DNSSEC Key Management in Multi-Master DNS

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Implementing DNSSEC protocol in multi-master DNS environments with multiple primary DNS servers is challenging due to key management and synchronization issues.

Innovation Solution

A signing key descriptor is generated to specify how a DNS zone should be signed, and a set of keys is created based on this descriptor at a key master peer DNS server, which is then distributed to other peer DNS servers, allowing each server to generate digital signatures for DNS data.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If DNSSEC protocol is implemented in multi-master DNS environment with multiple primary DNS servers, then DNS security is improved, but key management complexity and synchronization issues increase

Engineering Contradiction:

ImproveDNS securityVSAvoidkey management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a signing key descriptor as an intermediary mechanism that mediates key management between multiple primary DNS servers. The descriptor contains signing configuration information that can be consistently distributed to all peer DNS servers, allowing them to generate digital signatures without direct key exchange or complex synchronization protocols.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The signing key descriptor is copied and distributed to all peer DNS servers in the multi-master environment. Each server receives an identical copy of the descriptor, ensuring consistent signing behavior across all servers without requiring complex key synchronization mechanisms.

Inventive Principle:

Principle #26Copying

2Productivity

If multiple primary DNS servers are used in a DNS zone, then system availability and load distribution are improved, but implementing consistent DNSSEC signing across all servers becomes problematic

Engineering Contradiction:

Improvesystem availabilityVSAvoidsigning consistency

Core Design Contradiction:

ProductivityVSManufacturing precision

Solution Approach 1:

The signing key descriptor serves multiple functions simultaneously: it configures signing parameters, identifies key usage, and provides consistent signing instructions to all peer DNS servers. This universal descriptor enables all servers to perform DNSSEC signing with identical configuration, maintaining signing consistency while supporting multiple primary servers for improved availability.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Reliability

If DNSSEC signing is implemented across multiple peer DNS servers, then digital signature generation capability is improved, but key distribution and synchronization become more difficult

Engineering Contradiction:

Improvedigital signature generationVSAvoidkey synchronization

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The patent extracts the signing configuration information into a separate signing key descriptor that can be independently distributed to peer DNS servers. This extraction allows the configuration data to be propagated without requiring the actual cryptographic keys to be synchronized between servers, preventing key synchronization issues while maintaining signing capability.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS8681995B2Supporting DNS security in a multi-master environment

Publication Date: 2014.03.25 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Multiple peer domain name system (DNS) servers are included in a multi-master DNS environment. One of the multiple peer DNS servers is a key master peer DNS server that generates one or more keys for a DNS zone serviced by the multiple peer DNS servers. The key master peer DNS server can also generate a signing key descriptor that identifies the set of one or more keys for the DNS zone, and communicate the signing key descriptor to the other ones of the multiple peer DNS servers.