Client-Side Public Key Discovery via DANE and DNSSEC
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face difficulties in discovering and obtaining public keys for secure interactions over the Internet due to the manual and error-prone process of provisioning sender public keys, which often involves insecure communication channels and relies on unfoolproof certificate authorities.
Innovation Solution
A method utilizing DNS-based authentication of named entities (DANE) with DNS security extensions (DNSSEC) to automate the client-side discovery of public keys by constructing DNS queries for cryptographic credentials through a DNS resolver, allowing secure digital object transmission between domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual provisioning of public keys is used, then users can exchange public keys, but the process is error-prone and requires secure out-of-band communication channels
Solution Approach 1:
The patent introduces DNS as an intermediary system to automatically provision public keys. Instead of manual exchange or secure out-of-band channels, the DNS infrastructure mediates the key discovery process by storing public keys in DNS records and enabling automated retrieval through standard DNS queries, thus improving ease of operation while maintaining security through the established DNSSEC framework
Solution Approach 2:
The system enables self-service by allowing clients to automatically discover and retrieve public keys from DNS without human intervention. The automated key discovery process eliminates the need for manual provisioning steps, making the security infrastructure work autonomously through standardized DNS queries and responses
2Reliability
If certificate authorities are used to sign certificates, then certificates can be verified, but certificate authorities are not foolproof and have mistakenly signed unauthorized certificates
Solution Approach 1:
The patent inverts the traditional PKI model by allowing resource holders to directly attest to their own certificates through DNS records, rather than relying on third-party certificate authorities. This self-attestation approach, combined with DNSSEC's cryptographic signing of DNS records, eliminates the trust issues associated with CAs while maintaining verification accuracy through the existing DNSSEC authentication mechanism
3Ease of operation
If automated key discovery is implemented, then key provisioning becomes simpler, but new infrastructure (DNSSEC-secured zones) must be deployed
Solution Approach 1:
The patent leverages the universality of the DNS infrastructure, which is already universally deployed across the Internet. By extending DNS to include public key records and utilizing existing DNSSEC capabilities, the system achieves automated key discovery without requiring entirely new infrastructure. The multi-functionality of DNS (now serving both traditional naming and public key distribution) reduces overall system complexity despite the added capabilities
Data Source
AI summary
Provided is a method of digitally securing a digital object from a first user in a first domain to a second user in a second domain using a DNS provider. The method includes accessing, at a client device of the first user, a client-side local policy, wherein the local policy comprises one or more zones managed by one or more DNS providers and secured by DANE using DNSSEC; constructing a DNS query for a cryptographic credential for the second user based, at least in part, on a zone of the one or more zones in the local policy; providing a request for the cryptographic credential for the second user; obtaining the cryptographic credential for the second user from a DNS provider of the one or more DNS providers; digitally securing the digital object using the cryptographic credential; and providing the digital object to the second user.