Identifying trusted configuration information to perform service discovery
In one embodiment, a delegation engine automatically provisions a device connected to a network to securely identify and interact with external services. As a device boots in a deployment environment, the delegation engine generates a search domain name based on a manufacturer-supplied domain name and a domain name associated with the deployment environment. The delegation engine then searches a Domain Name System (DNS) to retrieve a delegation record stored at the search domain name. After verifying a manufacturer signature associated with the delegation record, the delegation engine configures the device based on service discovery information included in the delegation record. Because the delegation engine automates the provisioning process, the time required to provision devices is acceptable irrespective of the number of the devices. Further, because the delegation engine verifies the delegation record, the delegation engine does not expose the device to security risks during the provisioning process.
1. A computer-implemented method, the method comprising:
searching, by a device, a domain name system (DNS) for a record associated with a domain name, wherein the record comprises a transport layer security authentication (TLSA) record;
obtaining, by the device, the record from the DNS, wherein the record is associated with a signature generated using a private key, and wherein the record enables retrieval of a public key that corresponds to the private key;
authenticating, by the device, the signature associated with the record, wherein the authenticating is based on the public key; and
configuring the device based on information included in the record,
wherein the information included in the record comprises a trusted domain name that facilitates discovery of one or more services identified by an Internet of Things (IoT) device.
2. The computer-implemented method of claim 1 , wherein searching the DNS for the record comprises:
generating a DNS record query that includes the domain name; and
transmitting the DNS record query to a DNS server.
3. The computer-implemented method of claim 2 , wherein:
the delegation record is associated with a DNS Security Extensions (DNSSEC) signature that is generated based on DNSSEC; and
the DNS server is configured to verify the DNSSEC signature.
4. The computer-implemented method of claim 1 , further comprising:
transmitting a Dynamic Host Configuration Protocol (DHCP) request to a DHCP server; and
receiving, from the DHCP server, a response that includes the domain name.
5. The computer-implemented method of claim 1 , wherein a portion of the domain name is associated with a manufacturer of the device.
6. One or more non-transitory computer-readable storage media including instructions that, when executed by one or more processors, cause the one or more processors to perform steps comprising:
searching, by a device, a Domain Name System (DNS) for a record associated with a domain name, wherein the record comprises a transport layer security authentication (TLSA) record;
obtaining, by the device, the record from the DNS, wherein the record is associated with a signature generated using a private key, and wherein the record enables retrieval of a public key that corresponds to the private key;
authenticating, by the device, the signature associated with the record, wherein the authenticating is based on the public key; and
configuring the device based on information included in the record,
wherein the information included in the record comprises a trusted domain name that facilitates discovery of one or more services identified by an Internet of Things (IoT) device.
7. The one or more non-transitory computer-readable storage media of claim 6 , wherein searching the DNS for the record comprises:
generating a DNS record query that includes the domain name; and
transmitting the DNS record query to a DNS server.
8. The one or more non-transitory computer-readable storage media of claim 6 , further comprising:
transmitting a Dynamic Host Configuration Protocol (DHCP) request to a DHCP server; and
receiving, from the DHCP server, a response that includes the domain name.
9. The one or more non-transitory computer-readable storage media of claim 6 , wherein the record comprises a text record (TXT).
10. A system comprising:
a memory storing an engine associated with a device; and
a processor that is coupled to the memory and, when executing the engine, is configured to cause the engine to:
search a Domain Name System (DNS) for a record associated with a domain name, wherein the record comprises a transport layer security authentication (TLSA) record;
obtain the record from the DNS, wherein the record is associated with a signature generated using a private key, and wherein the record enables retrieval of a public key that corresponds to the private key;
authenticate the signature associated with the record, wherein the authenticating is based on the public key; and
configure the device based on information included in the record,
wherein the information included in the record comprises a trusted domain name that facilitates discovery of one or more services identified by an Internet of Things (IoT) device.
11. The system of claim 10 , wherein the record comprises a text record (TXT).
12. The system of claim 10 , wherein the device comprises a computing device, a smart phone, a wearable technology device, an appliance, or a sensor.