CN114285821B - Domain name resolution method, device, electronic device, storage medium and product - Google Patents

Abstract

The invention provides a domain name resolution method, a domain name resolution device, electronic equipment, a storage medium and a product, which are applied to terminal equipment, wherein the domain name resolution method comprises the following steps: acquiring a domain name resolution request input by a user, and inquiring a domain name in a preset domain name application list according to the domain name resolution request; the domain name application list comprises domain names corresponding to authorized applications, and when the domain names contained in the domain name resolution request exist in the domain name application list, a target IP address corresponding to the domain names is determined, and the target IP address is used as a resolution result of the domain name resolution request. The method provided by the invention is applied to the user terminal, plays a role in carrying out application diversion on the trusted application by providing the local DNS service for monitoring the local port at the user terminal, improves the processing speed of application access, realizes dynamic control of the application access, and ensures the safety of the application access.

Description

Domain name resolution method, device, electronic device, storage medium and product

Technical Field

The present invention relates to the field of Internet technology, and in particular to a domain name resolution method, device, electronic device, storage medium and product.

Background technique

With the rapid development of mobile Internet, people's requirements for secure access to applications are getting higher and higher, and it is particularly important to achieve secure access to business systems.

In the existing technology, the trusted agent is the data plane component of the zero-trust architecture, the first checkpoint to ensure secure business access, and the policy execution point for dynamic access control capabilities. Depending on different scenarios, the specific product form of the trusted agent varies greatly.

At present, the prerequisite for the trusted application proxy to proxy application access is that all applications that need to be proxied point their domain name resolution to the trusted application proxy server. There are two common implementation plans. The first is to modify the DNS domain name resolution of each application so that all application domain names that need to be proxied are resolved to the IP address of the trusted application proxy server. This method is difficult to maintain when there are many applications. After the domain name resolution address is modified, it takes a long time to take effect depending on the different DNS server refresh times in different places. The second is to configure a wildcard domain name to point to the trusted application proxy server. This is only applicable to the case where all application domain names that need to be proxied have the same suffix. After this solution takes effect, all domain names with the same suffix point to the trusted application proxy server, which cannot achieve more refined control over application access, resulting in a poor user experience.

Summary of the invention

The present invention provides a domain name resolution method, device, electronic device, storage medium and product, which are used to solve the technical problems in the prior art that application access has low real-time performance and cannot be more finely controlled, so as to achieve the purpose of improving the processing speed of application access and ensuring the timeliness and security of application access.

In a first aspect, the present invention provides a domain name resolution method, applied to a terminal device, comprising:

Get the domain name resolution request entered by the user;

According to the domain name resolution request, a domain name query is performed in a preset domain name application list; wherein the domain name application list includes domain names corresponding to authorized applications;

In a case where the domain name included in the domain name resolution request exists in the domain name application list, a target IP address corresponding to the domain name is determined, and the target IP address is used as a resolution result of the domain name resolution request.

Further, according to the domain name resolution method provided by the present invention, the determining of the target IP address corresponding to the domain name includes:

The IP address of the zero-trust trusted application proxy server is determined as the target IP address corresponding to the domain name.

Further, according to the domain name resolution method provided by the present invention, the determining of the target IP address corresponding to the domain name includes:

Determine a first IP address of the domain name according to the domain name; wherein the first IP address of the domain name is an IP address different from a second IP address of the domain name stored in a DNS server;

The first IP address of the domain name is determined as the target IP address corresponding to the domain name.

Furthermore, according to the domain name resolution method provided by the present invention, the method further includes:

Obtaining user identification information;

Correspondingly, when the domain name included in the domain name resolution request exists in the domain name application list, determining the target IP address corresponding to the domain name includes:

In a case where the domain name included in the domain name resolution request exists in the domain name application list, a target IP address corresponding to the domain name is determined based on the user identification information.

Further, according to the domain name resolution method provided by the present invention, after performing a domain name query in a preset domain name application list according to the domain name resolution request, the method further includes:

In the case that the domain name included in the domain name resolution request does not exist in the domain name application list, the domain name resolution request is forwarded to a DNS server to obtain a second IP address of the domain name included in the domain name resolution request.

Furthermore, according to the domain name resolution method provided by the present invention, before obtaining the domain name resolution request input by the user, the method includes:

Receiving the domain name application list;

The domain name application list is obtained by mapping the IP addresses of each application of the user to domain names in the zero trust trusted access console.

In a second aspect, the present invention further provides a domain name resolution device, comprising:

The acquisition module is used to obtain the domain name resolution request input by the user;

A query module, used to perform a domain name query in a preset domain name application list according to the domain name resolution request; wherein the domain name application list includes domain names corresponding to authorized applications;

The determination module is used to determine the target IP address corresponding to the domain name when the domain name included in the domain name resolution request exists in the domain name application list, and use the target IP address as the resolution result of the domain name resolution request.

In a third aspect, the present invention further provides an electronic device, comprising:

processor, memory and bus, wherein,

The processor and the memory communicate with each other via the bus;

The memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the steps of the domain name resolution method described in any one of the above items.

In a fourth aspect, the present invention further provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions enable a computer to execute the steps of the domain name resolution method as described above.

In a fifth aspect, the present invention further provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the steps of the domain name resolution method as described in any one of the above items are implemented.

The present invention provides a domain name resolution method, device, electronic device, storage medium and product, which are applied to a terminal device, obtain a domain name resolution request input by a user, and then perform a domain name query in a preset domain name application list according to the domain name resolution request, wherein the domain name application list contains domain names corresponding to authorized applications, and when the domain name contained in the domain name resolution request exists in the domain name application list, determine the target IP address corresponding to the domain name, and use the target IP address as the resolution result of the domain name resolution request. The domain name resolution method provided by the present invention is applied to a terminal device, and by providing a local DNS service that monitors a local port on a user terminal, it plays a role in diverting applications to a trusted application agent, improves the processing speed of application access, realizes dynamic control of application access, and ensures the timeliness and security of application access.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

FIG1 is a schematic diagram of a flow chart of a domain name resolution process in the prior art;

FIG2 is a flow chart of a domain name resolution method provided by the present invention;

FIG3 is a diagram showing an example of a domain name resolution method provided by the present invention;

FIG4 is a schematic diagram of the structure of a domain name resolution device provided by the present invention;

FIG. 5 is a schematic diagram of the structure of an electronic device provided by the present invention.

Detailed ways

In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

FIG1 is a flow chart of domain name resolution processing in the prior art. As shown in FIG1 , in the prior art, the DNS server resolution method is often used for domain name resolution. The DNS server includes a regional DNS server, a global root DNS server, a top-level DNS server, and an authoritative DNS server. The DNS used on the client computer is a regional DNS server. After receiving the domain name resolution request, the regional DNS server will obtain the resolution result from the authoritative DNS server and return it to the user, and cache the resolution result TTL value in its own server. It should be noted that the regional DNS server is generally provided by the network service provider, and can also be modified to a commonly used public DNS according to actual needs.

In the prior art, to resolve a domain name into the IP address corresponding to the domain name, the following steps are generally required:

1. The user terminal initiates a domain name resolution request to the regional DNS server.

2. The regional DNS server first initiates a domain name resolution request to the global root DNS server, and the global root DNS server returns the top-level DNS server address of the requested domain name.

3. The regional DNS server initiates a domain name resolution request to the top-level DNS server based on the obtained top-level DNS server address, and the top-level DNS server returns the authoritative DNS server address of the requested domain name.

4. The regional DNS server then initiates a domain name resolution request to the authoritative DNS server based on the address of the authoritative DNS server, and the authoritative DNS server returns the IP address of the requested domain name.

For example, if you want to request the resolution address of a domain name (A.com), you have to follow these steps:

(1) The user terminal asks the regional DNS server A.com what its IP address is;

(2) The regional DNS asks the global root DNS server what the IP address of A.com is. The global root DNS server answers: The top-level DNS server that manages the com domain name is xxx.

(3) The regional DNS server asks the top-level DNS server what the IP address of A.com is. The top-level DNS server replies: The authoritative DNS that manages A.com is xxx.

(4) The regional DNS server asks the authoritative DNS server A.com what its IP address is, and the authoritative DNS server replies: The IP address is XXXX.

The entire processing process can only be carried out through the interaction between the regional DNS server and multiple DNS servers. Dynamic control of application access is not implemented, resulting in low timeliness for users to obtain the IP address corresponding to the domain name.

FIG. 2 is a flow chart of a domain name resolution method provided by the present invention. As shown in FIG. 2 , the domain name resolution method provided by the present invention, applied on a terminal device, comprises the following steps:

Step 201: Obtain a domain name resolution request input by a user.

In this embodiment, a domain name resolution request initiated by a user terminal device is obtained. The domain name resolution request includes the domain name information to be requested. The domain name information can be A.com or B.com. It can be set according to the actual needs of the user and is not specifically limited here.

It should be noted that before obtaining the domain name resolution request input by the user, a local host DNS service needs to be installed on the terminal device to process the various steps of the domain name resolution method provided by the present invention. The DNS domain name system (Domain Name System) is a service of the Internet. It is a distributed database that maps domain names and target IP addresses to each other, enabling users to access the Internet more conveniently and quickly. The DNS service usually uses TCP and UDP port 53 to provide services.

Step 202: According to the domain name resolution request, a domain name query is performed in a preset domain name application list; wherein the domain name application list includes domain names corresponding to authorized applications.

In this embodiment, based on the obtained domain name resolution request, the domain name to be queried is obtained, and then the domain name query is performed in the preset domain name application list. It should be noted that the domain name application list exists in the local DNS service, and the domain name application list contains the domain name information corresponding to each authorized application, that is, the domain names corresponding to all applications to which the user has access rights. In this embodiment, these domain name information may be domain name information that is not supported by traditional DNS servers.

Step 203: When the domain name included in the domain name resolution request exists in the domain name application list, determine the target IP address corresponding to the domain name, and use the target IP address as the resolution result of the domain name resolution request.

In this embodiment, if the domain name obtained from the domain name resolution request obtained in step 201 exists in the domain name application list in the local DNS service on the terminal device, the target IP address corresponding to the domain name is determined from the domain name resolution application list, and the target IP address is used as the resolution result of the domain name resolution request. It should be noted that the target IP address determined in the domain name application list may be the IP address of the intranet corresponding to the domain name, or it may be the IP address of the zero-trust trusted application proxy server corresponding to the domain name. According to the corresponding IP address, the application access corresponding to the domain name is diverted to the intranet or the zero-trust trusted application proxy server to implement application diversion processing of application access. Among them, the target IP address can be set according to actual needs and is not specifically limited here.

For example, if the domain name A.com is obtained from the domain name resolution request, and if the domain name A.com is in the domain name application list in the local DNS service, then based on the mapping relationship between the domain name and the IP address, the IP address 12.12.12.12 corresponding to the domain name is determined in the preset domain name application list as the resolution result of the domain name resolution request, and the application access corresponding to the domain name is directed to the corresponding intranet or zero-trust trusted proxy server.

It should be noted that the virtual local DNS service provided on the user terminal adopts the reverse proxy technology. The reverse proxy technology requires a reverse proxy server, which is located between the user and the target server. The virtual local DNS service provided on the terminal device in the embodiment of the present invention belongs to the reverse proxy server. Although the local DNS service is a virtual server located between the user and the target server, for the user, the local DNS service is equivalent to the target server, that is, the user can directly access the local DNS service to obtain the resources of the target server. In addition, the reverse proxy server is usually used as an application layer firewall to provide certain protection against Web-based attacks on the website.

It should be noted that when using a virtual local DNS service for application diversion, the methods used for different diversion platforms are also different. For example, the Linux system and the Mac system use the method of changing /etc/resolv.conf, and the Windows system changes the DNS server of the network card attributes. The essence is to change the regional DNS server originally configured by the user to the local DNS service provided by the present invention. The local DNS service acts as a middleman. The domain name resolution request input by the user terminal will be sent to the local DNS service first. If the target IP address corresponding to the domain name exists in the domain name application list in the local DNS service, the target IP address will be directly returned; if not, the local DNS service will pass the domain name resolution request to the regional DNS server, and the regional DNS server will continue to query.

The domain name resolution method provided by the present invention is applied to a terminal device, and the domain name obtained from the acquired domain name resolution request is queried in a preset domain name application list. When the domain name included in the domain name resolution request exists in the domain name application list, the target IP address corresponding to the domain name is determined, and the target IP address is used as the resolution result of the domain name resolution request. The domain name resolution method provided by the present invention is applied to a terminal device, and by installing a local DNS service that monitors a local port in a user terminal, it plays a role in guiding the trusted application proxy, improves the processing speed of application access, realizes dynamic control of application access, and ensures the timeliness and security of application access.

In another embodiment of the present invention, the determining the target IP address corresponding to the domain name includes:

The IP address of the zero-trust trusted application proxy server is determined as the target IP address corresponding to the domain name.

In this embodiment, when there is a target IP address corresponding to the domain name in the domain name application list, the IP address of the zero-trust trusted application proxy server is determined as the target IP address corresponding to the domain name.

In this embodiment, the user needs to obtain the domain name application list after the login authentication is successful. The mapping relationship in the domain name application list includes the mapping relationship between the domain name and the IP address of the zero-trust trusted application proxy server. In this embodiment, there are multiple domain names in the domain name application list mapped to the same zero-trust trusted application proxy server IP address. For example, the IP address of the zero-trust trusted application proxy server is 2.2.2.2. After the user authentication is successful, three application domain name lists are obtained, namely: A.COM: 2.2.2.2, B.COM: 2.2.2.2, C.COM: 192.168.2.2, among which A and B are both authorized trusted proxy applications, and the IP addresses corresponding to the domain names are the IP addresses of the zero-trust trusted application proxy servers. C is an intranet application, and the mapping is the intranet address.

It should be noted that zero trust is a new generation of network security protection concept. The key is to break the default "trust". In essence, it is "continuous verification, never trust". By default, no one, device or system inside or outside the enterprise network is trusted. The trust foundation of access control is rebuilt based on identity authentication and authorization, thereby ensuring that the identity, device, application and link are trusted. Among them, the trusted agent is the data plane component of the zero trust architecture, the first gateway to ensure secure business access, and the policy execution point of dynamic access control capabilities.

The prerequisite for the zero-trust trusted application proxy server to proxy application access is that all applications that need to be proxied point their domain name resolutions to the IP address of the trusted application proxy server. Therefore, in this embodiment, the IP address of the zero-trust trusted proxy server is determined as the target IP address corresponding to the domain name, so that application access is directed to the zero-trust trusted application proxy server, so that all requests will be access-controlled through the zero-trust trusted application proxy server.

For example, the domain name obtained from the domain name resolution request is a.com, and the IP address of the zero-trust trusted proxy server is 2.2.2.2. Since the original IP corresponding to the domain name is 1.1.1.1, there is a certain timeliness in the query method in the prior art. In the domain name application list in the local DNS service in the embodiment of the present invention, a certain mapping relationship is established between the IP address 2.2.2.2 of the zero-trust trusted proxy server and the domain name a.com, and the IP address 2.2.2.2 of the zero-trust trusted proxy server is returned as the target IP address of the domain name, and the application corresponding to the domain name is directly directed to the gateway to achieve fast query of the domain name.

According to the domain name resolution method provided by the present invention, by determining the IP address of the zero-trust trusted application proxy server as the target IP address corresponding to the domain name, the timeliness and security of application access processing are guaranteed, and the user experience is improved.

In another embodiment of the present invention, the determining the target IP address corresponding to the domain name includes:

Determine a first IP address of the domain name according to the domain name; wherein the first IP address of the domain name is an IP address different from a second IP address of the domain name stored in a DNS server;

The first IP address of the domain name is determined as the target IP address corresponding to the domain name.

In this embodiment, the first IP address refers to the IP address of the intranet corresponding to the domain name, and the second IP address refers to the IP address of the public network corresponding to the domain name stored in the DNS server. In this embodiment, the first IP address of the domain name is determined from the domain name application list in the local DNS service according to the domain name information, and the first IP address is determined as the target IP address corresponding to the domain name. It should be noted that the first IP address is different from the second IP address stored in the DNS server, and the two are IP addresses corresponding to different network types. It can be set according to actual needs and is not specifically limited here.

It should be noted that in addition to a network card IP address, each terminal also has a virtual local loopback address, where the local loopback address starts with 127. This type of local loopback address starting with 127. belongs to the user terminal device, and the local DNS service in the embodiment of the present invention listens to port 53 of the local loopback address starting with 127. to provide DNS resolution services to the terminal.

It should be noted that in this embodiment, the domain name resolution is generally an intranet domain name. This domain name resolution method uses the local DNS service for resolution, which corresponds to the first IP address. In Internet applications, if the user is not logged in to the zero-trust trusted client in the present invention, these intranet domain names cannot be resolved.

The domain name resolution method provided by the embodiment of the present invention uses the first IP address determined in the domain name application list in the local DNS service as the target IP address corresponding to the domain name, thereby ensuring that the user can quickly obtain the IP address for access based on the mapping relationship between the domain name and the IP address when accessing the intranet, thereby improving the timeliness of application access and avoiding hijacking attacks on user domain names.

In another embodiment of the present invention, the method further comprises:

Obtaining user identification information;

Correspondingly, when the domain name included in the domain name resolution request exists in the domain name application list, determining the target IP address corresponding to the domain name includes:

In a case where the domain name included in the domain name resolution request exists in the domain name application list, a target IP address corresponding to the domain name is determined based on the user identification information.

In this embodiment, different domain name resolution strategies need to be determined for different users. In this embodiment, the user's identification information is obtained, where the identification information refers to a mark that distinguishes different user information, such as user 1 is represented by A, user 2 is represented by B, etc. When the domain name included in the domain name resolution request exists in the domain name application list in the local DNS service, the target IP address corresponding to the domain name is determined based on the user's identification information.

It should be noted that the domain name application list in the local DNS service contains each domain name information and the IP address information corresponding to each domain name, and based on the user's identification information, the domain name application list information that the user has been authorized to determine, and then determine the target IP address corresponding to the domain name according to the mapping relationship in the domain name application list. For example, if the identification information of user 1 is set to A and the identification information of user 2 is set to B, the domain name application list 1 of user 1 corresponding to identification A is determined in the gateway: a.com:2.2.2.2, b.com:2.2.2.2 and c.com:192.168.2.2, and the domain name application list 2 of user 2 corresponding to identification B is: a.com:2.2.2.2 and c.com:192.168.2.2. After determining the identification information of user 2, if the user wants to access the domain name b.com, according to the mapping relationship in the domain name application list, the domain name has no corresponding IP address, and user 2 cannot access the application; if the user wants to access the domain name c.com, the corresponding IP address 192.168.2.2 is determined as the target IP address corresponding to the domain name.

It should be noted that the same domain name may also resolve to different IP addresses. Each domain name corresponds to at least one IP address, and each IP address corresponds to only one domain name, that is, the IP addresses corresponding to the same domain name 1 are different. For example, based on the user's identification information in the gateway, it is determined that the domain name application list of user 1 contains domain name 1, and the domain name application list of user 2 also contains domain name 1. However, the IP address of domain name 1 in the domain name application list of user 1 is IP address 1, while the IP address of domain name 1 in the domain name application list of user 2 is IP address 2. The IP addresses corresponding to the same domain name are different. The mapping relationship between domain names and IP addresses can be set according to actual needs and is not specifically limited here.

For example, in scenario 1, it is determined in the gateway that the domain name application list 1 obtained by user 1 is a.com:2.2.2.2, b.com:2.2.2.2 and c.com:192.168.2.2, and the domain name application list 1 obtained by user 2 is a.com:3.3.3.3 and c.com:192.168.2.2. User 1 and user 2 use different trusted application proxies, which can achieve load balancing. Scenario 2: It is determined in the gateway that the domain name application list 1 obtained by user 1 is c.com:192.168.2.2, and the domain name application list 2 obtained by user 2 is c.com:192.168.2.3. Different users obtain different IP addresses of the same application, which can provide DNS load balancing capabilities for the application.

According to the domain name resolution method provided by the embodiment of the present invention, by obtaining the user's identification information, and then, when the domain name included in the domain name resolution request exists in the domain name application list, the target IP address corresponding to the domain name is determined based on the user's identification information. This can achieve the same domain name corresponding to different IP addresses, achieve the purpose of load balancing and hiding sensitive applications, and meet the diverse demand scenarios of enterprises.

In another embodiment of the present invention, after performing a domain name query in a preset domain name application list according to the domain name resolution request, the method further includes:

In the case that the domain name included in the domain name resolution request does not exist in the domain name application list, the domain name resolution request is forwarded to a DNS server to obtain a second IP address of the domain name included in the domain name resolution request.

In this embodiment, if the domain name to be queried does not exist in the domain name application list authorized by the user, the local DNS service needs to forward the domain name resolution request to the regional DNS server to obtain the second IP address of the domain name contained in the domain name resolution request. It should be noted that, as shown in Figure 3, the local DNS service initiates a domain name resolution request to the regional DNS server, and the regional DNS server first initiates a domain name resolution request to the global root DNS server, and the global root DNS server returns the top-level DNS server address of the requested domain name. The regional DNS server then initiates a domain name resolution request to the top-level DNS server, and the top-level DNS server returns the authoritative DNS server address of the requested domain name. The regional DNS server then initiates a domain name resolution request to the authoritative DNS server, and the authoritative DNS server returns the second IP address of the requested domain name. Among them, the second IP address is the IP address corresponding to accessing the public network.

It should be noted that the domain name that requires application diversion will return the IP address corresponding to the domain name in the user's authorized domain name application list. If no diversion is required, the domain name resolution method in this embodiment will be used to request the original DNS server to obtain the corresponding IP address result. The local DNS service will return the second IP address returned by the DNS server to the user.

According to the domain name resolution method provided by an embodiment of the present invention, when the domain name included in the domain name resolution request does not exist in the domain name application list in the local DNS service, the domain name resolution request is forwarded to the DNS server to obtain the second IP address of the domain name included in the domain name resolution request, which can ensure that the task requirement of domain name resolution can be completed even if the requested domain name does not exist in the domain name application list.

In another embodiment of the present invention, before obtaining the domain name resolution request input by the user, the process includes:

Receiving the domain name application list;

The domain name application list is obtained by mapping the IP addresses of each application of the user to domain names in the zero trust trusted access console.

In this embodiment, the local DNS service needs to receive a domain name application list before obtaining the domain name resolution request input by the user. The domain name application list is obtained by mapping the domain names of the IP addresses of various applications to which the user has access rights in the zero-trust trusted access console. According to the authorized user account information, after the user successfully logs in, the domain name application list including the IP addresses of authorized applications will be obtained. Then, the zero-trust trusted access console passes the generated domain name application list to the local DNS service for subsequent domain name resolution. It should be noted that the domain name application list contains the mapping relationship between the IP addresses of various applications of a certain user and each domain name. In other embodiments, the domain name application list may also contain other mapping relationships. It can be set according to actual needs and is not specifically limited here.

According to the domain name resolution method provided by the present invention, the local DNS service needs to receive a domain name application list for subsequent domain name resolution requests input by users after logging in through a zero-trust trusted terminal, and obtain a list of all applications that the user has permission to access, thereby ensuring the timeliness and security of domain name resolution.

FIG4 is a domain name resolution device provided by an embodiment of the present invention. As shown in FIG4 , the domain name resolution device provided by an embodiment of the present invention includes:

The acquisition module 401 is used to acquire a domain name resolution request input by a user;

A query module 402 is used to perform a domain name query in a preset domain name application list according to the domain name resolution request; wherein the domain name application list includes domain names corresponding to authorized applications;

The determination module 403 is used to determine the target IP address corresponding to the domain name when the domain name included in the domain name resolution request exists in the domain name application list, and use the target IP address as the resolution result of the domain name resolution request.

The domain name resolution device provided by the present invention is applied to a terminal device, and performs a domain name query in a preset domain name application list by using the domain name obtained from the domain name resolution request. When the domain name included in the domain name resolution request exists in the domain name application list, the target IP address corresponding to the domain name is determined, and the target IP address is used as the resolution result of the domain name resolution request. The domain name resolution method provided by the present invention is applied to a terminal device, and by installing a local DNS service that monitors a local port in a user terminal, it plays a role in diverting applications to a trusted application proxy, improves the processing speed of application access, realizes dynamic control of application access, and ensures the timeliness and security of application access.

Further, the determination module 403 is further used for:

The IP address of the zero-trust trusted application proxy server is determined as the target IP address corresponding to the domain name.

According to the domain name resolution device provided by the present invention, by determining the IP address of the zero-trust trusted application proxy server as the target IP address corresponding to the domain name, the timeliness and security of application access processing are guaranteed, and the user experience is improved.

Further, the determination module 403 is further used for:

Determine a first IP address of the domain name according to the domain name; wherein the first IP address of the domain name is an IP address different from a second IP address of the domain name stored in a DNS server;

The first IP address of the domain name is determined as the target IP address corresponding to the domain name.

The domain name resolution device provided according to the embodiment of the present invention uses the first IP address determined in the domain name application list in the local DNS service as the target IP address corresponding to the domain name, thereby ensuring that the user can quickly obtain the IP address for access based on the mapping relationship between the domain name and the IP address when accessing the intranet, thereby improving the timeliness of application access and avoiding hijacking attacks on user domain names.

Furthermore, the device further comprises an acquisition module, which is used to:

Obtaining user identification information;

Correspondingly, when the domain name included in the domain name resolution request exists in the domain name application list, determining the target IP address corresponding to the domain name includes:

In a case where the domain name included in the domain name resolution request exists in the domain name application list, a target IP address corresponding to the domain name is determined based on the user identification information.

The domain name resolution device provided by the embodiment of the present invention obtains the user's identification information, and then, when the domain name included in the domain name resolution request exists in the domain name application list, determines the target IP address corresponding to the domain name based on the user's identification information, thereby achieving the same domain name corresponding to different users' IP addresses, thereby meeting the diverse demand scenarios of enterprises.

Further, the query module 402 is also used for:

In the case that the domain name included in the domain name resolution request does not exist in the domain name application list, the domain name resolution request is forwarded to a DNS server to obtain a second IP address of the domain name included in the domain name resolution request.

According to the domain name resolution device provided by the embodiment of the present invention, when the domain name included in the domain name resolution request does not exist in the domain name application list in the local DNS service, the domain name resolution request is forwarded to the DNS server to obtain the second IP address of the domain name included in the domain name resolution request, which can ensure that the task requirement of domain name resolution can be completed even if the requested domain name does not exist in the domain name application list.

Furthermore, the device further comprises a receiving module, and the receiving module is used for:

Receiving the domain name application list;

The domain name application list is obtained by mapping the IP addresses of each application of the user to domain names in the zero trust trusted access console.

According to the domain name resolution method provided by the present invention, the local DNS service needs to receive a domain name application list for subsequent domain name resolution requests input by users after logging in through a zero-trust trusted terminal, and obtain a list of all applications that the user has permission to access, thereby ensuring the timeliness and security of domain name resolution.

Since the principle of the device described in the embodiment of the present invention is the same as that of the method described in the above embodiment, a more detailed explanation is not repeated here.

FIG5 is a schematic diagram of the physical structure of an electronic device provided in an embodiment of the present invention. As shown in FIG5 , the present invention provides an electronic device, including: a processor (processor) 501, a memory (memory) 502 and a bus 503;

The processor 501 and the memory 502 communicate with each other via the bus 503;

The processor 501 is used to call the program instructions in the memory 502 to execute the methods provided in the above-mentioned method embodiments, for example, including: obtaining a domain name resolution request input by a user, and performing a domain name query in a preset domain name application list according to the domain name resolution request, wherein the domain name application list includes domain names corresponding to authorized applications, and when the domain name included in the domain name resolution request exists in the domain name application list, determining a target IP address corresponding to the domain name, and using the target IP address as the resolution result of the domain name resolution request.

In an embodiment of the present invention, a non-transitory computer-readable storage medium is provided, and the non-transitory computer-readable storage medium stores computer instructions. The computer instructions enable the computer to execute the methods provided in the above-mentioned method embodiments, for example, including: obtaining a domain name resolution request input by a user, and performing a domain name query in a preset domain name application list according to the domain name resolution request, wherein the domain name application list includes domain names corresponding to authorized applications, and when the domain name included in the domain name resolution request exists in the domain name application list, determining a target IP address corresponding to the domain name, and using the target IP address as the resolution result of the domain name resolution request.

The present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided in the above embodiments, and the methods include: obtaining a domain name resolution request input by a user, and performing a domain name query in a preset domain name application list according to the domain name resolution request, wherein the domain name application list includes domain names corresponding to authorized applications, and when the domain name included in the domain name resolution request exists in the domain name application list, determining a target IP address corresponding to the domain name, and using the target IP address as the resolution result of the domain name resolution request.

A person of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some of the technical features therein by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (6)

1. A domain name resolution method, applied to a terminal device, comprising:

acquiring a domain name resolution request input by a user;

According to the domain name resolution request, domain name inquiry is carried out in a preset domain name application list; the domain name application list comprises domain names corresponding to authorized applications;

When a domain name included in the domain name resolution request exists in the domain name application list, determining a target IP address corresponding to the domain name, taking the target IP address as a resolution result of the domain name resolution request, wherein,

The IP address of the zero-trust trusted application proxy server is determined to be a target IP address corresponding to the domain name, so that application access is guided into the zero-trust trusted application proxy server, and all requests are subjected to access control through the zero-trust trusted application proxy server;

The determining the target IP address corresponding to the domain name includes:

determining a first IP address of the domain name according to the domain name; wherein the first IP address of the domain name is an IP address different from the second IP address of the domain name stored in the DNS server; determining a first IP address of the domain name as a target IP address corresponding to the domain name;

After the domain name query is performed in the preset domain name application list according to the domain name resolution request, the method further comprises the following steps:

and forwarding the domain name resolution request to a DNS server to obtain a second IP address of the domain name contained in the domain name resolution request under the condition that the domain name contained in the domain name resolution request does not exist in the domain name application list.

2. The domain name resolution method according to claim 1, wherein the method further comprises:

acquiring identification information of a user;

correspondingly, when the domain name included in the domain name resolution request exists in the domain name application list, determining the target IP address corresponding to the domain name includes:

when the domain name included in the domain name resolution request exists in the domain name application list, determining a target IP address corresponding to the domain name based on identification information of a user.

3. The domain name resolution method according to claim 1, comprising, prior to said obtaining a domain name resolution request entered by a user:

Receiving the domain name application list;

the domain name application list is obtained by mapping domain names of IP addresses of various applications of the user in a zero-trust trusted access control console.

4. A domain name resolution device, comprising:

the acquisition module is used for acquiring a domain name resolution request input by a user;

the query module is used for querying the domain name in a preset domain name application list according to the domain name resolution request; the domain name application list comprises domain names corresponding to authorized applications;

A determining module, configured to determine, when a domain name included in the domain name resolution request exists in the domain name application list, a target IP address corresponding to the domain name, and take the target IP address as a resolution result of the domain name resolution request, where,

The IP address of the zero-trust trusted application proxy server is determined as the target IP address corresponding to the domain name, so that the application access is led to the zero-trust trusted application proxy server, all requests are controlled by the zero-trust trusted application proxy server,

The determination module is also for:

determining a first IP address of the domain name according to the domain name; wherein the first IP address of the domain name is an IP address different from the second IP address of the domain name stored in the DNS server; determining a first IP address of the domain name as a target IP address corresponding to the domain name;

the query module is further configured to:

and forwarding the domain name resolution request to a DNS server to obtain a second IP address of the domain name contained in the domain name resolution request under the condition that the domain name contained in the domain name resolution request does not exist in the domain name application list.

5. An electronic device, comprising:

a processor, a memory, and a bus, wherein,

The processor and the memory complete communication with each other through the bus;

The memory stores program instructions executable by the processor, the processor invoking the program instructions to perform the steps of the domain name resolution method of any of claims 1 to 3.

6. A non-transitory computer readable storage medium storing computer instructions that cause a computer to perform the steps of the domain name resolution method of any of claims 1 to 3.