GTLD domain name registries RDAP architecture

1. A method for providing an Registration Data Access Protocol (“RDAP”) response, the method comprising:

obtaining, at a RDAP client over a network, a RDAP query for RDAP data from a user;

providing, by the RDAP client, the RDAP query and a cryptographic credential to a RDAP server, wherein the RDAP server communicates with a plurality of thick RDAP servers to provide respective thick RDAP answers to the RDAP query, wherein at least one thick RDAP answer is encrypted by at least one of the plurality of thick RDAP servers using a first symmetric key or asymmetric key provided by a key management service and associated with the cryptographic credential of the RDAP client;

obtaining, at the RDAP client, a consolidated thick and encrypted RDAP answer to the RDAP query from the RDAP server;

decrypting, by the RDAP client, the consolidated thick and encrypted RDAP answer using a second symmetric key or asymmetric key associated with the cryptographic credential to produce a decrypted thick RDAP answer, wherein the second symmetric key or asymmetric key corresponds to the first symmetric key or asymmetric key; and

providing, by the RDAP client, the decrypted thick RDAP answer to the user.

2. The method of claim 1 , further comprising authorizing the user with an authorization service.

3. The method of claim 2 , wherein the consolidated thick and encrypted RDAP answer is provided based on the user being authorized.

4. The method of claim 2 , wherein the consolidated thick and encrypted RDAP answer is provided based on an access token issued by the authorization service and digitally signed by a private cryptographic key of the authorization service.

5. The method of claim 2 , wherein the authorization service issues an authentication token for the user that comprises a claim that identifies a subject that has been authenticated.

6. The method of claim 1 , further comprising obtaining an access token issued by an authorization service and digitally signed by a private cryptographic key of the authorization service.

7. The method of claim 1 , wherein the first symmetric key or asymmetric key and the second symmetric key or asymmetric key have different validity periods.

8. The method of claim 1 , wherein the key management service uses a claim in an access token to determine entities for which the key management service provides encryption keys.

9. The method of claim 1 , further comprising:

providing, by the RDAP client, a domain name of a first thick RDAP server from the plurality of thick RDAP servers to an identity provider; and

obtaining, at the RDAP client, a cryptographic token from the identity provider based on the domain name, wherein the cryptographic token comprises an audience claim contained in the domain name of the first thick RDAP server.

10. A system for providing a Registration Data Access Protocol (“RDAP”) response, the system comprising:

one or more processors; and

a memory system comprising one or more computer-readable media, wherein the one or more computer-readable media contain instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

obtaining, at a RDAP client over a network, a RDAP query for RDAP data from a user;

providing, by the RDAP client, the RDAP query and a cryptographic credential to a RDAP server, wherein the RDAP server communicates with a plurality of thick RDAP servers to provide respective thick RDAP answers to the RDAP query, wherein at least one thick RDAP answer is encrypted using a first symmetric key or an asymmetric key provided by a key management service and associated with the cryptographic credential of the RDAP client;

obtaining a consolidated thick and encrypted RDAP answer to the RDAP query from the RDAP server;

decrypting the consolidated thick and encrypted RDAP answer using a second symmetric key or the asymmetric key associated with the cryptographic credential to produce a decrypted thick RDAP answer, wherein the second symmetric key or asymmetric key corresponds to the first symmetric key or asymmetric key; and

providing the decrypted thick RDAP answer to the user.

11. The system of claim 10 , wherein the one or more processors are further operable to perform operations comprising authorizing the user with an authorization service.

12. The system of claim 11 , wherein the thick RDAP answer is provided based on the user being authorized.

13. The system of claim 11 , wherein the thick RDAP answer is provided based on an access token issued by the authorization service and digitally signed by a private cryptographic key of the authorization service.

14. The system of claim 11 , wherein the authorization service issues an authentication token for the user that comprises a claim that identifies a subject that has been authenticated.

15. The system of claim 10 , wherein the one or more processors are further operable to perform operations comprising obtaining an access token issued by an authorization service and digitally signed by a private cryptographic key of the authorization service.

16. The system of claim 10 , wherein the first symmetric key or asymmetric key and the second symmetric key or asymmetric key have different validity periods.

17. The system of claim 10 wherein the key management service uses a claim in an access token to determine entities for which the key management service provides encryption keys.

18. The system of claim 10 , wherein the one or more processors are further operable to perform operations comprising:

providing, by the RDAP client, a domain name of a first thick RDAP server from the plurality of thick RDAP servers to an identity provider; and

obtaining, at the RDAP client, a cryptographic token from the identity provider based on the domain name, wherein the cryptographic token comprises an audience claim contained in the domain name of the first thick RDAP server.