DNS Certificate Distribution for TLS Latency Reduction

Solution Overview

Problem

Existing systems require senders to repeatedly request certificates from remote resources for encryption, leading to delays and bandwidth penalties, and may not have up-to-date certificates when needed.

Innovation Solution

A system that distributes and manages certificates using a Domain Name System (DNS) to store and update certificates locally on sending systems, allowing them to encrypt messages directly without relying on remote resources and ensuring up-to-date certificates are available.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If senders repeatedly request certificates from remote resources, then they can obtain certificates for encryption, but this causes delays and increases bandwidth usage

Engineering Contradiction:

Improvecertificate availabilityVSAvoidlatency

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary actions by harvesting certificates from remote resources in advance and storing them locally in a cache before they are needed. The delivery manager proactively retrieves certificates and stores them in sending systems' local memory, so when encryption is needed, the certificates are already available without requiring real-time remote requests.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces a delivery manager as an intermediary component that mediates between remote certificate resources and sending systems. The delivery manager harvests certificates from remote resources and distributes them to sending systems, which store them locally. This intermediary layer eliminates the need for senders to directly and repeatedly contact remote resources, reducing latency and bandwidth usage.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If senders repeatedly request certificates from remote resources, then they can obtain certificates for encryption, but this increases bandwidth usage

Engineering Contradiction:

Improvecertificate availabilityVSAvoidbandwidth usage

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The system performs preliminary actions by harvesting certificates from remote resources in advance and storing them locally in a cache before they are needed. The delivery manager proactively retrieves certificates and stores them in sending systems' local memory, so when encryption is needed, the certificates are already available without requiring real-time remote requests.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces a delivery manager as an intermediary component that mediates between remote certificate resources and sending systems. The delivery manager harvests certificates from remote resources and distributes them to sending systems, which store them locally. This intermediary layer eliminates the need for senders to directly and repeatedly contact remote resources, reducing latency and bandwidth usage.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Productivity

If senders store certificates locally, then they can encrypt messages immediately without remote requests, but they may not have up-to-date certificates

Engineering Contradiction:

Improveencryption speedVSAvoidcertificate currency

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system implements periodic action by having the delivery manager harvest certificates at regular intervals and update the local cache. The patent specifies that the delivery manager can be configured to periodically retrieve updated certificates from remote resources and distribute them to sending systems, ensuring that locally stored certificates remain current without requiring continuous remote connections.

Inventive Principle:

Principle #19Periodic action

Solution Approach 2:

The patent implements feedback mechanisms where the delivery manager monitors certificate expiration dates and validity status. When certificates are approaching expiration or become invalid, the delivery manager detects this through feedback from the remote resources and automatically retrieves updated certificates to replace the old ones in the local cache, ensuring continuous certificate validity.

Inventive Principle:

Principle #23Feedback

Data Source

PatentEP3528453B1Harvesting and distributing a certificate based on a DNS name

Publication Date: 2023.10.25 ZIXCORP SYST

Figure 1A
Figure 1B
Figure 2

AI summary

According to certain embodiments, a delivery manager (30) comprises an interface (510) and processing circuitry (520). The interface (510) is configured to receive a certificate that a DNS (40) associates with a DNS name of a first endpoint (20A). The processing circuitry (520) is configured to distribute the certificate to a second endpoint (20B). The second endpoint (20B) is configured to store the certificate in a local memory of the second endpoint (20B) and, in response to a future determination to establish a connection with the first endpoint (20A), use the certificate from the local memory of the second endpoint (20B) to establish transport layer security (TLS) for the connection.