DNS Provider Configuring Registry DNSSEC Records
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
A DNS provider that is not the registrar of a domain name cannot update Delegation Signer (DS) records or other data in a DNS parent zone controlled by a registry, preventing domain names from supporting DNSSEC without the registrar's intervention.
Innovation Solution
A DNS provider can obtain a public and private key pair through a certificate authority or registrar, sign requests to update DS records, and transmit them via an API to the registrar or registry, allowing verification and update of DS records to enable DNSSEC support.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a DNS provider that is not the registrar manages DNSSEC configuration, then management flexibility and independence are improved, but the ability to update DS records in the DNS parent zone is lost
Solution Approach 1:
The patent introduces an intermediary mechanism where the DNS provider signs DS record update requests with a private key, and the registry verifies these requests using a corresponding public key. This intermediary cryptographic verification system enables the DNS provider to update DS records without direct registrar involvement, resolving the contradiction between management independence and operational capability.
2Reliability
If the registrar controls all DNSSEC updates, then security control is maintained, but DNS provider independence and management flexibility are reduced
Solution Approach 1:
The patent enables the DNS provider to perform self-service for DS record updates by signing requests with its own private key. The registry independently verifies these signed requests using the public key, eliminating the need for registrar mediation. This self-service mechanism maintains security through cryptographic verification while granting DNS providers independent control over their DNSSEC configurations.
3Reliability
If DS record updates require registrar intervention, then unauthorized updates are prevented, but update speed and efficiency are reduced
Solution Approach 1:
The patent implements preliminary action by having the DNS provider sign the DS record update requests in advance using its private key before submission to the registry. The registry has the corresponding public key ready for immediate verification. This preliminary signing action enables rapid verification and processing without requiring time-consuming registrar intervention, thus improving update speed while maintaining authorization security.
Data Source
AI summary
A Domain Name System (DNS) provider that is not a registrar of a domain name may nonetheless request a registry (possibly via an API request from the registrar to the registry, or via a call directly to the registry) to alter a Delegation Signer (DS) record in a DNS parent zone or other data controlled by the registry. The registry preferably confirms that the DNS provider has control over a nameserver for the domain name. Using Public Key Infrastructure (PKI), the DNS provider may sign the request with a private key and store the public key in a location that confirms the DNS provider has control over the domain name or over the nameservers for the domain name. After successfully confirming the DNS provider, the registrar or registry may change the DS record so that the domain name supports Domain Name System Security Extensions (DNSSEC) or update other data with the registry.