# US 11,909,880 B2 · Centralized credential issuance and rotation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,880 B2 - Document ID: US11909880B2 - Status: Granted - Kind: B2 - Application number: 17/353,392 - Filed: 2021-06-21 - Published: 2021-10-07 - Granted: 2024-02-20 - Earliest claimed: 2019-09-25 - Assignees: ValiMail Inc. - Applicants: ValiMail Inc. - Inventors: Ashley Duane Wilson; Peter Martin Goldstein - Web page: https://patentgrep.com/patent/US11909880B2 ## CPC - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 61/4511: using domain name system [DNS] - H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/0815: {providing single-sign-on or federations} - H04L 67/133: Protocols for remote procedure calls [RPC] - H04L 67/146: Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding - H04L 2209/805: Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Embodiments relate to a system that may include a third-party server and a domain name system (DNS). The third-party server may be configured to receive a request for a credential from a named entity device for the named entity device to communicate with an application programming interface (API). The API may be associated with a domain. The third-party server may obtain the credential from the API. The third-party server may encrypt the credential with a public key corresponding to the named entity device to generate an encrypted credential. The DNS may be configured to receive the encrypted credential and publish a DNS record at a namespace of the DNS, the DNS record containing the encrypted credential for the named entity device to retrieve the credential. The named entity device may decrypt the encrypted credential by the private key stored at the device. ## Claims ### Claim 1 A system comprising: a third-party server comprising one or more processors and memory, the memory storing computer code comprising instructions, the instructions, when executed by the one or more processors, cause the one or more processors to at least: receive, by the third-party server from a named entity device, a request for a credential for the named entity device to communicate with an application programming interface (API), the API associated with a domain; obtain, by the third-party server, the credential from the API; and encrypt, by the third-party server, the credential with a public key corresponding to the named entity device to generate an encrypted credential; and a domain name system (DNS) associated with the domain, the DNS configured to receive the encrypted credential and publish a DNS record at a namespace of the DNS, the DNS record containing the encrypted credential for the named entity device to retrieve the credential. ### Claim 2 (depends on 1) The system of claim 1, wherein the credential includes a session token, and wherein the instruction to obtain the credential from the API comprises instructions, when executed, cause the one or more processors to at least: retrieve an API username and password corresponding to the named entity device, the API username and password stored at the third-party server; transmit the API username and password to the API for the API to generate the session token; and receive the session token. ### Claim 3 (depends on 1) The system of claim 1, wherein the instruction to obtain the credential from the API comprises instructions, when executed, cause the one or more processors to at least: receive the credential from the API that periodically pushes refreshed credentials to the third-party server. ### Claim 4 (depends on 1) The system of claim 1, wherein the request from the named entity device for the credential corresponds to a query to the DNS. ### Claim 5 (depends on 1) The system of claim 1, wherein the namespace is a delegated sub-namespace managed by the third-party server, the domain delegating the sub-namespace to the third-party server. ### Claim 6 (depends on 1) The system of claim 1, wherein the credential is a first session token, and the instructions, when executed by the one or more processors, further cause the one or more processors to at least: obtain, by the third-party server and responsive to the first session token being expired or close to expiration, a second session token from the API; encrypt, by the third-party server, the second session token with the public key corresponding to the named entity device; and publish, by the third-party server, the second session token encrypted by the public key at the namespace of the DNS for the named entity device to retrieve the second session token at the DNS. ### Claim 7 (depends on 1) The system of claim 1, wherein the public key is obtained from a DNS record associated with the named entity device. ### Claim 8 (depends on 1) The system of claim 1, wherein credential includes one or more of elements selected from the following: a key identifier, a secret key, a username, a password, and a session token. ### Claim 9 (depends on 1) The system of claim 1, wherein the DNS record includes a time to live entry that corresponds to a lifetime of the credential. ### Claim 10 (depends on 1) The system of claim 1, wherein the named entity device is an Internet-of-Thing (IoT) device that stores a private key corresponding to the public key at a hardware secure element. ### Claim 11 A computer-implemented method comprising: receiving, by a third-party server from a named entity device, a request for a credential for the named entity device to communicate with an application programming interface (API), the API associated with a domain; obtaining, by the third-party server, the credential from the API; encrypting, by the third-party server, the credential with a public key corresponding to the named entity device to generate an encrypted credential; and publishing, by the third-party server, a domain name system (DNS) record at a namespace of a DNS associated with the domain, the DNS record containing the encrypted credential for the named entity device to retrieve the credential at the DNS. ### Claim 12 (depends on 11) The computer-implemented method of claim 11, wherein the credential includes a session token, and wherein obtaining the credential from the API comprises: retrieving an API username and password corresponding to the named entity device, the API username and password stored at the third-party server; transmitting the API username and password to the API for the API to generate the session token; and receiving the session token. ### Claim 13 (depends on 11) The computer-implemented method of claim 11, wherein obtaining the credential from the API comprises: receiving the credential from the API that periodically pushes refreshed credentials to the third-party server. ### Claim 14 (depends on 11) The computer-implemented method of claim 11, wherein the request from the named entity device for the credential corresponds to a query to the DNS. ### Claim 15 (depends on 11) The computer-implemented method of claim 11, wherein the namespace is a delegated sub-namespace managed by the third-party server, the domain delegating the sub-namespace to the third-party server. ### Claim 16 (depends on 11) The computer-implemented method of claim 11, wherein the credential is a first session token, and the computer-implemented method further comprises: obtaining, by the third-party server and responsive to the first session token being expired or close to expiration, a second session token from the API; encrypting, by the third-party server, the second session token with the public key corresponding to the named entity device; and publishing, by the third-party server, the second session token encrypted by the public key at the namespace of the DNS for the named entity device to retrieve the second session token at the DNS. ### Claim 17 (depends on 11) The computer-implemented method of claim 11, wherein the public key is obtained from a DNS record associated with the named entity device. ### Claim 18 (depends on 11) The computer-implemented method of claim 11, wherein credential includes one or more of elements selected from the following: a key identifier, a secret key, a username, a password, and a session token. ### Claim 19 (depends on 11) The computer-implemented method of claim 11, wherein the DNS record includes a time to live entry that corresponds to a lifetime of the credential. ### Claim 20 A non-transitory computer-readable medium configured to store computer code comprising instructions, the instructions, when executed by one or more processors, cause the one or more processors to at least: receive, by a third-party server from a named entity device, a request for a credential for the named entity device to communicate with an application programming interface (API), the API associated with a domain; obtain, by the third-party server, the credential from the API; and encrypt, by the third-party server, the credential with a public key corresponding to the named entity device to generate an encrypted credential; and publish a domain name system (DNS) record at a namespace of a DNS associated with the domain, the DNS record containing the encrypted credential for the named entity device to retrieve the credential.