Multicast security control method and device based on DNS

• US 10,666,614 B2
• Filed: 06/08/2015
• Issued: 05/26/2020
• Est. Priority Date: 09/19/2014
• Status: Active Grant

• Current Assignee: ZTE Corporation
• Original Assignee: ZTE Corporation
• Inventors: Gao, Chunsheng, Wu, Yunfei, Wei, Yu
• Primary Examiner(s): Jean, Frantz B
• Application Number:
  US15/512,456
• Publication Number:
  US 20170295139A1
• Time in Patent Office: 1,814 Days
• Field of Search: 709225
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04N 21/6405 Multicasting data broadcast and multicast in packet switching networks H04L12/18

Abstract

The present disclosure relates to a multicast security control method and device based on DNS. The method includes: transmitting a DNS request message to a domain name server to acquire a multicast source DNS address list of an IPTV server; conducting address verification on a multicast data message according to the multicast source DNS address list and a locally maintained multicast address list after the multicast data message issued by the IPTV server is received; and conducting forwarding control on the multicast data message according to a verification result.

Claims

1. A multicast security control method based on Domain Name System DNS, comprising:

transmitting a DNS request message to a domain name server to acquire a multicast source DNS address list of an Internet Protocol Television IPTV server;

conducting address verification on a multicast data message according to the multicast source DNS address list and a locally maintained multicast address list after the multicast data message issued by the IPTV server is received; and

conducting forwarding control on the multicast data message according to a verification result;

wherein the step of transmitting the DNS request message to the domain name server to acquire the multicast source DNS address list information of the IPTV server comprises;

allocating domain name address information of the IPTV server;

transmitting the DNS request message to the domain name server, wherein the DNS request message includes the domain name address information of the IPTV server;

receiving a response message, fed back by the domain name server, corresponding to the domain name address information of the IPTV server; and

parsing the response message to acquire the multicast source DNS address list of the IPTV server.

2. The method according to claim 1, wherein the step of conducting the address verification on the multicast data message according to the multicast source DNS address list and a locally maintained multicast address list after the multicast data message issued by the IPTV server is received comprises:

parsing the multicast data message to acquire a source IP address and a destination IP address of the multicast data message after the multicast data message issued by the IPTV server is received;

matching the source IP address of the multicast data message with the multicast source DNS address list, and matching the destination IP address of the multicast data message with the multicast address list;

succeeding in verification when both the source IP address and the destination IP address of the multicast data message are matched with corresponding address information;

otherwise, failing in verification.

3. The method according to claim 2, wherein the step of conducting forwarding control on the multicast data message according to the verification result comprises:

forwarding the multicast data message to an IPTV receiving device when the verification succeeds;

otherwise, abandoning the multicast data message.

4. The method according to claim 1, prior to the step of conducting address verification on the multicast data message according to the multicast source DNS address list information and the locally maintained multicast address list, further comprising:

receiving a multicast protocol message transmitted by the IPTV receiving device, and forwarding the multicast protocol message to the IPTV server;

parsing the multicast protocol message, and judging whether the multicast protocol message is a joining message or a leaving message; and

adding the corresponding multicast address information into the multicast address list if the multicast protocol message is the joining message; and

deleting the corresponding multicast address information from the multicast address list if the multicast protocol message is the leaving message.

5. The method according to claim 4, wherein the multicast source DNS address list information comprises an address updating time issued by the domain name server;

and, after the step of acquiring the multicast source DNS address list of the IPTV server, the method further comprises;

setting a timer according to the address updating time, and regularly transmitting a DNS request message to the domain name server to update the multicast source DNS address list of the IPTV server.

11. The method according to claim 2, prior to the step of conducting address verification on the multicast data message according to the multicast source DNS address list information and the locally maintained multicast address list, further comprising:

receiving a multicast protocol message transmitted by the IPTV receiving device, and forwarding the multicast protocol message to the IPTV server;

parsing the multicast protocol message, and judging whether the multicast protocol message is a joining message or a leaving message; and

adding the corresponding multicast address information into the multicast address list if the multicast protocol message is the joining message; and

deleting the corresponding multicast address information from the multicast address list if the multicast protocol message is the leaving message.

12. The method according to claim 3, prior to the step of conducting address verification on the multicast data message according to the multicast source DNS address list information and the locally maintained multicast address list, further comprising:

receiving a multicast protocol message transmitted by the IPTV receiving device, and forwarding the multicast protocol message to the IPTV server;

parsing the multicast protocol message, and judging whether the multicast protocol message is a joining message or a leaving message; and

adding the corresponding multicast address information into the multicast address list if the multicast protocol message is the joining message; and

deleting the corresponding multicast address information from the multicast address list if the multicast protocol message is the leaving message.

13. The method according to claim 11, wherein the multicast source DNS address list information comprises an address updating time issued by the domain name server;

and, after the step of acquiring the multicast source DNS address list of the IPTV server, the method further comprises;

setting a timer according to the address updating time, and regularly transmitting a DNS request message to the domain name server to update the multicast source DNS address list of the IPTV server.

6. A multicast security control device based on DNS, comprising a processor and a storage device, wherein the storage device stores processor-executable programs, and the programs comprise:

an acquisition module, configured to transmit a DNS request message to a domain name server to acquire a multicast source DNS address list of an IPTV server;

a verification module, configured to conduct address verification on a multicast data message according to the multicast source DNS address list and a locally maintained multicast address list after the multicast data message issued by the IPTV server is received; and

a control module, configured to conduct forwarding control on the multicast data message according to a verification result;

wherein the acquisition module comprises;

a configuration unit, configured to allocate domain name address information of the IPTV server;

a transmission unit, configured to transmit the DNS request message to the domain name server, wherein the DNS request message includes the domain name address information of the IPTV server;

a receiving unit, configured to receive a response message, fed back by the domain name server, corresponding to the domain name address information of the IPTV server; and

an acquisition unit, configured to parse the response message to acquire the multicast source DNS address list of the IPTV server.

7. The device according to claim 6, wherein the verification module comprises:

a parsing unit, configured to parse the multicast data message to acquire a source IP address and a destination IP address of the multicast data message after the multicast data message issued by the IPTV server is received;

a matching unit, configured to match the source IP address of the multicast data message with the multicast source DNS address list, and to match the destination IP address of the multicast data message with the multicast address list; and

a judging unit, configured to determine success in verification when both the source IP address and the destination IP address of the multicast data message are matched with the corresponding address information;

otherwise to determine failure in verification.

8. The device according to claim 6, wherein the control module is further configured to forward the multicast data message to an IPTV receiving device when the verification succeeds;

otherwise, to abandon the multicast data message.

9. The device according to claim 6, wherein the programs further comprise:

a multicast address updating module, configured to receive a multicast protocol message transmitted by the IPTV receiving device and to forward the multicast protocol message to the IPTV server;

to parse the multicast protocol message, and to judge whether the multicast protocol message is a joining message or a leaving message; and

, to add the corresponding multicast address information into the multicast address list if the multicast protocol message is the joining message; and

to delete the corresponding multicast address information from the multicast address list if the multicast protocol message is the leaving message.

10. The device according to claim 9, wherein

the acquisition module is further configured to set a timer according to the address updating time, and to regularly transmit the DNS request message to the domain name server to update the multicast source DNS address list of the IPTV server.

14. The device according to claim 7, wherein the programs further comprise:

a multicast address updating module, configured to receive a multicast protocol message transmitted by the IPTV receiving device and to forward the multicast protocol message to the IPTV server;

to parse the multicast protocol message, and to judge whether the multicast protocol message is a joining message or a leaving message; and

, to add the corresponding multicast address information into the multicast address list if the multicast protocol message is the joining message; and

to delete the corresponding multicast address information from the multicast address list if the multicast protocol message is the leaving message.

15. The device according to claim 8, wherein the programs further comprise:

a multicast address updating module, configured to receive a multicast protocol message transmitted by the IPTV receiving device and to forward the multicast protocol message to the IPTV server;

to parse the multicast protocol message, and to judge whether the multicast protocol message is a joining message or a leaving message; and

, to add the corresponding multicast address information into the multicast address list if the multicast protocol message is the joining message; and

to delete the corresponding multicast address information from the multicast address list if the multicast protocol message is the leaving message.

16. The device according to claim 14, wherein

the acquisition module is further configured to set a timer according to the address updating time, and to regularly transmit the DNS request message to the domain name server to update the multicast source DNS address list of the IPTV server.