WO2022267977A1 - 信息处理方法、中间解析器、网络设备及存储介质 - Google Patents

信息处理方法、中间解析器、网络设备及存储介质 Download PDF

Info

Publication number
WO2022267977A1
WO2022267977A1 PCT/CN2022/099220 CN2022099220W WO2022267977A1 WO 2022267977 A1 WO2022267977 A1 WO 2022267977A1 CN 2022099220 W CN2022099220 W CN 2022099220W WO 2022267977 A1 WO2022267977 A1 WO 2022267977A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
domain name
name system
ciphertext
sensitive
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2022/099220
Other languages
English (en)
French (fr)
Inventor
尹芹
陶国军
缪川扬
童浩
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
ZTE Corp
Original Assignee
ZTE Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by ZTE Corp filed Critical ZTE Corp
Priority to EP22827472.6A priority Critical patent/EP4362421A4/en
Priority to US18/547,070 priority patent/US12513009B2/en
Publication of WO2022267977A1 publication Critical patent/WO2022267977A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4552—Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories

Definitions

  • the present application relates to the technical field of information processing, in particular to an information processing method, an intermediate parser, a network device and a storage medium.
  • the Domain Name System is an extremely widely used resolution system for mapping domain names and addresses on the Internet. Users can obtain the real Internet Protocol (Internet Protocol, IP) address of the target server by querying the domain name server, which can help users establish a link with the target server.
  • IP Internet Protocol
  • the user equipment when the user equipment initiates DNS request information for obtaining the IP address of the domain name field, it will first send the DNS request information to the intermediate resolver.
  • the intermediate resolver can include sensitive information such as the location or identity of the user equipment or the near-end service node as additional information in the DNS request information, but this will make the information transmitted in the network DNS request information exposes these sensitive information to security risks.
  • the existing DNS security protection needs to encrypt each field in the entire DNS request information. The purpose is to prevent forged feedback messages from intermediate attackers and maintain data integrity. Data breaches are not well protected.
  • the existing security technology requires all devices to have a trust mechanism that supports encryption and decryption of DNS request information, which leads to an increase in network resource overhead and equipment maintenance costs.
  • the embodiment of the present application provides an information processing method, an intermediate parser, a network device, and a storage medium, which can reduce the overhead of network resources and thereby reduce the maintenance cost of the device while avoiding exposure of sensitive information to security risks.
  • the embodiment of the present application provides an information processing method, which is applied to an intermediate parser, and the method includes:
  • the second domain name system request information is obtained according to the first domain name system request information, wherein the second domain name system request information includes ciphertext sensitive information and first ciphertext mark information, and the first ciphertext mark information is used for Indicating that the ciphertext sensitive information is ciphertext information;
  • the embodiment of the present application also provides an intermediate parser, including: a memory, a processor, and a computer program stored on the memory and operable on the processor, and the processor implements the computer program when executing the computer program.
  • an intermediate parser including: a memory, a processor, and a computer program stored on the memory and operable on the processor, and the processor implements the computer program when executing the computer program.
  • the embodiment of the present application further provides a network device, including the above-mentioned intermediate resolver.
  • the embodiment of the present application further provides a computer-readable storage medium storing computer-executable instructions, and the computer-executable instructions are used to execute the information processing method as described above.
  • the embodiment of the present application includes: receiving the first domain name system request information; obtaining the second domain name system request information according to the first domain name system request information, wherein the second domain name system request information includes ciphertext sensitive information and the first encrypted Text marking information, the first ciphertext marking information is used to indicate that the ciphertext-sensitive information is ciphertext information; the second domain name system request information is sent to the authoritative domain name system server, so that the authoritative domain name system server according to Information processing is performed on the ciphertext sensitive information and the first ciphertext mark information.
  • the embodiment of the present application includes: receiving the first domain name system request information; obtaining the second domain name system request information according to the first domain name system request information, wherein the second domain name system request information includes ciphertext sensitive information and first ciphertext tag information, The first ciphertext marking information is used to indicate that the ciphertext sensitive information is ciphertext information; the second domain name system request information is sent to the authoritative domain name system server, so that the authoritative domain name system server performs the ciphertext sensitive information and the first ciphertext marking information information processing.
  • the first domain name system request information by converting the first domain name system request information into the second domain name system request information including the ciphertext sensitive information and the first ciphertext mark information, there is no need to encrypt the entire first domain name system request information Therefore, while avoiding exposure of sensitive information to security risks, the overhead of network resources can be reduced, thereby reducing equipment maintenance costs.
  • FIG. 1 is a schematic diagram of a system architecture for executing an information processing method provided by an embodiment of the present application
  • FIG. 2 is a flowchart of an information processing method provided by an embodiment of the present application.
  • Fig. 3 is a schematic diagram of a message body substructure provided by an embodiment of the present application.
  • FIG. 4 is a schematic diagram of another message body substructure provided by an embodiment of the present application.
  • Fig. 5 is a schematic diagram of the expanded message body substructure of the RDATA element in Fig. 4;
  • Fig. 6 is the flowchart of the concrete method of step S120 in Fig. 2;
  • Fig. 7 is the flowchart of the concrete method of step S124 in Fig. 6;
  • FIG. 8 is a flowchart of another specific method of step S124 in FIG. 6;
  • FIG. 9 is a flowchart of a specific method of step S1244 in FIG. 5;
  • FIG. 10 is a flowchart of a specific method of step S122 in FIG. 6;
  • FIG. 11 is a flowchart of a specific method of step S1222 in FIG. 10;
  • FIG. 12 is a flowchart of another specific method of step S120 in FIG. 2;
  • Fig. 13 is a flowchart of a specific method of step S128 in Fig. 12;
  • Fig. 14 is a flowchart of another specific method of step S128 in Fig. 12;
  • FIG. 15 is a flowchart of a specific method of step S1284 in FIG. 14;
  • Fig. 16 is a flowchart of a specific method of step S126 in Fig. 12;
  • FIG. 17 is a flowchart of a specific method of step S1262 in FIG. 16;
  • Fig. 18 is a flowchart of an information processing method provided by another embodiment of the present application.
  • FIG. 19 is a flowchart of a specific method of step S150 in FIG. 18;
  • FIG. 20 is a flowchart of another specific method of step S150 in FIG. 18;
  • FIG. 21 is a flowchart of another specific method of step S150 in FIG. 18;
  • Fig. 22 is a flowchart of an information processing method provided in a specific example of the present application.
  • the present application provides an information processing method, an intermediate parser, a network device, and a storage medium.
  • the first domain name system request information is converted into information including ciphertext sensitive information and the first ciphertext
  • the second domain name system request information of the marking information and then send the second domain name system request information to the authoritative domain name system server, so that the authoritative domain name system server performs information processing according to the ciphertext sensitive information and the first ciphertext marking information, that is to say,
  • the solution of the embodiment of the present application transmits the second domain name system request information including the ciphertext sensitive information and the first ciphertext mark information without encrypting the entire first domain name system request information, thereby avoiding sensitive information In the case of being exposed to security risks, the overhead of network resources is reduced, thereby reducing the maintenance cost of the device; in addition, since the first ciphertext mark information is used to indicate that the ciphertext sensitive information is ciphertext information, the authoritative domain name system server can Properly decrypting
  • FIG. 1 is a schematic diagram of a system architecture for executing an information processing method provided by an embodiment of the present application.
  • the system architecture includes a client device 110 , an intermediate resolver 120 and an authoritative domain name system server 130 .
  • the intermediate resolver 120 communicates with the client device 110 and the authoritative domain name system server 130 respectively.
  • the intermediate resolver 120 can receive the first domain name system request information sent by the client device 110, and, in the case that the first domain name system request information carries sensitive information, the intermediate resolver 120 can make the first domain name system request information encrypted sensitive information to obtain the second domain name system request information carrying the ciphertext sensitive information; in the case that the first domain name system request information does not carry sensitive information, the intermediate resolver 120 can obtain the sensitive information corresponding to the client device 110 information, and encrypt the sensitive information, and then combine the first domain name system request information to generate the second domain name system request information carrying the ciphertext sensitive information.
  • the second domain name system request information also carries first ciphertext marking information for indicating that the ciphertext-sensitive information is ciphertext information.
  • the intermediate resolver 120 can also send the second domain name system request information to the authoritative domain name system server 130, so that the authoritative domain name system server 130 can perform related information processing according to the ciphertext sensitive information and the first ciphertext tag information.
  • the intermediate resolver 120 can also obtain the feedback information including the feedback type information and the second ciphertext mark information from the authoritative domain name system server 130, and the intermediate resolver 120 can convert the feedback information according to the feedback type information and the second ciphertext mark information Forward it to the client device 110, or reconstruct new domain name system request information and send it to the authoritative domain name system server 130, so that the authoritative domain name system server 130 reprocesses the new domain name system request information.
  • FIG. 2 is a flowchart of an information processing method provided by an embodiment of the present application.
  • the information processing method may be applied to an intermediate parser, such as the intermediate parser 120 in the system architecture shown in FIG. 1 .
  • the information processing method may include but not limited to step S110, step S120 and step S130.
  • Step S110 Receive the first domain name system request information.
  • the first domain name system request information is used to request a mapping relationship between a domain name and an Internet protocol address.
  • the initiator of the first domain name system request information includes, but is not limited to, the client device that needs to obtain the mapping relationship between the domain name and the Internet protocol address, and the receiver of the first domain name system request information includes, but is not limited to, Internet service provider equipment and intermediate resolvers device.
  • the first domain name system request information may carry sensitive information corresponding to the sender of the first domain name system request information, and the sensitive information may be used to identify the sender's corresponding IP address or the sender's device Corresponding hardware identification code.
  • the first domain name system request information may include extended domain name system client subnet option (EDNS Client Subnet, ECS) information, and the extended domain name system client subnet option information carries sensitive information.
  • the first domain name system request information is based on the Extension Mechanisms for DNS (EDNS) protocol of the domain name system, such as the IETF RFC 6891 protocol, and part of the extended domain name system client subnet protocol, such as the IETF RFC 7871 protocol The defined message body structure is generated.
  • EDNS Extension Mechanisms for DNS
  • the first domain name system request information is generated using a data structure defined by an extension mechanism protocol of the domain name system that transfers the packet size.
  • the first domain name system request information is sent after being encapsulated in User Datagram Protocol (UDP).
  • UDP User Datagram Protocol
  • Step S120 Obtain the second domain name system request information according to the first domain name system request information.
  • the second domain name system request information includes ciphertext sensitive information and first ciphertext marking information, and the first ciphertext marking information is used to indicate that the ciphertext sensitive information is ciphertext information.
  • the first information processing can be performed on the first domain name system request information to obtain the first information including the ciphertext sensitive information generated by encrypting the sensitive information.
  • the second domain name system request information so that the subsequent steps can send the second domain name system request information including the ciphertext sensitive information to the authoritative domain name system server.
  • first domain name system request information may or may not carry sensitive information, which is not specifically limited in this embodiment of the present application.
  • the first domain name system request information may be split into various data parts according to its components, and then the sensitive information is identified in these data parts, and then Encrypt the identified sensitive information to obtain the ciphertext sensitive information, and then combine the ciphertext sensitive information with other data in the first domain name system request information to form the second domain name system request information; Identify sensitive information in the system request information, then encrypt the identified sensitive information to obtain ciphertext sensitive information, and then update the sensitive information in the first domain name system request information to ciphertext sensitive information to obtain the second domain name system request information .
  • identifying sensitive information in each data part of the first domain name system request information can be identified based on pre-defined identification rules, or based on an intelligent analysis process identification, which is not specifically limited in this embodiment.
  • pre-defined identification rules the predefined identification rules define which fields of which tables are sensitive information; when identification is based on an intelligent analysis process, it can be automatically judged according to the specific content of the data whether it is sensitive information information.
  • the recipient of the information requested by the first domain name system can generate sensitive information corresponding to the recipient, and then the sensitive information Perform encryption processing to obtain the ciphertext sensitive information, and then combine the ciphertext sensitive information with other data in the first domain name system request information to form the second domain name system request information, or update the sensitive information in the first domain name system request information to encrypted
  • the text-sensitive information is obtained from the second domain name system request information.
  • the first domain name system request information is based on the domain name system-based extension mechanism information defined in the RFC6891 protocol
  • the second domain name system request information is based on the TTL element and the RDATA element in the message body structure defined in the RFC6891 protocol. extended.
  • FIG. 3 is a schematic diagram of a message body substructure provided by an embodiment of the present application.
  • the embodiment of the present application extends the TTL element in the message body structure defined by the RFC6891 protocol, and the message body substructure of the TTL element includes an OPTION-CODE field, an OPTION-LENGTH field and an EXTENDED-RCODE field, where , the EXTENDED-RCODE field is used to indicate that the domain name system request information has been extended, and the extended return message type is adopted.
  • This field can be combined with the RCODE field in the header field of the domain name system request information to indicate that in addition to the normal domain name system request return message More types.
  • the EXTENDED-RCODE field in the embodiment of the present application needs to be assigned a non-zero value when the domain name system request message is generated.
  • the embodiment of the present application only extends the EXTENDED-RCODE field of the message body substructure of the TTL element, and does not change the message body structure defined by the RFC6891 protocol, thereby ensuring compatibility.
  • Figure 4 is a schematic diagram of another message body substructure provided by an embodiment of the present application.
  • the structure includes an OPTION-DATA field, which can accommodate multiple pieces of additional information.
  • This embodiment of the present application extends the OPTION-DATA field.
  • FIG. 5 is a schematic diagram of the extended message body substructure of the RDATA element in FIG. 4.
  • the type of the message body substructure is defined as a pseudo address (Pseudo Address, PADR) type, and the set of the above-mentioned FAMILY field, ENCRYPTION TYPE field, ENCRYPTION FLAG field, and SIGNATURE field is defined as a PADR field.
  • the OPTION-CODE field in the message body substructure of the RDATA element is used in the embodiment of this application to indicate whether the domain name system request information carries encrypted ciphertext sensitive information, that is, whether the domain name system request information carries client equipment
  • the pseudo-address obtained by encrypting the Internet Protocol address of the Internet Protocol address or the Internet Protocol address of the intermediate resolver.
  • the OPTION-LENGTH field is used to indicate the length of the entire OPTION-DATA field.
  • the FMAILY field is used to indicate the type of ciphertext-sensitive information carried in the domain name system request information. For example, when the ciphertext sensitive information is an encrypted Internet Protocol version 4 (IPv4) address, the FMAILY field is assigned a value of 1; when the ciphertext sensitive information is an encrypted Internet Protocol version 6 (Internet Protocol version 6, IPv6) address, the FMAILY field is assigned a value of 2.
  • IPv4 Internet Protocol version 4
  • IPv6 Internet Protocol version 6
  • the ECRYPTION TYPE field is used to indicate the type of encryption algorithm used to encrypt sensitive information. For example, when the sensitive information is not encrypted, the ECRYPTION TYPE field is assigned a value of 0; when the sensitive information is encrypted using the MD5 information digest algorithm, the ECRYPTION TYPE field is assigned a value of 1; when using the Secure Hash Algorithm 1 (Secure Hash Algorithm 1 , SHA-1), the ECRYPTION TYPE field is assigned a value of 2.
  • the ECRYPTION FLAG field represents whether encrypted sensitive information has passed verification.
  • the intermediate resolver can determine whether the authoritative domain name system server has successfully decrypted the ciphertext sensitive information by whether the ECRYPTION FLAG field in the feedback details sent by the authoritative domain name system server to the intermediate resolver changes.
  • the SIGNATURE field is used to store the character string generated after encrypting the information to be protected.
  • the SIGNATURE field can store ciphertext sensitive information, or can be used to store the key used to encrypt sensitive information.
  • the message body structure of the RDATA element may also include extended domain name system client subnet option information, and the extended domain name system client subnet option information may also be used to store encrypted sensitive information.
  • the extended domain name system client subnet option information is immediately after or before the end of the previous message body in the domain name system request information, and the position of the pseudo-address field may not be fixed.
  • the pseudo address field and the extended domain name system client subnet option information are set adjacently.
  • the extended domain name system client subnet option information may not be set, or the extended domain name system client subnet option information may be assigned a value of 0.
  • Step S130 Send the second domain name system request information to the authoritative domain name system server, so that the authoritative domain name system server performs information processing according to the ciphertext sensitive information and the first ciphertext tag information.
  • the second domain name system request information including ciphertext sensitive information and first ciphertext mark information
  • the second domain name system request information can be sent to the authoritative domain name system server, so that the authoritative The domain name system server can perform data processing according to the ciphertext sensitive information and the first ciphertext mark information.
  • the embodiment of the present application does not encrypt the entire first domain name system request information, but can encrypt sensitive information separately to obtain the second domain name system request information carrying ciphertext sensitive information to realize the protection of sensitive information, thus It can reduce the overhead of network resources while avoiding the exposure of sensitive information to security risks, thereby reducing the maintenance cost of equipment; in addition, since the first ciphertext mark information is used to indicate that the ciphertext sensitive information is ciphertext information, therefore The authoritative domain name system server can properly decrypt the ciphertext sensitive information according to the first ciphertext mark information, thereby improving the processing accuracy of the second domain name system request information by the authoritative domain name system server.
  • the authoritative domain name system server After the authoritative domain name system server performs information processing according to the ciphertext sensitive information and the first ciphertext mark information, it will send a feedback result to the intermediate resolver, and the intermediate resolver can judge whether the authoritative domain name system server is based on the feedback result. Feedback on the correct mapping relationship between domain names and Internet Protocol Internet addresses.
  • the first domain name system request information includes first extended domain name system additional option information, wherein the first extended domain name system additional option information includes source-end sensitive information.
  • the first extended DNS additional option information is generated according to the extended DNS client subnet protocol, and the source sensitive information includes but not limited to the Internet Protocol address of the client device.
  • the first ciphertext tag information is stored in the OPTION-CODE field of the second domain name system request information, and the OPTION-CODE field is used in this embodiment of the application to indicate whether the domain name system request information carries an encrypted password.
  • Text-sensitive information that is, whether the domain name system request information carries the IP address of the client device or the pseudo-address obtained by encrypting the IP address of the intermediate resolver.
  • Figure 6 is a flow chart of the specific method of step S120 in Figure 2, and Figure 6 further illustrates step S120, which may include but not limited to step S121, step S122, step S123, step S124 and step S125.
  • Step S121 Obtain source-end sensitive information in the first extended DNS additional option information.
  • the source sensitive information is generated by the client device and added to the first domain name system request information.
  • the first domain name system request information includes the first extended domain name system additional option information, and the source sensitive information is generated by the client After the device is generated, it is added to the additional option information of the first extended domain name system.
  • the source-side sensitive information is used to characterize the Internet protocol address of the client device.
  • first extended domain name system additional option information may be generated by the client device, or may be generated by an intermediate resolver.
  • the source-side sensitive information is not limited to be generated only by the client device, for example, the first intermediate resolver connected to the client device side is used to realize the data penetration of the first domain name system request information, the first After the intermediate resolver obtains the request information of the first domain name system, it will verify whether the request information of the first domain name system carries sensitive information of the source end.
  • the first intermediate resolver will obtain local sensitive information according to the first domain name system request information, and send the first domain name system request information carrying the local sensitive information to the second intermediate resolver, and the local sensitive information is used to replace the local sensitive information generated by the client device
  • the second intermediate resolver encrypts the local sensitive information in the first domain name system request information to obtain ciphertext sensitive information.
  • the source sensitive information may be stored in the ADDRESS field in the first extended domain name system additional option information.
  • the source sensitive information may also be stored in the SIGNATURE field of the first domain name system request information.
  • Step S122 Encrypt the source-end sensitive information to obtain ciphertext sensitive information.
  • the encryption algorithm used to encrypt the sensitive information at the source can be a symmetric encryption algorithm, an advanced encryption standard or other encryption algorithms, and can be properly selected according to the actual application situation. This is not specifically limited.
  • the symmetric encryption algorithm refers to the encryption algorithm that uses the same key for encryption and decryption, and the sending and receiving parties need to agree on a public key before conducting secure communication.
  • Advanced Encryption Standard also known as Rijndael encryption, is a block encryption standard that can support a wider range of block and key lengths.
  • information such as the encryption algorithm or encryption strategy used to encrypt sensitive data can be included in the intermediate resolver, or the intermediate resolver can obtain it from other places, such as from the authoritative domain name system server. Obtained or obtained from the first domain name system request information, which is not specifically limited in this embodiment.
  • the encrypted ciphertext-sensitive information is stored in the SIGNATURE field of the PADR field of the second domain name system request information.
  • the second domain name system request information includes extended domain name system client subnet option information, and encrypted ciphertext sensitive information is stored in the extended domain name system client subnet option information.
  • the second domain name system request information includes an ECRYPTION TYPE field
  • the ECRYPTION TYPE field is used to indicate the encryption algorithm type used for encrypting sensitive information. For example, when the sensitive information is not encrypted, the ECRYPTION TYPE field is assigned a value of 0; when the sensitive information is encrypted using the MD5 information digest algorithm, the ECRYPTION TYPE field is assigned a value of 1; when using the Secure Hash Algorithm 1 (Secure Hash Algorithm 1 , SHA-1), the ECRYPTION TYPE field is assigned a value of 2.
  • Step S123 Construct first additional option information, wherein the first additional option information includes first ciphertext mark information.
  • the first additional option information includes first ciphertext mark information, and the first ciphertext mark information is used to indicate that the ciphertext sensitive information is ciphertext information.
  • the authoritative domain name system server After receiving the second domain name system request information, the authoritative domain name system server first Detect whether the second domain name system request information carries the first ciphertext mark information, and if the authoritative domain name system server detects the first ciphertext mark information, the authoritative domain name system server decrypts the ciphertext sensitive information.
  • the first additional option information is stored in the message body substructure of the RDATA element of the second Domain Name System request information.
  • the ciphertext mark information is stored in the OPTION-CODE field of the second Domain Name System request information.
  • Step S124 Obtain the second domain name system request information according to the ciphertext sensitive information and the first additional option information.
  • the ciphertext sensitive information and the first additional option information in the first domain name system request information are combined to form the second domain name system request information, since the embodiment of this application does not encrypt the entire first domain name system request information , but can encrypt the sensitive information separately to obtain the second domain name system request information carrying the ciphertext sensitive information to realize the protection of the sensitive information, so as to avoid the exposure of the sensitive information to security risks and reduce network resources overhead, thereby reducing the maintenance cost of the device; in addition, because the first ciphertext mark information is used to indicate that the ciphertext sensitive information is ciphertext information, the authoritative domain name system server can perform ciphertext sensitive information according to the first ciphertext mark information Proper decryption processing can improve the processing accuracy of the authoritative domain name system server for the information requested by the second domain name system.
  • the ciphertext-sensitive information and the first additional option information in the embodiment of the present application are not limited to a parallel relationship.
  • the ciphertext-sensitive information and the first additional option information may be stored in the second domain name system request information.
  • the ciphertext-sensitive information can be included in the first additional option information, so that the ciphertext-sensitive information and the first additional option information can be stored in the same field in the second Domain Name System request information .
  • the first additional option information includes a first encrypted signature field.
  • FIG. 7 is a flow chart of the specific method of step S124 in FIG. 6.
  • FIG. 7 further illustrates step S124, which may include but not limited to step S1241 and step S1242.
  • Step S1241 Fill the ciphertext sensitive information into the first encrypted signature field.
  • the ciphertext sensitive information is filled into the first encrypted signature field, and the first encrypted signature field is included in the first additional option information, which may be generated according to the extended domain name system client subnet option protocol , can also be generated according to the extended domain name system client subnet protocol.
  • the authoritative domain name system server parses it to obtain the first additional option information, and obtains the ciphertext-sensitive information by detecting the first encrypted signature field in the first additional option information.
  • the ciphertext-sensitive information is filled into the SIGNATURE field of the second domain name system request information.
  • Step S1242 Obtain second Domain Name System request information according to the first additional option information including the first ciphertext mark information and ciphertext sensitive information.
  • the authoritative domain name system server parses the request information of the second domain name system to obtain the first additional option information after obtaining it, and obtains the ciphertext sensitive information by detecting the first encrypted signature field in the first additional option information .
  • the first ciphertext mark information may also be obtained through the first additional option information.
  • FIG. 8 is a flow chart of another specific method of step S124 in FIG. 6.
  • FIG. 8 further illustrates step S124.
  • This step S124 may also include but not limited to step S1243 and step S1244.
  • Step S1243 Update the source sensitive information in the first extended DNS additional option information to ciphertext sensitive information.
  • the source-end sensitive information in the first extended DNS additional option information is updated to ciphertext-sensitive information, so the second DNS request information only encrypts the source-end sensitive information compared to the first DNS request information , and the ciphertext sensitive information generated after the source sensitive information is encrypted is still included in the additional option information of the first extended domain name system, so the second domain name system request information is not encrypted as a whole.
  • the second domain name system request information still has the same data structure as the first domain name system request information.
  • the solution of the embodiment of the present application uses the second domain name system request information including the ciphertext sensitive information and the first ciphertext tag information For transmission, there is no need to encrypt the entire first domain name system request information, so that the overhead of network resources can be reduced while avoiding exposure of sensitive information to security risks, thereby reducing equipment maintenance costs; in addition, because the first The ciphertext mark information is used to indicate that the ciphertext sensitive information is ciphertext information, so the authoritative domain name system server can properly decrypt the ciphertext sensitive information according to the first ciphertext mark information, so that the authoritative domain name system server can improve the second Processing Accuracy of Information Requested by Domain Name System.
  • the source-end sensitive information is stored in the SIGNATURE field of the first domain name system request information, and the ciphertext-sensitive information is obtained by encrypting the source-end sensitive information, and the ciphertext-sensitive information is filled into the first domain name system request The SIGNATURE field of the information to obtain the second domain name system request information.
  • Step S1244 Obtain the second DNS request information according to the updated first extended DNS additional option information and the first additional option information.
  • the intermediate resolver obtains the request information of the second domain name system according to the updated first extended domain name system additional option information and the first additional option information.
  • this embodiment of the present application does not need to encrypt the entire first domain name system request information, thereby reducing the overhead of network resources while avoiding exposure of sensitive information to security risks. Thereby reducing the maintenance cost of the device; in addition, since the first ciphertext mark information is used to indicate that the ciphertext sensitive information is ciphertext information, the authoritative domain name system server can properly decrypt the ciphertext sensitive information according to the first ciphertext mark information processing, so that the processing accuracy of the authoritative domain name system server on the information requested by the second domain name system can be improved.
  • the key used to encrypt sensitive information is stored in the first extended domain name system additional option information
  • the first additional option information includes a SIGNATURE field storing ciphertext sensitive information, so according to the updated first extension
  • the domain name system additional option information and the first additional option information obtain the second domain name system request information, which only encrypts sensitive information, but does not encrypt the entire domain name system request information.
  • FIG. 9 is a flow chart of the specific method of step S1244 in FIG. 5.
  • FIG. 9 further illustrates step S1244, which may include but not limited to step S12441 and step S12442.
  • Step S12441 Fill key information or first signature information in the first encrypted signature field, wherein the key information is used to decrypt the ciphertext sensitive information, and the first signature information is used to verify the integrity of the encrypted source sensitive information .
  • the key information can be the public key used to encrypt the sensitive information, and the authoritative domain name system server can decrypt the ciphertext sensitive information according to the key information.
  • the key information can also reflect the public key used when encrypting the sensitive information. encryption algorithm.
  • the first signature information may be used to verify the encrypted sensitive information at the source end, so as to ensure the integrity of the encrypted sensitive information at the source end.
  • the SIGNATURE field of the second domain name system request information may also be used to store the public key used to encrypt sensitive information.
  • Step S12442 According to the updated first extended domain name system additional option information and the first additional option information including key information or first signature information, obtain the second domain name system request information.
  • the second domain name system request information updates the first extended domain name system additional option information and the first additional option information including key information or first signature information compared with the first domain name system request information. Therefore, this application The embodiment does not need to encrypt the entire first domain name system request information, thereby reducing the overhead of network resources and reducing the maintenance cost of equipment while avoiding exposure of sensitive information to security risks; in addition, because the first encryption The text mark information is used to indicate that the ciphertext sensitive information is ciphertext information, so the authoritative domain name system server can properly decrypt the ciphertext sensitive information according to the first ciphertext mark information, thereby improving the authoritative domain name system server's ability to understand the second domain name The processing accuracy of the information requested by the system.
  • the first extended domain name system additional option information may store ciphertext-sensitive information, and may also store a key used to encrypt sensitive information.
  • the first additional option information includes a SIGNATURE field, and the SIGNATURE field may Store ciphertext sensitive information, and also store the key used to encrypt sensitive information. Therefore, the second domain name system request information is obtained according to the updated first extended domain name system additional option information and the first additional option information, which only encrypts sensitive information, but does not encrypt the entire domain name system request information.
  • FIG. 10 is a flow chart of the specific method of step S122 in FIG. 6.
  • FIG. 10 further illustrates step S122, which may include but not limited to step S1221 and step S1222.
  • Step S1221 Determine the first encryption strategy information according to the information length of the sensitive information at the source, where the first encryption strategy information includes the first ciphertext length.
  • the first encryption policy information is determined according to the information length of the sensitive information at the source.
  • the intermediate resolver can determine that the type of remote sensitive information is an Internet Protocol version 4 address by detecting the information length of the source-end sensitive information, and configure the first encryption policy information to correspond to the Internet Protocol version 4 address.
  • the intermediate resolver can determine that the remote sensitive information type is an Internet Protocol version 6 address by detecting the information length of the source-end sensitive information, and configure the first encryption policy information to correspond to the Internet Protocol version 6 address.
  • First encryption policy information of protocol version 6 addresses are examples of protocol version 4 addresses.
  • the first encryption policy information includes not only the length of the first ciphertext, but also an encryption method for the source-end sensitive information.
  • the source-end sensitive information corresponds to an IP version 4 address
  • the encryption method first Extract the domain name field in the form of Internet Protocol version 4 from the sensitive information at the source, and convert it into an integer and real number through the string conversion function, and limit the converted integer between 0 and 15 through the numerical limit, because it is encrypted
  • the resulting pseudo-address is also an Internet Protocol version 4 address, so it is necessary to reserve a 32-bit address space, convert the converted integer and real number into four four-digit binary numbers, fill the remaining address space with zeros, and then take 8 each time from the beginning
  • the bit binary number is converted into a decimal number to obtain the IP version 4 address, and then the hash algorithm is used to obtain the pseudo-address corresponding to the IP version 4 address, so as to realize the encryption of sensitive information.
  • the source-side sensitive information corresponds to an Internet Protocol version 6 address
  • the source-side sensitive information is regarded as a whole string for encryption.
  • the encryption algorithm used in this process includes but is not limited to the MD5 message digest algorithm, Since the sensitive information at the source is an Internet Protocol version 6 address, a 128-bit address space needs to be reserved.
  • the sensitive information at the source is too long, according to the encryption strategy, the sensitive information at the source is encrypted twice to reduce the number of encrypted ciphertext sensitive information.
  • the information length of the sensitive information at the source end may be determined by SIGNATURE in the first DNS request information, or by the length of data in the first extended DNS additional option information in the first DNS request information.
  • Step S1222 Encrypt the source sensitive information according to the first encryption policy information to obtain ciphertext sensitive information, wherein the information length of the ciphertext sensitive information matches the first ciphertext length.
  • the sensitive information at the source is encrypted according to the first encryption policy information to obtain sensitive ciphertext information.
  • the first encryption policy information is configured to correspond to an Internet Protocol
  • the first encryption policy information of the version 4 address specifically, first extract the domain name field in the form of Internet protocol version 4 from the sensitive information at the source, and convert it into an integer and real number through a string conversion function, and the conversion can be restricted by the numerical value
  • the final integer is limited between 0 and 15. Since the encrypted pseudo-address is also an Internet Protocol version 4 address, a 32-bit address space needs to be reserved, and the converted integer and real number are converted into four four-digit binary numbers.
  • the first encryption strategy information is configured as the first encryption strategy information corresponding to an Internet protocol version 6 address, and the source-side sensitive information is regarded as a whole string for encryption
  • the encryption algorithm used in this process includes but is not limited to the MD5 message digest algorithm. Since the sensitive information at the source is an Internet Protocol version 6 address, a 128-bit address space needs to be reserved.
  • the first domain name system request information is constructed based on the message body of the pseudo-address type in the embodiment of the present application, and the type of source-end sensitive information can be known through the first domain name system request information. For example, if the source-end sensitive information corresponds to If the IP version 4 address is used, the FAMILY field of the second domain name system request information is assigned a value of 1, and if the source sensitive information corresponds to an IP version 6 address, the FAMILY field of the second domain name system request information is assigned a value of 2.
  • the type of source sensitive information is determined by the FAMILY field of the first domain name system request information, for example, when the FAMILY field of the first domain name system request information is assigned a value of 1, the source sensitive information corresponds to the Internet Protocol Version 4 address, when the FAMILY field of the first domain name system request information is assigned a value of 1, the source-side sensitive information corresponds to an IP version 6 address.
  • Step S1222 may include but not limited to step S12221 and step S12222.
  • Step S12221 Perform a first encryption process on the source-side sensitive information according to the first encryption policy information to obtain first ciphertext information.
  • the source-side sensitive information is first encrypted according to the first encryption strategy information to obtain first ciphertext information
  • the first ciphertext information may be an Internet Protocol address obtained according to the source-side sensitive information, for example, when The source-side sensitive information corresponds to an IP version 4 address
  • the first encryption policy information is configured as the first encryption policy information corresponding to the IP version 4 address.
  • the IP version 4 format is extracted from the source-side sensitive information. The domain name field, and convert it into an integer and real number through the string conversion function, and limit the converted integer between 0 and 15 through the value limit.
  • the encrypted pseudo-address is also an Internet Protocol version 4 address
  • the first encryption policy information is configured as the first encryption policy information corresponding to an IP version 6 address, and the first encryption process is performed on the sensitive information at the source to obtain a 128-bit An Internet Protocol version 6 address.
  • Step S12222 Perform a second encryption process on the first ciphertext information according to the first encryption policy information to obtain ciphertext-sensitive information, wherein the information length of the ciphertext-sensitive information is smaller than the information length of the first ciphertext information.
  • the second encryption process is performed on the first ciphertext information according to the first encryption policy information to obtain the ciphertext sensitive information, for example, first extract the domain name field in the form of Internet Protocol version 4 from the source sensitive information, and pass it
  • the character string conversion function converts the integer into a real number, and the converted integer can be limited between 0 and 15 through the value limit.
  • the encrypted pseudo-address is also an Internet Protocol version 4 address
  • a 32-bit address space needs to be reserved , convert the converted integer and real numbers into four four-digit binary numbers, fill the remaining address space with zeros, and convert the 8-bit binary numbers to decimal numbers from the beginning each time to obtain the IP version 4 address, and then use the second
  • the encryption process obtains the pseudo-address corresponding to the IP version 4 address, so as to realize the encryption of sensitive information. Due to the limitation of the number of addresses, if the IP version 4 address still exceeds 32 bits after a second encryption process, at least one second encryption process is performed again to prevent the information length of the ciphertext sensitive information obtained after the encryption process from being greater than the second encryption process. The information length of a ciphertext results in information loss.
  • the encryption algorithm used in this process includes but is not limited to, since the sensitive information at the source corresponds to an IP version 6 address, a 128-bit address space needs to be reserved. If the length of the IP version 6 address obtained after the first encryption of the sensitive information at the source is still greater than 128 bits after the second encryption, then at least one second encryption is performed again to prevent the encryption from being obtained after the encryption.
  • the information length of the text-sensitive information is greater than the information length of the first ciphertext, resulting in information loss.
  • the algorithm used in the second encryption process includes but is not limited to a hash algorithm or an MD5 message digest algorithm.
  • the ECRYPTION TYPE field is set according to the encryption algorithm type used for encrypting the sensitive information. For example, when the sensitive information is not encrypted, the ECRYPTION TYPE field is assigned a value of 0; when the sensitive information is encrypted using the MD5 information digest algorithm, the ECRYPTION TYPE field is assigned a value of 1; when using the Secure Hash Algorithm 1 (Secure Hash Algorithm 1 , SHA-1), the ECRYPTION TYPE field is assigned a value of 2.
  • Figure 12 is a flowchart of another specific method of step S120 in Figure 2, and Figure 12 further illustrates step S120, when the first domain name system request information does not include the first extended domain name system additional option information , the step S120 may include but not limited to step S125, step S126, step S127 and step S128.
  • Step S125 Obtain local sensitive information according to the information requested by the first domain name system.
  • the intermediate resolver first detects whether the obtained first domain name system request information carries sensitive information. Since the sensitive information is carried in the system client subnet option information, by detecting whether the first domain name system request information includes the first extension The domain name system additional option information can determine whether the first domain name system request information carries sensitive information. When the information requested by the first domain name system does not carry sensitive information, the intermediate resolver obtains local sensitive information. Local sensitive information includes, but is not limited to, the Internet protocol address of the intermediate resolver and the hardware identification code of the intermediate resolver.
  • Step S126 Encrypt the local sensitive information to obtain ciphertext sensitive information.
  • the encryption algorithm used for encrypting local sensitive information may be a symmetric encryption algorithm, an advanced encryption standard, or other encryption algorithms, and may be appropriately selected according to actual application conditions. Not specifically limited.
  • the symmetric encryption algorithm refers to the encryption algorithm that uses the same key for encryption and decryption, and the sending and receiving parties need to agree on a public key before conducting secure communication.
  • Advanced Encryption Standard also known as Rijndael encryption, is a block encryption standard that can support a wider range of block and key lengths.
  • information such as the encryption algorithm or encryption strategy used to encrypt sensitive data can be included in the intermediate resolver, or the intermediate resolver can obtain it from other places, such as from the authoritative domain name system server. Obtained or obtained from the first domain name system request information, which is not specifically limited in this embodiment.
  • the encrypted ciphertext-sensitive information is stored in the SIGNATURE field of the PADR field of the second domain name system request information.
  • the second domain name system request information includes extended domain name system client subnet option information, and encrypted ciphertext sensitive information is stored in the extended domain name system client subnet option information.
  • the second domain name system request information includes an ECRYPTION TYPE field
  • the ECRYPTION TYPE field is used to indicate the encryption algorithm type used for encrypting sensitive information. For example, when the sensitive information is not encrypted, the ECRYPTION TYPE field is assigned a value of 0; when the sensitive information is encrypted using the MD5 information digest algorithm, the ECRYPTION TYPE field is assigned a value of 1; when using the Secure Hash Algorithm 1 (Secure Hash Algorithm 1 , SHA-1), the ECRYPTION TYPE field is assigned a value of 2.
  • Step S127 Construct the second additional option information, wherein the second additional option information includes the first ciphertext mark information.
  • the second additional option information includes the first ciphertext mark information, and the first ciphertext mark information is used to indicate that the ciphertext sensitive information is ciphertext information.
  • the authoritative domain name system server After receiving the second domain name system request information, the authoritative domain name system server first Detect whether the second domain name system request information carries the first ciphertext mark information, and if the authoritative domain name system server detects the first ciphertext mark information, the authoritative domain name system server decrypts the ciphertext sensitive information.
  • the first domain name system request information is constructed according to the extended domain name system client subnet option protocol, and the second additional option information can be included in the extended domain name system client subnet option information.
  • the second additional option information is stored in the message body substructure of the RDATA element of the second Domain Name System request information.
  • the first domain name system request information is constructed according to the extended domain name system client subnet option protocol, and the second additional option information can be included in the extended domain name system client subnet option information.
  • the first ciphertext tag information is stored in the OPTION-CODE field of the second domain name system request information, and the OPTION-CODE field is used in this embodiment of the application to indicate whether the domain name system request information carries an encrypted password.
  • Text-sensitive information that is, whether the domain name system request information carries the IP address of the client device or the pseudo-address obtained by encrypting the IP address of the intermediate resolver.
  • Step S128 Obtain the second domain name system request information according to the ciphertext sensitive information and the second additional option information.
  • the ciphertext-sensitive information and the second additional option information in the first domain name system request information are combined to form the second domain name system request information. Since the scheme of the embodiment of this application will include the ciphertext-sensitive information and the first There is no need to encrypt the entire first domain name system request information, so that the overhead of network resources can be reduced while avoiding exposure of sensitive information to security risks, thereby Reduce equipment maintenance costs; in addition, because the first ciphertext mark information is used to indicate that the ciphertext sensitive information is ciphertext information, the authoritative domain name system server can properly decrypt the ciphertext sensitive information according to the first ciphertext mark information , so that the processing accuracy of the authoritative domain name system server on the information requested by the second domain name system can be improved.
  • the ciphertext-sensitive information and the second additional option information in the embodiment of the present application are not limited to a parallel relationship.
  • the ciphertext-sensitive information and the second additional option information may be stored in the second domain name system request information.
  • the ciphertext sensitive information can be included in the second additional option information, so that the ciphertext sensitive information and the second additional option information can be stored in the same field in the second domain name system request information .
  • the second additional option information includes a second encrypted signature field.
  • FIG. 13 is a flow chart of the specific method of step S128 in FIG. 12.
  • FIG. 13 further illustrates step S128, which may include but not limited to step S1281 and step S1282.
  • Step S1281 Fill the ciphertext sensitive information into the second encrypted signature field.
  • the ciphertext sensitive information is filled into the second encrypted signature field, and the second encrypted signature field is included in the second additional option information, which may be generated according to the extended domain name system client subnet option protocol , which can also be generated according to the extended domain name system client subnet protocol.
  • the authoritative domain name system server parses it to obtain the second additional option information, and obtains the ciphertext-sensitive information by detecting the second encrypted signature field in the second additional option information.
  • the ciphertext-sensitive information is filled into the SIGNATURE field of the second domain name system request information.
  • Step S1282 Obtain second Domain Name System request information according to the second additional option information including the first ciphertext mark information and ciphertext sensitive information.
  • FIG. 14 is a flow chart of another specific method of step S128 in FIG. 12.
  • FIG. 14 further illustrates step S128, which may also include but not limited to step S1283 and step S1284.
  • Step S1283 Construct second extended DNS additional option information according to the ciphertext sensitive information, wherein the second extended DNS additional option information includes ciphertext sensitive information.
  • the second extended domain name system additional option information is constructed based on the ciphertext sensitive information, so the second domain name system request information only encrypts the local sensitive information compared with the first domain name system request information, and the local sensitive information is encrypted
  • the generated ciphertext sensitive information is still included in the additional option information of the second extended domain name system, so the second domain name system request information is not encrypted as a whole.
  • the second domain name system request information is in the first
  • the domain name system request information still has the same data structure. Therefore, this embodiment of the application does not encrypt the entire first domain name system request information, but can encrypt sensitive information separately to obtain the second domain name carrying ciphertext sensitive information.
  • the system requests information to realize the protection of sensitive information, so that the equipment in the transmission path does not need to support the encryption and decryption of the entire domain name system request information, thereby reducing the overhead of network resources and reducing the maintenance cost of equipment.
  • the ciphertext-sensitive information is filled into the second extended domain name system additional option information.
  • the second extended domain name system additional option information can also be used to store the key used for the encrypted ciphertext-sensitive information.
  • the ciphertext-sensitive information may be stored in the ADDRESS field in the second extended domain name system additional option information.
  • Step S1284 Get the second domain name system request information according to the second extended domain name system additional option information and the second additional option information.
  • the intermediate resolver obtains the second domain name system request information according to the second additional option information. Since the encrypted ciphertext sensitive information of local sensitive information is still included in the second additional option information, this embodiment of the present application does not The entire first domain name system request information is not encrypted, but the sensitive information can be encrypted separately to obtain the second domain name system request information carrying ciphertext sensitive information to realize the protection of sensitive information, so that the equipment in the transmission path does not need to It supports the encryption and decryption processing of the entire domain name system request information, thereby reducing the overhead of network resources and reducing the maintenance cost of equipment.
  • the first extended domain name system additional option information may store ciphertext-sensitive information, or a key used to encrypt sensitive information
  • the second additional option information may store a SIGNATURE field, and the SIGNATURE field may Store ciphertext sensitive information, and also store the key used to encrypt sensitive information. Therefore, the second domain name system request information is obtained according to the updated first extended domain name system additional option information and the second additional option information, which only encrypts sensitive information, but does not encrypt the entire domain name system request information.
  • FIG. 15 is a flow chart of the specific method of step S1284 in FIG. 14.
  • FIG. 15 further illustrates step S1284, which may include but not limited to step S12841 and step S12842.
  • Step S12841 Fill key information or second signature information in the second encrypted signature field, wherein the key information is used to decrypt the ciphertext sensitive information, and the second signature information is used to verify the integrity of the encrypted local sensitive information.
  • the key information can be the public key used to encrypt the sensitive information, and the authoritative domain name system server can decrypt the ciphertext sensitive information according to the key information.
  • the key information can also reflect the public key used when encrypting the sensitive information. encryption algorithm.
  • the second signature information can be used to verify the encrypted local sensitive information, so as to ensure the integrity of the local sensitive information.
  • the SIGNATURE field of the second domain name system request information may also be used to store the public key used to encrypt sensitive information.
  • Step S12842 According to the second extended domain name system additional option information and the second additional option information including key information or second signature information, obtain the second domain name system request information.
  • the second domain name system request information carries ciphertext sensitive information in the second additional option information compared with the first domain name system request information, therefore, this embodiment of the application does not encrypt the entire first domain name system request information
  • the sensitive information can be encrypted separately to obtain the second domain name system request information carrying the ciphertext sensitive information to realize the protection of sensitive information, so that the devices in the transmission path do not need to support the encryption and decryption processing of the entire domain name system request information , thereby reducing the overhead of network resources and reducing the maintenance cost of equipment.
  • FIG. 16 is a flow chart of the specific method of step S126 in FIG. 12.
  • FIG. 16 further illustrates step S126, which may include but not limited to step S1261 and step S1262.
  • Step S1261 Determine the second encryption policy information according to the information length of the local sensitive information, where the second encryption policy information includes the second ciphertext length.
  • the second encryption policy information is determined according to the information length of the local sensitive information.
  • the intermediate resolver can determine that the remote sensitive information type is an Internet Protocol version 4 address by detecting the information length of the local sensitive information, and set the second encryption strategy The information is configured as second encryption policy information corresponding to an Internet Protocol version 4 address.
  • the intermediate resolver can determine that the remote sensitive information type is an Internet Protocol version 6 address by detecting the information length of the local sensitive information, and set the second encryption strategy
  • the information is configured as second encryption policy information corresponding to an Internet Protocol version 6 address.
  • the second encryption policy information includes not only the length of the first ciphertext, but also an encryption method for local sensitive information.
  • the local sensitive information corresponds to an Internet Protocol version 4 address
  • the encryption method first from the local Extract the domain name field in the form of Internet Protocol version 4 from the sensitive information, and convert it into an integer and real number through the string conversion function, and limit the converted integer between 0 and 15 through the value limit.
  • the address is also an Internet Protocol version 4 address, so a 32-bit address space needs to be reserved, and the converted integer and real number are converted into four four-digit binary numbers, and the remaining address space is filled with zeros, and then 8-bit binary numbers are taken from the beginning each time Convert it into a decimal number to obtain the IP version 4 address, and then use the hash algorithm to obtain the pseudo-address corresponding to the IP version 4 address, so as to realize the encryption of sensitive information.
  • the local sensitive information corresponds to an Internet Protocol version 6 address
  • the local sensitive information is regarded as a whole string for encryption.
  • the encryption algorithm used in this process includes but is not limited to the MD5 information digest algorithm. Due to the local Sensitive information is an Internet Protocol version 6 address, so a 128-bit address space needs to be reserved.
  • the local sensitive information is encrypted twice to reduce the number of bits of the encrypted ciphertext sensitive information.
  • Step S1262 Encrypt the local sensitive information according to the second encryption policy information to obtain ciphertext sensitive information, wherein the information length of the ciphertext sensitive information matches the first ciphertext length.
  • the local sensitive information is encrypted according to the second encryption policy information to obtain ciphertext sensitive information.
  • the second encryption policy information is configured to correspond to an IP version 4 address.
  • the second encryption policy information of the address specifically, first extract the domain name field in the form of Internet protocol version 4 from the local sensitive information, and convert it into an integer and real number through the string conversion function, and the converted integer can be restricted by the numerical value
  • the limit is between 0 and 15.
  • the encrypted pseudo-address is also an Internet Protocol version 4 address
  • a 32-bit address space needs to be reserved, and the converted integer and real number are converted into four four-digit binary numbers, and the remaining The address space is filled with zeros, and then the 8-bit binary number is converted to a decimal number from the beginning each time to obtain the IP version 4 address, and then the hash algorithm is used to obtain the pseudo-address corresponding to the IP version 4 address, so as to realize the protection of sensitive information encryption.
  • the second encryption policy information is configured as the second encryption policy information corresponding to the IP version 6 address, and the local sensitive information is regarded as an entire string for encryption.
  • the encrypted algorithm includes but is not limited to the MD5 message digest algorithm. Since the local sensitive information is an Internet Protocol version 6 address, a 128-bit address space needs to be reserved.
  • the first domain name system request information is constructed based on the message body of the pseudo-address type in the embodiment of the present application.
  • the type of local sensitive information can be known through the first domain name system request information. For example, if the local sensitive information corresponds to the Internet protocol Version 4 address, assign the FAMILY field of the second DNS request information to 1, and assign the FAMILY field of the second Domain Name System request information to 2 if the local sensitive information corresponds to an IP version 6 address.
  • the type of local sensitive information is determined through the FAMILY field of the first domain name system request information. For example, when the FAMILY field of the first domain name system request information is assigned a value of 1, the local sensitive information corresponds to Internet protocol version 4 For the address, when the FAMILY field of the first domain name system request information is assigned a value of 1, the local sensitive information corresponds to an IP version 6 address.
  • FIG. 17 is a flow chart of the specific method of step S1262 in FIG. 16.
  • FIG. 17 further illustrates step S1262.
  • This step S1262 may include but not limited to step S12621 and step S12622.
  • Step S12621 Perform the first encryption process on the local sensitive information according to the second encryption policy information to obtain the second ciphertext information.
  • the local sensitive information is first encrypted according to the second encryption policy information to obtain the second ciphertext information
  • the second ciphertext information may be the IP address obtained according to the local sensitive information, for example, when the local sensitive information
  • the information corresponds to the IP version 4 address
  • the second encryption policy information is configured as the second encryption policy information corresponding to the IP version 4 address.
  • the domain name field in the form of the IP version 4 is extracted from the local sensitive information, and Convert it into an integer and real number through the string conversion function, and limit the converted integer between 0 and 15 through the value limit.
  • the encrypted pseudo-address is also an Internet Protocol version 4 address
  • 32 bits need to be reserved address space, convert the converted integer and real numbers into four four-digit binary numbers, fill the remaining address space with zeros, and convert 8-bit binary numbers into decimal numbers from the beginning each time to obtain Internet Protocol version 4 addresses.
  • the second encryption policy information is configured as the second encryption policy information corresponding to an Internet Protocol version 6 address, and the 128-bit Internet address is obtained by performing the first encryption process on the local sensitive information. Protocol version 6 address.
  • Step S12622 Perform a second encryption process on the second ciphertext information according to the second encryption strategy information to obtain ciphertext-sensitive information, wherein the information length of the ciphertext-sensitive information is smaller than the information length of the second ciphertext information.
  • the second encryption process is performed on the second ciphertext information according to the second encryption strategy information to obtain the ciphertext sensitive information.
  • the domain name field in the form of Internet Protocol version 4 is extracted from the local sensitive information, and passed through the character
  • the string conversion function converts it into an integer and real number, and the converted integer can be limited between 0 and 15 through the value limit. Since the encrypted pseudo-address is also an Internet Protocol version 4 address, it is necessary to reserve a 32-bit address space.
  • Due to the limitation of the number of addresses if the IP version 4 address still exceeds 32 bits after a second encryption process, at least one second encryption process is performed again to prevent the information length of the ciphertext sensitive information obtained after the encryption process from being greater than the second encryption process. The information length of the second ciphertext results in information loss.
  • the second encryption policy information is configured as the second encryption policy information corresponding to an Internet Protocol version 6 address, and the local sensitive information is regarded as an entire string for encryption
  • the The encryption algorithm used in the process includes but is not limited to, since the local sensitive information corresponds to the IP version 6 address, 128-bit address space needs to be reserved. If the length of the IP version 6 address obtained after the first encryption of the local sensitive information is still greater than 128 bits after the second encryption, perform at least one second encryption again to prevent the ciphertext obtained after the encryption The information length of the sensitive information is greater than the information length of the second ciphertext, resulting in loss of information.
  • the algorithm used in the second encryption process includes but is not limited to a hash algorithm or an MD5 message digest algorithm.
  • the ECRYPTION TYPE field is set according to the encryption algorithm type used for encrypting the sensitive information. For example, when the sensitive information is not encrypted, the ECRYPTION TYPE field is assigned a value of 0; when the sensitive information is encrypted using the MD5 information digest algorithm, the ECRYPTION TYPE field is assigned a value of 1; when using the Secure Hash Algorithm 1 (Secure Hash Algorithm 1 , SHA-1), the ECRYPTION TYPE field is assigned a value of 2.
  • FIG. 18 is a flowchart of an information processing method provided by another embodiment of the present application.
  • the information processing method may also include but not limited to step S140 and step S150 .
  • Step S140 Receive the feedback information sent by the authoritative domain name system server according to the ciphertext sensitive information and the first ciphertext mark information, wherein the feedback information includes the feedback type information and the second ciphertext mark information.
  • the authoritative domain name system server After receiving the second domain name system request information, the authoritative domain name system server generates feedback information according to the second domain name system request information, and sends the feedback information to the client device.
  • the feedback information is used to enable the client device to obtain the required
  • the feedback information is also used to let the intermediate resolver or the client device know whether the authoritative domain name system server successfully decrypts the ciphertext sensitive information in the second domain name system name request information.
  • the feedback information is constructed according to the PADR message body combination type in the embodiment of the present application.
  • the feedback information also includes extended DNS subnet option information.
  • Step S150 Perform information processing according to the feedback type information and the second ciphertext mark information.
  • the intermediate resolver performs information processing according to the feedback type information and the second ciphertext mark information carried in the feedback information, so that the intermediate resolver can perform further processing according to the processing status of the authoritative domain name system server.
  • FIG. 19 is a flow chart of the specific method of step S150 in FIG. 18.
  • FIG. 19 further illustrates step S150, which may include but not limited to step S151 and step S152.
  • Step S151 When the feedback type information indicates that the authoritative DNS server cannot recognize the second DNS request information, and the second ciphertext mark information indicates that the authoritative DNS server cannot decrypt the ciphertext sensitive information, reconstruct the first DNS request information according to the first DNS request information.
  • the authoritative domain name system server cannot decrypt the ciphertext sensitive information, so the intermediate resolver reconstructs according to the first domain name system request information
  • the third domain name system requests information, and the third domain name system request information does not include encrypted sensitive information.
  • the corresponding authoritative DNS server does not support the extended DNS client subnet option or the corresponding authoritative DNS server is not pre-configured with the corresponding decryption algorithm or the If the authoritative domain name system server fails, reconstruct the third domain name system request information and send the third domain name system request information to the authoritative domain name system server, so as to detect the availability of the authoritative domain name system server.
  • the feedback information uses the pseudo-address type message body structure in the embodiment of this application, so by checking the ECRYPTION FLAG field in the feedback information, it can be determined whether the authoritative domain name system server can recognize the second domain name system request information and whether The ciphertext sensitive information in the second domain name system request information can be decrypted.
  • the authoritative domain name system server cannot recognize the request information of the second domain name system, and cannot decrypt the ciphertext sensitive information in the request information of the second domain name system .
  • a new authoritative domain name system server is selected.
  • the third domain name system request information may or may not carry the second additional option information and/or the first extended domain name system additional option information, which is not specifically limited in this embodiment.
  • the third domain name system request information may or may not carry the second additional option information and/or the second extended domain name system additional option information, which is not specifically limited in this embodiment.
  • Step S152 Send the third domain name system request information to the authoritative domain name system server, so that the authoritative domain name system server performs information processing according to the third domain name system request information.
  • the intermediate resolver sends the third domain name system request information to the authoritative domain name system server, so that the authoritative domain name system server performs information processing according to the third domain name system request information.
  • FIG. 20 is a flowchart of another specific method of step S150 in FIG. 18.
  • FIG. 20 further illustrates step S150, which may include but not limited to step S153 and step S154.
  • Step S153 When the feedback type information indicates that the authoritative DNS server normally recognizes the request information of the second DNS, and the second ciphertext mark information indicates that the authoritative DNS server has not decrypted the sensitive information of the ciphertext, reconstruct the first DNS request information according to the first DNS request information.
  • Four domain name system request information wherein the fourth domain name system request information includes plaintext sensitive information corresponding to ciphertext sensitive information.
  • the authoritative domain name system server cannot recognize the request information of the second domain name system
  • the authoritative domain name system server cannot decrypt the ciphertext sensitive information, so the intermediate resolver reconstructs according to the first domain name system request information
  • the fourth domain name system requests information, and the fourth domain name system includes plaintext sensitive information corresponding to the ciphertext sensitive information.
  • the feedback type information indicates that the authoritative DNS server cannot recognize the request information of the second DNS, for example, the corresponding authoritative DNS server does not support the extended DNS client subnet option or the corresponding authoritative DNS server is not pre-configured with the corresponding decryption algorithm, then Reconstructing the request information of the fourth domain name system that records sensitive information in clear text, and sending the request information of the fourth domain name system to an authoritative domain name system server, so as to improve compatibility.
  • the feedback information uses the pseudo-address type message body structure in the embodiment of this application, so by checking the ECRYPTION FLAG field in the feedback information, it can be determined whether the authoritative domain name system server can recognize the second domain name system request information and whether The ciphertext sensitive information in the second domain name system request information can be decrypted.
  • the FLAG flag in the ECRYPTION FLAG field of the feedback information is 2
  • the fourth domain name system request information may or may not carry the second additional option information and/or the first extended domain name system additional option information, which is not specifically limited in this embodiment.
  • the fourth domain name system request information may or may not carry the second additional option information and/or the second extended domain name system additional option information, which is not specifically limited in this embodiment.
  • Step S154 Send the fourth domain name system request information to the authoritative domain name system server, so that the authoritative domain name system server performs information processing according to the plaintext sensitive information.
  • the intermediate resolver sends the fourth domain name system request information to the authoritative domain name system server, so that the authoritative domain name system server performs information processing according to the plaintext sensitive information carried in the fourth domain name system request information.
  • the feedback information further includes a target Internet Protocol address, where the target Internet Protocol address is an Internet Protocol address corresponding to the first Domain Name System request information.
  • FIG. 21 is a flowchart of another specific method of step S150 in FIG. 18.
  • FIG. 21 further illustrates step S150, which may include but not limited to step S155 and step S156.
  • Step S155 When the feedback type information indicates that the authoritative DNS server normally recognizes the second DNS request information, and the second ciphertext mark information indicates that the authoritative DNS server correctly decrypts the ciphertext sensitive information, cache the first DNS request information and the target Internet Mapping relationship between interconnection protocol addresses.
  • the feedback type information indicates that the authoritative domain name system server normally recognizes the request information of the second domain name system
  • the second ciphertext mark information indicates that the authoritative domain name system server correctly decrypts the ciphertext sensitive information
  • the second domain name system requests information, and decrypts the ciphertext sensitive information in the second domain name system request information, and caches the mapping relationship between the first domain name system request information and the target Internet Protocol address in the intermediate resolver
  • the feedback information uses the pseudo-address type message body structure in the embodiment of this application, so by checking the ECRYPTION FLAG field in the feedback information, it can be determined whether the authoritative domain name system server can recognize the second domain name system request information and whether The ciphertext sensitive information in the second domain name system request information can be decrypted.
  • the authoritative domain name system server can recognize the second domain name system request information and can decrypt the ciphertext sensitive information.
  • Step S156 Forward the feedback information back to the originator of the first domain name system request information.
  • the feedback information includes the Internet Protocol address corresponding to the first domain name system request information, and by forwarding the feedback information back to the initiator of the first domain name system request information, the initiator of the first domain name system request information can A mapping relationship between the first Domain Name System request information and the target Internet Protocol address is obtained.
  • the feedback information may be encrypted or unencrypted, which is not specifically limited in this embodiment.
  • the initiator of the first domain name system request information may be a client device or an intermediate resolver, which is not specifically limited in this embodiment.
  • FIG. 22 is a flowchart of an information processing method provided in a specific example of the present application.
  • the information processing method is applied to, and the information processing method includes the following steps:
  • Step S101 receiving the first domain name system request information
  • Step S102a Extract the domain name field in the first domain name system request information and check whether there is a corresponding resolution record in the local DNS cache. When there is a corresponding resolution record in the local DNS cache, construct DNS response information based on the resolution record and send it to the client device ;
  • Step S102b when there is no corresponding resolution record in the local DNS cache, obtain sensitive information
  • Step S103 Select an encryption algorithm according to the length of the sensitive information to encrypt the sensitive information to obtain the ciphertext sensitive information
  • Step S104 Reconstruct the first Domain Name System request information in eDNS0 format according to the ciphertext sensitive information to obtain the second Domain Name System request information;
  • Step S105 Encapsulate the second domain name system request information into a UDP packet and send it to the authoritative domain name system server;
  • Step S106 Receive feedback information from the authoritative domain name system server, check the RCODE field in the feedback information, and when the return code of the RCODE field is 0, check the ENCRYPTION FLAG field in the PADR field;
  • Step S107a When the field return code of the ENCRYPTION FLAG field is 0, fill in the RDATA field with unencrypted sensitive information to construct the third domain name system request information and send it to the authoritative domain name system server;
  • Step S107b When the field return code of the ENCRYPTION FLAG field is 1, check other fields of the feedback information.
  • Step S108 If all fields of the feedback information are normal, record the domain name mapping relationship in the feedback information into the local DNS cache, and forward the domain name mapping relationship back to the client device.
  • the specific method for selecting an encryption algorithm according to the length of sensitive information in step S103 includes: when the target of sensitive information is to be mapped to a shorter IPv4 address, reserve 32-bit address space, and each 4-bit corresponds to an integer. Convert the sensitive information into an integer and real number with the string conversion function, convert the converted integer and real number into four four-digit binary numbers, fill the remaining address space with zeros, and convert the 8-bit binary number to a decimal number from the beginning each time. to get the IPv4 address.
  • the EXTENDED-RCODE field in the TTL element is set to 0x1, indicating that the domain name system request information carries ciphertext-sensitive information.
  • the OPTION-CODE field in the RDATA field is set to 27000, the OPTION-LENGTH field is set to 36, and the FAMILY field is set to 1, indicating that the IPv4 address format will be used in the future;
  • the ENCRYPTION TYPE field is set to 2, indicating that crc32(), bese_convert() will be used encryption mechanism;
  • the ENCRYPTION FLAG field is set to 0, which is used in the DNS request message, indicating that the message has an encrypted pseudo-address, and by default the remote DNS authoritative server cannot recognize the message;
  • the SIGNATURE field is filled with encrypted ciphertext Sensitive information or keys used in the encryption process.
  • the pseudo-address obtained after encryption may also be filled in the ADDRESS field
  • the specific method of selecting an encryption algorithm according to the length of the sensitive information in step S103 also includes: when the target of the sensitive information is to be mapped to a longer IPv6 address, reserving a 128-bit address space. Convert sensitive information into a 128-bit character string in MD5 mode, and each 4 bits corresponds to a character to obtain an IPv6 address.
  • the EXTENDED-RCODE field in the TTL element is set to 0x1, indicating that the domain name system request information carries ciphertext-sensitive information.
  • the OPTION-CODE field in the RDATA field is set to 27000, the OPTION-LENGTH field is set to 132, and the FAMILY field is set to 2, indicating that the IPv6 address format will be used in the future; the ENCRYPTION TYPE field is set to 1; the ENCRYPTION FLAG field is set to 0 for In the DNS request message, it means that the message has an encrypted pseudo-address, and by default the remote DNS authoritative server cannot recognize the message; the SIGNATURE field is filled with encrypted ciphertext sensitive information or the key used in the encryption process.
  • the pseudo-address obtained after encryption may also be filled in the ADDRESS field of the extended domain name system client subnet option information.
  • an embodiment of the present application also provides an intermediate parser, which includes: a memory, a processor, and a computer program stored in the memory and operable on the processor.
  • the processor and memory can be connected by a bus or other means.
  • memory can be used to store non-transitory software programs and non-transitory computer-executable programs.
  • the memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid-state storage devices.
  • the memory optionally includes memory located remotely from the processor, and these remote memories may be connected to the processor via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • the intermediate parser in this embodiment can be applied to, for example, the intermediate parser 120 in the embodiment shown in Figure 1, and the intermediate parser in this embodiment can constitute, for example, the A part of the system architecture, these embodiments all belong to the same inventive concept, so these embodiments have the same implementation principle and technical effect, and will not be described in detail here.
  • the non-transitory software programs and instructions required to realize the information processing method of the above-mentioned embodiment are stored in the memory, and when executed by the processor, the information processing method in the above-mentioned embodiment is executed, for example, the above-described execution in FIG. 2
  • Method steps S1221 to S1222 Method steps S12221 to S12222 in FIG. 11 , method steps S125 to S128 in FIG. 12 , method steps S1281 to S1282 in FIG. 13 , method steps S1283 to S1284 in FIG.
  • Method steps S12841 to S12842 method steps S1261 to S1262 in FIG. 16, method steps S12621 to S12622 in FIG. 17, method steps S140 to S150 in FIG. 18, method steps S151 to S152 in FIG. Method steps S153 to S154, method steps S155 to S156 in FIG. 21 or method steps S101 to S108 as shown in FIG. 22 .
  • an embodiment of the present application also provides a network device, the network device includes the intermediate resolver in the above embodiment, so the network device in this embodiment and the intermediate resolver in the above embodiment belong to the same invention Therefore, these embodiments have the same implementation principle and technical effect, and will not be described in detail here.
  • an embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are executed by a processor or a controller, for example, by the above-mentioned Execution by a processor in the device embodiment can cause the processor to execute the information processing method in the above embodiment, for example, execute the method steps S110 to S130 in FIG. 2 and the method steps S121 to S124 in FIG. 6 described above. , method steps S1241 to S1242 in FIG. 7, method steps S1243 to S1244 in FIG. 8, method steps S12441 to S12442 in FIG. 9, method steps S1221 to S1222 in FIG. 10, method steps S12221 to S12222 in FIG.
  • method steps S125 to S128 in FIG. 12 method steps S1281 to S1282 in FIG. 13 , method steps S1283 to S1284 in FIG. 14 , method steps S12841 to S12842 in FIG. 15 , method steps S1261 to S1262 in FIG. 16 , method steps S12621 to S12622 in FIG. 17 , method steps S140 to S150 in FIG. 18 , method steps S151 to S152 in FIG. 19 , method steps S153 to S154 in FIG. 20 , method steps S155 to S156 in FIG. 21 Or the method steps S101 to S108 as shown in FIG. 22 .
  • Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, tape, magnetic disk storage or other magnetic storage devices, or can Any other medium used to store desired information and which can be accessed by a computer.
  • communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了信息处理方法、中间解析器、网络设备及存储介质。其中，信息处理方法包括：接收第一域名系统请求信息；根据第一域名系统请求信息得到第二域名系统请求信息，其中，第二域名系统请求信息包括密文敏感信息和第一密文标记信息，第一密文标记信息用于指示密文敏感信息为密文信息；将第二域名系统请求信息发送给权威域名系统服务器，使得权威域名系统服务器根据密文敏感信息和第一密文标记信息进行信息处理。

Description

信息处理方法、中间解析器、网络设备及存储介质
相关申请的交叉引用
本申请基于申请号为202110712488.0、申请日为2021年6月25日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本申请涉及信息处理技术领域，尤其是一种信息处理方法、中间解析器、网络设备及存储介质。
背景技术
域名系统(Domain Name System，DNS)是在互联网上应用极其广泛的一套域名和地址映射的解析系统。用户通过对域名服务器进行域名查询能够获得目标服务器的真实网际互连协议(Internet Protocol，IP)地址，从而能够帮助用户建立和目标服务器的链接。
在相关技术中，当用户设备发起获取域名字段的IP地址的DNS请求信息时，会先将该DNS请求信息发送给中间解析器。为了提供更加精确的归属地判断，中间解析器可以在DNS请求信息中，将能够标识用户设备或者近端服务节点的位置或身份等敏感信息作为附加信息，但是，这会使得在网络中传输的DNS请求信息把这些敏感信息暴露在安全风险之下。现有的DNS安全保护为了应对该安全风险，需要对整个DNS请求信息中的每一个字段都进行加密处理，其目的是防止中间攻击者的伪造反馈消息，保持数据的完整性，但这对于敏感数据泄露则没有很好的保护作用。并且，现有的安全技术要求所有设备均具有支持对DNS请求信息的加密处理和解密处理的信任机制，从而导致了网络资源开销的增加，提高了设备的维护成本。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本申请实施例提供了一种信息处理方法、中间解析器、网络设备及存储介质，能够在避免敏感信息暴露在安全风险之下的情况下，降低网络资源的开销，从而降低设备的维护成本。
第一方面，本申请实施例提供了一种信息处理方法，应用于中间解析器，所述方法包括：
接收第一域名系统请求信息；
根据所述第一域名系统请求信息得到第二域名系统请求信息，其中，所述第二域名系统请求信息包括密文敏感信息和第一密文标记信息，所述第一密文标记信息用于指示所述密文敏感信息为密文信息；
将所述第二域名系统请求信息发送给权威域名系统服务器，使得所述权威域名系统服务器根据所述密文敏感信息和所述第一密文标记信息进行信息处理。
第二方面，本申请实施例还提供了一种中间解析器，包括：存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现如上所述 的信息处理方法。
第三方面，本申请实施例还提供了一种网络设备，包括有如上所述的中间解析器。
第四方面，本申请实施例还提供了一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行如上所述的信息处理方法。
本申请实施例包括：接收第一域名系统请求信息；根据所述第一域名系统请求信息得到第二域名系统请求信息，其中，所述第二域名系统请求信息包括密文敏感信息和第一密文标记信息，所述第一密文标记信息用于指示所述密文敏感信息为密文信息；将所述第二域名系统请求信息发送给权威域名系统服务器，使得所述权威域名系统服务器根据所述密文敏感信息和所述第一密文标记信息进行信息处理。
本申请实施例包括：接收第一域名系统请求信息；根据第一域名系统请求信息得到第二域名系统请求信息，其中，第二域名系统请求信息包括密文敏感信息和第一密文标记信息，第一密文标记信息用于指示密文敏感信息为密文信息；将第二域名系统请求信息发送给权威域名系统服务器，使得权威域名系统服务器根据密文敏感信息和第一密文标记信息进行信息处理。根据本申请实施例的方案，通过将第一域名系统请求信息转换成包括有密文敏感信息和第一密文标记信息的第二域名系统请求信息，无需对整个第一域名系统请求信息进行加密处理，因此能够在避免敏感信息暴露在安全风险之下的情况下，降低网络资源的开销，从而降低设备的维护成本。
本申请的其它特征和优点将在随后的说明书中阐述，并且，部分地从说明书中变得显而易见，或者通过实施本申请而了解。本申请的目的和其他优点可通过在说明书、权利要求书以及附图中所特别指出的结构来实现和获得。
附图说明
附图用来提供对本申请技术方案的进一步理解，并且构成说明书的一部分，与本申请的实施例一起用于解释本申请的技术方案，并不构成对本申请技术方案的限制。
图1是本申请一个实施例提供的用于执行信息处理方法的系统架构的示意图；
图2是本申请一个实施例提供的信息处理方法的流程图；
图3是本申请一个实施例提供的一种消息体子结构的示意图；
图4是本申请一个实施例提供的另一种消息体子结构的示意图；
图5是图4中的RDATA元素的消息体子结构经过扩展后的示意图；
图6是图2中步骤S120的具体方法的流程图；
图7是图6中步骤S124的具体方法的流程图；
图8是图6中步骤S124的另一具体方法的流程图；
图9是图5中步骤S1244的具体方法的流程图；
图10是图6中步骤S122的具体方法的流程图；
图11是图10中步骤S1222的具体方法的流程图；
图12是图2中步骤S120的另一具体方法的流程图；
图13是图12中步骤S128的具体方法的流程图；
图14是图12中步骤S128的另一具体方法的流程图；
图15是图14中步骤S1284的具体方法的流程图；
图16是图12中步骤S126的具体方法的流程图；
图17是图16中步骤S1262的具体方法的流程图；
图18是本申请另一个实施例提供的信息处理方法的流程图；
图19是图18中步骤S150的具体方法的流程图；
图20是图18中步骤S150的另一具体方法的流程图；
图21是图18中步骤S150的另一具体方法的流程图；
图22是本申请一个具体示例提供的信息处理方法的流程图。
具体实施方式
为了使本申请的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处所描述的具体实施例仅用以解释本申请，并不用于限定本申请。
需要说明的是，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于流程图中的顺序执行所示出或描述的步骤。说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
本申请提供了一种信息处理方法、中间解析器、网络设备及存储介质，当接收到第一域名系统请求信息，将第一域名系统请求信息转换成包括有密文敏感信息和第一密文标记信息的第二域名系统请求信息，接着将第二域名系统请求信息发送给权威域名系统服务器，使得权威域名系统服务器根据密文敏感信息和第一密文标记信息进行信息处理，即是说，本申请实施例的方案通过将包括有密文敏感信息和第一密文标记信息的第二域名系统请求信息进行传输，无需对整个第一域名系统请求信息进行加密处理，从而能够在避免敏感信息暴露在安全风险之下的情况下，降低网络资源的开销，从而降低设备的维护成本；另外，由于第一密文标记信息用于指示密文敏感信息为密文信息，因此权威域名系统服务器可以根据第一密文标记信息对密文敏感信息进行适当的解密处理，从而可以提高权威域名系统服务器对第二域名系统请求信息的处理准确性。
下面结合附图，对本申请实施例作进一步阐述。
如图1所示，图1是本申请一个实施例提供的用于执行信息处理方法的系统架构的示意图。在图1的示例中，该系统架构包括客户端设备110、中间解析器120和权威域名系统服务器130。其中，中间解析器120分别与客户端设备110和权威域名系统服务器130通信连接。
中间解析器120能够接收由客户端设备110发送的第一域名系统请求信息，并且，在第一域名系统请求信息携带有敏感信息的情况下，中间解析器120能够对第一域名系统请求信息中的敏感信息进行加密，得到携带有密文敏感信息的第二域名系统请求信息；在第一域名系统请求信息不携带敏感信息的情况下，中间解析器120能够获取与客户端设备110对应的敏感信息，并对该敏感信息进行加密，接着结合第一域名系统请求信息生成携带有密文敏感信息的第二域名系统请求信息。此外，第二域名系统请求信息还携带有用于指示密文敏感信息为密文信息的第一密文标记信息。另外，中间解析器120还能够将第二域名系统请求信息发送至权威域名系统服务器130，使得权威域名系统服务器130能够根据密文敏感信息和第一密文标记信息进行相关的信息处理。此外，中间解析器120还能够从权威域名系统服务器 130获取包括有反馈类型信息和第二密文标记信息的反馈信息，中间解析器120能够根据反馈类型信息和第二密文标记信息将反馈信息转发至客户端设备110，或者重新构建新的域名系统请求信息并发送给权威域名系统服务器130，使得权威域名系统服务器130对新的域名系统请求信息重新进行处理。
本申请实施例描述的系统架构以及应用场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域技术人员可知，随着系统架构的演变和新应用场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本领域技术人员可以理解的是，图1中示出的系统架构并不构成对本申请实施例的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
基于上述系统架构，下面提出本申请的数据处理方法的各个实施例。
如图2所示，图2是本申请一个实施例提供的信息处理方法的流程图，该信息处理方法，可以应用于中间解析器，例如图1所示系统架构中的中间解析器120。该信息处理方法可以包括但不限于有步骤S110、步骤S120和步骤S130。
步骤S110：接收第一域名系统请求信息。
本步骤中，第一域名系统请求信息用于请求域名与网际协议互联地址间的映射关系。第一域名系统请求信息的发起方包括但不限于需要获取域名与网际协议互联地址间映射关系的客户端设备，第一域名系统请求信息的接收方包括但不限于互联网服务提供商设备和中间解析器。
在一实施例中，第一域名系统请求信息可以携带对应于第一域名系统请求信息的发送方的敏感信息，该敏感信息可以用于表征该发送方对应的网际协议互联地址或该发送方设备对应的硬件标识码。
具体地，在一实施例中，第一域名系统请求信息可以包括扩展域名系统客户端子网选项(EDNS Client Subnet，ECS)信息，该扩展域名系统客户端子网选项信息携带有敏感信息。在一实施例中，第一域名系统请求信息基于域名系统的扩展名机制(Extension Mechanisms for DNS，EDNS)协议，如IETF RFC 6891协议，以及部分扩展域名系统客户端子网协议，如IETF RFC 7871协议所定义的消息体结构生成。
具体地，在一实施例中，采用一种传递包大小的域名系统的扩展名机制协议所定义的数据结构生成第一域名系统请求信息。
在一实施例中，第一域名系统请求信息以用户数据报协议(User Datagram Protocol，UDP)封装后发送。
步骤S120：根据第一域名系统请求信息得到第二域名系统请求信息。其中，第二域名系统请求信息包括密文敏感信息和第一密文标记信息，第一密文标记信息用于指示密文敏感信息为密文信息。
本步骤中，由于在步骤S110中接收到了第一域名系统请求信息，因此可以对该第一域名系统请求信息进行第一信息处理，得到包括由敏感信息经过加密后生成的密文敏感信息的第二域名系统请求信息，以便于后续步骤可以将该包括有密文敏感信息的第二域名系统请求信息信息发送给权威域名系统服务器。
需要说明的是，第一域名系统请求信息可以携带有敏感信息，也可以不携带敏感信息， 本申请实施例对此不做具体限定。
需要说明的是，对第一域名系统请求信息进行第一信息处理得到第二域名系统请求信息，可以有不同的实施方式，本实施例对此并不作具体限定。例如，在第一域名系统请求信息携带有敏感信息的情况下，可以先将第一域名系统请求信息按照其各个组成部分拆分成各个数据部分，然后在这些数据部分中识别出敏感信息，再对识别出的敏感信息进行加密处理得到密文敏感信息，接着将密文敏感信息和第一域名系统请求信息中的其他数据合并形成第二域名系统请求信息；又如，可以先在第一域名系统请求信息中识别出敏感信息，然后对识别出的敏感信息进行加密处理得到密文敏感信息，接着将第一域名系统请求信息中的敏感信息更新为密文敏感信息得到第二域名系统请求信息。其中，在第一域名系统请求信息的各个数据部分中识别出敏感信息，或者直接在第一域名系统请求信息中识别出敏感信息，可以基于预先定义的识别规则进行识别，也可以基于智能分析过程进行识别，本实施例对此并不作具体限定。例如，当基于预先定义的识别规则进行识别时，该预先定义的识别规则定义了哪些表的哪些字段属于敏感信息；当基于智能分析过程进行识别时，可以根据数据的具体内容自动判断是否属于敏感信息。再如，在第一域名系统请求信息不携带敏感信息的情况下，可以由第一域名系统请求信息的接收方，如中间解析器，生成对应于该接收方的敏感信息，然后对该敏感信息进行加密处理得到密文敏感信息，接着将密文敏感信息和第一域名系统请求信息中的其他数据合并形成第二域名系统请求信息，或者将第一域名系统请求信息中的敏感信息更新为密文敏感信息得到第二域名系统请求信息。
在一实施例中，第一域名系统请求信息是基于RFC6891协议中定义的基于域名系统的扩展名机制信息，第二域名系统请求信息对于RFC6891协议定义的消息体结构中的TTL元素和RDATA元素进行了扩展。
具体地，如图3所示，图3是本申请一个实施例提供的一种消息体子结构的示意图。参照图3，本申请实施例对RFC6891协议定义的消息体结构中的TTL元素进行了扩展，TTL元素的消息体子结构中包括有OPTION-CODE字段、OPTION-LENGTH字段和EXTENDED-RCODE字段，其中，EXTENDED-RCODE字段用于表示域名系统请求信息经过了扩展，采用了扩展返回消息类型，此字段和域名系统请求信息中头部字段中的RCODE字段合并可以表示除普通域名系统请求返回消息之外更多的类型。例如，EXTENDED-RCODE字段和RCODE字段合并后为0x1则表示本域名系统请求信息采用了本申请实施例中的扩展返回消息类型。此外，当EXTENDED-RCODE字段为0则表示不使用扩展返回消息类型。因此，本申请实施例中的EXTENDED-RCODE字段需要在域名系统请求消息生成时赋值为非0值。
需要说明的是，本申请实施例仅对TTL元素的消息体子结构的EXTENDED-RCODE字段进行了扩展，并未改变由RFC6891协议定义的消息体结构，从而保证了兼容性。
如图4所示，图4是本申请一个实施例提供的另一种消息体子结构的示意图，参照图4，本申请实施例对RFC6891协议定义的消息体结构中的RDATA元素的消息体子结构包括有OPTION-DATA字段，该字段可以容纳多个附加信息，本申请实施例对于OPTION-DATA字段进行了扩展。
具体地，参照图5，图5是图4中的RDATA元素的消息体子结构经过扩展后的示意图，在图5的示例中，OPTION-DATA字段经过扩展后包括FAMILY字段、ENCRYPTION TYPE 字段、ENCRYPTION FLAG字段和SIGNATURE字段。本申请实施例将该种消息体子结构的类型定义为伪地址(Pseudo Address，PADR)类型，上述FAMILY字段、ENCRYPTION TYPE字段、ENCRYPTION FLAG字段和SIGNATURE字段的集合定义为PADR字段。
RDATA元素的消息体子结构中的OPTION-CODE字段在本申请实施例中用于表示域名系统请求信息是否携带有加密后的密文敏感信息，也即表示域名系统请求信息是否携带有用户端设备的网际协议地址或中间解析器的网际协议地址经过加密后得到的伪地址。
OPTION-LENGTH字段用于表示整个OPTION-DATA字段的长度。
FMAILY字段用于表示域名系统请求信息中携带的密文敏感信息的类型。例如，当密文敏感信息是经过加密后的网际协议版本4(Internet Protocol version 4，IPv4)地址，则FMAILY字段赋值为1，当密文敏感信息是经过加密后的网际协议版本6(Internet Protocol version 6，IPv6)地址，则FMAILY字段赋值为2。
ECRYPTION TYPE字段用于表示对敏感信息进行加密所使用的加密算法类型。例如，当敏感信息未经加密，则ECRYPTION TYPE字段赋值为0，当采用MD5信息摘要算法对敏感信息进行加密，则ECRYPTION TYPE字段赋值为1，当使用使用安全散列算法1(Secure Hash Algorithm 1，SHA-1)则ECRYPTION TYPE字段赋值为2。
ECRYPTION FLAG字段是代表加密敏感信息是否通过验证。例如中间解析器能够通过权威域名系统服务器向中间解析器发送的反馈细信息中的ECRYPTION FLAG字段是否发生变化来判断权威域名系统服务器是否成功对密文敏感信息进行了解密。
SIGNATURE字段用于存储对需要保护的信息进行加密后生成的字符串，例如SIGNATURE字段可以存储密文敏感信息，或者可以用于存储加密敏感信息所使用的密钥。
此外，RDATA元素的消息体结构中还可以包括扩展域名系统客户端子网选项信息，该扩展域名系统客户端子网选项信息同样可以用于存储密文敏感信息。
需要说明的是，扩展域名系统客户端子网选项信息紧随在域名系统请求信息中的上一个消息体的结尾之后或者之前，伪地址字段的位置可以不固定。
具体地，在域名系统请求信息同时设置有伪地址字段和扩展域名系统客户端子网选项信息时，伪地址字段和扩展域名系统客户端子网选项信息相邻设置。
在一实施例中，当密文敏感信息存储于域名系统请求信息的SIGNATURE字段中，则可以不设置扩展域名系统客户端子网选项信息，或者将扩展域名系统客户端子网选项信息赋值为0。
步骤S130：将第二域名系统请求信息发送给权威域名系统服务器，使得权威域名系统服务器根据密文敏感信息和第一密文标记信息进行信息处理。
本步骤中，由于在步骤S120中得到了包括密文敏感信息和第一密文标记信息的第二域名系统请求信息，因此可以将该第二域名系统请求信息发送给权威域名系统服务器，使得权威域名系统服务器可以根据密文敏感信息和第一密文标记信息进行数据处理。由于本申请实施例并未对整个第一域名系统请求信息进行加密处理，而是能够将敏感信息单独加密得到携带有密文敏感信息的第二域名系统请求信息以实现对敏感信息的保护，从而能够在避免敏感信息暴露在安全风险之下的情况下，降低网络资源的开销，从而降低设备的维护成本；另外，由于第一密文标记信息用于指示密文敏感信息为密文信息，因此权威域名系统服务器可以根据第一密文标记信息对密文敏感信息进行适当的解密处理，从而可以提高权威域名系统服务 器对第二域名系统请求信息的处理准确性。
需要说明的是，权威域名系统服务器在根据密文敏感信息和第一密文标记信息进行信息处理后，会向中间解析器发送反馈结果，中间解析器能够根据该反馈结果判断权威域名系统服务器是否反馈了正确的域名与网际协议互联地址间的映射关系。
在一实施例中，第一域名系统请求信息包括第一扩展域名系统附加选项信息，其中，第一扩展域名系统附加选项信息包括源端敏感信息。第一扩展域名系统附加选项信息是根据扩展域名系统客户端子网协议生成的，源端敏感信息包括但不限于客户端设备的网际互连协议地址。
在一实施例中，第一密文标记信息存储于第二域名系统请求信息的OPTION-CODE字段，OPTION-CODE字段在本申请实施例中用于表示域名系统请求信息是否携带有加密后的密文敏感信息，也即表示域名系统请求信息是否携带有用户端设备的网际协议地址或中间解析器的网际协议地址经过加密后得到的伪地址。
如图6所示，图6是图2中步骤S120的具体方法的流程图，图6对步骤S120进行进一步的说明，该步骤S120可以包括但不限于步骤S121、步骤S122、步骤S123、步骤S124和步骤S125。
步骤S121：获取第一扩展域名系统附加选项信息中的源端敏感信息。
本步骤中，源端敏感信息由客户端设备生成后添加至第一域名系统请求信息中，具体地，第一域名系统请求信息包括第一扩展域名系统附加选项信息，源端敏感信息由客户端设备生成后添加至第一扩展域名系统附加选项信息中。源端敏感信息用于表征客户端设备的网际互联协议地址。
需要说明的是，第一扩展域名系统附加选项信息可以由客户端设备生成，也可以由中间解析器生成。
需要说明的是，源端敏感信息并非仅仅限定于仅由客户端设备生成，例如，连接到用户端设备一侧的第一中间解析器用于实现第一域名系统请求信息的数据穿透，第一中间解析器获取到第一域名系统请求信息后会校验第一域名系统请求信息是否携带有源端敏感信息，在第一域名系统请求信息未携带源端敏感信息的情况下，第一中间解析器会根据第一域名系统请求信息获取本地敏感信息，并向第二中间解析器发送携带有该本地敏感信息的第一域名系统请求信息，该本地敏感信息即用于替代由客户端设备生成的源端敏感信息，第二中间解析器在接收到该第一域名系统请求信息后，对第一域名系统请求信息中的本地敏感信息进行加密处理得到密文敏感信息。
在一实施例中，源端敏感信息可以存储在第一扩展域名系统附加选项信息中的ADDRESS字段中。
在一实施例中，源端敏感信息也可以存储在第一域名系统请求信息的SIGNATURE字段中。
步骤S122：对源端敏感信息进行加密处理得到密文敏感信息。
需要说明的是，对源端敏感信息进行加密处理而采用到的加密算法，可以是对称加密算法、高级加密标准或者其他加密算法，可以根据实际的应用情况而进行适当的选择，本实施例对此并不作具体限定。其中，对称加密算法是指加密和解密使用相同密钥的加密算法，收发双方在进行安全通信之前，需要商定一个公共密钥。高级加密标准又称Rijndael加密法， 是一种区块加密标准，能够支持更大范围的区块和密钥长度。
需要说明的是，对敏感数据进行加密处理而采用到的加密算法或加密策略等信息，可以包含在中间解析器中，也可以是中间解析器从其他地方获取得到，例如从权威域名系统服务器中获取得到或者从第一域名系统请求信息中获取得到，本实施例对此并不作具体限定。
在一实施例中，加密后的密文敏感信息存储于第二域名系统请求信息PADR字段的SIGNATURE字段中。
在一实施例中，第二域名系统请求信息包括扩展域名系统客户端子网选项信息，加密后的密文敏感信息存储于该扩展域名系统客户端子网选项信息中。
在一实施例中，第二域名系统请求信息包括ECRYPTION TYPE字段，ECRYPTION TYPE字段用于表示对敏感信息进行加密所使用的加密算法类型。例如，当敏感信息未经加密，则ECRYPTION TYPE字段赋值为0，当采用MD5信息摘要算法对敏感信息进行加密，则ECRYPTION TYPE字段赋值为1，当使用使用安全散列算法1(Secure Hash Algorithm 1，SHA-1)则ECRYPTION TYPE字段赋值为2。
步骤S123：构建第一附加选项信息，其中，第一附加选项信息包括第一密文标记信息。
本步骤中，第一附加选项信息包括第一密文标记信息，第一密文标记信息用于指示密文敏感信息为密文信息，权威域名系统服务器在接收到第二域名系统请求信息后首先检测该第二域名系统请求信息是否携带有第一密文标记信息，在权威域名系统服务器检测到第一密文标记信息的情况下，权威域名系统服务器对密文敏感信息进行解密。
在一实施例中，第一附加选项信息存储于第二域名系统请求信息的RDATA元素的消息体子结构中。
在一实施例中，密文标记信息存储于第二域名系统请求信息OPTION-CODE字段中。
步骤S124：根据密文敏感信息和第一附加选项信息得到第二域名系统请求信息。
本步骤中，将密文敏感信息和第一域名系统请求信息中的第一附加选项信息合并形成第二域名系统请求信息，由于本申请实施例并未对整个第一域名系统请求信息进行加密处理，而是能够将敏感信息单独加密得到携带有密文敏感信息的第二域名系统请求信息以实现对敏感信息的保护，从而能够在避免敏感信息暴露在安全风险之下的情况下，降低网络资源的开销，从而降低设备的维护成本；另外，由于第一密文标记信息用于指示密文敏感信息为密文信息，因此权威域名系统服务器可以根据第一密文标记信息对密文敏感信息进行适当的解密处理，从而可以提高权威域名系统服务器对第二域名系统请求信息的处理准确性。
需要说明的是，本申请实施例中的密文敏感信息与第一附加选项信息不限于是并列关系，例如，密文敏感信息和第一附加选项信息可以存储于第二域名系统请求信息中的两个不同的字段中，再如，密文敏感信息可以包含于第一附加选项信息中，使得密文敏感信息和第一附加选项信息可以存储于第二域名系统请求信息中的同一个字段中。
在一实施例中，第一附加选项信息包括第一加密签名字段。
如图7所示，图7是图6中步骤S124的具体方法的流程图，图7对步骤S124进行进一步的说明，该步骤S124可以包括但不限于有步骤S1241和步骤S1242。
步骤S1241：将密文敏感信息填充进第一加密签名字段。
本步骤中，密文敏感信息被填充进第一加密签名字段，第一加密签名字段被包含在第一附加选项信息中，第一附加选项信息可以是根据扩展域名系统客户端子网选项协议生成的， 也可以是根据扩展域名系统客户端子网协议生成的。权威域名系统服务器在获取到第二域名系统请求信息后对其进行解析以获得第一附加选项信息，并通过检测第一附加选项信息中的第一加密签名字段获取密文敏感信息。
在一实施例中，密文敏感信息被填充进第二域名系统请求信息的SIGNATURE字段中。
步骤S1242：根据包括第一密文标记信息和密文敏感信息的第一附加选项信息，得到第二域名系统请求信息。
本步骤中，权威域名系统服务器在获取到第二域名系统请求信息后对其进行解析以获得第一附加选项信息，并通过检测第一附加选项信息中的第一加密签名字段获取密文敏感信息。在一实施例中，第一密文标记信息也可以通过第一附加选项信息得到。
如图8所示，图8是图6中步骤S124的另一具体方法的流程图，图8对步骤S124进行进一步的说明，该步骤S124还可以包括但不限于有步骤S1243和步骤S1244。
步骤S1243：将第一扩展域名系统附加选项信息中的源端敏感信息更新为密文敏感信息。
本步骤中，将第一扩展域名系统附加选项信息中的源端敏感信息更新为密文敏感信息，因此第二域名系统请求信息相比第一域名系统请求信息仅对于源端敏感信息进行了加密，且源端敏感信息进行加密后生成的密文敏感信息仍包含于第一扩展域名系统附加选项信息中，因此第二域名系统请求信息并未整体进行加密，相比第一域名系统请求信息，第二域名系统请求信息于第一域名系统请求信息仍具有相同的数据结构，因此，本申请实施例的方案通过将包括有密文敏感信息和第一密文标记信息的第二域名系统请求信息进行传输，无需对整个第一域名系统请求信息进行加密处理，从而能够在避免敏感信息暴露在安全风险之下的情况下，降低网络资源的开销，从而降低设备的维护成本；另外，由于第一密文标记信息用于指示密文敏感信息为密文信息，因此权威域名系统服务器可以根据第一密文标记信息对密文敏感信息进行适当的解密处理，从而可以提高权威域名系统服务器对第二域名系统请求信息的处理准确性。
在一实施例中，源端敏感信息存储在第一域名系统请求信息的SIGNATURE字段中，通过对源端敏感信息进行加密得到密文敏感信息，并将密文敏感信息填充进第一域名系统请求信息的SIGNATURE字段中以得到第二域名系统请求信息。
步骤S1244：根据更新后的第一扩展域名系统附加选项信息和第一附加选项信息得到第二域名系统请求信息。
本步骤中，中间解析器根据更新后的第一扩展域名系统附加选项信息和第一附加选项信息得到第二域名系统请求信息，由于源端敏感信息经加密后的密文敏感信息仍包含在第一扩展域名系统附加选项信息中，因此，本申请实施例无需对整个第一域名系统请求信息进行加密处理，从而能够在避免敏感信息暴露在安全风险之下的情况下，降低网络资源的开销，从而降低设备的维护成本；另外，由于第一密文标记信息用于指示密文敏感信息为密文信息，因此权威域名系统服务器可以根据第一密文标记信息对密文敏感信息进行适当的解密处理，从而可以提高权威域名系统服务器对第二域名系统请求信息的处理准确性。
在一实施例中，第一扩展域名系统附加选项信息中存储有加密敏感信息所使用的密钥，第一附加选项信息包括存储有密文敏感信息的SIGNATURE字段，因此根据更新后的第一扩展域名系统附加选项信息和第一附加选项信息得到第二域名系统请求信息，其仅仅对敏感信息进行了加密，并未对整个域名系统请求信息进行加密。
如图9所示，图9是图5中步骤S1244的具体方法的流程图，图9对步骤S1244进行进一步的说明，该步骤S1244可以包括但不限于有步骤S12441和步骤S12442。
步骤S12441：在第一加密签名字段中填充密钥信息或者第一签名信息，其中，密钥信息用于解密密文敏感信息，第一签名信息用于验证加密后的源端敏感信息的完整性。
本步骤中，密钥信息可以是加密敏感信息所使用的公钥，权威域名系统服务器能够根据该密钥信息对密文敏感信息进行解密，此外，密钥信息还可以反应加密敏感信息时所使用的加密算法。第一签名信息可以用于对加密后的源端敏感信息进行校验，以保证加密后的源端敏感信息的完整性。
在一实施例中，第二域名系统请求信息的SIGNATURE字段也可以用于存储加密敏感信息所使用的公钥。
步骤S12442：根据更新后的第一扩展域名系统附加选项信息，以及包括密钥信息或者第一签名信息的第一附加选项信息，得到第二域名系统请求信息。
本步骤中，第二域名系统请求信息相比第一域名系统请求信息更新了第一扩展域名系统附加选项信息以及包括有密钥信息或者第一签名信息的第一附加选项信息，因此，本申请实施例无需对整个第一域名系统请求信息进行加密处理，从而能够在避免敏感信息暴露在安全风险之下的情况下，降低网络资源的开销，从而降低设备的维护成本；另外，由于第一密文标记信息用于指示密文敏感信息为密文信息，因此权威域名系统服务器可以根据第一密文标记信息对密文敏感信息进行适当的解密处理，从而可以提高权威域名系统服务器对第二域名系统请求信息的处理准确性。
在一实施例中，第一扩展域名系统附加选项信息中可以存储有密文敏感信息，也可以存储有加密敏感信息所使用的密钥，第一附加选项信息包括存储有SIGNATURE字段，SIGNATURE字段可以存储密文敏感信息，也可以存储用于加密敏感信息所使用的密钥。因此根据更新后的第一扩展域名系统附加选项信息和第一附加选项信息得到第二域名系统请求信息，其仅仅对敏感信息进行了加密，并未对整个域名系统请求信息进行加密。
如图10所示，图10是图6中步骤S122的具体方法的流程图，图10对步骤S122进行进一步的说明，该步骤S122可以包括但不限于有步骤S1221和步骤S1222。
步骤S1221：根据源端敏感信息的信息长度确定第一加密策略信息，其中，第一加密策略信息包括第一密文长度。
本步骤中，通过源端敏感信息的信息长度确定第一加密策略信息。当源端敏感信息为网际协议版本4地址，中间解析器能够通过检测源端敏感信息的信息长度确定远端敏感信息类型为网际协议版本4地址，并将第一加密策略信息配置为对应于网际协议版本4地址的第一加密策略信息。当源端敏感信息为网际协议版本6地址，中间解析器能够通过检测源端敏感信息的信息长度确定远端敏感信息类型为网际协议版本6地址，并将第一加密策略信息配置为对应于网际协议版本6地址的第一加密策略信息。
在一实施例中，第一加密策略信息除了包括第一密文长度，还包括对于源端敏感信息的加密方法，例如，当源端敏感信息对应于网际协议版本4地址，根据加密方法，首先从源端敏感信息中提取网际协议版本4形式的域名字段，并将其通过字符串转换函数转换成整实数，并可以通过数值限制将转换后的整数限制在0～15之间，由于经过加密后的伪地址也是网际协议版本4地址，因此需要预留32位的地址空间，将转换后的整实数再转换为4个四位的二进 制数，余下地址空间补零，再从头每次取8位二进制数转换为十进制数，以得到网际协议版本4地址，再采用哈希算法获得该网际协议版本4地址所对应的伪地址，以实现对于敏感信息的加密。
又如，当源端敏感信息对应于网际协议版本6地址，根据加密方法，将源端敏感信息视为一个整字符串进行加密，该过程所使用的加密算法包括但不限于MD5信息摘要算法，由于源端敏感信息为网际协议版本6地址，因此需要预留128位的地址空间。
再如，当源端敏感信息过长，根据加密策略，对源端敏感信息进行二次加密处理以缩减加密后的密文敏感信息的位数。
在一实施例中，源端敏感信息的信息长度可以通过第一域名系统请求信息中的SIGNATURE确定，或者通过第一域名系统请求信息中的第一扩展域名系统附加选项信息中数据的长度确定。
步骤S1222：根据第一加密策略信息对源端敏感信息进行加密处理得到密文敏感信息，其中，密文敏感信息的信息长度与第一密文长度相匹配。
本步骤中，根据第一加密策略信息对源端敏感信息进行加密处理得到密文敏感信息，例如，当源端敏感信息对应网际协议版本4地址，第一加密策略信息则配置为对应于网际协议版本4地址的第一加密策略信息，具体地，首先从源端敏感信息中提取网际协议版本4形式的域名字段，并将其通过字符串转换函数转换成整实数，并可以通过数值限制将转换后的整数限制在0～15之间，由于经过加密后的伪地址也是网际协议版本4地址，因此需要预留32位的地址空间，将转换后的整实数再转换为4个四位的二进制数，余下地址空间补零，再从头每次取8位二进制数转换为十进制数，以得到网际协议版本4地址，再采用哈希算法获得该网际协议版本4地址所对应的伪地址，以实现对于敏感信息的加密。
此外，当源端敏感信息对应网际协议版本6地址，第一加密策略信息则配置为对应于网际协议版本6地址的第一加密策略信息，将源端敏感信息视为一个整字符串进行加密，该过程所使用的加密算法包括但不限于MD5信息摘要算法，由于源端敏感信息为网际协议版本6地址，因此需要预留128位的地址空间。
在一实施例中，第一域名系统请求信息基于本申请实施例的伪地址类型消息体构建，通过第一域名系统请求信息能够得知源端敏感信息的类型，例如，若源端敏感信息对应网际协议版本4地址，则将第二域名系统请求信息的FAMILY字段赋值为1，若源端敏感信息对应网际协议版本6地址，则将第二域名系统请求信息的FAMILY字段赋值为2。
在一实施例中，源端敏感信息的类型是通过第一域名系统请求信息的FAMILY字段确定的，例如，当第一域名系统请求信息的FAMILY字段赋值为1，则源端敏感信息对应网际协议版本4地址，当第一域名系统请求信息的FAMILY字段赋值为1，则源端敏感信息对应网际协议版本6地址。
如图11所示，图11是图10中步骤S1222的具体方法的流程图，图11对步骤S1222进行进一步的说明，当第一域名系统请求信息不包括第一扩展域名系统附加选项信息，该步骤S1222可以包括但不限于有步骤S12221和步骤S12222。
步骤S12221：根据第一加密策略信息对源端敏感信息进行第一加密处理得到第一密文信息。
本步骤中，根据第一加密策略信息对源端敏感信息进行第一加密处理得到第一密文信息， 第一密文信息可以是根据源端敏感信息得到的网际互连协议地址，例如，当源端敏感信息对应网际协议版本4地址，第一加密策略信息则配置为对应于网际协议版本4地址的第一加密策略信息，具体地，首先从源端敏感信息中提取网际协议版本4形式的域名字段，并将其通过字符串转换函数转换成整实数，并可以通过数值限制将转换后的整数限制在0～15之间，由于经过加密后的伪地址也是网际协议版本4地址，因此需要预留32位的地址空间，将转换后的整实数再转换为4个四位的二进制数，余下地址空间补零，再从头每次取8位二进制数转换为十进制数，以得到网际协议版本4地址。又如，当源端敏感信息对应网际协议版本6地址，第一加密策略信息则配置为对应于网际协议版本6地址的第一加密策略信息，通过源端敏感信息进行第一加密处理得到128位的网际协议版本6地址。
步骤S12222：根据第一加密策略信息对第一密文信息进行第二加密处理得到密文敏感信息，其中，密文敏感信息的信息长度小于第一密文信息的信息长度。
本步骤中，根据第一加密策略信息对第一密文信息进行第二加密处理得到密文敏感信息，例如，首先从源端敏感信息中提取网际协议版本4形式的域名字段，并将其通过字符串转换函数转换成整实数，并可以通过数值限制将转换后的整数限制在0～15之间，由于经过加密后的伪地址也是网际协议版本4地址，因此需要预留32位的地址空间，将转换后的整实数再转换为4个四位的二进制数，余下地址空间补零，再从头每次取8位二进制数转换为十进制数，以得到网际协议版本4地址，再采用第二加密处理获得该网际协议版本4地址所对应的伪地址，以实现对于敏感信息的加密。由于地址位数限制，若网际协议版本4地址经过一次第二加密处理后仍超过32位，则再次进行至少一次第二加密处理，以防止加密处理后得到的密文敏感信息的信息长度大于第一密文的信息长度而导致信息丢失。
又如，当源端敏感信息对应网际协议版本6地址，第一加密策略信息则配置为对应于网际协议版本6地址的第一加密策略信息，将源端敏感信息视为一个整字符串进行加密，该过程所使用的加密算法包括但不限于，由于源端敏感信息对应网际协议版本6地址，因此需要预留128位的地址空间。若源端敏感信息经过第一加密处理后获得的网际协议版本6地址经过一次第二加密处理后信息长度仍超过128位，则再次进行至少一次第二加密处理，以防止加密处理后得到的密文敏感信息的信息长度大于第一密文的信息长度而导致信息丢失。
在一实施例中，第二加密处理采用的算法包括但不限于哈希算法或MD5信息摘要算法。
在一实施例中，对密文敏感信息进行加密后，根据对敏感信息进行加密所使用的加密算法类型设置ECRYPTION TYPE字段。例如，当敏感信息未经加密，则ECRYPTION TYPE字段赋值为0，当采用MD5信息摘要算法对敏感信息进行加密，则ECRYPTION TYPE字段赋值为1，当使用使用安全散列算法1(Secure Hash Algorithm 1，SHA-1)则ECRYPTION TYPE字段赋值为2。
如图12所示，图12是图2中步骤S120的另一具体方法的流程图，图12对步骤S120进行进一步的说明，当第一域名系统请求信息不包括第一扩展域名系统附加选项信息，该步骤S120可以包括但不限于有步骤S125、步骤S126、步骤S127和步骤S128。
步骤S125：根据第一域名系统请求信息获取本地敏感信息。
本步骤中，中间解析器首先检测获取到的第一域名系统请求信息是否携带有敏感信息，由于敏感信息携带于系统客户端子网选项信息，因此通过检测第一域名系统请求信息是否包括第一扩展域名系统附加选项信息即可确定第一域名系统请求信息是否携带有敏感信息。当 第一域名系统请求信息未携带敏感信息，则该中间解析器获取本地敏感信息。本地敏感信息包括但不限于该中间解析器的网际互联协议地址以及该中间解析器的硬件标识码。
步骤S126：对本地敏感信息进行加密处理得到密文敏感信息。
需要说明的是，对本地敏感信息进行加密处理而采用到的加密算法，可以是对称加密算法、高级加密标准或者其他加密算法，可以根据实际的应用情况而进行适当的选择，本实施例对此并不作具体限定。其中，对称加密算法是指加密和解密使用相同密钥的加密算法，收发双方在进行安全通信之前，需要商定一个公共密钥。高级加密标准又称Rijndael加密法，是一种区块加密标准，能够支持更大范围的区块和密钥长度。
需要说明的是，对敏感数据进行加密处理而采用到的加密算法或加密策略等信息，可以包含在中间解析器中，也可以是中间解析器从其他地方获取得到，例如从权威域名系统服务器中获取得到或者从第一域名系统请求信息中获取得到，本实施例对此并不作具体限定。
在一实施例中，加密后的密文敏感信息存储于第二域名系统请求信息PADR字段的SIGNATURE字段中。
在一实施例中，第二域名系统请求信息包括扩展域名系统客户端子网选项信息，加密后的密文敏感信息存储于该扩展域名系统客户端子网选项信息中。
在一实施例中，第二域名系统请求信息包括ECRYPTION TYPE字段，ECRYPTION TYPE字段用于表示对敏感信息进行加密所使用的加密算法类型。例如，当敏感信息未经加密，则ECRYPTION TYPE字段赋值为0，当采用MD5信息摘要算法对敏感信息进行加密，则ECRYPTION TYPE字段赋值为1，当使用使用安全散列算法1(Secure Hash Algorithm 1，SHA-1)则ECRYPTION TYPE字段赋值为2。
步骤S127：构建第二附加选项信息，其中，第二附加选项信息包括第一密文标记信息。
本步骤中，第二附加选项信息包括第一密文标记信息，第一密文标记信息用于指示密文敏感信息为密文信息，权威域名系统服务器在接收到第二域名系统请求信息后首先检测该第二域名系统请求信息是否携带有第一密文标记信息，在权威域名系统服务器检测到第一密文标记信息的情况下，权威域名系统服务器对密文敏感信息进行解密。
在一实施例中，第一域名系统请求信息是根据扩展域名系统客户端子网选项协议构建的，第二附加选项信息可以包含在扩展域名系统客户端子网选项信息中。
在一实施例中，第二附加选项信息存储于第二域名系统请求信息的RDATA元素的消息体子结构中。
在一实施例中，第一域名系统请求信息是根据扩展域名系统客户端子网选项协议构建的，第二附加选项信息可以包含在扩展域名系统客户端子网选项信息中。
在一实施例中，第一密文标记信息存储于第二域名系统请求信息的OPTION-CODE字段，OPTION-CODE字段在本申请实施例中用于表示域名系统请求信息是否携带有加密后的密文敏感信息，也即表示域名系统请求信息是否携带有用户端设备的网际协议地址或中间解析器的网际协议地址经过加密后得到的伪地址。
步骤S128：根据密文敏感信息和第二附加选项信息得到第二域名系统请求信息。
本步骤中，将密文敏感信息和第一域名系统请求信息中的第二附加选项信息合并形成第二域名系统请求信息，由于本申请实施例的方案通过将包括有密文敏感信息和第一密文标记信息的第二域名系统请求信息进行传输，无需对整个第一域名系统请求信息进行加密处理， 从而能够在避免敏感信息暴露在安全风险之下的情况下，降低网络资源的开销，从而降低设备的维护成本；另外，由于第一密文标记信息用于指示密文敏感信息为密文信息，因此权威域名系统服务器可以根据第一密文标记信息对密文敏感信息进行适当的解密处理，从而可以提高权威域名系统服务器对第二域名系统请求信息的处理准确性。
需要说明的是，本申请实施例中的密文敏感信息与第二附加选项信息不限于是并列关系，例如，密文敏感信息和第二附加选项信息可以存储于第二域名系统请求信息中的两个不同的字段中，再如，密文敏感信息可以包含于第二附加选项信息中，使得密文敏感信息和第二附加选项信息可以存储于第二域名系统请求信息中的同一个字段中。
在一实施例中，第二附加选项信息包括第二加密签名字段。
如图13所示，图13是图12中步骤S128的具体方法的流程图，图13对步骤S128进行进一步的说明，该步骤S128可以包括但不限于有步骤S1281和步骤S1282。
步骤S1281：将密文敏感信息填充进第二加密签名字段。
本步骤中，密文敏感信息被填充进第二加密签名字段，第二加密签名字段被包含在第二附加选项信息中，第二附加选项信息可以是根据扩展域名系统客户端子网选项协议生成的，也可以是根据扩展域名系统客户端子网协议生成的。权威域名系统服务器在获取到第二域名系统请求信息后对其进行解析以获得第二附加选项信息，并通过检测第二附加选项信息中的第二加密签名字段获取密文敏感信息。
在一实施例中，密文敏感信息被填充进第二域名系统请求信息的SIGNATURE字段中。
步骤S1282：根据包括第一密文标记信息和密文敏感信息的第二附加选项信息，得到第二域名系统请求信息。
本步骤中，权威域名系统服务器在获取到第二域名系统请求信息后对其进行解析以获得第二附加选项信息，并通过检测第二附加选项信息中的第二加密签名字段获取密文敏感信息。如图14所示，图14是图12中步骤S128的另一具体方法的流程图，图14对步骤S128进行进一步的说明，该步骤S128还可以包括但不限于有步骤S1283和步骤S1284。
步骤S1283：根据密文敏感信息构建第二扩展域名系统附加选项信息，其中，第二扩展域名系统附加选项信息包括密文敏感信息。
本步骤中，根据密文敏感信息构建第二扩展域名系统附加选项信息，因此第二域名系统请求信息相比第一域名系统请求信息仅对于本地敏感信息进行了加密，且本地敏感信息进行加密后生成的密文敏感信息仍包含于第二扩展域名系统附加选项信息中，因此第二域名系统请求信息并未整体进行加密，相比第一域名系统请求信息，第二域名系统请求信息于第一域名系统请求信息仍具有相同的数据结构，因此，本申请实施例并未对整个第一域名系统请求信息进行加密处理，而是能够将敏感信息单独加密得到携带有密文敏感信息的第二域名系统请求信息以实现对敏感信息的保护，使得传输路径中的设备无需支持整个域名系统请求信息的加密和解密处理，从而减少了网络资源的开销，降低了设备的维护成本。
在一实施例中，密文敏感信息填充至第二扩展域名系统附加选项信息中，此外，第二扩展域名系统附加选项信息还可用于保存加密后的密文敏感信息所使用的密钥。
在一实施例中，密文敏感信息可以存储在第二扩展域名系统附加选项信息中的ADDRESS字段中。
步骤S1284：根据第二扩展域名系统附加选项信息和第二附加选项信息得到第二域名系 统请求信息。
本步骤中，中间解析器根据第二附加选项信息得到第二域名系统请求信息，由于本地敏感信息经加密后的密文敏感信息仍包含在第二附加选项信息中，因此，本申请实施例并未对整个第一域名系统请求信息进行加密处理，而是能够将敏感信息单独加密得到携带有密文敏感信息的第二域名系统请求信息以实现对敏感信息的保护，使得传输路径中的设备无需支持整个域名系统请求信息的加密和解密处理，从而减少了网络资源的开销，降低了设备的维护成本。
在一实施例中，第一扩展域名系统附加选项信息中可以存储有密文敏感信息，也可以存储有加密敏感信息所使用的密钥，第二附加选项信息包括存储有SIGNATURE字段，SIGNATURE字段可以存储密文敏感信息，也可以存储用于加密敏感信息所使用的密钥。因此根据更新后的第一扩展域名系统附加选项信息和第二附加选项信息得到第二域名系统请求信息，其仅仅对敏感信息进行了加密，并未对整个域名系统请求信息进行加密。
如图15所示，图15是图14中步骤S1284的具体方法的流程图，图15对步骤S1284进行进一步的说明，该步骤S1284可以包括但不限于有步骤S12841和步骤S12842。
步骤S12841：在第二加密签名字段中填充密钥信息或者第二签名信息，其中，密钥信息用于解密密文敏感信息，第二签名信息用于验证加密后的本地敏感信息的完整性。
本步骤中，密钥信息可以是加密敏感信息所使用的公钥，权威域名系统服务器能够根据该密钥信息对密文敏感信息进行解密，此外，密钥信息还可以反应加密敏感信息时所使用的加密算法。第二签名信息可以用于对加密后的本地敏感信息进行校验，以保证本地敏感信息的完整性。
在一实施例中，第二域名系统请求信息的SIGNATURE字段也可以用于存储加密敏感信息所使用的公钥。
步骤S12842：根据第二扩展域名系统附加选项信息，以及包括密钥信息或者第二签名信息的第二附加选项信息，得到第二域名系统请求信息。
本步骤中，第二域名系统请求信息相比第一域名系统请求信息在第二附加选项信息中携带了密文敏感信息，因此，本申请实施例并未对整个第一域名系统请求信息进行加密处理，而是能够将敏感信息单独加密得到携带有密文敏感信息的第二域名系统请求信息以实现对敏感信息的保护，使得传输路径中的设备无需支持整个域名系统请求信息的加密和解密处理，从而减少了网络资源的开销，降低了设备的维护成本。
如图16所示，图16是图12中步骤S126的具体方法的流程图，图16对步骤S126进行进一步的说明，该步骤S126可以包括但不限于有步骤S1261和步骤S1262。
步骤S1261：根据本地敏感信息的信息长度确定第二加密策略信息，其中，第二加密策略信息包括第二密文长度。
本步骤中，通过本地敏感信息的信息长度确定第二加密策略信息。当本地敏感信息对应网际协议版本4(Internet Protocol version 4，IPv4)地址，中间解析器能够通过检测本地敏感信息的信息长度确定远端敏感信息类型为网际协议版本4地址，并将第二加密策略信息配置为对应于网际协议版本4地址的第二加密策略信息。当本地敏感信息对应网际协议版本6(Internet Protocol version 6，IPv4)地址，中间解析器能够通过检测本地敏感信息的信息长度确定远端敏感信息类型为网际协议版本6地址，并将第二加密策略信息配置为对应于网际协 议版本6地址的第二加密策略信息。
在一实施例中，第二加密策略信息除了包括第一密文长度，还包括对于本地敏感信息的加密方法，例如，当本地敏感信息对应于网际协议版本4地址，根据加密方法，首先从本地敏感信息中提取网际协议版本4形式的域名字段，并将其通过字符串转换函数转换成整实数，并可以通过数值限制将转换后的整数限制在0～15之间，由于经过加密后的伪地址也是网际协议版本4地址，因此需要预留32位的地址空间，将转换后的整实数再转换为4个四位的二进制数，余下地址空间补零，再从头每次取8位二进制数转换为十进制数，以得到网际协议版本4地址，再采用哈希算法获得该网际协议版本4地址所对应的伪地址，以实现对于敏感信息的加密。
又如，当本地敏感信息对应于网际协议版本6地址，根据加密方法，将本地敏感信息视为一个整字符串进行加密，该过程所使用的加密算法包括但不限于MD5信息摘要算法，由于本地敏感信息为网际协议版本6地址，因此需要预留128位的地址空间。
再如，当本地敏感信息过长，根据加密方法，对本地敏感信息进行二次加密处理以缩减加密后的密文敏感信息的位数。
步骤S1262：根据第二加密策略信息对本地敏感信息进行加密处理得到密文敏感信息，其中，密文敏感信息的信息长度与第一密文长度相匹配。
本步骤中，根据第二加密策略信息对本地敏感信息进行加密处理得到密文敏感信息，例如，当本地敏感信息对应网际协议版本4地址，第二加密策略信息则配置为对应于网际协议版本4地址的第二加密策略信息，具体地，首先从本地敏感信息中提取网际协议版本4形式的域名字段，并将其通过字符串转换函数转换成整实数，并可以通过数值限制将转换后的整数限制在0～15之间，由于经过加密后的伪地址也是网际协议版本4地址，因此需要预留32位的地址空间，将转换后的整实数再转换为4个四位的二进制数，余下地址空间补零，再从头每次取8位二进制数转换为十进制数，以得到网际协议版本4地址，再采用哈希算法获得该网际协议版本4地址所对应的伪地址，以实现对于敏感信息的加密。
此外，当本地敏感信息对应网际协议版本6地址，第二加密策略信息则配置为对应于网际协议版本6地址的第二加密策略信息，将本地敏感信息视为一个整字符串进行加密，该过程所加密算法包括但不限于MD5信息摘要算法，由于本地敏感信息为网际协议版本6地址，因此需要预留128位的地址空间。
在一实施例中，第一域名系统请求信息基于本申请实施例的伪地址类型消息体构建，通过第一域名系统请求信息能够得知本地敏感信息的类型，例如，若本地敏感信息对应网际协议版本4地址，则将第二域名系统请求信息的FAMILY字段赋值为1，若本地敏感信息对应网际协议版本6地址，则将第二域名系统请求信息的FAMILY字段赋值为2。
在一实施例中，本地敏感信息的类型是通过第一域名系统请求信息的FAMILY字段确定的，例如，当第一域名系统请求信息的FAMILY字段赋值为1，则本地敏感信息对应网际协议版本4地址，当第一域名系统请求信息的FAMILY字段赋值为1，则本地敏感信息对应网际协议版本6地址。
如图17所示，图17是图16中步骤S1262的具体方法的流程图，图17对步骤S1262进行进一步的说明，该步骤S1262可以包括但不限于有步骤S12621和步骤S12622。
步骤S12621：根据第二加密策略信息对本地敏感信息进行第一加密处理得到第二密文信 息。
本步骤中，根据第二加密策略信息对本地敏感信息进行第一加密处理得到第二密文信息，第二密文信息可以是根据本地敏感信息得到的网际互连协议地址，例如，当本地敏感信息对应网际协议版本4地址，第二加密策略信息则配置为对应于网际协议版本4地址的第二加密策略信息，具体地，首先从本地敏感信息中提取网际协议版本4形式的域名字段，并将其通过字符串转换函数转换成整实数，并可以通过数值限制将转换后的整数限制在0～15之间，由于经过加密后的伪地址也是网际协议版本4地址，因此需要预留32位的地址空间，将转换后的整实数再转换为4个四位的二进制数，余下地址空间补零，再从头每次取8位二进制数转换为十进制数，以得到网际协议版本4地址。又如，当本地敏感信息对应网际协议版本6地址，第二加密策略信息则配置为对应于网际协议版本6地址的第二加密策略信息，通过本地敏感信息进行第一加密处理得到128位的网际协议版本6地址。
步骤S12622：根据第二加密策略信息对第二密文信息进行第二加密处理得到密文敏感信息，其中，密文敏感信息的信息长度小于第二密文信息的信息长度。
本步骤中，根据第二加密策略信息对第二密文信息进行第二加密处理得到密文敏感信息，例如，首先从本地敏感信息中提取网际协议版本4形式的域名字段，并将其通过字符串转换函数转换成整实数，并可以通过数值限制将转换后的整数限制在0～15之间，由于经过加密后的伪地址也是网际协议版本4地址，因此需要预留32位的地址空间，将转换后的整实数再转换为4个四位的二进制数，余下地址空间补零，再从头每次取8位二进制数转换为十进制数，以得到网际协议版本4地址，再采用第二加密处理获得该网际协议版本4地址所对应的伪地址，以实现对于敏感信息的加密。由于地址位数限制，若网际协议版本4地址经过一次第二加密处理后仍超过32位，则再次进行至少一次第二加密处理，以防止加密处理后得到的密文敏感信息的信息长度大于第二密文的信息长度而导致信息丢失。
又如，当本地敏感信息对应网际协议版本6地址，第二加密策略信息则配置为对应于网际协议版本6地址的第二加密策略信息，将本地敏感信息视为一个整字符串进行加密，该过程所使用的加密算法包括但不限于，由于本地敏感信息对应网际协议版本6地址，因此需要预留128位的地址空间。若本地敏感信息经过第一加密处理后获得的网际协议版本6地址经过一次第二加密处理后信息长度仍超过128位，则再次进行至少一次第二加密处理，以防止加密处理后得到的密文敏感信息的信息长度大于第二密文的信息长度而导致信息丢失。
在一实施例中，第二加密处理采用的算法包括但不限于哈希算法或MD5信息摘要算法。
在一实施例中，对密文敏感信息进行加密后，根据对敏感信息进行加密所使用的加密算法类型设置ECRYPTION TYPE字段。例如，当敏感信息未经加密，则ECRYPTION TYPE字段赋值为0，当采用MD5信息摘要算法对敏感信息进行加密，则ECRYPTION TYPE字段赋值为1，当使用使用安全散列算法1(Secure Hash Algorithm 1，SHA-1)则ECRYPTION TYPE字段赋值为2。
如图18所示，图18是本申请另一个实施例提供的信息处理方法的流程图，参照图18，该信息处理方法还可以包括但不限于有步骤S140和步骤S150。
步骤S140：接收权威域名系统服务器根据密文敏感信息和第一密文标记信息发送的反馈信息，其中，反馈信息包括反馈类型信息和第二密文标记信息。
本步骤中，权威域名系统服务器接收到第二域名系统请求信息后，根据第二域名系统请 求信息生成反馈信息，并向客户端设备发送该反馈信息，反馈信息用于使客户端设备得到所需的域名与网际互连协议地址的对应关系，此外，反馈信息还用于使得中间解析器或客户端设备获知权威域名系统服务器是否成功解密第二域系统名请求信息中的密文敏感信息。
在一实施例中，反馈信息是根据本申请实施例中的PADR消息体结合类型构建的。
在一实施例中，反馈信息也包括有扩展域名系统子网选项信息。
步骤S150：根据反馈类型信息和第二密文标记信息进行信息处理。
本步骤中，中间解析器根据反馈信息所携带的反馈类型信息和第二密文标记信息进行信息处理，使得中间解析器能够根据权威域名系统服务器的处理情况做进一步的处理。
如图19所示，图19是图18中步骤S150的具体方法的流程图，图19对步骤S150进行进一步的说明，该步骤S150可以包括但不限于有步骤S151和步骤S152。
步骤S151：当反馈类型信息表示权威域名系统服务器无法识别第二域名系统请求信息，并且第二密文标记信息表示权威域名系统服务器无法解密密文敏感信息，根据第一域名系统请求信息重构第三域名系统请求信息，其中，第三域名系统请求信息不包括密文敏感信息。
本步骤中，当反馈类型信息表示权威域名系统服务器无法识别第二域名系统请求信息，则权威域名系统服务器亦无法对密文敏感信息进行解密，因此中间解析器根据第一域名系统请求信息重构第三域名系统请求信息，该第三域名系统请求信息不包括密文敏感信息。当反馈类型信息表示权威域名系统服务器无法识别第二域名系统请求信息，例如对应的权威域名系统服务器不支持扩展域名系统客户端子网选项或对应的权威域名系统服务器没有预先配置相应的解密算法或该权威域名系统服务器失效，则重构第三域名系统请求信息，并将该第三域名系统请求信息发送至权威域名系统服务器，以对于该权威域名系统服务器的可用性进行检测。
在一实施例中，反馈信息使用了本申请实施例中的伪地址类型消息体结构，因此通过检验反馈信息中的ECRYPTION FLAG字段能够确定权威域名系统服务器是否能够识别第二域名系统请求信息以及是否能够对第二域名系统请求信息中的密文敏感信息进行解密。
具体的，当反馈信息的ECRYPTION FLAG字段中的FLAG标志位为0，则表示权威域名系统服务器不能识别第二域名系统请求信息，也无法对第二域名系统请求信息中的密文敏感信息进行解密。
在一实施例中，当检测到当前选择的权威域名系统服务器失效，则选择新的权威域名系统服务器。
需要说明的是，第三域名系统请求信息可以携带也可以不携带第二附加选项信息和/或第一扩展域名系统附加选项信息，本实施例对此不做具体限定。
需要说明的是，第三域名系统请求信息可以携带也可以不携带第二附加选项信息和/或第二扩展域名系统附加选项信息，本实施例对此不做具体限定。
步骤S152：将第三域名系统请求信息发送给权威域名系统服务器，使得权威域名系统服务器根据第三域名系统请求信息进行信息处理。
本步骤中，中间解析器将第三域名系统请求信息发送至权威域名系统服务器，使得权威域名系统服务器根据第三域名系统请求信息进行信息处理。
如图20所示，图20是图18中步骤S150的另一具体方法的流程图，图20对步骤S150进行进一步的说明，该步骤S150可以包括但不限于有步骤S153和步骤S154。
步骤S153：当反馈类型信息表示权威域名系统服务器正常识别第二域名系统请求信息，并且第二密文标记信息表示权威域名系统服务器没有解密密文敏感信息，根据第一域名系统请求信息重构第四域名系统请求信息，其中，第四域名系统请求信息包括密文敏感信息对应的明文敏感信息。
本步骤中，当反馈类型信息表示权威域名系统服务器无法识别第二域名系统请求信息，则权威域名系统服务器亦无法对密文敏感信息进行解密，因此中间解析器根据第一域名系统请求信息重构第四域名系统请求信息，该第四域名系统包括密文敏感信息对应的明文敏感信息。当反馈类型信息表示权威域名系统服务器无法识别第二域名系统请求信息，例如对应的权威域名系统服务器不支持扩展域名系统客户端子网选项或对应的权威域名系统服务器没有预先配置相应的解密算法，则重构使用明文记载敏感信息的第四域名系统请求信息，并将该第四域名系统请求信息发送至权威域名系统服务器，以提高兼容性。
在一实施例中，反馈信息使用了本申请实施例中的伪地址类型消息体结构，因此通过检验反馈信息中的ECRYPTION FLAG字段能够确定权威域名系统服务器是否能够识别第二域名系统请求信息以及是否能够对第二域名系统请求信息中的密文敏感信息进行解密。
具体的，当反馈信息的ECRYPTION FLAG字段中的FLAG标志位为2，则表示权威域名系统服务器能够识别第二域名系统请求信息，但无法对第二域名系统请求信息中的密文敏感信息进行解密。
需要说明的是，第四域名系统请求信息可以携带也可以不携带第二附加选项信息和/或第一扩展域名系统附加选项信息，本实施例对此不做具体限定。
需要说明的是，第四域名系统请求信息可以携带也可以不携带第二附加选项信息和/或第二扩展域名系统附加选项信息，本实施例对此不做具体限定。
步骤S154：将第四域名系统请求信息发送给权威域名系统服务器，使得权威域名系统服务器根据明文敏感信息进行信息处理。
本步骤中，中间解析器将第四域名系统请求信息发送至权威域名系统服务器，使得权威域名系统服务器根据第四域名系统请求信息携带的明文敏感信息进行信息处理。
在一实施例中，反馈信息还包括目标网际互连协议地址，目标网际互连协议地址是第一域名系统请求信息对应的网际互连协议地址。
如图21所示，图21是图18中步骤S150的另一具体方法的流程图，图21对步骤S150进行进一步的说明，该步骤S150可以包括但不限于有步骤S155和步骤S156。
步骤S155：当反馈类型信息表示权威域名系统服务器正常识别第二域名系统请求信息，并且第二密文标记信息表示权威域名系统服务器正确解密密文敏感信息，缓存第一域名系统请求信息与目标网际互连协议地址之间的映射关系。
本步骤中，当反馈类型信息表示权威域名系统服务器正常识别第二域名系统请求信息，并且第二密文标记信息表示权威域名系统服务器正确解密密文敏感信息，因此证明权威域名系统服务器能够正常识别第二域名系统请求信息，并对第二域名系统请求信息中的密文敏感信息进行解密，通过将第一域名系统请求信息与目标网际互连协议地址之间的映射关系缓存在中间解析器，能够提高客户端设备获取第一域名系统请求信息与目标网际互连协议地址之间的映射关系的效率，减少了系统调度的复杂性。
在一实施例中，反馈信息使用了本申请实施例中的伪地址类型消息体结构，因此通过检 验反馈信息中的ECRYPTION FLAG字段能够确定权威域名系统服务器是否能够识别第二域名系统请求信息以及是否能够对第二域名系统请求信息中的密文敏感信息进行解密。
具体的，当反馈信息的ECRYPTION FLAG字段中的FLAG标志位为1，则表示权威域名系统服务器能够识别第二域名系统请求信息，且能够对密文敏感信息进行解密。
步骤S156：将反馈信息转发回第一域名系统请求信息的发起方。
本步骤中，反馈信息包括第一域名系统请求信息对应的网际互连协议地址，通过将反馈信息转发回第一域名系统请求信息的发起方，能够使得第一第一域名系统请求信息的发起方获得第一域名系统请求信息与目标网际互连协议地址之间的映射关系。此外，反馈信息可以是经过加密的，也可以是未经加密的，本实施例对此不做具体限定。
需要说明的是，第一域名系统请求信息的发起方可以是客户端设备，也可以是中间解析器，本实施例对此不做具体限定。
为了更加清楚的说明本申请实施例提供的信息处理方法的处理流程，下面以具体的示例进行说明。
如图22所示，图22是本申请一个具体示例提供的信息处理方法的流程图。该信息处理方法应用于，该信息处理方法包括以下步骤：
步骤S101：接收第一域名系统请求信息；
步骤S102a：提取第一域名系统请求信息中的域名字段并查找本地DNS缓存是否存在对应的解析记录，当本地DNS缓存中有相应的解析记录，根据解析记录构造DNS响应信息并发送至用户端设备；
步骤S102b：当本地DNS缓存中没有对应的解析记录，获取敏感信息；
步骤S103：根据敏感信息的长短选择加密算法对敏感信息进行加密，得到密文敏感信息；
步骤S104：根据密文敏感信息以eDNS0格式重构第一域名系统请求信息得到第二域名系统请求信息；
步骤S105：将第二域名系统请求信息封装成UDP包后发送至权威域名系统服务器；
步骤S106：从权威域名系统服务器接收反馈信息，检查反馈信息中的RCODE字段，当RCODE的字段返回代码是0，检查PADR字段中的ENCRYPTION FLAG字段；
步骤S107a：当ENCRYPTION FLAG字段的字段返回代码是0，以未加密的敏感信息进行RDATA字段的填写以构造第三域名系统请求信息并发送至权威域名系统服务器；
步骤S107b：当ENCRYPTION FLAG字段的字段返回代码是1，检查反馈信息的其它字段。
步骤S108：在反馈信息的所有字段正常的情况下，将反馈信息中的域名映射关系记录到本地DNS缓存中，并将域名映射关系转发回客户端设备。
需要说明的是，步骤S103根据敏感信息的长短选择加密算法的具体方法包括：在敏感信息的目标是映射为较短的IPv4地址的情况下，预留32位的地址空间，并且每4位对应一个整数。将敏感信息以字符串转换函数转换为整实数，将转换后的整实数再转换为4个四位的二进制数，余下地址空间补零，再从头每次取8位二进制数转换为十进制数，以得到IPv4地址。在以eDNS0格式重构第二域名系统请求信息的过程中，将TTL元素中的EXTENDED-RCODE字段设置为0x1，表示该域名系统请求信息携带有密文敏感信息。RDATA字段中的OPTION-CODE字段设置为27000，OPTION-LENGTH字段设置为36，FAMILY字 段设置为1，表示后续将使用IPv4地址格式；ENCRYPTION TYPE字段设置为2，表示使用crc32()，bese_convert()的加密机制；ENCRYPTION FLAG字段设置为0，用于DNS请求消息中，代表本消息存在加密的伪地址，并且默认远端的DNS权威服务器不能识别本消息；SIGNATURE字段中填入加密后的密文敏感信息或加密过程中使用的密钥。另外，还可以将加密后得到的伪地址填写入扩展域名系统客户端子网选项信息的ADDRESS字段中。
需要说明的是，步骤S103根据敏感信息的长短选择加密算法的具体方法还包括：在敏感信息的目标是映射为较长的IPv6地址的情况下，预留128位的地址空间。将敏感信息以MD5方式转换成一个128位的字符串，每4个位对应一个字符获得IPv6地址。在以eDNS0格式重构第二域名系统请求信息的过程中，将TTL元素中的EXTENDED-RCODE字段设置为0x1，表示该域名系统请求信息携带有密文敏感信息。RDATA字段中的OPTION-CODE字段设置为27000，OPTION-LENGTH字段设置为132，FAMILY字段设置为2，表示后续将使用IPv6地址格式；ENCRYPTION TYPE字段设置为1；ENCRYPTION FLAG字段设置为0，用于DNS请求消息中，代表本消息存在加密的伪地址，并且默认远端的DNS权威服务器不能识别本消息；SIGNATURE字段中填入加密后的密文敏感信息或加密过程中使用的密钥。另外，还可以将加密后得到的伪地址填写入扩展域名系统客户端子网选项信息的ADDRESS字段中。
另外，本申请的一个实施例还提供了一种中间解析器，该中间解析器包括：存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序。
处理器和存储器可以通过总线或者其他方式连接。
存储器作为一种非暂态计算机可读存储介质，可用于存储非暂态软件程序以及非暂态性计算机可执行程序。此外，存储器可以包括高速随机存取存储器，还可以包括非暂态存储器，例如至少一个磁盘存储器件、闪存器件、或其他非暂态固态存储器件。在一些实施方式中，存储器可选包括相对于处理器远程设置的存储器，这些远程存储器可以通过网络连接至该处理器。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
需要说明的是，本实施例中的中间解析器，可以应用至例如图1所示实施例中的中间解析器120，本实施例中的中间解析器能够构成例如图1所示实施例中的系统架构的一部分，这些实施例均属于相同的发明构思，因此这些实施例具有相同的实现原理以及技术效果，此处不再详述。
实现上述实施例的信息处理方法所需的非暂态软件程序以及指令存储在存储器中，当被处理器执行时，执行上述实施例中的信息处理方法，例如，执行以上描述的图2中的方法步骤S110至S130、图6中的方法步骤S121至S124、图7中的方法步骤S1241至S1242、图8中的方法步骤S1243至S1244、图9中的方法步骤S12441至S12442、图10中的方法步骤S1221至S1222、图11中的方法步骤S12221至S12222、图12中的方法步骤S125至S128、图13中的方法步骤S1281至S1282、图14中的方法步骤S1283至S1284、图15中的方法步骤S12841至S12842、图16中的方法步骤S1261至S1262、图17中的方法步骤S12621至S12622、图18中的方法步骤S140至S150、图19中的方法步骤S151至S152、图20中的方法步骤S153至S154、图21中的方法步骤S155至S156或者如图22中示出的方法步骤S101至S108。
另外，本申请的一个实施例还提供了一种网络设备，该网络设备包括有上述实施例的中间解析器，因此本实施例中的网络设备与上述实施例中的中间解析器属于相同的发明构思，因此这些实施例具有相同的实现原理以及技术效果，此处不再详述。
以上所描述的装置实施例或者系统实施例仅仅是示意性的，其中作为分离部件说明的单元可以是或者也可以不是物理上分开的，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。
此外，本申请的一个实施例还提供了一种计算机可读存储介质，该计算机可读存储介质存储有计算机可执行指令，该计算机可执行指令被一个处理器或控制器执行，例如，被上述装置实施例中的一个处理器执行，可使得上述处理器执行上述实施例中的信息处理方法，例如，执行以上描述的图2中的方法步骤S110至S130、图6中的方法步骤S121至S124、图7中的方法步骤S1241至S1242、图8中的方法步骤S1243至S1244、图9中的方法步骤S12441至S12442、图10中的方法步骤S1221至S1222、图11中的方法步骤S12221至S12222、图12中的方法步骤S125至S128、图13中的方法步骤S1281至S1282、图14中的方法步骤S1283至S1284、图15中的方法步骤S12841至S12842、图16中的方法步骤S1261至S1262、图17中的方法步骤S12621至S12622、图18中的方法步骤S140至S150、图19中的方法步骤S151至S152、图20中的方法步骤S153至S154、图21中的方法步骤S155至S156或者如图22中示出的方法步骤S101至S108。
本领域普通技术人员可以理解，上文中所公开方法中的全部或某些步骤、系统可以被实施为软件、固件、硬件及其适当的组合。某些物理组件或所有物理组件可以被实施为由处理器，如中央处理器、数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。这样的软件可以分布在计算机可读介质上，计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的，术语计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于RAM、ROM、EEPROM、闪存或其他存储器技术、CD-ROM、数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。
以上是对本申请的较佳实施进行了具体说明，但本申请并不局限于上述实施方式，熟悉本领域的技术人员在不违背本申请本质的前提下还可作出种种的等同变形或替换，这些等同的变形或替换均包含在本申请权利要求所限定的范围内。

Claims (20)

  1. 一种信息处理方法，应用于中间解析器，所述方法包括：
    接收第一域名系统请求信息；
    根据所述第一域名系统请求信息得到第二域名系统请求信息，其中，所述第二域名系统请求信息包括密文敏感信息和第一密文标记信息，所述第一密文标记信息用于指示所述密文敏感信息为密文信息；
    将所述第二域名系统请求信息发送给权威域名系统服务器，使得所述权威域名系统服务器根据所述密文敏感信息和所述第一密文标记信息进行信息处理。
  2. 根据权利要求1所述的方法，其中，所述第一域名系统请求信息包括第一扩展域名系统附加选项信息，其中，所述第一扩展域名系统附加选项信息包括源端敏感信息；
    所述根据所述第一域名系统请求信息得到第二域名系统请求信息，包括：
    获取所述第一扩展域名系统附加选项信息中的所述源端敏感信息；
    对所述源端敏感信息进行加密处理得到所述密文敏感信息；
    构建第一附加选项信息，其中，所述第一附加选项信息包括所述第一密文标记信息；
    根据所述密文敏感信息和所述第一附加选项信息得到第二域名系统请求信息。
  3. 根据权利要求2所述的方法，其中，所述第一附加选项信息包括第一加密签名字段；
    所述根据所述密文敏感信息和所述第一附加选项信息得到第二域名系统请求信息，包括：
    将所述密文敏感信息填充进所述第一加密签名字段；
    根据包括所述第一密文标记信息和所述密文敏感信息的所述第一附加选项信息，得到第二域名系统请求信息。
  4. 根据权利要求2所述的方法，其中，所述根据所述密文敏感信息和所述第一附加选项信息得到第二域名系统请求信息，包括：
    将所述第一扩展域名系统附加选项信息中的所述源端敏感信息更新为所述密文敏感信息；
    根据更新后的所述第一扩展域名系统附加选项信息和所述第一附加选项信息得到第二域名系统请求信息。
  5. 根据权利要求4所述的方法，其中，所述第一附加选项信息包括第一加密签名字段；
    所述根据更新后的所述第一扩展域名系统附加选项信息和所述第一附加选项信息得到第二域名系统请求信息，包括：
    在所述第一加密签名字段中填充密钥信息或者第一签名信息，其中，所述密钥信息用于解密所述密文敏感信息，所述第一签名信息用于验证加密后的所述源端敏感信息的完整性；
    根据更新后的所述第一扩展域名系统附加选项信息，以及包括所述密钥信息或者所述第一签名信息的所述第一附加选项信息，得到第二域名系统请求信息。
  6. 根据权利要求2所述的方法，其中，所述对所述源端敏感信息进行加密处理得到所述密文敏感信息，包括：
    根据所述源端敏感信息的信息长度确定第一加密策略信息，其中，所述第一加密策略信息包括第一密文长度；
    根据所述第一加密策略信息对所述源端敏感信息进行加密处理得到所述密文敏感信息， 其中，所述密文敏感信息的信息长度与所述第一密文长度相匹配。
  7. 根据权利要求6所述的方法，其中，所述根据所述第一加密策略信息对所述源端敏感信息进行加密处理得到所述密文敏感信息，包括：
    根据所述第一加密策略信息对所述源端敏感信息进行第一加密处理得到第一密文信息；
    根据所述第一加密策略信息对所述第一密文信息进行第二加密处理得到所述密文敏感信息，其中，所述密文敏感信息的信息长度小于所述第一密文信息的信息长度。
  8. 根据权利要求1所述的方法，其中，所述第一域名系统请求信息不包括第一扩展域名系统附加选项信息；
    所述根据所述第一域名系统请求信息得到第二域名系统请求信息，包括：
    根据所述第一域名系统请求信息获取本地敏感信息；
    对所述本地敏感信息进行加密处理得到所述密文敏感信息；
    构建第二附加选项信息，其中，所述第二附加选项信息包括所述第一密文标记信息；
    根据所述密文敏感信息和所述第二附加选项信息得到第二域名系统请求信息。
  9. 根据权利要求8所述的方法，其中，所述第二附加选项信息包括第二加密签名字段；
    所述根据所述密文敏感信息和所述第二附加选项信息得到第二域名系统请求信息，包括：
    将所述密文敏感信息填充进所述第二加密签名字段；
    根据包括所述第一密文标记信息和所述密文敏感信息的所述第二附加选项信息，得到第二域名系统请求信息。
  10. 根据权利要求8所述的方法，其中，所述根据所述密文敏感信息和所述第二附加选项信息得到第二域名系统请求信息，包括：
    根据所述密文敏感信息构建第二扩展域名系统附加选项信息，其中，所述第二扩展域名系统附加选项信息包括所述密文敏感信息；
    根据所述第二扩展域名系统附加选项信息和所述第二附加选项信息得到第二域名系统请求信息。
  11. 根据权利要求10所述的方法，其中，所述第二附加选项信息包括第二加密签名字段；
    所述根据所述第二扩展域名系统附加选项信息和所述第二附加选项信息得到第二域名系统请求信息，包括：
    在所述第二加密签名字段中填充密钥信息或者第二签名信息，其中，所述密钥信息用于解密所述密文敏感信息，所述第二签名信息用于验证加密后的所述本地敏感信息的完整性；
    根据所述第二扩展域名系统附加选项信息，以及包括所述密钥信息或者所述第二签名信息的所述第二附加选项信息，得到第二域名系统请求信息。
  12. 根据权利要求8所述的方法，其中，所述对所述本地敏感信息进行加密处理得到所述密文敏感信息，包括：
    根据所述本地敏感信息的信息长度确定第二加密策略信息，其中，所述第二加密策略信息包括第二密文长度；
    根据所述第二加密策略信息对所述本地敏感信息进行加密处理得到所述密文敏感信息，其中，所述密文敏感信息的信息长度与所述第二密文长度相匹配。
  13. 根据权利要求12所述的方法，其中，所述根据所述第二加密策略信息对所述本地敏感信息进行加密处理得到所述密文敏感信息，包括：
    根据所述第二加密策略信息对所述本地敏感信息进行第一加密处理得到第二密文信息；
    根据所述第二加密策略信息对所述第二密文信息进行第二加密处理得到所述密文敏感信息，其中，所述密文敏感信息的信息长度小于所述第二密文信息的信息长度。
  14. 根据权利要求1至13任意一项所述的方法，其中，所述将所述第二域名系统请求信息发送给权威域名系统服务器之后，所述方法还包括：
    接收所述权威域名系统服务器根据所述密文敏感信息和所述第一密文标记信息发送的反馈信息，其中，所述反馈信息包括反馈类型信息和第二密文标记信息；
    根据所述反馈类型信息和所述第二密文标记信息进行信息处理。
  15. 根据权利要求14所述的方法，其中，所述根据所述反馈类型信息和所述第二密文标记信息进行信息处理，包括：
    当所述反馈类型信息表示所述权威域名系统服务器无法识别所述第二域名系统请求信息，并且所述第二密文标记信息表示所述权威域名系统服务器无法解密所述密文敏感信息，根据所述第一域名系统请求信息重构第三域名系统请求信息，其中，所述第三域名系统请求信息不包括所述密文敏感信息；
    将所述第三域名系统请求信息发送给所述权威域名系统服务器，使得所述权威域名系统服务器根据所述第三域名系统请求信息进行信息处理。
  16. 根据权利要求14所述的方法，其中，所述根据所述反馈类型信息和所述第二密文标记信息进行信息处理，包括：
    当所述反馈类型信息表示所述权威域名系统服务器正常识别所述第二域名系统请求信息，并且所述第二密文标记信息表示所述权威域名系统服务器没有解密所述密文敏感信息，根据所述第一域名系统请求信息重构第四域名系统请求信息，其中，所述第四域名系统请求信息包括所述密文敏感信息对应的明文敏感信息；
    将所述第四域名系统请求信息发送给所述权威域名系统服务器，使得所述权威域名系统服务器根据所述明文敏感信息进行信息处理。
  17. 根据权利要求14所述的方法，其中，所述反馈信息还包括目标网际互连协议地址；所述根据所述反馈类型信息和所述第二密文标记信息进行信息处理，包括：
    当所述反馈类型信息表示所述权威域名系统服务器正常识别所述第二域名系统请求信息，并且所述第二密文标记信息表示所述权威域名系统服务器正确解密所述密文敏感信息，缓存所述第一域名系统请求信息与所述目标网际互连协议地址之间的映射关系；
    将所述反馈信息转发回所述第一域名系统请求信息的发起方。
  18. 一种中间解析器，包括：存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现如权利要求1至17任意一项所述的信息处理方法。
  19. 一种网络设备，包括有如权利要求18所述的中间解析器。
  20. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求1至17任意一项所述的信息处理方法。
PCT/CN2022/099220 2021-06-25 2022-06-16 信息处理方法、中间解析器、网络设备及存储介质 Ceased WO2022267977A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP22827472.6A EP4362421A4 (en) 2021-06-25 2022-06-16 INFORMATION PROCESSING METHOD, INTERMEDIARY ANALYZER, NETWORK DEVICE AND STORAGE MEDIUM
US18/547,070 US12513009B2 (en) 2021-06-25 2022-06-16 Domain name system request information processing method

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110712488.0A CN115604221A (zh) 2021-06-25 2021-06-25 信息处理方法、中间解析器、网络设备及存储介质
CN202110712488.0 2021-06-25

Publications (1)

Publication Number Publication Date
WO2022267977A1 true WO2022267977A1 (zh) 2022-12-29

Family

ID=84544922

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/099220 Ceased WO2022267977A1 (zh) 2021-06-25 2022-06-16 信息处理方法、中间解析器、网络设备及存储介质

Country Status (4)

Country Link
US (1) US12513009B2 (zh)
EP (1) EP4362421A4 (zh)
CN (1) CN115604221A (zh)
WO (1) WO2022267977A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110463163B (zh) * 2017-03-28 2022-08-05 Netapp股份有限公司 用于提供对会话服务器的按需唤醒访问的方法及系统
CN116980151A (zh) * 2022-04-22 2023-10-31 戴尔产品有限公司 用于地址加密的方法、电子设备和计算机程序产品
ES3021407T3 (en) * 2022-08-09 2025-05-26 Nokia Solutions & Networks Oy Communication network
CN115941647B (zh) * 2023-02-21 2023-05-30 中国信息通信研究院 确保网络标识迭代查询数据可靠性与真实性的方法和装置
CN119675921B (zh) * 2024-11-28 2025-10-21 互联网域名系统北京市工程研究中心有限公司 一种针对dns区数据的加密方法及系统

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103825969A (zh) * 2013-10-29 2014-05-28 电子科技大学 一种基于匿名网络的dns查询方法
CN105959433A (zh) * 2016-07-22 2016-09-21 无锡华云数据技术服务有限公司 一种域名解析方法及其域名解析系统

Family Cites Families (40)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6961783B1 (en) * 2001-12-21 2005-11-01 Networks Associates Technology, Inc. DNS server access control system and method
US7734745B2 (en) * 2002-10-24 2010-06-08 International Business Machines Corporation Method and apparatus for maintaining internet domain name data
US9015469B2 (en) * 2011-07-28 2015-04-21 Cloudflare, Inc. Supporting secure sessions in a cloud-based proxy service
US9531685B2 (en) * 2011-12-16 2016-12-27 Akamai Technologies, Inc. Providing forward secrecy in a terminating SSL/TLS connection proxy using Ephemeral Diffie-Hellman key exchange
US8782774B1 (en) * 2013-03-07 2014-07-15 Cloudflare, Inc. Secure session capability using public-key cryptography without access to the private key
US9350550B2 (en) * 2013-09-10 2016-05-24 M2M And Iot Technologies, Llc Power management and security for wireless modules in “machine-to-machine” communications
US8996873B1 (en) * 2014-04-08 2015-03-31 Cloudflare, Inc. Secure session capability using public-key cryptography without access to the private key
US9184911B2 (en) * 2014-04-08 2015-11-10 Cloudflare, Inc. Secure session capability using public-key cryptography without access to the private key
US8966267B1 (en) * 2014-04-08 2015-02-24 Cloudflare, Inc. Secure session capability using public-key cryptography without access to the private key
US9137217B1 (en) * 2014-05-16 2015-09-15 Iboss, Inc. Manage encrypted network traffic using DNS responses
US9544278B2 (en) * 2015-01-07 2017-01-10 Red Hat, Inc. Using domain name system security extensions in a mixed-mode environment
US9894041B2 (en) * 2015-09-25 2018-02-13 Microsoft Technology Licensing, Llc Secure domain name resolution in computer networks
US10708226B2 (en) * 2016-01-29 2020-07-07 Verisign, Inc. Domain name resolution
US10009336B2 (en) * 2016-05-18 2018-06-26 Cisco Technology, Inc. Network security system to validate a server certificate
US10440053B2 (en) * 2016-05-31 2019-10-08 Lookout, Inc. Methods and systems for detecting and preventing network connection compromise
US11218465B2 (en) * 2017-01-29 2022-01-04 Beame.io Ltd. Establishing an AD-HOC secure connection between two electronic computing devices using a self-expiring locally transmitted information packet
CN110537346B (zh) * 2017-03-06 2023-03-24 诺基亚技术有限公司 安全去中心化域名系统
US10680806B1 (en) * 2017-10-24 2020-06-09 Verisign, Inc. DNS-based symmetric-key infrastructure
US10701046B1 (en) * 2017-10-24 2020-06-30 Verisign, Inc. Symmetric-key infrastructure
US11552997B2 (en) * 2018-02-06 2023-01-10 Akamai Technologies, Inc. Secure request authentication for a threat protection service
WO2020006162A1 (en) * 2018-06-28 2020-01-02 Iot And M2M Technologies, Llc Ecdhe key exchange for mutual authentication using a key server
US11228448B2 (en) * 2018-11-20 2022-01-18 Iot And M2M Technologies, Llc Mutually authenticated ECDHE key exchange for a device and a network using multiple PKI key pairs
EP3888337B1 (en) * 2018-11-26 2026-03-18 Telefonaktiebolaget Lm Ericsson (Publ) Domain name system queries
US11343084B2 (en) * 2019-03-01 2022-05-24 John A. Nix Public key exchange with authenticated ECDHE and security against quantum computers
US11405204B2 (en) * 2019-06-15 2022-08-02 Meta Platforms, Inc Scalable, secure, efficient, and adaptable distributed digital ledger transaction network
US12022287B2 (en) * 2019-07-08 2024-06-25 John A. Nix EAP-TLS authentication with concealed user identities and wireless networks
US11277373B2 (en) * 2019-07-24 2022-03-15 Lookout, Inc. Security during domain name resolution and browsing
US11438763B2 (en) * 2019-09-25 2022-09-06 Hughes Network Systems, Llc System and method for improving network performance when using secure DNS access schemes
US11070533B2 (en) * 2019-10-10 2021-07-20 Forcepoint Llc Encrypted server name indication inspection
US11356423B2 (en) * 2020-01-14 2022-06-07 Cisco Technology, Inc. Managing encrypted server-name-indication (ESNI) at proxy devices
US11444944B2 (en) * 2020-02-11 2022-09-13 Mcafee, Llc Privacy and security enabled domain name system with optional zero-touch provisioning
US20210281667A1 (en) * 2020-03-05 2021-09-09 The Regents Of The University Of California Named content for end-to-end information-centric ip internet
US11336692B1 (en) * 2020-05-07 2022-05-17 NortonLifeLock Inc. Employing SNI hostname extraction to populate a reverse DNS listing to protect against potentially malicious domains
US20210377016A1 (en) * 2020-05-29 2021-12-02 EMC IP Holding Company LLC Key rollover for client side encryption in deduplication backup systems
US10924456B1 (en) * 2020-07-14 2021-02-16 Centripetal Networks, Inc. Methods and systems for efficient encrypted SNI filtering for cybersecurity applications
US20230370423A1 (en) * 2020-09-15 2023-11-16 Telefonaktiebolaget Lm Ericsson (Publ) Mechanism for traffic detection in case of encrypted traffic
US11677714B2 (en) * 2020-09-21 2023-06-13 Level 3 Communications, Llc Collecting passive DNS traffic to generate a virtual authoritative DNS server
US11750363B2 (en) * 2020-11-04 2023-09-05 Bitdefender IPR Management Ltd. Privacy-preserving domain name service (DNS)
US11374898B1 (en) * 2020-12-14 2022-06-28 Lenovo (Singapore) Pte. Ltd. Use of partial hash of domain name to return IP address associated with the domain name
US12200136B2 (en) * 2021-05-28 2025-01-14 Comcast Cable Communications, Llc Systems and methods for secure communication

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103825969A (zh) * 2013-10-29 2014-05-28 电子科技大学 一种基于匿名网络的dns查询方法
CN105959433A (zh) * 2016-07-22 2016-09-21 无锡华云数据技术服务有限公司 一种域名解析方法及其域名解析系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4362421A4 *

Also Published As

Publication number Publication date
EP4362421A4 (en) 2025-06-25
US20240056318A1 (en) 2024-02-15
US12513009B2 (en) 2025-12-30
EP4362421A1 (en) 2024-05-01
CN115604221A (zh) 2023-01-13

Similar Documents

Publication Publication Date Title
US11330008B2 (en) Network addresses with encoded DNS-level information
WO2022267977A1 (zh) 信息处理方法、中间解析器、网络设备及存储介质
Arends et al. Protocol modifications for the DNS security extensions
JP4464963B2 (ja) 暗号で保護されたプレフィクスを用いたインターネットプロトコルネットワーク用のロケーションプライバシー
JP4054007B2 (ja) 通信システム、ルータ装置、通信方法、ルーティング方法、通信プログラムおよびルーティングプログラム
US9467416B2 (en) Methods and systems for dynamic domain name system (DDNS)
JP2009503916A (ja) マルチ鍵暗号化生成アドレス
US20190306110A1 (en) Experience differentiation
US10305864B2 (en) Method and system for interest encryption in a content centric network
JP5132975B2 (ja) ユーザーエージェントを識別するために匿名ルーティング識別子を生成して送信する装置および関連方法
WO2008098453A1 (en) A method, system and apparatus for the dhcp message transmission
Wouters Dns-based authentication of named entities (dane) bindings for openpgp
CN105721505A (zh) 一种数据安全传输方法、装置及系统
Laganier Host Identity Protocol (HIP) Domain Name System (DNS) Extension
CN103650457A (zh) 一种共享接入的检测方法、设备和终端设备
CN110832806B (zh) 针对面向身份的网络的基于id的数据面安全
KR101326360B1 (ko) Ｄｎｓ 서버 간의 보안 통신 방법 및 이를 위한 관할 ｄｎｓ 서버, 그리고 보안 통신 시스템
Ahrenholz Host identity protocol distributed hash table interface
CN119675921B (zh) 一种针对dns区数据的加密方法及系统
KR100917392B1 (ko) ＩＰｖ6 네트워크에서 인접 노드의 탐색 메시지를송수신하는 방법
CN109120417B (zh) 计费报文的抄送方法、装置、计费服务器及接入设备
Buijsman et al. Securing the last mile of DNS with CGA-TSIG
Schanzenbach et al. RFC 0000 The GNU Name System
Schanzenbach et al. RFC 9498: The GNU Name System
CN118984215A (zh) 层次化密钥管理方法、装置和存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22827472

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 18547070

Country of ref document: US

WWE Wipo information: entry into national phase

Ref document number: 2022827472

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2022827472

Country of ref document: EP

Effective date: 20240125

WWG Wipo information: grant in national office

Ref document number: 18547070

Country of ref document: US