DNSSEC Bootstrapping via X.509 Credential Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Domain Name System (DNS) is vulnerable to DNS cache poisoning, which can lead to resolution failures or malicious content distribution due to inaccurate or misconfigured IP address information, and there is a need for a secure method to obtain authentic DNSSEC credentials for entities interacting with DNSSEC-enabled domains.
Innovation Solution
A method and system for bootstrapping a relying entity by receiving and verifying instances of security credentials associated with certifying entities, using a lookup table to provide the relying entity with cryptographically signed security credentials, and determining the authenticity of information using a Byzantine fault tolerance policy to ensure secure authentication and authorization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If DNS cache servers store DNS query results to improve efficiency, then DNS resolution speed is improved, but the system becomes vulnerable to DNS cache poisoning attacks
Solution Approach 1:
The patent introduces digital signatures as an intermediary mechanism between DNS servers and cache servers. Each DNS record is signed by its authoritative source, and cache servers verify these signatures before storing or using the records. This mediator (cryptographic signature) ensures data authenticity while allowing caching to proceed, thus maintaining both speed and reliability.
Solution Approach 2:
The patent applies preliminary action by pre-signing DNS records with cryptographic signatures before they are cached. The authoritative DNS server signs the records in advance, and the signatures travel with the records to cache servers. This preliminary cryptographic binding prevents cache poisoning because tampered records will have invalid signatures and can be rejected.
2Device complexity
If DNSSEC credentials are distributed through DNS itself, then the system is simplified, but cyclic dependencies and security vulnerabilities arise
Solution Approach 1:
The patent uses X.509 certificates from trusted certificate authorities as intermediaries to distribute DNSSEC credentials. Instead of relying on DNS to distribute its own security credentials (which creates cyclic dependencies), the system uses an independent, trusted external authority (the certificate authority) to sign and distribute DNSSEC keys. This breaks the cycle and provides a secure foundation.
Solution Approach 2:
The patent extracts the credential distribution function from the DNS system itself and places it in a separate, trusted X.509 certificate infrastructure. By taking out the credential distribution mechanism from the potentially compromised DNS environment and placing it in a separate, well-established PKI system, the patent avoids cyclic dependencies and provides a secure bootstrap for DNSSEC.
3Reliability
If multiple certifying entities provide security credentials, then redundancy and security are improved, but verification complexity increases
Solution Approach 1:
The patent applies universality by using a single, standardized X.509 certificate verification mechanism that works across multiple certifying entities. Instead of implementing different verification protocols for different certificate authorities, the system uses the universal X.509 standard, which provides a unified approach to verifying credentials from any trusted certificate authority, thus managing complexity while maintaining security.
Data Source
AI summary
The disclosure is directed to securely bootstrapping devices in a network environment. Methods and systems include hardware and/or operations for receiving, based on an identifier provisioned at a relying entity, instances of a security credential of an information system, wherein the instances are associated with respective certifying entities. The operations also include verifying the authenticity of the instances of the security credential using information of the certifying entities provisioned at the relying entity. The operations further includes determining matches between the instances of the security credential. Additionally, the operations include determining based on the matches that a first instance of the security credential satisfies a policy provisioned at the relying entity. Further, the operations include verifying the authenticity of information requested from the information system using the first instance of the security credential. In various implementations, the information system may be the domain name system.