CN113315853B - Cloud protection node scheduling method, system and storage medium - Google Patents

Abstract

The invention discloses a cloud protection node scheduling method, system, and storage medium. The method includes: when a DNS management system receives a domain name resolution request sent by a client, extracts the protection domain name in the domain name resolution request, and uses the domain name corresponding to the protection domain name The first alias record, resolve the first alias; the first alias is the domain name alias exclusive to the protected domain name; use the second alias record corresponding to the first alias, resolve the second alias, and determine multiple binding relationships with the second alias Node IP address; input the node IP address into the cloud protection node scheduling algorithm, determine the available target node IP address, and send the target node IP address to the client, so that the client will send the data sent to the protection domain name to the target node IP The cloud protection node corresponding to the address. This method uniformly schedules the IP addresses of multiple cloud protection nodes, which can effectively ensure that the nodes are available, thereby avoiding the problem of inaccessibility of the source site caused by the offline of a single node.

Description

A cloud protection node scheduling method, system and storage medium

technical field

The present invention relates to the field of cloud protection, in particular to a cloud protection node scheduling method, system and storage medium.

Background technique

With the increasing awareness of network security, more and more websites choose to connect their origin sites to the cloud protection platform and use the cloud protection platform to defend against network attacks. In related technologies, the user sets a domain name alias for the protection domain name that needs to be protected, and points the domain name alias to the node IP address of the cloud protection node, so that other clients can first obtain the node IP address through the DNS management system, and send it to the The data of the protected domain name is sent to the IP address of the node, so that the data passes the attack detection of the cloud protection node and then sent to the IP address of the source station originally pointed to by the protected domain name. However, when the service of the cloud protection node is abnormal, or when the IP address of the node is blocked by the operator, the data sent to the protection domain name will not be able to reach the server corresponding to the IP address of the source site, which will cause the client to be unable to access the source site and affect the source site. normal operation of the site.

Contents of the invention

The purpose of the present invention is to provide a cloud protection node scheduling method, system and storage medium, which can uniformly schedule the node IP addresses of multiple cloud protection nodes, and send domain names to The client that resolves the request returns the IP address of the node, which can effectively ensure that the cloud protection node is effective and reliable, thereby avoiding the problem of inaccessibility of the source site caused by a single node being offline.

In order to solve the above technical problems, the present invention provides a cloud protection node scheduling method, including:

When the DNS management system receives the domain name resolution request sent by the client, it extracts the protected domain name in the domain name resolution request, and uses the first alias record corresponding to the protected domain name to resolve the first alias; the first alias is A domain name alias dedicated to the protected domain name;

Using the second alias record corresponding to the first alias, resolve the second alias, and determine a plurality of node IP addresses that establish a binding relationship with the second alias;

Input the IP address of the node into the cloud protection node scheduling algorithm, determine the available IP address of the target node, and send the IP address of the target node to the client, so that the client will send the IP address to the protection domain name The data is sent to the cloud protection node corresponding to the IP address of the target node.

Optionally, before the DNS management system receives the domain name resolution request sent by the client, it also includes:

When the cloud protection management platform receives the configuration request, it extracts the domain name to be configured and the corresponding first alias to be configured from the configuration request, and sets the first alias record of the domain name to be configured to point to the domain name to be configured. Configure the first alias, and determine the main domain name of the domain name to be protected;

Judging whether there are other protected domain names belonging to the main domain name configured;

If so, search for a second alias corresponding to the primary domain name, and set the second alias record of the first alias to be configured to point to the second alias corresponding to the primary domain name;

If not, then determine the number of primary domain names corresponding to each of the second aliases, and set the second alias record of the first alias to be configured to point to the second alias with the smallest number of primary domain names;

Writing the first alias record of the protected domain name to be configured and the second alias record of the first alias to be configured into the DNS management system.

Optionally, after determining the number of primary domain names corresponding to each of the second aliases, the method further includes:

The cloud protection management platform judges whether the minimum value in the number of primary domain names is greater than or equal to a preset threshold;

If so, generating alarm information, and sending the alarm information to the alarm server, so that the alarm server performs an alarm operation;

If not, execute the step of setting the second alias record of the first alias to be configured to point to the second alias with the least number of primary domain names.

Optionally, after writing the first alias record of the protected domain name to be configured and the second alias record of the first alias to be configured into the DNS management system, the method further includes:

When the cloud protection management platform receives the domain name removal request, it sets the protected domain name in the domain name removal request as the protected domain name to be removed, and uses the first alias record of the protected domain name to be removed to determine The first alias to be removed;

In the DNS management system, the cloud protection management platform deletes the first alias record corresponding to the protected domain name to be removed and the second alias record of the first alias to be removed.

Optionally, after the DNS management system receives the domain name resolution request sent by the client, it further includes:

The DNS management system extracts the source IP address in the domain name resolution request;

Correspondingly, the cloud protection node scheduling algorithm determines the target node IP address according to the operation status of the cloud protection node corresponding to the node IP address, and the region information and/or operator information to which the source address belongs.

The present invention also provides a cloud protection node scheduling system, including: a DNS management system and a cloud protection node, wherein,

The DNS management system is configured to extract the protected domain name in the domain name resolution request when receiving the domain name resolution request sent by the client, and use the first alias record corresponding to the protected domain name to resolve the first alias; the second An alias is a domain name alias exclusive to the protected domain name; using the second alias record corresponding to the first alias, the second alias is resolved, and a plurality of node IP addresses that establish a binding relationship with the second alias are determined; The node IP address is input into the cloud protection node scheduling algorithm, the available target node IP address is determined, and the target node IP address is sent to the client, so that the client will send data to the protection domain name Send to the cloud protection node corresponding to the IP address of the target node;

The cloud protection node is configured to perform attack detection on the data sent by the client to the protection domain name.

Optionally, it also includes: a cloud protection management platform, wherein,

The cloud protection management platform is configured to, when receiving a configuration request, extract the domain name to be configured for protection and the corresponding first alias to be configured from the configuration request, record the first alias of the domain name for protection to be configured, and set In order to point to the first alias to be configured, and determine the main domain name of the protected domain name to be configured; determine whether other protected domain names belonging to the main domain name are configured; if so, search for the second domain name corresponding to the main domain name Alias, and set the second alias record of the first alias to be configured to point to the second alias corresponding to the main domain name; if not, determine the number of main domain names corresponding to each second alias, and set The second alias record of the first alias to be configured is set to point to the second alias with the smallest number of primary domain names; the first alias record of the protected domain name to be configured and the second alias record of the first alias to be configured The alias record is written into the DNS management system;

The DNS management system is further configured to save the received first alias record and second alias record.

Optionally, it also includes: an alarm server, wherein,

The cloud protection management platform is also used to judge whether the minimum value of the number of primary domain names is greater than or equal to a preset threshold; if so, generate alarm information and send the alarm information to the alarm server, so that the alarm The server executes an alarm operation; if not, execute the step of setting the second alias record of the first alias to be configured to point to the second alias with the least number of primary domain names;

The alarm server is configured to perform an alarm operation when receiving the alarm information.

Optionally,

The cloud protection management platform is further configured to set the protected domain name in the domain name removal request as the protected domain name to be removed when receiving the domain name removal request, and use the first An alias record, determining the first alias to be removed; in the DNS management system, removing the first alias record corresponding to the protected domain name to be removed and the second alias record of the first alias to be removed.

The present invention also provides a storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the cloud protection node scheduling method described in any one of the above are implemented.

The present invention provides a cloud protection node scheduling method, which includes that when the DNS management system receives the domain name resolution request sent by the client, extracts the protection domain name in the domain name resolution request, and uses the first alias record corresponding to the protection domain name , resolve the first alias; the first alias is a domain name alias exclusive to the protected domain name; use the second alias record corresponding to the first alias to resolve the second alias, and determine to establish a binding with the second alias multiple node IP addresses of the relationship; input the node IP address into the cloud protection node scheduling algorithm, determine the available target node IP address, and send the target node IP address to the client, so that the client Send the data sent to the protection domain name to the cloud protection node corresponding to the IP address of the target node.

It can be seen that this method uses the second alias to uniformly schedule the IP addresses of multiple nodes. After the DNS management system resolves the first alias corresponding to the protected domain name in the domain name resolution request, it will further determine the second alias corresponding to the first alias. Since the second alias is bound with multiple node IP addresses, the DNS management system can input these node IP addresses into the cloud protection node scheduling algorithm to detect the availability of node IP addresses, and determine the available target node IP addresses , the IP address of the target node will be sent to the client, which can first ensure that the cloud protection node corresponding to the IP address of the target node is available, and can effectively detect the attack on the data sent by the client; at the same time, because the second alias is bound to multiple nodes IP address, when the IP address of a certain node is abnormal and cannot be used, it can also switch to other normal node IP addresses for attack detection, which can effectively avoid the problem of inaccessibility of the source site caused by related technologies using a single node IP address for attack detection , and ultimately improve the effectiveness and reliability of the cloud protection node attack detection function. The present invention also provides a cloud protection node scheduling system and a storage medium, which have the above beneficial effects.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only It is an embodiment of the present invention, and those skilled in the art can also obtain other drawings according to the provided drawings without creative work.

FIG. 1 is a flow chart of a cloud protection node scheduling method provided by an embodiment of the present invention;

Fig. 2 is a flow chart of adding a protection domain name to the cloud protection management platform provided by the embodiment of the present invention;

Fig. 3 is the flowchart of deleting the protected domain name by the cloud protection management platform provided by the embodiment of the present invention;

Fig. 4a is a structural block diagram of a cloud protection node scheduling system provided by an embodiment of the present invention;

Fig. 4b is a structural block diagram of another cloud protection node scheduling system provided by an embodiment of the present invention;

Fig. 4c is a structural block diagram of another cloud protection node scheduling system provided by an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

In related technologies, the user sets a domain name alias for the protection domain name that needs to be protected, and points the domain name alias to the node IP address of the cloud protection node, so that other clients can first obtain the node IP address through the DNS management system, and send it to the The data of the protected domain name is sent to the IP address of the node, so that the data passes the attack detection of the cloud protection node and then sent to the IP address of the source station originally pointed to by the protected domain name. However, when the service of the cloud protection node is abnormal, or when the IP address of the node is blocked by the operator, the data sent to the protection domain name will not be able to reach the server corresponding to the IP address of the source site, which will cause the client to be unable to access the source site and affect the source site. normal operation of the site. In view of this, the present invention provides a cloud protection node scheduling method, which can uniformly schedule the node IP addresses of multiple cloud protection nodes, and only send the domain name resolution request to the client after ensuring that the cloud protection node corresponding to the node IP address is available. The terminal returns the node IP address, which can effectively ensure that the cloud protection node is effective and reliable, thereby avoiding the problem of inaccessibility of the source site caused by the offline of a single node. Please refer to FIG. 1. FIG. 1 is a flowchart of a cloud protection node scheduling method provided by an embodiment of the present invention. The method may include:

S101. When the DNS management system receives the domain name resolution request sent by the client, it extracts the protected domain name in the domain name resolution request, and uses the first alias record corresponding to the protected domain name to resolve the first alias; the first alias is exclusive to the protected domain name Domain aliases.

A domain name alias (CNAME) is a domain name used to set the mapping relationship between domain names or between domain names and IP addresses. In the embodiment of the present invention, the domain name protected against attacks by the cloud protection node is the protection domain name, and the first alias is exactly the domain name alias that the protection domain name is used to map to the IP address of the cloud protection node. It can be understood that the first alias is a domain name alias exclusive to the protected domain name. In other words, the correspondence between the first alias and the protected domain name is one-to-one.

It should be noted that the embodiment of the present invention does not limit the specific form of the protected domain name, and for details, refer to related technologies of network domain names. It can be understood that the protection domain name is a domain name provided by the user to the cloud protection node service provider, and its content can be freely set by the user. The embodiment of the present invention also does not limit the specific form of the first alias, and the first alias, like the protected domain name, can also be set freely. First of all, it can be understood that since the role of the first alias is to map to the cloud protection node, the primary domain name of the first alias can be set as the primary domain name of the cloud protection node service provider; in addition, for the convenience of management, the first alias can be further set Content related to the protected domain name. For example, when the main domain name of the cloud protection node service provider is yunfanghu.com and the protection domain name is www.abc.com, the first alias of the protection domain name can be set as abc-com.yunfanghu.com. Of course, if the protected domain name is example.abc.com, the first alias can also be set to example-abc-com.yunfanghu.com. Further, in order to improve the standardization of the first alias for efficient management, a unified naming template can also be used to adjust the protected domain name to obtain the first alias. It should be noted that the embodiment of the present invention does not limit a specific naming template, which can also be flexibly adjusted according to actual application conditions.

Further, it can be understood that the specific content of the first alias record is the mapping relationship between the defense domain name and the first alias. The embodiment of the present invention does not limit the specific form of the first alias record, and reference may be made to related technologies of the DNS (Domain Name System) domain name system. The present invention does not limit the specific form and content of the domain name resolution request, and reference may be made to related technologies of the DNS domain name system.

S102. Using the second alias record corresponding to the first alias, resolve the second alias, and determine IP addresses of multiple nodes that establish a binding relationship with the second alias.

In related technologies, since the first alias directly points to the node IP address, the DNS management system will directly return the node IP address corresponding to the first alias to the client after analyzing the first alias, so that the client will send to The data of the protected domain name is sent to the node IP address. However, when the cloud protection node corresponding to the node IP address is unavailable, or the node IP address is blocked by the operator, the data sent by the client to the node IP address will not be further sent to the IP address of the source site of the protection domain name. As a result, the source site cannot work normally; similarly, because the node IP address is unavailable, the client cannot trace the source to the IP address of the protected domain name source site through the node IP address, thus causing the source site to be inaccessible. However, in the embodiment of the present invention, the first alias will not directly point to the node IP address, but will point to the second alias. There are multiple node IP addresses bound under the second alias, and the DNS management system will learn from these node IP addresses. Select an available node IP address in the address and send it to the client, which can effectively ensure that the cloud protection node is available, thereby avoiding the inaccessibility of the origin site of the protection domain name caused by the failure of the cloud protection node.

It should be noted that the second alias is also a domain name alias, and its content can also be flexibly adjusted according to actual application requirements. It can be understood that the second alias belongs to the cloud protection node service provider and is a dedicated domain name alias for scheduling node IP addresses, so the specific content of the second alias may be related to the primary domain name of the cloud protection node service provider. For example, the primary domain name of the cloud protection node service provider is yunfanghu.com, and the second alias can be second.yunfanghu.com. The embodiment of the present invention also does not limit the number of second aliases, which can be set according to actual application requirements. It can be understood that when there are multiple second aliases, they can be sorted during the process of naming the second aliases, for example, second1.yunfanghu.com, second2.yunfanghu.com...secondn.yunfanghu.com.

Further, it can be understood that, in order to improve the utilization rate of the second alias, multiple first aliases can be set to point to the same second alias, in other words, the quantitative correspondence between the first alias and the second alias is Many to one. It is also understandable that a mapping upper limit can be set for the second alias, that is, only a limited number of first aliases can point to the same second alias. It should be noted that the embodiment of the present invention does not limit the specific value of the upper limit of the mapping, which can be set according to actual application requirements. Of course, since the protected domain names with the same primary domain name usually come from the same company, for example, example1.abc.com, example2.abc.com, and example3.abc.com all have the same primary domain name abc.com, and the primary domain name Usually from the same company, in order to effectively manage the protected domain names of the same company, the upper limit of mapping related to the main domain name can also be set for the second alias, that is, the second alias can only be pointed to by a limited number of main domain names. For example, for the protected domain names example1.abc.com and example2.abc.com, their first aliases are respectively example1-abc-com.yunfanghu.comexample2-abc-com.yunfanghu.com, both of which point to the second For the second alias of .yunfanghu.com, since the protected domain names all have the same primary domain name abc.com, the number of primary domain names corresponding to the second alias second.yunfanghu.com is 1; for another example, for the protected domain name example. abc1.com, example.ab2c.com, their first aliases are example-abc1-com.yunfanghu.com, example-abc2-com.yunfanghu.com, these two first aliases point to second.yunfanghu.com A second alias, since the protected domain name has different main domain names, namely abc1.com and abc2.com, so the number of main domain names corresponding to the second alias second.yunfanghu.com is 2 at this time. In order to effectively manage the protected domain names of the same company, in the embodiment of the present invention, a mapping upper limit related to the primary domain name can be set for the second alias, that is, the second alias can only be pointed to by a limited number of primary domain names. It should be noted that the embodiment of the present invention does not limit the specific value of the mapping upper limit corresponding to each second alias, which can be set according to actual application requirements.

Further, the embodiment of the present invention does not limit the number of node IP addresses bound to each second alias, which can be set according to actual application requirements. The present invention also does not limit the specific manner of determining the IP address of the node that establishes the binding relationship with the second alias, for example, it may be determined through an A (Address) record, and relevant technologies of DNS may be referred to.

S103. Input the node IP address into the cloud protection node scheduling algorithm, determine the available target node IP address, and send the target node IP address to the client, so that the client sends the data sent to the protection domain name to the corresponding target node IP address cloud protection node.

It should be noted that the embodiment of the present invention does not limit the specific implementation and process of the cloud protection node scheduling algorithm, as long as the algorithm can select an available target node IP address from the input node IP addresses. It can be understood that, in order to ensure that the node IP address is available, the algorithm can use network diagnostic tools (ping, Packet InternetGrouper) to perform access diagnosis on the node IP address, and can also obtain the operation status of the cloud protection node, such as the normal operation of the cloud protection service or Abnormal operation information, specific computing resource (CPU, hard disk, etc.) occupancy rate, etc., and determine whether the cloud protection node is working normally according to the operation status, and then determine the available node IP address. Since the specific operating conditions of the cloud protection nodes can effectively reflect the working conditions of the cloud protection nodes as a whole, in the embodiment of the present invention, the cloud protection node scheduling algorithm can determine the IP address of the target node according to the operation of the cloud protection node corresponding to the node IP address .

Furthermore, considering that the cloud protection node may be set up with multiple regions and operators, in order to further increase the speed of client access to the source site of the protected domain name, the DNS management system can further extract the domain name resolution request when it obtains the request. The source IP address (that is, the IP address corresponding to the client), and according to the region information corresponding to the source IP address, the operator information it belongs to, or the combination of region information and operator information, further determine the client in the available node IP addresses Quickly accessible node IP address.

In a possible situation, after the DNS management system receives the domain name resolution request sent by the client, it further includes:

Step 11: The DNS management system extracts the source IP address in the domain name resolution request.

Correspondingly, the cloud protection node scheduling algorithm determines the IP address of the target node according to the operation status of the cloud protection node corresponding to the node IP address, and the region information and/or operator information to which the source address belongs.

Finally, it should be noted that the embodiment of the present invention does not limit a specific DNS management system, as long as the above functions can be realized, and the specific DNS management system or DNS management device can refer to DNS related technologies.

Based on the above embodiments, this method uses the second alias to uniformly schedule multiple node IP addresses. After the DNS management system resolves the first alias corresponding to the protected domain name in the domain name resolution request, it will further determine the first alias corresponding to the first alias. Two aliases, since the second alias is bound to multiple node IP addresses, the DNS management system can input these node IP addresses into the cloud protection node scheduling algorithm to detect the availability of node IP addresses and determine the available target nodes After the IP address, the target node IP address will be sent to the client, which can first ensure that the cloud protection node corresponding to the target node IP address is available, and can effectively detect the attack on the data sent by the client; at the same time, because the second alias binding has Multiple node IP addresses, when a node IP address is abnormal and cannot be used, it can also switch to other normal node IP addresses for attack detection, which can effectively avoid the source station site caused by related technologies using a single node IP address for attack detection Inability to access the problem, and ultimately improve the effectiveness and reliability of the cloud defense node attack detection function.

Based on the above embodiments, it can be understood that in order for the DNS management system to resolve the corresponding node IP address according to the protection domain name, the first alias record and the second alias record of the protection domain name need to be set in the DNS management system. The following is an introduction to the setting method of the first alias record and the second alias record of the protected domain name. Before the DNS management system receives the domain name resolution request sent by the client, it may also include:

S201. When the cloud protection management platform receives the configuration request, it extracts the protection domain name to be configured and the corresponding first alias name to be configured from the configuration request, and sets the first alias record of the protection domain name to be configured to point to the first alias name to be configured , and determine the primary domain name of the protected domain name to be configured.

In the embodiment of the present invention, the setting function of the first alias record and the second alias record can be implemented by the cloud protection management platform, which is a separate platform independent of the DNS management system. It should be noted that the embodiment of the present invention does not limit the specific hardware structure of the cloud protection management platform, as long as it can complete the corresponding functions in the embodiment of the present invention, which can be set according to actual application requirements.

Further, it can be understood that the configuration request is a request for setting the first alias record and the second alias record, and the request can be manually input on the cloud protection management platform, or sent to the cloud protection management platform by the user through the client. Sending is performed, and the method of generating and sending the configuration request information is not limited in this embodiment of the present invention. Furthermore, in order to effectively set the alias record, the configuration request includes at least the domain name to be configured and the corresponding first alias to be configured; of course, in order to further set the cloud protection nodes related to the domain name to be configured, the configuration request may also include the The IP address of the source site corresponding to the protection domain name, so that after the cloud protection management platform completes the setting of the first alias record and the second alias record, it can write the source site IP address of the protection domain name to be configured into the corresponding cloud protection node.

Further, it should be noted that the embodiment of the present invention does not limit the specific manner of determining the primary domain name of the domain name to be protected, and reference can be made to related technologies of domain names.

S202. Determine whether other protected domain names belonging to the main domain name are configured; if yes, proceed to step S203; if not, proceed to step S204.

Considering that the protected domain names with the same primary domain name usually come from the same company, in order to effectively manage the protected domain names, in the embodiment of the present invention, the same second alias is used to manage the protected domain names with the same primary domain name in a unified manner, so the steps of this step The purpose is to find out whether there are other defense domain names configured under the main domain name to which the defense domain name belongs. If so, point the first alias of the protection domain name to the second alias corresponding to other defense domain names.

S203. Search for a second alias corresponding to the primary domain name, and set the second alias record of the first alias to be configured to point to the second alias corresponding to the primary domain name.

S204. Determine the number of primary domain names corresponding to each second alias, and set the second alias record of the first alias to be configured to point to the second alias with the smallest number of primary domain names.

When the main domain name of the protection domain name to be configured does not have a protection domain name that has been set, the cloud protection management platform will determine the number of main domain names corresponding to each second alias, so as to allocate the protection domain name to be configured to the number of main domain names The least number of secondary aliases, thereby ensuring load balancing for each secondary alias. It can be understood that when there are multiple second aliases with the smallest number of primary domain names, one of these second aliases may be selected in a certain order for setting.

Furthermore, if the cloud protection management platform needs to re-determine the number of primary domain names corresponding to the second alias every time when setting the defense domain name to be configured, the setting efficiency will be reduced. Therefore, a corresponding counter can be set for each second alias. To record the number of times the second alias is consumed, and each time after completing the step of setting the second alias record of the first alias to be configured to point to the second alias with the smallest number of primary domain names, the counter of the corresponding second alias Add one, so that the cloud protection management platform only needs to read the counter value to quickly determine the number of primary domain names corresponding to the second alias.

Further, in the embodiment of the present invention, in order to ensure that each second alias only serves a limited number of primary domain names, an upper limit on the number of corresponding primary domain names can be set for the second alias, and when determining the number of primary domain names corresponding to each second alias After that, it is further determined whether the minimum value in the number of primary domain names is greater than the upper limit of the number of primary domain names. If yes, it can be determined that all the second aliases are full, and then a corresponding alarm operation can be performed to remind the management personnel to expand the capacity. It should be noted that the embodiment of the present invention does not limit the specific value of the upper limit of the number of primary domain names corresponding to each second alias, which can be set according to actual application requirements; the embodiment of the present invention also does not limit specific alarm operations, such as displaying Alarm information, play alarm audio and video; of course, alarm information can also be generated and sent to the alarm server, so that the alarm server can perform the above alarm operation. In order to effectively manage the cloud protection node scheduling system and clearly divide the specific functions of each device, in the embodiment of the present invention, the cloud protection management platform can generate alarm information and send it to the alarm server, so that the alarm server can perform the above alarm operation.

In a possible situation, after determining the number of primary domain names corresponding to each second alias, it may also include:

Step 21: The cloud protection management platform judges whether the minimum value of the number of primary domain names is greater than or equal to a preset threshold; if yes, proceed to step 22; if not, proceed to step 23.

It should be noted that the preset threshold becomes the above-mentioned upper limit of the number of primary domain names. Of course, in order to further improve the management efficiency of managers, an early warning threshold can also be set, so that the cloud protection management platform performs corresponding early warning operations when it determines that the minimum value of the number of primary domain names reaches the early warning threshold. It should be noted that the limited description of the warning operation in the present invention is consistent with the above-mentioned limited description of the warning operation.

Step 22: Generate alarm information, and send the alarm information to the alarm server, so that the alarm server performs an alarm operation.

Step 23: Execute the step of setting the second alias record of the first alias to be configured to point to the second alias with the least number of primary domain names.

S205. Write the first alias record of the protected domain name to be configured and the second alias record of the first alias to be configured into the DNS management system.

Further, it can be understood that the cloud protection management platform can also delete the configured protection domain name, and delete the first alias record and the second alias record of the deleted protection domain name in the DNS management system.

In a possible situation, after writing the first alias record of the domain name to be protected and the second alias record of the first alias to be configured into the DNS management system, it may also include:

Step 31: When the cloud protection management platform receives the domain name removal request, set the protected domain name in the domain name removal request as the protected domain name to be removed, and use the first alias record of the protected domain name to be removed to determine the domain name to be removed first alias;

Step 32: In the DNS management system, the cloud protection management platform deletes the first alias record corresponding to the protected domain name to be removed and the second alias record corresponding to the first alias to be removed.

It should be noted that if a counter is set to record the number of primary domain names for each second alias, while removing the protected domain name, the cloud protection management platform also needs to determine whether there are other domain names configured under the primary domain name corresponding to the protected domain name to be removed For the protected domain name that has not been removed, if so, just delete the protected domain name to be removed and the corresponding first alias record and the second alias record; The counter of the domain name is decremented by one, and the protected domain name to be removed and the corresponding first alias record and second alias record are removed.

Based on the above-mentioned embodiments, this method can realize the effective setting and management of the protected domain name through the cloud protection management platform, and in the process of setting the protected domain name, write the corresponding first alias record and the second alias record into the DNS management system, So that the DNS management system can perform effective resolution according to the first alias record and the second alias record.

The following describes the process of setting the protection domain name on the cloud protection management platform in combination with a specific flow chart. Please refer to FIG. 2, which is a flow chart of adding a protection domain name to the cloud protection management platform provided by the embodiment of the present invention. The process may include:

1. When the cloud protection management platform receives the configuration request, it extracts the domain name to be configured and the corresponding first alias to be configured from the configuration request, and sets the first alias record of the domain name to be configured to point to the first alias to be configured , and determine the primary domain name of the protected domain name to be configured;

2. Determine whether there are other protected domain names belonging to the main domain name configured; if yes, go to step 3; if not, go to step 4;

3. Find the second alias corresponding to the primary domain name, set the second alias record to be configured as the first alias to point to the second alias corresponding to the primary domain name, and finally exit the process;

4. Obtain the number of main domain names corresponding to each second alias, and determine whether the minimum value of the number of main domain names is greater than or equal to the alarm threshold; if yes, go to step 5; if not, go to step 6;

5. Generate alarm information, and send the alarm information to the alarm server, so that the alarm server performs an alarm operation, and enters step 8;

6. Determine whether the minimum value in the number of primary domain names is greater than or equal to the warning threshold; if so, proceed to step 7; if not, proceed to step 8; where the warning threshold is less than the warning threshold;

5. Generate early warning information, and send the early warning information to the alarm server, so that the alarm server performs the early warning operation, and enter step 8;

8. Set the second alias record of the first alias to be configured to point to the second alias with the smallest number of primary domain names, and add one to the number of primary domain names corresponding to the second alias,

9. Write the first alias record of the protected domain name to be configured and the second alias record of the first alias to be configured into the DNS management system.

Please refer to Fig. 3, Fig. 3 is a flow chart of deleting a protected domain name on the cloud protection management platform provided by an embodiment of the present invention, and the process may include:

1. When the cloud protection management platform receives a domain name removal request, it sets the protected domain name in the domain name removal request as the protected domain name to be removed, and uses the first alias record of the protected domain name to be removed to determine the second domain name to be removed. an alias;

2. Determine whether the main domain name of the protected domain name to be removed is configured with other undeleted protected domain names; if so, proceed to step 3; if not, proceed to step 4;

3. Subtract one from the number of primary domain names of the second alias corresponding to the primary domain name, and proceed to step 4;

4. In the DNS management system, remove the first alias record corresponding to the protected domain name to be removed and the second alias record corresponding to the first alias to be removed.

A cloud protection node scheduling system and storage medium provided by the embodiments of the present invention are introduced below. The cloud protection node scheduling system and storage medium described below and the cloud protection node scheduling method described above can be referred to in correspondence.

Please refer to FIG. 4a. FIG. 4a is a structural block diagram of a cloud protection node scheduling system provided by an embodiment of the present invention. The system includes: a DNS management system 401 and a cloud protection node 402, wherein,

The DNS management system 401 is configured to extract the protected domain name in the domain name resolution request when receiving the domain name resolution request sent by the client, and use the first alias record corresponding to the protected domain name to resolve the first alias; the first alias is the protected domain name Exclusive domain name alias; use the second alias record corresponding to the first alias to resolve the second alias, and determine the IP addresses of multiple nodes that establish a binding relationship with the second alias; input the node IP addresses into the cloud protection node scheduling algorithm to determine Available IP address of the target node, and send the IP address of the target node to the client, so that the client sends the data sent to the protection domain name to the cloud protection node 402 corresponding to the IP address of the target node;

The cloud protection node 402 is configured to detect attacks on the data sent by the client to the protection domain name.

Optionally, please refer to FIG. 4b. FIG. 4b is a structural block diagram of another cloud protection node scheduling system provided by an embodiment of the present invention. The system may also include: a cloud protection management platform 403, wherein,

The cloud protection management platform 403 is configured to extract the domain name to be configured and the corresponding first alias to be configured from the configuration request when receiving the configuration request, and set the first alias record of the domain name to be configured to point to the first alias to be configured. an alias, and determine the main domain name of the domain name to be protected; determine whether there are other protected domain names belonging to the main domain name; if so, search for the second alias corresponding to the main domain name, and set the record, set it to point to the second alias corresponding to the main domain name; if not, determine the number of main domain names corresponding to each second alias, and set the second alias record to be configured to point to the one with the smallest number of main domain names The second alias; write the first alias record of the protected domain name to be configured and the second alias record of the first alias to be configured into the DNS management system 401;

The DNS management system 401 is further configured to store the received first alias record and the second alias record.

Optionally, please refer to FIG. 4c. FIG. 4c is a structural block diagram of another cloud protection node scheduling system provided by an embodiment of the present invention. The system may also include: an alarm server 404, wherein,

The cloud protection management platform 403 is also used to judge whether the minimum value in the number of primary domain names is greater than or equal to a preset threshold; if so, generate alarm information and send the alarm information to the alarm server 404, so that the alarm server performs an alarm operation; if If not, perform the step of setting the second alias record of the first alias to be configured to point to the second alias with the least number of primary domain names;

The alarm server 404 is configured to perform an alarm operation when receiving alarm information.

Optionally, the cloud protection management platform 403 is also configured to set the protected domain name in the domain name removal request as the protected domain name to be removed when receiving the domain name removal request, and use the first alias of the protected domain name to be removed record, determining the first alias to be removed; in the DNS management system 401, removing the first alias record corresponding to the protected domain name to be removed and the second alias record to be removed from the first alias.

Optionally, the DNS management system 401 is also configured to extract the source IP address in the domain name resolution request when receiving the domain name resolution request sent by the client;

Correspondingly, the cloud protection node scheduling algorithm in the DNS management system 401 determines the target node IP address according to the operation status of the cloud protection node corresponding to the node IP address, and the region information and/or operator information to which the source address belongs.

An embodiment of the present invention further provides a storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the cloud protection node scheduling method in any of the foregoing embodiments are implemented.

Since the embodiment of the storage medium part corresponds to the embodiment of the cloud protection node scheduling method part, please refer to the description of the embodiment of the cloud protection node scheduling method part for the embodiment of the storage medium part, and details will not be repeated here.

Each embodiment in the description is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same and similar parts of each embodiment can be referred to each other. As for the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and for the related information, please refer to the description of the method part.

Professionals can further realize that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software or a combination of the two. In order to clearly illustrate the possible Interchangeability, in the above description, the components and steps of each example have been generally described according to their functions. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present invention.

The steps of the methods or algorithms described in connection with the embodiments disclosed herein may be directly implemented by hardware, software modules executed by a processor, or a combination of both. Software modules can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other Any other known storage medium.

A cloud protection node scheduling method, system and storage medium provided by the present invention have been introduced in detail above. In this paper, specific examples are used to illustrate the principle and implementation of the present invention, and the descriptions of the above embodiments are only used to help understand the method and core idea of the present invention. It should be pointed out that for those skilled in the art, without departing from the principle of the present invention, some improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the protection scope of the claims of the present invention.

Claims (8)

1. A cloud protection node scheduling method, characterized in that, comprising: When the DNS management system receives the domain name resolution request sent by the client, it extracts the protected domain name in the domain name resolution request, and uses the first alias record corresponding to the protected domain name to resolve the first alias; the first alias is A domain name alias dedicated to the protected domain name; Using the second alias record corresponding to the first alias, resolve the second alias, and determine a plurality of node IP addresses that establish a binding relationship with the second alias; Input the IP address of the node into the cloud protection node scheduling algorithm, determine the available IP address of the target node, and send the IP address of the target node to the client, so that the client will send the IP address to the protection domain name The data is sent to the cloud protection node corresponding to the IP address of the target node; Before the DNS management system receives the domain name resolution request sent by the client, it also includes: When the cloud protection management platform receives the configuration request, it extracts the domain name to be configured and the corresponding first alias to be configured from the configuration request, and sets the first alias record of the domain name to be configured to point to the domain name to be configured. Configure the first alias, and determine the main domain name of the domain name to be protected; Judging whether there are other protected domain names belonging to the main domain name configured; If so, search for a second alias corresponding to the primary domain name, and set the second alias record of the first alias to be configured to point to the second alias corresponding to the primary domain name; If not, then determine the number of primary domain names corresponding to each of the second aliases, and set the second alias record of the first alias to be configured to point to the second alias with the smallest number of primary domain names; Writing the first alias record of the protected domain name to be configured and the second alias record of the first alias to be configured into the DNS management system. 2. The cloud protection node scheduling method according to claim 1, further comprising: after determining the number of primary domain names corresponding to each of the second aliases: The cloud protection management platform judges whether the minimum value in the number of primary domain names is greater than or equal to a preset threshold; If so, generating alarm information, and sending the alarm information to the alarm server, so that the alarm server performs an alarm operation; If not, execute the step of setting the second alias record of the first alias to be configured to point to the second alias with the least number of primary domain names. 3. The cloud protection node scheduling method according to claim 1, wherein, after writing the first alias record of the protection domain name to be configured and the second alias record of the first alias to be configured into the DNS After the management system, also include: When the cloud protection management platform receives the domain name removal request, it sets the protected domain name in the domain name removal request as the protected domain name to be removed, and uses the first alias record of the protected domain name to be removed to determine The first alias to be removed; In the DNS management system, the cloud protection management platform deletes the first alias record corresponding to the protected domain name to be removed and the second alias record of the first alias to be removed. 4. The cloud protection node scheduling method according to claim 1, characterized in that, after the DNS management system receives the domain name resolution request sent by the client, it further includes: The DNS management system extracts the source IP address in the domain name resolution request; Correspondingly, the cloud protection node scheduling algorithm determines the target node IP address according to the operation status of the cloud protection node corresponding to the node IP address, and the region information and/or operator information to which the source IP address belongs. 5. A cloud protection node scheduling system, characterized in that it comprises: a DNS management system and a cloud protection node, wherein, The DNS management system is configured to extract the protected domain name in the domain name resolution request when receiving the domain name resolution request sent by the client, and use the first alias record corresponding to the protected domain name to resolve the first alias; the second An alias is a domain name alias exclusive to the protected domain name; using the second alias record corresponding to the first alias, the second alias is resolved, and a plurality of node IP addresses that establish a binding relationship with the second alias are determined; The node IP address is input into the cloud protection node scheduling algorithm, the available target node IP address is determined, and the target node IP address is sent to the client, so that the client will send data to the protection domain name Send to the cloud protection node corresponding to the IP address of the target node; The cloud protection node is configured to perform attack detection on the data sent by the client to the protection domain name; The cloud protection node scheduling system also includes: a cloud protection management platform, wherein, The cloud protection management platform is configured to, when receiving a configuration request, extract the domain name to be configured for protection and the corresponding first alias to be configured from the configuration request, record the first alias of the domain name for protection to be configured, and set In order to point to the first alias to be configured, and determine the main domain name of the protected domain name to be configured; determine whether other protected domain names belonging to the main domain name are configured; if so, search for the second domain name corresponding to the main domain name Alias, and set the second alias record of the first alias to be configured to point to the second alias corresponding to the main domain name; if not, determine the number of main domain names corresponding to each second alias, and set The second alias record of the first alias to be configured is set to point to the second alias with the smallest number of primary domain names; the first alias record of the protected domain name to be configured and the second alias record of the first alias to be configured The alias record is written into the DNS management system; The DNS management system is further configured to save the received first alias record and second alias record. 6. The cloud protection node scheduling system according to claim 5, further comprising: an alarm server, wherein, The cloud protection management platform is also used to judge whether the minimum value of the number of primary domain names is greater than or equal to a preset threshold; if so, generate alarm information and send the alarm information to the alarm server, so that the alarm The server executes an alarm operation; if not, execute the step of setting the second alias record of the first alias to be configured to point to the second alias with the least number of primary domain names; The alarm server is configured to perform an alarm operation when receiving the alarm information. 7. The cloud protection node scheduling system according to claim 5, wherein: The cloud protection management platform is further configured to set the protected domain name in the domain name removal request as the protected domain name to be removed when receiving the domain name removal request, and use the first An alias record, determining the first alias to be removed; in the DNS management system, removing the first alias record corresponding to the protected domain name to be removed and the second alias record of the first alias to be removed. 8. A storage medium, wherein a computer program is stored on the storage medium, and when the computer program is executed by a processor, the steps of the cloud protection node scheduling method according to any one of claims 1 to 4 are implemented .

Images