DNSSEC signing server

• US 10,158,620 B2
• Filed: 07/26/2017
• Issued: 12/18/2018
• Est. Priority Date: 05/02/2011
• Status: Active Grant

• Current Assignee: VeriSign, Inc.
• Original Assignee: VeriSign, Inc.
• Inventors: Smith, David, Gould, James, Lavu, Ramana, Deshpande, Deepak
• Primary Examiner(s): HOLDER, BRADLEY W
• Application Number:
  US15/660,237
• Publication Number:
  US 20170324724A1
• Time in Patent Office: 510 Days
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Systems and methods for performing DNSSEC signing are described in which digital signature operations may be performed by a network accessible signing server that is configured to interact with a separate client application. Exemplary methods may include receiving a signing request at the signing server from the client application to sign first data. The signing server may determine an active KSK and/or an active ZSK for the first data. The first data may then be transmitted by the signing server to a digital signature modules, which may include, for example, a hardware support module, or software signing applications. The signing server may receive a digitally signed version of the first data from the digital signature module, and provide the signed first data to the client application.

Claims

1. A remote Domain Name System Security Extensions (DNSSEC) signing system comprising:

a registry provisioning computer system configured to accept and execute a command that changes Domain Name System (DNS) data related to a domain;

a registry database storage device storing DNS data; and

a signing server configured to interact with the registry provisioning computer system and registry database to sign DNS data;

wherein the signing server is configured to;

receive a signing request from the registry provisioning computer system to sign a first data;

determine an active Key Signing Key (KSK) or an active Zone Signing Key (ZSK) to sign the first data;

transmit the first data to one of a plurality of digital signature logic to be signed;

receive the first data that has been signed using the active KSK or the active ZSK; and

store the first data that has been signed in the registry database storage device.

2. The remote DNSSEC signing system of claim 1, wherein the registry provisioning computer system supports a provisioning interface.

3. The remote DNSSEC signing system of claim 2, wherein the command changes DNS data for a domain under a Top level Domain (TLD) managed by a DNS registry.

4. The remote DNSSEC signing system of claim 3, wherein the remote DNSSEC signing system is further configured to sign one or more portions of the DNS data that has been changed by the command according to a DNSSEC protocol, without signing an entire zone.

5. The remote DNSSEC signing system of claim 4, wherein the remote DNSSEC signing system is further configured to take each committed transaction in the registry database and apply it incrementally to a plurality of DNS Servers.

6. The remote DNSSEC signing system of claim 4, wherein the signing server is configured to provide signed DNS data to the registry provisioning computer system.

7. The remote DNSSEC signing system of claim 3, wherein the remote DNSSEC signing system is further configured to sign an entire zone.

8. The remote DNSSEC signing system of claim 3, wherein the remote DNSSEC signing system is further configured to apply a DNS data change to a plurality of DNS Servers.

9. The remote DNSSEC signing system of claim 2, wherein the command adds a new domain.

10. The remote DNSSEC signing system of claim 9, wherein the remote DNSSEC signing system is further configured to update NextSECure (NSEC) resource records.

11. The remote DNSSEC signing system of claim 9, wherein the remote DNSSEC signing system is further configured to update NextSECure version 3 (NSEC3) resource records.

12. The remote DNSSEC signing system of claim 2, wherein the command updates an existing domain.

13. The remote DNSSEC signing system of claim 2, wherein the remote DNSSEC signing system is configured to process requests regarding domains under different top-level domains (TLDs).

14. The remote DNSSEC signing system of claim 2, wherein the remote DNSSEC signing system is configured to process requests regarding at least two domains managed by a plurality of registrars.

15. The remote DNSSEC signing system of claim 2, wherein the signing request specifies an algorithm to use to sign the first data.