Concurrent DNS Record Versioning for Seamless Key Rollover
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Domain Name System (DNS) is vulnerable to inefficiencies and resolution failures due to inefficiencies in DNSSEC data signing techniques, particularly in large zones, leading to delays and resolution failures, and the lack of efficient storage and resource utilization in the DNS environment, as well as inadequate testing of registry data during key/algorithm rollovers.
Innovation Solution
A system and method for concurrently publishing current and next versions of DNS records using different signing keys, allowing for simultaneous operation and testing/validation without storing intermediate versions in the registry database, enabling efficient key rollovers and improved resource utilization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNSSEC data signing is performed using traditional sequential methods, then data integrity is maintained, but DNS resolution experiences delays and failures especially in large zones
Solution Approach 1:
The patent applies preliminary action by generating and validating the next version of DNS data (including next version signing keys and signed records) before the current version expires. This allows the transition to occur without interruption, as the next version is already prepared and validated in advance, eliminating the delays associated with traditional sequential signing methods.
Solution Approach 2:
The patent introduces an intermediary mechanism by maintaining both current and next version DNS data simultaneously in the database. The system uses version indicators and selective querying to transition between versions, allowing smooth handover without forcing resolvers to wait for sequential updates, thus reducing resolution delays while maintaining integrity.
2Reliability
If multiple versions of DNS data are stored simultaneously, then testing and validation can occur without disrupting live service, but database storage requirements increase
Solution Approach 1:
The patent applies segmentation by dividing DNS data into distinct current version and next version segments, each with its own signing keys and validation status. This allows the system to store multiple versions separately organized, enabling efficient testing and validation of the next version while maintaining the current live version, with storage optimized through structured segmentation rather than unorganized duplication.
3Productivity
If DNS data is published directly without intermediate testing, then publication speed is improved, but resolution failures may occur due to unvalidated data
Solution Approach 1:
The patent applies preliminary action by performing complete validation of the next version DNS data (including signing key validation and record signing validation) before it becomes live. This preliminary validation ensures that only verified, error-free data is published, eliminating resolution failures while maintaining high publication speed through the use of asynchronous validation processes and efficient database queries.
4Reliability
If traditional DNSSEC signing methods are used, then security is maintained, but key rollover processes are inefficient and resource-intensive
Solution Approach 1:
The patent applies preliminary action by generating and validating next version signing keys before they are needed for live operation. This allows key rollover to occur smoothly without disruption, as the new keys are already created and validated in advance, significantly improving rollover efficiency while maintaining security through the use of cryptographically secure key generation and validation processes.
Data Source
AI summary
A method for concurrently publishing a current version of a plurality of Domain Name System (DNS) records for zone of a domain name and for storing a next version of the plurality of DNS records for the zone, the method comprising the steps of: obtaining selected data of registry data associated with the domain name stored in a registry database; digitally signing the registry data to generate a first signed DNS record and digitally signing the registry data to generate a second signed DNS record; and a distribution system for coordinating concurrent generation and transmission of the current version and the next version; the distribution system and signing system cooperating to: a) generate the current version to include the first signed DNS record; and b) while the current version is operational in the DNS, generate the next version the second signed DNS record.