Identifying trusted configuration information to perform service discovery

Patent metadata

Field	Value
Publication number	US-2016337181-A1
Application number	US-201615148990-A
Country	US
Kind code	A1
Filing date	May 6, 2016
Priority date	May 11, 2015
Publication date	Nov 17, 2016
Grant date	—

Abstract

In one embodiment, a delegation engine automatically provisions a device connected to a network to securely identify and interact with external services. As a device boots in a deployment environment, the delegation engine generates a search domain name based on a manufacturer-supplied domain name and a domain name associated with the deployment environment. The delegation engine then searches a Domain Name System (DNS) to retrieve a delegation record stored at the search domain name. After verifying a manufacturer signature associated with the delegation record, the delegation engine configures the device based on service discovery information included in the delegation record. Because the delegation engine automates the provisioning process, the time required to provision devices is acceptable irrespective of the number of the devices. Further, because the delegation engine verifies the delegation record, the delegation engine does not expose the device to security risks during the provisioning process.

First claim

What is claimed is:

1 . A computer-implemented method for provisioning a device with configuration information, the method comprising:
generating a search domain name based on a first domain name associated with a manufacturer and stored in the device and a second domain name associated with a deployment environment; searching a Domain Name System (DNS) for a delegation record installed under the search domain name; verifying a manufacturer signature associated with the delegation record; and configuring the device based on service discovery information included in the delegation record to facilitate service discovery operations in the deployment environment.

2 . The computer-implemented method of claim 1 , wherein the service discovery information comprises a trusted domain name.

3 . The computer-implemented method of claim 1 , wherein the manufacturer signature is generated using a private key, and verifying the manufacturer signature comprises:
determining a public key based on public key information stored in the device; and
authenticating the manufacturer signature based on the public key.

4 . The computer-implemented method of claim 3 , wherein determining the public key comprises searching, based on the public key information, the DNS for a Transport-Layer Security Authentication (TLSA) record that includes the public key.

5 . The computer-implemented method of claim 1 , wherein generating the search domain name comprises compositing the first domain name and the second domain name.

6 . The computer-implemented method of claim 1 , wherein searching the DNS for the delegation record comprises generating a DNS record query that includes the search domain name, and transmitting the DNS record query to a DNS server.

7 . The computer-implemented method of claim 6 , wherein the delegation record is associated with a DNS Security Extensions (DNSSEC) signature that is generated based on DNSSEC, and the DNS server is configured to verify the DNSSEC signature.

8 . The computer-implemented method of claim 1 , further comprising:
transmitting a Dynamic Host Configuration Protocol (DHCP) request to a DHCP server included in the deployment environment; receiving a response that includes a domain search path from the DHCP server; and setting the second domain name to a domain name included in the domain search path.

9 . A computer-readable storage medium including instructions that, when executed by a processor, cause the processor to provision a device with configuration information by performing the steps of:
searching a Domain Name System (DNS) for a delegation record installed under a search domain name; performing one or more verification operations to authenticate the delegation record; and configuring the device based on service discovery information included in the delegation record to facilitate service discovery operations in a networked environment.

10 . The computer-readable storage medium of claim 9 , wherein the service discovery information comprises a trusted domain name.

11 . The computer-readable storage medium of claim 9 , wherein a manufacturer signature is associated with the delegation record, the manufacturer signature is generated using a private key, and performing the one or more verification operations comprises:
determining a public key based on public key information stored in the device; and authenticating the manufacturer signature based on the public key.

12 . The computer-readable storage medium of claim 11 , wherein determining the public key comprises searching, based on the public key information, the DNS for a Transport-Layer Security Authentication (TLSA) record that is associated with the public key.

13 . The computer-readable storage medium of claim 9 , wherein searching the DNS for the delegation record comprises generating a DNS record query that includes the search domain name, and transmitting the DNS record query to a DNS server included in the networked environment.

14 . The computer-readable storage medium of claim 9 , further comprising generating the search domain name based on a first domain name associated with a manufacturer and stored in the device and a second domain name associated with the networked environment.

15 . The computer-readable storage medium of claim 14 , further comprising:
transmitting a Dynamic Host Configuration Protocol (DHCP) request to a DHCP server included in the networked environment; receiving a response that includes a domain search path from the DHCP server; and setting the second domain name to a domain name included in the domain search path.

16 . The computer-readable storage medium of claim 9 , wherein the delegation record comprises a text record (TXT).

17 . A system comprising:
a memory storing a delegation engine and manufacturer data; and a processor that is coupled to the memory and, when executing the delegation engine, is configured to: generate a search domain name based on a first domain name included in the manufacturer data and a second domain name associated with a deployment environment; search a Domain Name System (DNS) for a delegation record installed under the search domain name; verify a manufacturer signature associated with the delegation record; and configure a device based on service discovery information included in the delegation record to facilitate service discovery operations in the deployment environment.

18 . The system of claim 17 , wherein the service discovery information comprises a trusted domain name.

19 . The system of claim 17 , wherein the delegation record comprises a text record (TXT).

20 . The system of claim 17 , wherein the device comprises a computing device, a smart phone, a wearable technology device, an appliance, or a sensor.

Assignees

• Verisign Inc

Inventors

• Cathrow Andrew
• Fregly Andrew
• James Stephen D

Classifications

• H04L63/166

  at the transport layer · CPC title

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04L63/123

  received data contents, e.g. message integrity · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L41/0806 Primary

  for initial configuration or provisioning, e.g. plug-and-play · CPC title