301635B (zh) 访问控制方法、装置和服务器
WO2022222524A1 (zh) 一种访问控制方法和相关设备
US20230300141A1 (en) Network security management method and computer device
CN114793163A (zh) 通信方法、装置及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22869405

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE