DNS+ protocol and infrastructure for enhanced domain utility
AssigneeFreename AG
InventorsPaolo Domenighetti, Davide Vicini
Life of this patent
Estimating the term…
Abstract
A secure, field-based data sharing protocol leveraging the DNS infrastructure with DNSSEC, post-quantum cryptography, and real-time usability flows. The protocol enables domain owners to selectively expose structured confidential data (e.g., IBANs, credit cards, wallets, phone numbers) to authorized entities like banks, PSPs, or telcos using a set of predictable, encrypted DNS TXT records. It introduces a format for revocable, auditable, and verifiable publishing of confidential information, distributed without centralized APIs.
Claims25
A method for securely distributing confidential data via the Domain Name System (DNS), comprising:
- encrypting data fields using authenticated symmetric encryption with AES-256-GCM to produce encrypted data;
- encapsulating a symmetric encryption key using a recipient-specific post-quantum public key cryptography scheme based on Kyber-768;
- publishing the encrypted data, encapsulated key, and associated metadata as DNS TXT records within a structured subdomain namespace;
- securing said DNS TXT records using Domain Name System Security Extensions (DNSSEC) to guarantee authenticity and integrity;
- and
- enabling authorized recipients to retrieve, verify, decapsulate, and decrypt the confidential data by resolving the DNS TXT records.
A system for post-quantum secure data sharing using DNS, comprising:
- a publisher module, comprising a memory, configured to encrypt data fields with AES-256-GCM, encapsulate symmetric keys using Kyber-768 with recipient public keys, generate metadata records, and publish said records as DNS TXT records under DNSSEC-signed zones;
- a DNS resolver module, comprising a memory, capable of retrieving said DNS TXT records, verifying DNSSEC signatures, performing Kyber-768 decapsulation to recover symmetric keys, and decrypting the encrypted data fields for authorized recipients;
- and
- an API and software development kit (SDK) providing interfaces for secure record generation, publishing, validation, and resolution.
A method for establishing and managing identity, authorization, and delegation of actions for autonomous or artificial-intelligence (AI) agents using a DNS-based cryptographic protocol, comprising:
- publishing, under a domain name associated with an AI agent, one or more public DNS TXT records containing metadata, capabilities, and verification information;
- publishing one or more encrypted DNS TXT records containing per-recipient authorization data, each encrypted using a symmetric encryption algorithm and encapsulated by a post-quantum key-encapsulation mechanism;
- performing DNSSEC validation of said records to ensure authenticity and integrity;
- retrieving and decrypting the per-recipient encrypted records using a corresponding private key of the intended recipient;
- and
- enforcing, by a relying party, access policies and authorization scopes derived from decrypted information.
Dependencies are inferred from the claim text.