DNS-based public key infrastructure for digital object architectures

1. A computer-implemented method for establishing trust for a handle used to identify a digital object in a digital object architecture (DOA), the method comprising:

associating a first attester identifier with a first attester from a trusted public key infrastructure (PKI);

identifying a first digital object public key for a first digital object;

generating, by the first attester, a first digital object identity attestation that associates the first digital object public key with a handle identifier for the first digital object, wherein the handle identifier is external to the trusted PKI; and

generating a first attester identity attestation attesting that the first attester is authentic, wherein the first attester identity attestation includes the first attester identifier.

2. The computer-implemented method of claim 1 , wherein the first digital object identity attestation binds the handle identifier for the first digital object to an identifier from the trusted PKI.

3. The computer-implemented method of claim 1 , wherein the first digital object identity attestation contains an identifier for the first digital object and the first digital object public key.

4. The computer-implemented method of claim 1 , further comprising authenticating the first digital object, comprising:

identifying the first attester based on the first digital object identity attestation; and

verifying that the first attester is authentic based at least on the first attester identity attestation.

5. The computer-implemented method of claim 4 , wherein authenticating the first digital object further comprises:

determining a first domain name associated with the first attester; and

retrieving the first attester identity attestation from a trust store based on the first domain name.

6. The computer-implemented method of claim 4 , wherein authenticating the first digital object further comprises:

retrieving a first attester public key from the first attester identity attestation, wherein the first attester identity attestation includes the first attester public key; and

verifying a first attester signature included in the first digital object identity attestation based on the first attester public key.

7. The computer-implemented method of claim 1 , wherein the first digital object identity attestation includes:

an identifier for an external attestation, and

a public key of the external attestation,

wherein the external attestation is external to the trusted PKI.

8. A computer-implemented method for establishing trust for a handle used to identify a digital object in a digital object architecture (DOA), the method comprising:

associating a first domain with a first handle identifier for a first digital object;

generating, by a first attester, a first attester signature included in a first digital object identity attestation that binds the first domain to the first handle identifier, wherein the first attester is from a trusted public key infrastructure (PKI) and the first handle identifier is external to the trusted PKI; and

including in a first handle identified by the first handle identifier:

the first digital object identity attestation, and

the first domain.

9. The computer-implemented method of claim 8 , wherein the first handle comprises the first digital object identity attestation.

10. The computer-implemented method of claim 8 , further comprising storing the first digital object identity attestation in a Domain Name System (DNS), wherein the first digital object identity attestation comprises a transport layer security authentication (TLSA) record.

11. The computer-implemented method of claim 8 , further comprising storing the first digital object identity attestation in a trust store, wherein the first digital object identity attestation comprises a X.509 certificate.

12. The computer-implemented method of claim 8 , further comprising:

identifying a first digital object public key for the first digital object; and

generating, by a second attester, a second attester signature included in a first external attestation that includes the first digital object public key, wherein the second attester is from the trusted PKI.

13. The computer-implemented method of claim 12 , further comprising authenticating the first digital object comprising:

authenticating the first attester identified in the first digital object identity attestation;

upon authenticating the first attester, retrieving a first attester public key from a first attester identity attestation; and

verifying the first attester signature included in the first digital object identity attestation based on the first attester public key.

14. The computer-implemented method of claim 13 , wherein authenticating the first digital object further comprises verifying the first digital object based on the first digital object public key included in the first external attestation.

15. The computer-implemented method of claim 13 , wherein authenticating the first attester identified in the first digital object identity attestation comprises:

iteratively, starting from the first attester until reaching a trust root in a linked sequence of attester identity attestations:

retrieving a sequential attester identity attestation attesting that a previous attester is authentic,

retrieving a sequential attester signature from the sequential identity attestation, and

identifying a next attester from the sequential attester signature.

16. A non-transitory computer-readable medium including instructions that, when executed by a processor, cause the processor to perform the steps of:

associating a first attester identifier with a first attester from a trusted public key infrastructure (PKI);

identifying a first digital object public key for a first digital object;

generating, by the first attester, a first digital object identity attestation that associates the first digital object public key with a first handle identifier for the first digital object, wherein the handle identifier is external to the trusted PKI; and

generating a first attester identity attestation attesting that the first attester is authentic, wherein the first attester identity attestation includes the first attester identifier.

17. The non-transitory computer-readable medium of claim 16 , wherein a DOA handle registry that includes the first handle identifier.

18. The non-transitory computer-readable medium of claim 16 , wherein generating the first attester identity attestation comprises generating, by a second attester, an attester signature based on a private key of the second attester.

19. The non-transitory computer-readable medium of claim 16 , wherein the first attester identity attestation attests to a first attester public key.

20. The non-transitory computer-readable medium of claim 16 , wherein the first digital object identity attestation attests to an identity of an external attester and a public key of the external attester, wherein the external attester is external to the trusted PKI.

21. The computer-implemented method of claim 1 , wherein the trusted PKI is separate from the DOA.

22. The computer-implemented method of claim 21 , wherein the trusted PKI is coupled to a PKI registration system of the DOA.