DOMAIN NAME RESOLUTION METHOD, SYSTEM, AND DEVICE

• US 20150222590A1
• Filed: 04/16/2015
• Published: 08/06/2015
• Est. Priority Date: 07/30/2013
• Status: Active Grant

• Current Assignee: Tencent Technology Company Limited (Tencent Holdings Limited)
• Original Assignee: Tencent Technology Company Limited (Tencent Holdings Limited)
• Inventors: LUO, Xijun, BAI, Jingtao
• Granted Patent: US 10,419,387 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

A domain name resolution method may include sending, by user equipment, a first resolution request to a protection device. The method may include sending, by the protection device, a CNAME response to the user equipment in response to the first resolution request. The method may include sending, by the user equipment, the a second resolution request to the protection device. The second resolution request may include an identification information of the user equipment and a target domain name based on the CNAME response. The method may include validating, by the protection device, the identification information, and in response to successful validation, sending a third resolution request to a domain name server. The method may include determining, by the domain name server, that the third resolution request is sent by the protection device based on an indicator information, and in response, resolving, the target domain name in the third resolution request.

Claims

1. A domain name resolution method, comprising:

receiving, by a protection device, a first domain resolution request from a communication equipment;

sending, by the protection device, a canonical name (CNAME) response to the communication equipment in response to the first resolution request;

receiving, by the protection device, a second resolution request from the communication equipment, wherein the second resolution request is based on the CNAME response and comprises an identification information of the communication equipment and a target domain name;

validating, by the protection device, the identification information in the second resolution request;

sending, by the protection device, a third resolution request for receipt by a domain name server, in response to the identification information in the second resolution request passing the validation, wherein the third resolution request comprises an indicator information, the identification information, and the target domain name, and the indicator information identifies that the third resolution request is sent by the protection device; and

receiving, by the protection device, from the domain name server, a network address of the target domain name included in the third resolution request, said network address received in response to the third resolution request sent by the protection device based on the indicator information.

2. The method according to claim 1, wherein the sending, by the protection device, the CNAME response in response to the first resolution request further comprises:

determining, by the protection device, whether the first resolution request is a resolution request re-sent by the communication equipment.

3. The method according to claim 2, wherein the first resolution request comprises an identification field for identifying the communication equipment, and the protection device sends the CNAME response in response to the first domain resolution request if the first resolution request is a re-sent resolution request, the sending, by the protection device, the CNAME response further comprises:

in response to determining that the first resolution request is a re-sent resolution request;

performing, by the protection device, a hashing using the identification field in the first resolution request to acquire the identification information; and

constructing, by the protection device, the CNAME response comprising the identification information and the target domain name.

4. The method according to claim 1, wherein the first resolution request comprises an identification field for identifying the communication equipment, the method further comprising:

adding, by the protection device, the identification field into a white list, in response to the identification information in the second resolution request passing the validation.

5. The method according to claim 2, wherein the first resolution request comprises an identification field for identifying the communication equipment, the method further comprising:

adding, by the protection device, the identification field into a white list, in response to the identification information in the second resolution request passing the validation.

6. The method according to claim 3, further comprising:

adding, by the protection device, the identification field into a white list, in response to the identification information in the second resolution request passing the validation.

7. The method according to claim 3, wherein the hashing using the identification field of the first resolution request is a first hashing, and the validating, by the protection device, the identification information in the second resolution request further comprises:

performing, by the protection device, a second hashing based on the identification information in the second resolution request to acquire a hash result; and

determining that the identification information in the second resolution request passes the validation, if the hash result matches with the identification field from the first resolution request.

8. A domain name resolution system, comprising:

client equipment, a protection device, and a domain name server, wherein;

the client equipment is configured to send a first resolution request for receipt by the protection device;

the protection device is configured to send a canonical name (CNAME) response for receipt by the client equipment in response to the first resolution request;

the client equipment is further configured to send a second resolution request for receipt by the protection device, wherein the second resolution request comprises identification information of the client equipment and a target domain name based on the CNAME response from the protection device;

the protection device is further configured to validate the identification information in the second resolution request, and send a third resolution request for receipt by the domain name server in response to the identification information in the second resolution request being successfully validated, wherein the third resolution request comprises an indicator information, the identification information, and the target domain name, and the indicator information identifies that the third resolution request is sent by the protection device; and

the domain name server is configured to determine that the third resolution request is sent by the protection device based on the indicator information, and resolve the target domain name in the third resolution request.

9. The system according to claim 8, wherein the protection device is further configured to determine that the first resolution request is a re-sent resolution request from the client equipment.

10. The system according to claim 9, wherein the first resolution request comprises an identification field for identifying the client equipment, and in response to the first resolution request being a resolution request that is re-sent by the client equipment:

the protection device is configured to perform a hashing using the identification field to acquire the identification information, and the protection device is configured to construct the CNAME response comprising the identification information and the target domain name.

11. The system according to claim 10, wherein the protection device is further configured to add the identification field into a white list, in response to the identification information in the second resolution request being successfully validated.

12. The system according to claim 10, wherein the hashing using the identification field is a first hashing, and the protection device is further configured to:

perform a second hashing using the identification information in the second resolution request to obtain a hash result, and

determine that the identification information in the second resolution request passes the validation in response to the hash result matching the identification field.

13. A domain name resolution device, comprising:

a receiving unit, a constructing unit, a validating unit, and a sending unit, wherein;

the receiving unit is configured to receive a first resolution request sent by a client equipment;

the constructing unit is configured to send a canonical name (CNAME) response for receipt by the client equipment in response to the first resolution request;

the validating unit is configured to receive a second resolution request sent by the client equipment in response to the CNAME response, and to validate an identification information in the second resolution request, wherein the second resolution request comprises the identification information of the client equipment and a target domain name; and

the sending unit is configured to send a third resolution request, for receipt by a domain name server, in response to the identification information in the second resolution request being successfully validated, wherein the third resolution request includes an indicator information, the identification information, and the target domain name, and wherein the indicator information identifies that the third resolution request is sent by the domain name resolution device; and

wherein the domain name server determines that the third resolution request is sent by the domain name resolution device based on the indicator information, and in response resolves the target domain name in the third resolution request.

14. The device according to claim 13, wherein the receiving unit comprises:

a receiving sub-unit configured to receive the first resolution request for the target domain name, wherein the first resolution request is sent by the client equipment; and

a determining unit configured to determine that the first resolution request is a resolution request re-sent by the client equipment.

15. The device according to claim 14, wherein the first resolution request comprises an identification field for identifying the client equipment, and

the receiving unit, in response to the first resolution request being a resolution request that is re-sent by the client equipment, further comprises:

a calculating unit configured to perforin a hashing on the identification field to obtain the identification information, and further configured to construct the CNAME response that comprises the identification information and the target domain name.

16. The device according to claim 15, further comprising:

an adding unit configured to add the identification field into a white list in response to the identification information in the second resolution request being successfully validated.