DNS-Based Device Ownership Attestation for Cloud Attribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing systems lack a reliable mechanism to verify device ownership and attribute responsibility, especially in public cloud deployments with managed service providers, leading to difficulties in determining fault or issue remediation.
Innovation Solution
A network-based attestation mechanism using DNS constructs, such as TXT resource records, to store and manage device ownership information, allowing attestation without requiring access to endpoint devices, and leveraging protocols like QOTD for lightweight information exchange.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic certificates on TLS-based services are used for device ownership attestation, then attestation reliability is improved, but device complexity and configuration requirements increase
Solution Approach 1:
The patent introduces DNS servers as intermediary components that store and provide attestation information. Instead of requiring direct cryptographic verification between devices, the DNS server acts as a mediator that holds pre-configured attestation data (TXT records) and serves it to requestors, thereby maintaining reliability while reducing device complexity
Solution Approach 2:
The patent creates a copy of attestation information in the form of DNS TXT records. The original cryptographic certificates remain on the device, but a simplified copy of the attestation data is stored in the DNS system, allowing verification without requiring the full cryptographic infrastructure on the endpoint device
2Ease of operation
If coarse public registration records are used for device attribution, then ease of operation is improved, but measurement precision of ownership verification deteriorates
Solution Approach 1:
The patent merges the simplicity of DNS lookup operations with precise attestation data in TXT records. The coarse mechanism of DNS querying is combined with fine-grained attestation information about device ownership, responsibility, and operational status, achieving both ease of operation and measurement precision
Solution Approach 2:
Attestation information is preliminarily configured in DNS TXT records before verification is needed. This pre-positioning of accurate ownership and responsibility data allows for precise verification through simple DNS queries, eliminating the need for complex real-time verification processes
3Quantity of substance
If DNS TXT records are used to store attestation information, then storage requirements are reduced, but information completeness may be limited
Solution Approach 1:
The patent extracts only the essential attestation information (ownership, responsibility, operational status) from the full cryptographic certificate data and stores it in DNS TXT records. This selective extraction maintains the critical verification elements while minimizing storage requirements in the DNS system
Solution Approach 2:
The patent moves attestation information from the device dimension to the network dimension by storing it in DNS servers. This dimensional shift allows the information to be accessible to multiple devices simultaneously without increasing individual device storage requirements, while maintaining information completeness through network-wide availability
Data Source
AI summary
Mechanisms are provided for computing device attestation. An attestation request is received, from a requestor computing device, for attestation of a target computing device. The attestation request includes a computing device network address of the target computing device. A first lookup operation of the computing device network address is performed in a domain name service (DNS) server to obtain a device name for the target computing device. A second lookup operation of the device name is performed in the DNS server to obtain a text resource record corresponding to the device name. The text resource record stores attestation information for the target computing device corresponding to the device name. Attestation information is extracted from the text resource record and returned to the requestor computing device to perform attestation of the target computing device.