Back to results
US 2017/0012943 A1Published application
Extending dnssec trust chains to objects outside the dns
AssigneeVeriSign, Inc.
InventorsBurton S. Kaliski, JR., Eric Osterweil, Glen Wiley
Life of this patent
Estimating the term…
Abstract
The present invention generally relates to systems and methods for extending a chain of trust beyond the DNS. Some embodiments provide a verifier with the ability to validate a chain of trust starting with the trust anchor at the DNS root all the way to a service or object of interest outside the DNS.
Claims54
A method of providing data, the method comprising:
- receiving at a first Domain Name System (DNS) server, over an electronic computer network, a first DNS resource record request from a client computer, wherein the first DNS resource record request comprises a first domain name;
- providing, by the first DNS server to the client computer and in response to the first DNS resource record request, a first DNS resource record comprising a URI for a non-DNS service;
- whereby the client computer derives a target URI from the URI for the non-DNS service, contacts a non-DNS service at the target URI for requested data, and receives the requested data from the non-DNS service;
- receiving, at a second DNS server, over the electronic computer network, a second DNS resource record request from the client computer, the second DNS resource record request comprising a second domain name;
- and
- providing, by the second DNS server to the client computer and in response to the second DNS resource record request, a second DNS resource record comprising cryptographic authentication information corresponding to the second domain name;
- whereby the client computer cryptographically validates the requested data using the cryptographic authentication information.
4 more elements
A system for providing data, the system comprising:
- a first Domain Name System (DNS) server configured to:
- receive, over an electronic computer network, a first DNS resource record request from the client computer, wherein the first DNS resource record request comprises a first domain name;
- and
- provide, to the client computer and in response to the first DNS resource record request, a first DNS resource record comprising a URI for a non-DNS service;
- whereby the client computer derives a target URI from the URI for the non-DNS service, contacts a non-DNS service at the target URI for requested data, and receives the requested data from the non-DNS service;
- and
- a second DNS server communicatively coupled to the first DNS server, the second DNS server configured to:
- receive, over the electronic computer network, a second DNS resource record request from the client computer, the second DNS resource record request comprising a second domain name;
- and
- provide, to the client computer and in response to the second DNS resource record request, a second DNS resource record comprising cryptographic authentication information corresponding to the second domain name;
- whereby the client computer cryptographically validates the requested data using the cryptographic authentication information.
8 more elements
A method of obtaining data, the method comprising:
- sending, from a client computer and over an electronic computer network, a first Domain Name System (DNS) resource record request to a first DNS server, wherein the first DNS resource record request comprises a first domain name;
- receiving, by the client computer, a first DNS resource record sent from the first DNS server in response to the first DNS resource record request, the first DNS resource record comprising a URI for a non-DNS service;
- deriving, by the client computer, a target URI from the URI for the non-DNS service;
- contacting, by the client computer and over the electronic computer network, the non-DNS service at the target URI for requested data;
- receiving, by the client computer and over the electronic computer network, the requested data from the non-DNS service;
- sending, by the client computer and over the electronic network, a second DNS resource record request to a second DNS server, the second DNS resource record request comprising a second domain name;
- receiving, by the client computer, a second DNS resource record sent from the second DNS server in response to the second DNS resource record request, the second DNS resource record comprising cryptographic authentication information corresponding to the second domain name;
- and
- cryptographically validating the requested data using the cryptographic authentication information.
6 more elements
A non-transitory computer readable medium comprising computer-interpretable instructions, which, when executed by at least one electronic processor of a client computer, configure the at least one electronic processor to perform a method comprising:
- sending, from the client computer and over an electronic computer network, a first Domain Name System (DNS) resource record request to a first DNS server, wherein the first DNS resource record request comprises a first domain name;
- receiving, by the client computer, a first DNS resource record sent from the first DNS server in response to the first DNS resource record request, the first DNS resource record comprising a URI for a non-DNS service;
- deriving, by the client computer, a target URI from the URI for the non-DNS service;
- contacting, by the client computer and over the electronic computer network, the non-DNS service at the target URI for requested data;
- receiving, by the client computer and over the electronic computer network, the requested data from the non-DNS service;
- sending, by the client computer and over the electronic network, a second DNS resource record request to a second DNS server, the second DNS resource record request comprising a second domain name;
- receiving, by the client computer, a second DNS resource record sent from the second DNS server in response to the second DNS resource record request, the second DNS resource record comprising cryptographic authentication information corresponding to the second domain name;
- and
- cryptographically validating the requested data using the cryptographic authentication information.
6 more elements
Dependencies are inferred from the claim text.