# US 11,909,876 B1 · Multi autonomous secure domain name systems

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,909,876 B1
- Document ID: US11909876B1
- Status: Granted
- Kind: B1
- Application number: 17/841,584
- Filed: 2022-06-15
- Granted: 2024-02-20
- Earliest claimed: 2018-08-30
- Assignees: United Services Automobile Association (USAA)
- Applicants: United Services Automobile Association (USAA)
- Inventors: Jason Paul Larrew
- Web page: https://patentgrep.com/patent/US11909876B1

## CPC

- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- H04L 9/3247: {involving digital signatures}
- H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L 61/4511: using domain name system [DNS]
- H04L 63/123: {received data contents, e.g. message integrity}
- H04L 61/4552: Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Embodiments disclosed herein allow multiple providers to answer for DNS while having DNSSEC enabled for the same zone. To do so, the system shares DNSKEY records between autonomous DNS vendors. Sharing DNSKEY records allows customers to use multiple DNS providers with DNSSEC enabled without sharing private keys amongst providers.

## Claims

### Claim 1

A system comprising:
a top level domain (TLD) server; and
a first primary Domain Name System (DNS) server and a second primary DNS server autonomously operating in a first group of DNS servers, wherein each primary DNS server in the first group has an ability to make changes to records independently from other primary DNS servers in the first group and comprises one or more processors and one or more memories storing instructions that, when executed by the one or more processors, cause the system to perform a process comprising:
effecting, by the first primary DNS server, a change to a first record in the first primary DNS server,
wherein to propagate the change:
the first primary DNS server signs the change with a first private key to validate the change,
the first primary DNS server generates one or more first DNSKEY records that records the change,
effecting, by the second primary DNS server, the change to a second record in the second primary DNS server,
wherein to propagate the change:
the second primary DNS server signs the change with a second private key to validate the change,
the second primary DNS server generates one or more second DNSKEY records that records the change,
wherein to ensure a DNSKEY record request routed to any primary DNS servers autonomously operating in the first group is filled:
the one or more second DNSKEY records and the one or more first DNSKEY records are exchanged between the first primary DNS server and the second primary DNS server.

### Claim 2 (depends on 1)

The system according to claim 1, wherein the one or more first DNSKEY records each include a first public key, wherein the one or more second DNSKEY records each include a second public key.

### Claim 3 (depends on 2)

The system according to claim 2, wherein the first public key and the second public key each include a public Zone Signing Key and a public Key Signing Key.

### Claim 4 (depends on 1)

The system according to claim 1, wherein the one or more first DNSKEY records comprises a first DNSKEY record signed with a public Zone Signing Key and another first DNSKEY record signed with a public Key Signing Key.

### Claim 5 (depends on 4)

The system according to claim 4, wherein the first primary DNS server creates a Delegation Signer (DS) record by hashing the another first DNSKEY record signed with the public Key Signing Key.

### Claim 6 (depends on 5)

The system according to claim 5, wherein the DS record is sent to the TLD server.

### Claim 7 (depends on 1)

The system according to claim 1, wherein the first primary DNS server and the second primary DNS server are not publicly accessible.

### Claim 8

A method comprising:
effecting, by a first primary Domain Name System (DNS) server, a change to a record in the first primary DNS server, wherein the first primary DNS server and a second primary DNS server autonomously operate in a first group of DNS servers, wherein each primary DNS server in the first group has an ability to make changes to records independently from other primary DNS servers in the first group;
wherein to propagate the change:
the first primary DNS server signs the change with a first private key to validate the change,
the first primary DNS server generates one or more first DNSKEY records that records the change,
effecting, by the second primary DNS server, the change to a second record in the second primary DNS server,
wherein to propagate the change:
the second primary DNS server signs the change with a second private key to validate the change,
the second primary DNS server generates one or more second DNSKEY records that records the change,
wherein to ensure a DNSKEY record request routed to any primary DNS servers autonomously operating in the first group is filled:
the one or more second DNSKEY records and the one or more first DNSKEY records are exchanged between the first primary DNS server and the second primary DNS server.

### Claim 9 (depends on 8)

The method of claim 8, wherein the one or more first DNSKEY records each include a first public key, wherein the one or more second DNSKEY records each include a second public key.

### Claim 10 (depends on 9)

The method of claim 9, wherein the first public key and the second public key each include a public Zone Signing Key and a public Key Signing Key.

### Claim 11 (depends on 8)

The method of claim 8, wherein the one or more first DNSKEY records comprises a first DNSKEY record signed with a public Zone Signing Key and another first DNSKEY record signed with a public Key Signing Key.

### Claim 12 (depends on 11)

The method of claim 11, wherein the first primary DNS server creates a Delegation Signer (DS) record by hashing the another first DNSKEY record signed with the public Key Signing Key.

### Claim 13 (depends on 12)

The method of claim 12, wherein the DS record is sent to a TLD server.

### Claim 14 (depends on 8)

The method of claim 8, wherein the first primary DNS server and the second primary DNS server are not publicly accessible.

### Claim 15

A non-transitory computer-readable medium storing instructions that, when executed by a computing system, cause the computing system to perform operations comprising:
effecting, by a first primary Domain Name System (DNS) server, a change to a record in the first primary DNS server, wherein the first primary DNS server and a second primary DNS server autonomously operate in a first group of DNS servers, wherein each primary DNS server in the first group has an ability to make changes to records independently from other primary DNS servers in the first group;
wherein to propagate the change:
the first primary DNS server signs the change with a first private key to validate the change,
the first primary DNS server generates one or more first DNSKEY records that records the change,
effecting, by the second primary DNS server, the change to a second record in the second primary DNS server,
wherein to propagate the change:
the second primary DNS server signs the change with a second private key to validate the change,
the second primary DNS server generates one or more second DNSKEY records that records the change,
wherein to ensure a DNSKEY record request routed to any primary DNS servers autonomously operating in the first group is filled:
the one or more second DNSKEY records and the one or more first DNSKEY records are exchanged between the first primary DNS server and the second primary DNS server.

### Claim 16 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the one or more first DNSKEY records each include a first public key, wherein the one or more second DNSKEY records each include a second public key.

### Claim 17 (depends on 16)

The non-transitory computer-readable medium of claim 16, wherein the first public key and the second public key each include a public Zone Signing Key and a public Key Signing Key.

### Claim 18 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the one or more first DNSKEY records comprises a first DNSKEY record signed with a public Zone Signing Key and another first DNSKEY record signed with a public Key Signing Key.

### Claim 19 (depends on 18)

The non-transitory computer-readable medium of claim 18, wherein the first primary DNS server creates a Delegation Signer (DS) record by hashing the another first DNSKEY record signed with the public Key Signing Key, wherein the DS record is sent to a TLD server.

### Claim 20 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the first primary DNS server and the second primary DNS server are not publicly accessible.