ืคึผืจืึธื”ืึธืกื˜ืขืจ > ื‘ืœืึธื’ > ืึทื“ืžื™ื ื™ืกื˜ืจืึทืฆื™ืข > ืžื™ื ืึทืžื™ื™ื– ื“ื™ ืจื™ืกืงืก ืคื•ืŸ ื ื™ืฆืŸ DNS-over-TLS (DoT) ืื•ืŸ DNS-over-HTTPS (DoH)

ืžื™ื ืึทืžื™ื™ื– ื“ื™ ืจื™ืกืงืก ืคื•ืŸ ื ื™ืฆืŸ DNS-over-TLS (DoT) ืื•ืŸ DNS-over-HTTPS (DoH)

ืžื™ื ืึทืžื™ื™ื– ื“ื™ ืจื™ืกืงืก ืคื•ืŸ ื ื™ืฆืŸ DNS-over-TLS (DoT) ืื•ืŸ DNS-over-HTTPS (DoH)ืžื™ื ืึทืžื™ื™ื– ื“ื™ ืจื™ืกืงืก ืคื•ืŸ ื ื™ืฆืŸ ื“ืึธื” ืื•ืŸ ื“ืึธื˜

ื“ืึธื” ืื•ืŸ ื“ืึธื˜ ืฉื•ืฅ

ืฆื™ ืื™ืจ ืงืึธื ื˜ืจืึธืœ ื“ื™ื™ืŸ DNS ืคืึทืจืงืขืจ? ืึธืจื’ืึทื ืึทื–ื™ื™ืฉืึทื ื– ื™ื ื•ื•ืขืกื˜ื™ืจืŸ ืึท ืคึผืœืึทืฅ ืคื•ืŸ ืฆื™ื™ื˜, ื’ืขืœื˜ ืื•ืŸ ืžื™ ืื™ืŸ ืกื™ืงื™ื•ืจื™ื ื’ ื–ื™ื™ืขืจ ื ืขื˜ื•ื•ืึธืจืงืก. ืึธื‘ืขืจ, ืื™ื™ืŸ ื’ืขื’ื ื˜ ื•ื•ืึธืก ืึธืคื˜ ื ื™ืฉื˜ ื‘ืึทืงื•ืžืขืŸ ื’ืขื ื•ื’ ื•ืคืžืขืจืงื–ืึทืžืงื™ื™ื˜ ืื™ื– DNS.

ื ื’ื•ื˜ืข ืื™ื‘ืขืจื‘ืœื™ืง ืคื•ืŸ ื“ื™ ืจื™ืกืงืก ื•ื•ืึธืก DNS ื‘ืจืขื ื’ื˜ ืื™ื– ื•ื•ืขืจื™ืกื™ื’ืŸ ืคึผืจืขื–ืขื ื˜ื™ืจื•ื ื’ ื‘ื™ื™ ื“ื™ ืื™ื ืคืึธืกืขืงื•ืจื™ื˜ื™ ื–ื™ืฆื•ื ื’.

ืžื™ื ืึทืžื™ื™ื– ื“ื™ ืจื™ืกืงืก ืคื•ืŸ ื ื™ืฆืŸ DNS-over-TLS (DoT) ืื•ืŸ DNS-over-HTTPS (DoH)31% ืคื•ืŸ ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืงืœืืกืŸ ืกืขืจื•ื•ื™ื™ื“ ื’ืขื•ื•ื™ื™ื ื˜ ื“ื ืก ืคึฟืึทืจ ืฉืœื™ืกืœ ื•ื•ืขืงืกืœ

31% ืคื•ืŸ ืจืึทื ืกืึธืžื•ื•ืึทืจืข ืงืœืืกืŸ ืกืขืจื•ื•ื™ื™ื“ ื’ืขื•ื•ื™ื™ื ื˜ ื“ื ืก ืคึฟืึทืจ ืฉืœื™ืกืœ ื•ื•ืขืงืกืœ.

ื“ื™ ืคึผืจืึธื‘ืœืขื ืื™ื– ืขืจื ืกื˜. ืœื•ื™ื˜ Palo Alto Networks Unit 42 ืคืึธืจืฉื•ื ื’ ืœืึทื‘ืึธืจืึทื˜ืึธืจื™ืข, ื‘ืขืขืจืขืš 85% ืคื•ืŸ ืžืึทืœื•ื•ืึทืจืข ื ื™ืฆื˜ ื“ื ืก ืฆื• ืคืึทืจืœื™ื™ื’ืŸ ืึท ื‘ืึทืคึฟืขืœ ืื•ืŸ ืงืึธื ื˜ืจืึธืœ ืงืึทื ืึทืœ, ืึทืœืึทื•ื™ื ื’ ืึทื˜ืึทืงืขืจื– ืฆื• ืœื™ื™ื›ื˜ ืึทืจื™ื™ึทื ืฉืคึผืจื™ืฆืŸ ืžืึทืœื•ื•ืึทืจืข ืื™ืŸ ื“ื™ื™ืŸ ื ืขืฅ ืื•ืŸ ื’ืึทื ื•ื•ืขื ืขืŸ ื“ืึทื˜ืŸ. ื–ื™ื ื˜ ื–ื™ื™ืŸ ืึธื ื”ื™ื™ื‘, DNS ืคืึทืจืงืขืจ ืื™ื– ืœืึทืจื’ืขืœื™ ืึทื ืขื ืงืจื™ืคึผื˜ื™ื“ ืื•ืŸ ืงืขื ืขืŸ ื–ื™ื™ืŸ ืœื™ื™ื›ื˜ ืึทื ืึทืœื™ื™ื–ื“ ื“ื•ืจืš NGFW ื–ื™ื›ืขืจื”ื™ื™ื˜ ืžืขืงืึทื ื™ื–ืึทืžื–. 

ื ื™ื• ืคึผืจืึธื˜ืึธืงืึธืœืก ืคึฟืึทืจ ื“ื ืก ื”ืึธื‘ืŸ ื™ืžืขืจื“ื–ืฉื“ ืึทื™ืžืขื“ ืฆื• ืคืึทืจื’ืจืขืกืขืจืŸ ื“ื™ ืงืึทื ืคืึทื“ืขื ืฉื™ืึทืœืึทื˜ื™ ืคื•ืŸ ื“ื ืก ืงืึทื ืขืงืฉืึทื ื–. ื–ื™ื™ ื–ืขื ืขืŸ ืึทืงื˜ื™ื•ื•ืœื™ ื’ืขืฉื˜ื™ืฆื˜ ื“ื•ืจืš ืœื™ื“ื™ื ื’ ื‘ืœืขื˜ืขืจืขืจ ื•ื•ืขื ื“ืึธืจืก ืื•ืŸ ืื ื“ืขืจืข ื•ื•ื™ื™ื›ื•ื•ืืจื’ ื•ื•ืขื ื“ืึธืจืก. ืขื ืงืจื™ืคึผื˜ื™ื“ ื“ื ืก ืคืึทืจืงืขืจ ื•ื•ืขื˜ ื‘ืึทืœื“ ืึธื ื”ื™ื™ื‘ืŸ ืฆื• ื•ื•ืึทืงืกืŸ ืื™ืŸ ืคึฟื™ืจืžืข ื ืขื˜ื•ื•ืึธืจืงืก. ืขื ืงืจื™ืคึผื˜ื™ื“ ื“ื ืก ืคืึทืจืงืขืจ ื•ื•ืึธืก ืื™ื– ื ื™ืฉื˜ ืจืขื›ื˜ ืึทื ืึทืœื™ื™ื–ื“ ืื•ืŸ ืจื™ื–ืึทืœื•ื•ื“ ื“ื•ืจืš ืžื›ืฉื™ืจื™ื ืคึผืึธื•ื–ื™ื– ืึท ื–ื™ื›ืขืจื”ื™ื™ื˜ ืจื™ื–ื™ืงื™ืจืŸ ืคึฟืึทืจ ืึท ืคื™ืจืžืข. ืคึฟืึทืจ ื‘ื™ื™ึทืฉืคึผื™ืœ, ืึทื–ืึท ืึท ืกืึทืงืึธื ืข ืื™ื– ืงืจื™ืคึผื˜ืึธืœืึทืงืขืจื– ื•ื•ืึธืก ื ื•ืฆืŸ ื“ื ืก ืฆื• ื•ื•ืขืงืกืœ ืขื ืงืจื™ืคึผืฉืึทืŸ ืฉืœื™ืกืœืขืŸ. ืึทื˜ืึทืงืขืจื– ืคืึธื“ืขืจืŸ ืื™ืฆื˜ ืึท ื•ื™ืกืœื™ื™ื–ื’ืขืœื˜ ืคื•ืŸ ืขื˜ืœืขื›ืข ืžื™ืœื™ืึธืŸ ื“ืึธืœืœืึทืจืก ืฆื• ื•ืžืงืขืจืŸ ืึทืงืกืขืก ืฆื• ื“ื™ื™ืŸ ื“ืึทื˜ืŸ. ื’ืึทืจืžื™ืŸ, ืคึฟืึทืจ ื‘ื™ื™ึทืฉืคึผื™ืœ, ื‘ืึทืฆืึธืœื˜ $ 10 ืžื™ืœื™ืึธืŸ.

ื•ื•ืขืŸ ืจืขื›ื˜ ืงืึทื ืคื™ื’ื™ืขืจื“, NGFWs ืงืขื ืขืŸ ืœื™ื™ืงืขื ืขืŸ ืึธื“ืขืจ ื‘ืึทืฉื™ืฆืŸ ื“ื™ ื ื•ืฆืŸ ืคื•ืŸ DNS-over-TLS (DoT) ืื•ืŸ ืงืขื ืขืŸ ื–ื™ื™ืŸ ื’ืขื ื•ืฆื˜ ืฆื• ืœื™ื™ืงืขื ืขืŸ ื“ื™ ื ื•ืฆืŸ ืคื•ืŸ DNS-over-HTTPS (DoH), ืึทืœืึทื•ื™ื ื’ ืึทืœืข DNS ืคืึทืจืงืขืจ ืื•ื™ืฃ ื“ื™ื™ืŸ ื ืขืฅ ืฆื• ื–ื™ื™ืŸ ืึทื ืึทืœื™ื™ื–ื“.

ื•ื•ืึธืก ืื™ื– ืขื ืงืจื™ืคึผื˜ื™ื“ ื“ื ืก?

ื•ื•ืึธืก ืื™ื– ื“ื ืก

ื“ื™ ืคืขืœื“ ื ืึธืžืขืŸ ืกื™ืกื˜ืขื (ื“ื ืก) ืจื™ื–ืึทืœื•ื•ื– ืžืขื ื˜ืฉ-ืœื™ื™ืขื ืขืŸ ืคืขืœื“ ื ืขืžืขืŸ (ืœืžืฉืœ, ืึทื“ืจืขืก www.paloaltonetworks.com ) ืฆื• IP ืึทื“ืจืขืกืขืก (ืœืžืฉืœ, 34.107.151.202). ื•ื•ืขืŸ ืึท ื‘ืึทื ื™ืฆืขืจ ืึทืจื™ื™ึทืŸ ืึท ืคืขืœื“ ื ืึธืžืขืŸ ืื™ืŸ ืึท ื•ื•ืขื‘ ื‘ืœืขื˜ืขืจืขืจ, โ€‹โ€‹ื“ืขืจ ื‘ืœืขื˜ืขืจืขืจ ืกืขื ื“ื– ืึท ื“ื ืก ืึธื ืคึฟืจืขื’ ืฆื• ื“ื™ ื“ื ืก ืกืขืจื•ื•ืขืจ, ืื•ืŸ ื‘ืขื˜ืŸ ื“ื™ IP ืึทื“ืจืขืก ืคึฟืึทืจื‘ื•ื ื“ืŸ ืžื™ื˜ ื“ืขื ืคืขืœื“ ื ืึธืžืขืŸ. ืื™ืŸ ืขื ื˜ืคืขืจ, ื“ืขืจ ื“ื ืก ืกืขืจื•ื•ืขืจ ืงืขืจื˜ ื“ื™ IP ืึทื“ืจืขืก ื•ื•ืึธืก ื“ืขืจ ื‘ืœืขื˜ืขืจืขืจ ื•ื•ืขื˜ ื ื•ืฆืŸ.

ื“ื ืก ืคึฟืจืื’ืŸ ืื•ืŸ ืจืขืกืคึผืึธื ืกืขืก ื–ืขื ืขืŸ ื’ืขืฉื™ืงื˜ ืึทืจื™ื‘ืขืจ ื“ื™ ื ืขืฅ ืื™ืŸ ืงืœืึธืจ ื˜ืขืงืกื˜, ืึทื ืขื ืงืจื™ืคึผื˜ื™ื“, ื•ื•ืึธืก ืžืื›ื˜ ืขืก ืฉืคึผื™ืจืขื•ื•ื“ื™ืง ืฆื• ืกืคึผื™ื™ื™ื ื’ ืึธื“ืขืจ ื˜ืฉืึทื ื’ื™ื ื’ ื“ื™ ืขื ื˜ืคืขืจ ืื•ืŸ ืจื™ื“ืขืจืขืงื˜ื™ื ื’ ื“ืขื ื‘ืœืขื˜ืขืจืขืจ ืฆื• ื‘ื™ื™ื–ืข ืกืขืจื•ื•ืขืจืก. ื“ื ืก ืขื ืงืจื™ืคึผืฉืึทืŸ ืžืื›ื˜ ืขืก ืฉื•ื•ืขืจ ืคึฟืึทืจ ื“ื ืก ืจื™ืงื•ื•ืขืก ืฆื• ื–ื™ื™ืŸ ื˜ืจืึทืงื˜ ืึธื“ืขืจ ื’ืขื‘ื™ื˜ืŸ ื‘ืขืฉืึทืก ื˜ืจืึทื ืกืžื™ืกื™ืข. ืขื ืงืจื™ืคึผื˜ื™ื ื’ DNS ืจื™ืงื•ื•ืขืก ืื•ืŸ ืจืขืกืคึผืึธื ืกืขืก ืคึผืจืึทื˜ืขืงืฅ ืื™ืจ ืคื•ืŸ ืžืขื ื˜ืฉ-ืื™ืŸ-ื“ืขื-ืžื™ื˜ืŸ ืื ืคืืœืŸ ื‘ืฉืขืช ืื™ืจ ื“ื•ืจื›ืคื™ืจืŸ ื“ื™ ื–ืขืœื‘ืข ืคืึทื ื’ืงืฉืึทื ืึทืœื™ื˜ื™ ื•ื•ื™ ื“ื™ ื˜ืจืื“ื™ืฆื™ืื ืขืœืŸ ืคึผืœืึทื™ื ื˜ืขืงืกื˜ DNS (Domain Name System) ืคึผืจืึธื˜ืึธืงืึธืœ. 

ืื™ืŸ ื“ื™ ืœืขืฆื˜ืข ื™ืึธืจืŸ, ืฆื•ื•ื™ื™ ื“ื ืก ืขื ืงืจื™ืคึผืฉืึทืŸ ืคึผืจืึธื˜ืึธืงืึธืœืก ื–ืขื ืขืŸ ื‘ืึทืงืขื ืขื :

  1. DNS-over-HTTPS (DoH)

  2. DNS-over-TLS (DoT)

ื“ื™ ืคึผืจืึธื˜ืึธืงืึธืœืก ื”ืึธื‘ืŸ ืื™ื™ืŸ ื–ืึทืš ืื™ืŸ ืคึผืจืึธืกื˜: ื–ื™ื™ ื“ื™ืœื™ื‘ืจืึทื˜ืœื™ ื‘ืึทื”ืึทืœื˜ืŸ DNS ืจื™ืงื•ื•ืขืก ืคื•ืŸ ืงื™ื™ืŸ ื™ื ื˜ืขืจืกืขืคึผืฉืึทืŸ ... ืื•ืŸ ืคื•ืŸ ื“ื™ ื–ื™ื›ืขืจื”ื™ื™ื˜ ื’ืึทืจื“ื– ืคื•ืŸ ื“ืขืจ ืึธืจื’ืึทื ื™ื–ืึทืฆื™ืข. ื“ื™ ืคึผืจืึธื˜ืึธืงืึธืœืก ื ื•ืฆืŸ ื‘ืคึฟืจื˜ TLS (Transport Layer Security) ืฆื• ืคืึทืจืœื™ื™ื’ืŸ ืึท ื™ื ืงืจื™ืคึผื˜ื™ื“ ืคึฟืึทืจื‘ื™ื ื“ื•ื ื’ ืฆื•ื•ื™ืฉืŸ ืึท ืงืœื™ืขื ื˜ ื•ื•ืึธืก ืžืื›ื˜ ืคึฟืจืื’ืŸ ืื•ืŸ ืึท ืกืขืจื•ื•ืขืจ ื•ื•ืึธืก ืœื™ื™ื–ืŸ ื“ื ืก ืคึฟืจืื’ืŸ ืื™ื‘ืขืจ ืึท ืคึผืึธืจื˜ ื•ื•ืึธืก ืื™ื– ื ื™ืฉื˜ ื ืึธืจืžืึทืœื™ ื’ืขื ื™ืฆื˜ ืคึฟืึทืจ ื“ื ืก ืคืึทืจืงืขืจ.

ื“ื™ ืงืึทื ืคืึทื“ืขื ืฉื™ืึทืœืึทื˜ื™ ืคื•ืŸ ื“ื ืก ืงื•ื•ื™ืจื™ื– ืื™ื– ืึท ื’ืจื•ื™ืก ืคึผืœื•ืก ืคื•ืŸ ื“ื™ ืคึผืจืึธื˜ืึธืงืึธืœืก. ืึธื‘ืขืจ, ื–ื™ื™ ืฉื˜ืขืœืŸ ืคึผืจืึธื‘ืœืขืžืก ืคึฟืึทืจ ื–ื™ื›ืขืจื”ื™ื™ื˜ ื’ืึทืจื“ื– ื•ื•ืึธืก ืžื•ื–ืŸ ืžืึธื ื™ื˜ืึธืจ ื ืขืฅ ืคืึทืจืงืขืจ ืื•ืŸ ื“ืขื˜ืขืงื˜ ืื•ืŸ ืคืึทืจืฉืคึผืึทืจืŸ ื‘ื™ื™ื–ืข ืงืึทื ืขืงืฉืึทื ื–. ื•ื•ื™ื™ึทืœ ื“ื™ ืคึผืจืึธื˜ืึธืงืึธืœืก ื–ืขื ืขืŸ ืึทื ื“ืขืจืฉ ืื™ืŸ ื–ื™ื™ืขืจ ื™ืžืคึผืœืึทืžืขื ื˜ื™ื™ืฉืึทืŸ, ื“ื™ ืึทื ืึทืœื™ืกื™ืก ืžืขื˜ื”ืึธื“ืก ื•ื•ืขื˜ ื–ื™ื™ืŸ ืึทื ื“ืขืจืฉ ืฆื•ื•ื™ืฉืŸ DoH ืื•ืŸ DoT.

ื“ื ืก ืื™ื‘ืขืจ ื”ื˜ื˜ืคึผืก (ื“ืึธื”)

ืžื™ื ืึทืžื™ื™ื– ื“ื™ ืจื™ืกืงืก ืคื•ืŸ ื ื™ืฆืŸ DNS-over-TLS (DoT) ืื•ืŸ DNS-over-HTTPS (DoH)ื“ื ืก ืื™ืŸ ื”ื˜ื˜ืคึผืก

DoH ื ื™ืฆื˜ ื“ื™ ื‘ืืงืื ื˜ืข ืคึผืึธืจื˜ 443 ืคึฟืึทืจ HTTPS, ืคึฟืึทืจ ื•ื•ืึธืก ื“ืขืจ RFC ื“ืขืจืงืœืขืจื˜ ืกืคึผืึทืกื™ืคื™ืงืœื™ ืึทื– ื“ื™ ื›ื•ื•ื ื” ืื™ื– ืฆื• "ืžื™ืฉืŸ ื“ืึธื” ืคืึทืจืงืขืจ ืžื™ื˜ ืื ื“ืขืจืข HTTPS ืคืึทืจืงืขืจ ืื•ื™ืฃ ื“ืขืจ ื–ืขืœื‘ื™ืงืขืจ ืงืฉืจ", "ืžืึทื›ืŸ ืขืก ืฉื•ื•ืขืจ ืฆื• ืึทื ืึทืœื™ื™ื– ื“ื ืก ืคืึทืจืงืขืจ" ืื•ืŸ ืึทื–ื•ื™ ืึทืจื•ืžื ืขืžืขืŸ ืคึฟื™ืจืžืข ืงืึธื ื˜ืจืึธืœืก. ( RFC 8484 ื“ืึธื” ืึธืคึผื˜ื™ื™ืœื•ื ื’ 8.1 ). ื“ื™ ื“ืึธื” ืคึผืจืึธื˜ืึธืงืึธืœ ื ื™ืฆื˜ TLS ืขื ืงืจื™ืคึผืฉืึทืŸ ืื•ืŸ ื“ื™ ื‘ืขื˜ืŸ ืกื™ื ื˜ืึทืงืก ืฆื•ื’ืขืฉื˜ืขืœื˜ ื“ื•ืจืš ื“ื™ ืคึผืจืึธืกื˜ HTTPS ืื•ืŸ HTTP/2 ืกื˜ืึทื ื“ืึทืจื“ืก, ืึทื“ื™ื ื’ ื“ื ืก ืจื™ืงื•ื•ืขืก ืื•ืŸ ืจืขืกืคึผืึธื ืกืขืก ืื•ื™ืฃ ืฉืคึผื™ืฅ ืคื•ืŸ ื ืึธืจืžืึทืœ ื”ื˜ื˜ืคึผ ืจื™ืงื•ื•ืขืก.

ืจื™ืกืงืก ืคึฟืึทืจื‘ื•ื ื“ืŸ ืžื™ื˜ ื“ืึธื”

ืื•ื™ื‘ ืื™ืจ ืงืขื ืขืŸ ื ื™ืฉื˜ ื•ื™ืกื˜ื™ื™ืœืŸ ืจืขื’ื•ืœืขืจ HTTPS ืคืึทืจืงืขืจ ืคื•ืŸ ื“ืึธื” ืจื™ืงื•ื•ืขืก, ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื– ืื™ืŸ ื“ื™ื™ืŸ ืึธืจื’ืึทื ื™ื–ืึทืฆื™ืข ืงืขื ืขืŸ (ืื•ืŸ ื•ื•ืขื˜) ื‘ื™ื™ืคึผืึทืก ื“ื™ ื”ื™ื’ืข ื“ื ืก ืกืขื˜ื˜ื™ื ื’ืก ื“ื•ืจืš ืจื™ื“ืขืจืขืงื˜ื™ื ื’ ืจื™ืงื•ื•ืขืก ืฆื• ื“ืจื™ื˜-ืคึผืึทืจื˜ื™ื™ ืกืขืจื•ื•ืขืจืก ืจื™ืกืคึผืึทื ื“ื™ื ื’ ืฆื• ื“ืึธื” ืจื™ืงื•ื•ืขืก, ื•ื•ืึธืก ื‘ื™ื™ืคึผืึทืกื™ื– ืงื™ื™ืŸ ืžืึธื ื™ื˜ืึธืจื™ื ื’, ื“ืึธืก ื”ื™ื™ืกื˜, ื“ื™ืกื˜ืจื•ื™ื– ื“ื™ ืคื™ื™ื™ืงื™ื™ื˜ ืฆื• ืงืึธื ื˜ืจืึธืœ ื“ื™ ื“ื ืก ืคืึทืจืงืขืจ. ื™ื“ืขืึทืœืœื™, ืื™ืจ ื–ืึธืœ ืงืึธื ื˜ืจืึธืœื™ืจืŸ ื“ืึธื” ื ื™ืฆืŸ HTTPS ื“ืขืงืจื™ืคึผื˜ื™ืึธืŸ ืคืึทื ื’ืงืฉืึทื ื–. 

ะ˜ ื’ื•ื’ืœ ืื•ืŸ ืžืึธื–ื™ืœืœืึท ื”ืึธื‘ืŸ ื™ืžืคึผืœืึทืžืขื ืึทื“ ื“ืึธื” ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื– ืื™ืŸ ื“ื™ ืœืขืฆื˜ืข ื•ื•ืขืจืกื™ืข ืคื•ืŸ โ€‹โ€‹โ€‹โ€‹ื–ื™ื™ืขืจ ื‘ืจืึทื•ื–ืขืจื–, ืื•ืŸ ื‘ื™ื™ื“ืข ืงืึธืžืคึผืึทื ื™ืขืก ื–ืขื ืขืŸ ืืจื‘ืขื˜ืŸ ืฆื• ื ื•ืฆืŸ DoH ื“ื•ืจืš ืคืขืœื™ืงื™ื™ึทื˜ ืคึฟืึทืจ ืึทืœืข ื“ื ืก ืจื™ืงื•ื•ืขืก. ืžื™ื™ืงืจืึธืกืึธืคึฟื˜ ืื™ื– ืื•ื™ืš ื“ืขื•ื•ืขืœืึธืคึผื™ื ื’ ืคึผืœืึทื ื– ืื•ื™ืฃ ื™ื ื˜ืึทื’ืจื™ื™ื˜ื™ื ื’ DoH ืื™ืŸ ื–ื™ื™ืขืจ ืึธืคึผืขืจื™ื™ื˜ื™ื ื’ ืกื™ืกื˜ืขืžืขืŸ. ื“ื™ ื“ืึทื•ื ืกื™ื™ื“ ืื™ื– ืึทื– ื ื™ื˜ ื‘ืœื•ื™ื– ืจืขืคึผื™ืึทื˜ืึทื‘ืึทืœ ื•ื•ื™ื™ื›ื•ื•ืืจื’ ืงืึธืžืคึผืึทื ื™ืขืก, ืึธื‘ืขืจ ืื•ื™ืš ืึทื˜ืึทืงืขืจื– ื”ืึธื‘ืŸ ืื ื’ืขื”ื•ื™ื‘ืŸ ืฆื• ื ื•ืฆืŸ ื“ืึธื” ื•ื•ื™ ืึท ืžื™ื˜ืœ ืคื•ืŸ ื‘ื™ื™ืคึผืึทืกื™ื ื’ ื˜ืจืื“ื™ืฆื™ืื ืขืœืŸ ืคึฟื™ืจืžืข ืคื™ื™ืจื•ื•ืึทืœ ืžื™ื˜ืœืขืŸ. (ืคึฟืึทืจ ื‘ื™ื™ึทืฉืคึผื™ืœ, ืึธืคึผืฉืึทืฆื•ื ื’ ื“ื™ ืคืืœื’ืขื ื“ืข ืึทืจื˜ื™ืงืœืขืŸ: PsiXBot ื ื™ืฆื˜ ืื™ืฆื˜ Google DoH , PsiXBot ื”ืืœื˜ ืฆื• ื™ื•ื•ืึทืœื•ื• ืžื™ื˜ ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงื˜ ื“ื ืก ื™ื ืคืจืึทืกื˜ืจืึทืงื˜ืฉืขืจ ะธ ื’ืึธื“ืœื•ืึท ื‘ืึทืงื“ืึธืจ ืึทื ืึทืœื™ืกื™ืก .) ืื™ืŸ ื™ืขื“ืขืจ ืคืึทืœ, ื‘ื™ื™ื“ืข ื’ื•ื˜ ืื•ืŸ ื‘ื™ื™ื–ืข ื“ืึธื” ืคืึทืจืงืขืจ ื•ื•ืขื˜ ื–ื™ื™ืŸ ืึทื ื“ื™ื˜ืขืงื˜ื™ื“, ืื•ืŸ ืœืึธื–ืŸ ื“ื™ ืึธืจื’ืึทื ื™ื–ืึทืฆื™ืข ื‘ืœื™ื ื“ ืฆื• ื“ื™ ื‘ื™ื™ื–ืข ื ื•ืฆืŸ ืคื•ืŸ ื“ืึธื” ื•ื•ื™ ืึท ืงืึทื ื“ื•ื•ื™ื˜ ืฆื• ืงืึธื ื˜ืจืึธืœื™ืจืŸ ืžืึทืœื•ื•ืึทืจืข (C2) ืื•ืŸ ื’ืึทื ื•ื•ืขื ืขืŸ ืฉืคึผื™ืจืขื•ื•ื“ื™ืง ื“ืึทื˜ืŸ.

ื™ื ืฉื•ืจื™ื ื’ ื•ื•ื™ื–ืึทื‘ื™ืœื™ื˜ื™ ืื•ืŸ ืงืึธื ื˜ืจืึธืœ ืคื•ืŸ ื“ืึธื” ืคืึทืจืงืขืจ

ื•ื•ื™ ื“ืขืจ ื‘ืขืกื˜ืขืจ ืœื™ื™ื–ื•ื ื’ ืคึฟืึทืจ ื“ืึธื” ืงืึธื ื˜ืจืึธืœ, ืžื™ืจ ืจืขืงืึธืžืขื ื“ื™ืจืŸ ืงืึทื ืคื™ื’ื™ืขืจื™ื ื’ NGFW ืฆื• ื“ืขืงืจื™ืคึผื˜ ื”ื˜ื˜ืคึผืก ืคืึทืจืงืขืจ ืื•ืŸ ืคืึทืจืฉืคึผืึทืจืŸ ื“ืึธื” ืคืึทืจืงืขืจ (ืึทืคึผืคึผืœื™ืงืึทื˜ื™ืึธืŸ ื ืึธืžืขืŸ: dns-over-https). 

ืขืจืฉื˜ืขืจ, ืžืึทื›ืŸ ื–ื™ื›ืขืจ ืึทื– NGFW ืื™ื– ืงืึทื ืคื™ื’ื™ืขืจื“ ืฆื• ื“ืขืงืจื™ืคึผื˜ ื”ื˜ื˜ืคึผืก, ืœื•ื™ื˜ ืฆื• ืึท ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ ืฆื• ื‘ืขืกื˜ืขืจ ื“ืขืงืจื™ืคึผื˜ื™ืึธืŸ ื˜ืขืงื ื™ืงืก.

ืจื’ืข, ืฉืึทืคึฟืŸ ืึท ื”ืขืจืฉืŸ ืคึฟืึทืจ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืคืึทืจืงืขืจ "dns-over-https" ื•ื•ื™ ื’ืขื•ื•ื™ื–ืŸ ืื•ื ื˜ืŸ:

ืžื™ื ืึทืžื™ื™ื– ื“ื™ ืจื™ืกืงืก ืคื•ืŸ ื ื™ืฆืŸ DNS-over-TLS (DoT) ืื•ืŸ DNS-over-HTTPS (DoH)Palo Alto Networks NGFW ื”ืขืจืฉืŸ ืฆื• ืคืึทืจืฉืคึผืึทืจืŸ ื“ื ืก-ืื™ื‘ืขืจ-HTTPS

ื•ื•ื™ ืึท ื™ื ื˜ืขืจื™ื ืึธืœื˜ืขืจื ืึทื˜ื™ื•ื• (ืื•ื™ื‘ ื“ื™ื™ืŸ ืึธืจื’ืึทื ื™ื–ืึทืฆื™ืข ื”ืื˜ ื ื™ืฉื˜ ื’ืึธืจ ื™ืžืคึผืœืึทืžืขื ืึทื“ HTTPS ื“ืขืงืจื™ืคึผื˜ื™ืึธืŸ), NGFW ืงืขื ืขืŸ ื–ื™ื™ืŸ ืงืึทื ืคื™ื’ื™ืขืจื“ ืฆื• ืฆื•ืœื™ื™ื’ืŸ ืึท "ืœื™ื™ืงืขื ืขืŸ" ืงืึทืžืฃ ืฆื• ื“ื™ "dns-over-https" ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืฉื™ื™ึทืŸ, ืึธื‘ืขืจ ื“ื™ ื•ื•ื™ืจืงื•ื ื’ ื•ื•ืขื˜ ื–ื™ื™ืŸ ืœื™ืžื™ื˜ืขื“ ืฆื• ื‘ืœืึทืงื™ื ื’ ื–ื™ื›ืขืจ ื’ืขื–ื•ื ื˜- ื‘ืืงืื ื˜ ื“ืึธื” ืกืขืจื•ื•ืขืจืก ื“ื•ืจืš ื–ื™ื™ืขืจ ืคืขืœื“ ื ืึธืžืขืŸ, ืึทื–ื•ื™ ืึธืŸ HTTPS ื“ืขืงืจื™ืคึผื˜ื™ืึธืŸ, ื“ืึธื” ืคืึทืจืงืขืจ ืงืขื ืขืŸ ื ื™ื˜ ื–ื™ื™ืŸ ื’ืึธืจ ื™ื ืกืคึผืขืงื˜ื™ื“ (ื–ืขืŸ  ืึทืคึผืคึผืœื™ืขื“ื™ืึท ืคึฟื•ืŸ Palo Alto Networks   ืื•ืŸ ื–ื•ื›ืŸ ืคึฟืึทืจ "dns-over-https").

DNS ืื™ื‘ืขืจ TLS (DoT)

ืžื™ื ืึทืžื™ื™ื– ื“ื™ ืจื™ืกืงืก ืคื•ืŸ ื ื™ืฆืŸ DNS-over-TLS (DoT) ืื•ืŸ DNS-over-HTTPS (DoH)ื“ื ืก ืื™ืŸ TLS

ื‘ืฉืขืช ื“ื™ DoH ืคึผืจืึธื˜ืึธืงืึธืœ ื˜ืขื ื“ื– ืฆื• ืžื™ืฉืŸ ืžื™ื˜ ืื ื“ืขืจืข ืคืึทืจืงืขืจ ืื™ืŸ ื“ืขืจ ื–ืขืœื‘ื™ืงืขืจ ืคึผืึธืจื˜, ื“ืึธื˜ ืึทื ืฉื˜ืึธื˜ ื“ื™ืคืึธืœืฅ ืฆื• ื ื•ืฆืŸ ืึท ืกืคึผืขืฆื™ืขืœ ืคึผืึธืจื˜ ืจืขื–ืขืจื•ื•ื™ืจื˜ ืคึฟืึทืจ ื“ืขื ื‘ืœื•ื™ื– ืฆื™ืœ, ืืคื™ืœื• ืกืคึผืึทืกื™ืคื™ืงืœื™ ื ื™ื˜ ื“ืขืจืœื•ื™ื‘ืŸ ื“ื™ ื–ืขืœื‘ืข ืคึผืึธืจื˜ ืฆื• ื ื•ืฆืŸ ื“ื•ืจืš ื˜ืจืื“ื™ืฆื™ืื ืขืœืŸ ืึทื ืขื ืงืจื™ืคึผื˜ื™ื“ ื“ื ืก ืคืึทืจืงืขืจ ( RFC 7858, ืึธืคึผื˜ื™ื™ืœื•ื ื’ 3.1 ).

ื“ื™ ื“ืึธื˜ ืคึผืจืึธื˜ืึธืงืึธืœ ื ื™ืฆื˜ TLS ืฆื• ืฆื•ืฉื˜ืขืœืŸ ืขื ืงืจื™ืคึผืฉืึทืŸ ื•ื•ืึธืก ืขื ืงืึทืคึผืกืึทืœื™ื™ืฅ ื ืึธืจืžืึทืœ ื“ื ืก ืคึผืจืึธื˜ืึธืงืึธืœ ืคึฟืจืื’ืŸ, ืžื™ื˜ ืคืึทืจืงืขืจ ื ื™ืฆืŸ ื“ื™ ื‘ืึทื•ื•ื•ืกื˜ ืคึผืึธืจื˜ 853 ( RFC 7858 ืึธืคึผื˜ื™ื™ืœื•ื ื’ 6 ). ื“ื™ ื“ืึธื˜ ืคึผืจืึธื˜ืึธืงืึธืœ ืื™ื– ื“ื™ื–ื™ื™ื ื“ ืฆื• ืžืึทื›ืŸ ืขืก ื’ืจื™ื ื’ืขืจ ืคึฟืึทืจ ืึธืจื’ืึทื ืึทื–ื™ื™ืฉืึทื ื– ืฆื• ืคืึทืจืฉืคึผืึทืจืŸ ืคืึทืจืงืขืจ ืื•ื™ืฃ ืึท ืคึผืึธืจื˜, ืึธื“ืขืจ ืึธื ื ืขืžืขืŸ ืคืึทืจืงืขืจ ืึธื‘ืขืจ ื’ืขื‘ืŸ ื“ืขืงืจื™ืคึผื˜ื™ืึธืŸ ืื•ื™ืฃ ื“ืขื ืคึผืึธืจื˜.

ืจื™ืกืงืก ืคึฟืึทืจื‘ื•ื ื“ืŸ ืžื™ื˜ ื“ืึธื˜

Google ื”ืื˜ ื™ืžืคึผืœืึทืžืขื ืึทื“ ื“ืึธื˜ ืื™ืŸ ื–ื™ื™ืŸ ืงืœื™ืขื ื˜ ืึทื ื“ืจื•ื™ื“ 9 ืคึผื™ืจืึธื’ ืื•ืŸ ืฉืคึผืขื˜ืขืจ , ืžื™ื˜ ื“ื™ ืคืขืœื™ืงื™ื™ึทื˜ ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืฆื• ืื•ื™ื˜ืึธืžืึทื˜ื™ืฉ ื ื•ืฆืŸ DoT ืื•ื™ื‘ ื‘ื ื™ืžืฆื. ืื•ื™ื‘ ืื™ืจ ื”ืึธื˜ ืึทืกืกืขืกืกืขื“ ื“ื™ ืจื™ืกืงืก ืื•ืŸ ืื™ืจ ื–ืขื ื˜ ื’ืจื™ื™ื˜ ืฆื• ื ื•ืฆืŸ ื“ืึธื˜ ืื•ื™ืฃ ื“ื™ ืึธืจื’ืึทื ืึทื–ื™ื™ืฉืึทื ืึทืœ ืžื“ืจื’ื”, ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื”ืึธื‘ืŸ ื ืขืฅ ืึทื“ืžื™ื ื™ืกื˜ืจืึทื˜ืึธืจืก ื‘ืคื™ืจื•ืฉ ืœืึธื–ืŸ ืึทื•ื˜ื‘ืึทื•ื ื“ ืคืึทืจืงืขืจ ืื•ื™ืฃ ืคึผืึธืจื˜ 853 ื“ื•ืจืš ื–ื™ื™ืขืจ ืคึผืขืจื™ืžืขื˜ืขืจ ืคึฟืึทืจ ื“ืขื ื ื™ื™ึทืข ืคึผืจืึธื˜ืึธืงืึธืœ.

ื™ื ืฉื•ืจื™ื ื’ ื•ื•ื™ื–ืึทื‘ื™ืœื™ื˜ื™ ืื•ืŸ ืงืึธื ื˜ืจืึธืœ ืคื•ืŸ ื“ืึธื˜ ืคืึทืจืงืขืจ

ื•ื•ื™ ืึท ื‘ืขืกื˜ืขืจ ืคื™ืจ ืคึฟืึทืจ ื“ืึธื˜ ืงืึธื ื˜ืจืึธืœ, ืžื™ืจ ืจืขืงืึธืžืขื ื“ื™ืจืŸ ืงื™ื™ืŸ ืคื•ืŸ ื“ื™ ืื•ื™ื‘ืŸ, ื‘ืื–ื™ืจื˜ ืื•ื™ืฃ ื“ื™ื™ืŸ ืึธืจื’ืึทื ื™ื–ืึทืฆื™ืข ืก ืจืขืงื•ื•ื™ืจืขืžืขื ืฅ:

  • ืงืึทื ืคื™ื’ื™ืขืจ NGFW ืฆื• ื“ืขืงืจื™ืคึผื˜ ืึทืœืข ืคืึทืจืงืขืจ ืคึฟืึทืจ ื“ืขืกื˜ื™ื ื™ื™ืฉืึทืŸ ืคึผืึธืจื˜ 853. ื“ื•ืจืš ื“ืขืงืจื™ืคึผื˜ื™ื ื’ ืคืึทืจืงืขืจ, ื“ืึธื˜ ื•ื•ืขื˜ ื“ืขืจืฉื™ื™ึทื ืขืŸ ื•ื•ื™ ืึท ื“ื ืก ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืฆื• ื•ื•ืึธืก ืื™ืจ ืงืขื ืขืŸ ืฆื•ืœื™ื™ื’ืŸ ืงื™ื™ืŸ ืงืึทืžืฃ, ืึทื–ืึท ื•ื•ื™ ื’ืขื‘ืŸ ืึทื‘ืึธื ืขืžืขื ื˜ Palo Alto Networks DNS Security ืฆื• ืงืึธื ื˜ืจืึธืœื™ืจืŸ DGA ื“ืึธื•ืžื™ื™ื ื– ืึธื“ืขืจ ืึท ื™ื’ื–ื™ืกื˜ื™ื ื’ ืื™ื™ื ืขืจ ื“ื ืก ืกื™ื ืงื”ืึธืœื™ื ื’ ืื•ืŸ ืึทื ื˜ื™-ืกืคึผื™ื•ื•ืึทืจืข.

  • ืึทืŸ ืื ื“ืขืจ ื‘ืจื™ืจื” ืื™ื– ืฆื• ื”ืึธื‘ืŸ ื“ื™ ืึทืคึผ-ืฉื™ื™ึทืŸ ืžืึธื˜ืึธืจ ื’ืึธืจ ืคืึทืจืฉืคึผืึทืจืŸ 'dns-over-tls' ืคืึทืจืงืขืจ ืื•ื™ืฃ ืคึผืึธืจื˜ 853. ื“ืึธืก ืื™ื– ื™ื•ื–ืฉืึทื•ื•ืึทืœื™ ื‘ืœืึทืงื˜ ื“ื•ืจืš ืคืขืœื™ืงื™ื™ึทื˜, ืงื™ื™ืŸ ืงืึทืžืฃ ืื™ื– ืคืืจืœืื ื’ื˜ (ืกื™ื™ึทื“ืŸ ืื™ืจ ืกืคึผืึทืกื™ืคื™ืงืœื™ ืœืึธื–ืŸ 'dns-over-tls' ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืึธื“ืขืจ ืคึผืึธืจื˜ ืคืึทืจืงืขืจ 853).

ืžืงื•ืจ: www.habr.com

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’