Identifying trusted configuration information to perform service discovery

Patent metadata

Field	Value
Publication number	US-11190397-B2
Application number	US-201615148990-A
Country	US
Kind code	B2
Filing date	May 6, 2016
Priority date	May 11, 2015
Publication date	Nov 30, 2021
Grant date	Nov 30, 2021

Abstract

In one embodiment, a delegation engine automatically provisions a device connected to a network to securely identify and interact with external services. As a device boots in a deployment environment, the delegation engine generates a search domain name based on a manufacturer-supplied domain name and a domain name associated with the deployment environment. The delegation engine then searches a Domain Name System (DNS) to retrieve a delegation record stored at the search domain name. After verifying a manufacturer signature associated with the delegation record, the delegation engine configures the device based on service discovery information included in the delegation record. Because the delegation engine automates the provisioning process, the time required to provision devices is acceptable irrespective of the number of the devices. Further, because the delegation engine verifies the delegation record, the delegation engine does not expose the device to security risks during the provisioning process.

First claim

What is claimed is:

1. A computer-implemented method for provisioning a device with configuration information, the method comprising:
generating a search domain name by compositing (i) a manufacturer domain name to (ii) a first search path domain name, wherein:
the manufacturer domain name is associated with both a first domain and a manufacturer of the device, and is stored with the device, and
the first search path domain name is associated with a second domain, and is one of a plurality of domain names included in a domain search path in a deployment environment;

searching a Domain Name System (DNS) for a delegation record installed under the search domain name;
obtaining, based on information stored in the device, the delegation record, wherein the delegation record includes a public key;
authenticating, based on the public key, a manufacturer signature associated with the delegation record, wherein the manufacturer signature is generated using a private key paired with the public key; and
configuring the device based on service discovery information included in the delegation record to facilitate service discovery operations in the deployment environment.

2. The computer-implemented method of claim 1 , wherein the service discovery information comprises a trusted domain name.

3. The computer-implemented method of claim 1 , wherein obtaining the record that includes the public key comprises searching the DNS for a Transport-Layer Security Authentication (TLSA) record that includes the public key.

4. The computer-implemented method of claim 1 , wherein searching the DNS for the delegation record comprises:
generating a DNS record query that includes the search domain name; and
transmitting the DNS record query to a DNS server.

5. The computer-implemented method of claim 4 , wherein:
the delegation record is associated with a DNS Security Extensions (DNSSEC) signature that is generated based on DNSSEC, and
the DNS server is configured to verify the DNSSEC signature.

6. The computer-implemented method of claim 1 , further comprising:
transmitting a Dynamic Host Configuration Protocol (DHCP) request to a DHCP server included in the deployment environment; and
receiving, from the DHCP server, a response that includes the domain search path, wherein the domain search path includes two or more domain names.

7. The computer-implemented method of claim 1 , wherein compositing the manufacturer domain name to the first search path domain name comprises prefixing the first search path domain name with the manufacturer domain name.

8. One or more non-transitory computer-readable storage media including instructions that, when executed by one or more processors, cause the one or more processors to provision a device with configuration information by performing the steps of:
searching a Domain Name System (DNS) for a delegation record installed under a search domain name, wherein the search domain name is a composite of (i) a manufacturer domain name and (ii) a first search path domain name, wherein:
the manufacturer domain name is associated with both a first domains and a manufacturer of the device, and is stored with the device, and
the first search path domain name is associated with a second domain, and is one of a plurality of domain names included in a domain search path in a networked environment;

obtaining, based on information stored in the device, device, the delegation record, wherein the delegation record includes a public key;
authenticating, based on the public key, a manufacturer signature associated with the delegation record, wherein the manufacturer signature is generated using a private key paired with the public key; and
configuring the device based on service discovery information included in the delegation record to facilitate service discovery operations in the networked environment.

9. The one or more non-transitory computer-readable storage media of claim 8 , wherein the service discovery information comprises a trusted domain name.

10. The one or more non-transitory computer-readable storage media of claim 8 , wherein obtaining the record that includes the public key comprises searching the DNS for a Transport-Layer Security Authentication (TLSA) record that includes the public key.

11. The one or more non-transitory computer-readable storage media of claim 8 , wherein searching the DNS for the delegation record comprises:
generating a DNS record query that includes the search domain name; and
transmitting the DNS record query to a DNS server included in the networked environment.

12. The one or more non-transitory computer-readable storage media of claim 8 , further comprising:
transmitting a Dynamic Host Configuration Protocol (DHCP) request to a DHCP server included in the networked environment; and
receiving, from the DHCP server, a response that includes the domain search path, wherein the domain search path includes two or more domain names.

13. The one or more non-transitory computer-readable storage media of claim 7 , wherein the delegation record comprises a text record (TXT).

14. A system comprising:
a memory storing a delegation engine and
a processor that is coupled to the memory and, when executing the delegation engine, is configured to cause the delegation engine to:
generate a search domain name by compositing (i) a manufacturer domain name and (ii) a first search path domain name, wherein:
the manufacturer domain name is associated with both a first domain and a manufacturer of the system, and is stored with the system, and
the first search path domain name is associated with a second domain and is one of a plurality of domain names included in a domain search path in a deployment environment;

search a Domain Name System (DNS) for a delegation record installed under the search domain name;
obtain, based on information stored in the system, the delegation record, wherein the delegation record includes a public key;
authenticating, based on the public key, a manufacturer signature associated with the delegation record, wherein the manufacturer signature is generated using a private key paired with the public key; and
configure a device based on service discovery information included in the delegation record to facilitate service discovery operations in the deployment environment.

15. The system of claim 14 , wherein the service discovery information comprises a trusted domain name.

16. The system of claim 14 , wherein the delegation record comprises a text record (TXT).

17. The system of claim 14 , wherein the device comprises a computing device, a smart phone, a wearable technology device, an appliance, or a sensor.

Assignees

• Verisign Inc

Inventors

• Cathrow Andrew
• Fregly Andrew
• James Stephen D

Classifications

• H04L61/4511 Primary

  using domain name system [DNS] · CPC title

• H04L67/51

  Discovery or management thereof, e.g. service location protocol [SLP] or web services · CPC title

• H04L61/4541

  Directories for service discovery · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title