Transparent DNSSEC-signing proxy

Patent metadata

Field	Value
Publication number	US-10033699-B2
Application number	US-201615148867-A
Country	US
Kind code	B2
Filing date	May 6, 2016
Priority date	May 8, 2015
Publication date	Jul 24, 2018
Grant date	Jul 24, 2018

Abstract

A first DNS server receives, from a client device, a DNS query for a domain name and transmits, to a second DNS server, the DNS query for the domain name. The first DNS server receives, from the second DNS server, an answer to the DNS query that is unsigned. The first DNS server signs the received answer to the DNS query and transmits, to the client device, the signed DNS answer.

First claim

What is claimed is:

1. A method in a proxy Domain Name System (DNS) server, comprising:
receiving, from a client device, a DNS query for a domain name as a result of a name server of a second DNS server being changed to point to the proxy DNS server;
transmitting, to the second DNS server, the DNS query for the domain name;
receiving, from the second DNS server, an answer to the DNS query that is unsigned;
signing the received answer to the DNS query, wherein the received answer to the DNS query includes a resource record, and wherein signing the received answer to the DNS query includes generating a resource record digital signature (RRSIG) record that includes a signature of the resource record wherein signing the received answer to the DNS query includes using a private zone signing key (ZSK) managed by the proxy DNS server, and wherein the proxy DNS server creates a DNSKEY record that includes a public ZSK, the DNSKEY record further includes a public key signing key (KSK), and further comprising signing the public ZSK and the public KSK of the DNSKEY record with a private key signing key (KSK), and the proxy DNS server creates a delegate signer (DS) record from the public KSK;
caching, at the proxy DNS server, the signed DNS answer, wherein caching the signed answer includes caching the resource record and caching the RRSIG;
transmitting, to the client device, the signed DNS answer;
receiving, from a second client device, a second DNS query for the domain name;
determining that the signed DNS answer is cached; and
responsive to determining that the signed DNS answer is cached, transmitting, to the second client device, the signed DNS answer as an answer to the second DNS query.

2. An apparatus, comprising:
a proxy Domain Name System (DNS) server including a set of one or more processors and a set of one or more non-transitory machine-readable storage mediums storing instructions, that when executed by the set of processors, cause the set of processors to perform the following operations:
receive, from a client device, a DNS query for a domain name as a result of a name server of a second DNS server being changed to point to the proxy DNS server;
transmit, to a second DNS server, the DNS query for the domain name;
receive, from the second DNS server, an answer to the DNS query that is unsigned;
sign the received answer to the DNS query, wherein the received answer to the DNS query includes a resource record, and wherein to sign the received answer to the DNS query includes to generate a resource record digital signature (RRSIG) record that includes a signature of the resource record, wherein signing the received answer to the DNS query includes using a private zone signing key (ZSK) managed by the proxy DNS server, and wherein the proxy DNS server creates a DNSKEY record that includes a public ZSK, the DNSKEY record further includes a public key signing key (KSK), and further comprising signing the public ZSK and the public KSK of the DNSKEY record with a private key signing key (KSK), and the proxy DNS server creates a delegate signer (DS) record from the public KSK;
cache, at the proxy DNS server, the signed DNS answer, wherein to cache the signed answer includes to cache the resource record and to cache the RRSIG;
transmit, to the client device, the signed DNS answer;
receive, from a second client device, a second DNS query for the domain name;
determine that the signed DNS answer is cached; and
responsive to determining that the signed DNS answer to the DNS query is cached, transmit, to the second client device, the signed DNS answer as an answer to the second DNS query.

3. A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor of a proxy Domain Name System (DNS) server, causes said processor to perform operations comprising:
receiving, from a client device, a DNS query for a domain name as a result of a name server of a second DNS server being changed to point to the proxy DNS server;
transmitting, to a second DNS server, the DNS query for the domain name;
receiving, from the second DNS server, an answer to the DNS query that is unsigned;
signing the received answer to the DNS query, wherein the received answer to the DNS query includes a resource record, and wherein signing the received answer to the DNS query includes generating a resource record digital signature (RRSIG) record that includes a signature of the resource record wherein signing the received answer to the DNS query includes using a private zone signing key (ZSK) managed by the proxy DNS server, and wherein the proxy DNS server creates a DNSKEY record that includes a public ZSK, the DNSKEY record further includes a public key signing key (KSK), and further comprising signing the public ZSK and the public KSK of the DNSKEY record with a private key signing key (KSK), and the proxy DNS server creates a delegate signer (DS) record from the public KSK;
caching, at the proxy DNS server, the signed DNS answer, wherein caching the signed answer includes caching the resource record and caching the RRSIG;
transmitting, to the client device, the signed DNS answer;
receiving, from a second client device, a second DNS query for the domain name;
determining that the signed DNS answer is cached; and
responsive to determining that the signed DNS answer is cached, transmitting, to the second client device, the signed DNS answer as an answer to the second DNS query.

Assignees

• Cloudflare Inc

Inventors

• Sullivan Nicholas Thomas
• Gudmundsson Olafur
• Valsorda Filippo

Classifications

• H04L63/12

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title

• H04L63/0281 Primary

  Proxies · CPC title

• H04L67/2819

  Electricity · mapped topic

• H04L61/1511

  Electricity · mapped topic

• H04L67/564

  Enhancement of application control based on intercepted application data · CPC title