Domain-server public-key reference

• US 9,667,415 B1
• Filed: 03/30/2016
• Issued: 05/30/2017
• Est. Priority Date: 11/18/2015
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Wingenbach, John C., Doleh, Yaser K., Marzorati, Mauro
• Primary Examiner(s): LESNIEWSKI, VICTOR D
• Application Number:
  US15/084,580
• Publication Number:
  US 20170142105A1
• Time in Patent Office: 426 Days
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Abstract

A domain is identified from a communication address. The domain corresponds to a host name. Resource records associated with the host name are caused to be queried for a public key reference. The public key reference is received in response to the caused resource record query. A public key associated with the communication address is identified based on the public key reference.

Claims

1. A method comprising:

identifying, by an email client of a sender, a domain from a communication address of a recipient, the domain corresponds to a host name, wherein the client is operating on a computing device;

causing, by the client, resource records of a domain name system (DNS) associated with the host name to be queried for a public key reference stored in the resource records, the public key reference associated with the communication address;

receiving, by the client and in response to the causing the resource records to be queried, the public key reference directed to a subdomain corresponding to a second host name;

causing, by the client, secondary resource records associated with the second host name to be queried for a second public key reference stored in the secondary resource records;

obtaining, by the client and in response to the causing the secondary resource records to be queried for the second public key reference, the second public key reference, the second public key reference including a uniform resource indicator that corresponds to a location of a public key;

causing, by the client, the secondary resource records associated with the second host name to be queried for a third public key reference stored in the secondary resource records;

obtaining, by the client and in response to the causing the secondary resource records to be queried for the third public key reference, the third public key reference, the third public key reference including a digest for verification of the public key, wherein the digest is generated by the recipient from the public key before being provided to the DNS for storage in the third public key reference;

retrieving, by the client and based on the uniform resource indicator, the public key from the location, wherein the location is a key server;

generating, by the client and based on a hashing algorithm, a public key hash sum from the retrieved public key;

comparing, by the client, the digest to the retrieved public key hash sum;

determining, by the client and based on the comparison, the public key is non-matching;

presenting, by the client, a verification error based on the determined non-matching public key, the verification error informing a user that any communication with the communication address is unsecure, the verification error dismissible by the user; and

providing, by the client and based on a dismissal of the verification error, an unencrypted email to the communication address.