Self-Signed Certificate Authentication via DNSSEC
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing public CA model for TLS is fundamentally vulnerable to man-in-the-middle attacks and residual security vulnerabilities, particularly when using CA-issued certificates, which can lead to compromised security due to the reliance on multiple trusted CAs and the complexity of PKIX certification path validation in DANE TLSA protocols.
Innovation Solution
Implementing a system that uses self-signed certificates stored in the DNS, where the registrar manages their own DNS zone and authenticates the self-signed certificates directly through the DNS, leveraging DNSSEC for secure storage and authentication, thereby reducing reliance on multiple CAs and enhancing trust and control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If CA-issued certificates are used for secure connections, then authentication is provided through trusted CAs, but security vulnerabilities arise due to reliance on multiple CAs and complexity of PKIX validation
Solution Approach 1:
The patent extracts the certificate authentication process from the complex PKIX validation system and implements it directly within the DNS infrastructure. Instead of relying on external CAs and multi-step validation chains, the DNS server itself issues and validates certificates, eliminating the need for complex PKIX path validation while maintaining authentication trust.
Solution Approach 2:
The patent introduces DNSSEC as an intermediary layer that provides cryptographic signing of DNS records, including certificates. This intermediary mechanism enables trust verification without requiring the complex PKIX validation chain, as DNSSEC signatures provide direct cryptographic proof of authenticity for the certificate stored in DNS.
2Adaptability or versatility
If multiple CAs are used for certificate issuance, then coverage and versatility are improved, but security trust is compromised due to potential CA betrayals and vulnerabilities
Solution Approach 1:
The patent implements a self-service model where the DNS server autonomously issues certificates to clients without requiring external CAs. The DNS server generates and signs certificates using its own private key, and clients verify these certificates using the DNS server's public key obtained through DNSSEC-secured DNS queries. This eliminates reliance on multiple CAs while maintaining security trust through cryptographic verification.
3Ease of manufacture
If self-signed certificates are used, then cost and ease of creation are improved, but security properties are reduced due to lack of CA signing
Solution Approach 1:
The patent uses DNSSEC as an intermediary trust mechanism that transforms self-signed certificates into securely authenticated credentials. The DNS server signs the certificate with its DNSSEC private key, and the signature is verified by clients through the DNSSEC validation process. This provides the ease of self-signed certificate creation while achieving the security properties of CA-signed certificates through DNSSEC mediation.
Data Source
AI summary
A method for using a self-signed digital certificate for establishing a secure connection between an Extensible Provisioning Protocol (EPP) client and a server on a communications network, including: receiving a communicated self-signed certificate from the EPP client; obtaining a unique identifier of the EPP client, the unique identifier associated with a domain name stored in a Domain Name System (DNS); using the unique identifier to access a designated DNS record in a DNS zone of the DNS associated with the domain name; retrieving the copy of the digital certificate from the designated DNS record, the copy of the digital certificate containing a public key of the EPP client bound to the domain name; authenticating the copy of the digital certificate with the communicated self-signed certificate; and receiving a generated session key from the EPP client to establish the secure connection over the communications network with the EPP client.