Systems and methods using DNS tunneling for fast symmetric session encryption key establishment using a computing device
View Patent ↗A method, system, and machine-readable recording medium for accelerated exchange and secure provisioning of symmetric session encryption-keys between systems by tunneling over the public Internet domain name service (DNS) to establish an encrypted communication session, a method referred to as DNS Fast Open (DFO), which improves on the speed of the prior-art by routing data more efficiently across the internet with fewer round trips, thereby reducing time, bandwidth and network computing resources, as well as improving security by utilizing shared-secret key-derivation keys to generate symmetric encryption-keys which may provide quantum-safe confidentiality protection to information in electronic communications, particularly for use in an e-commerce environment.
1. A method performed by a client computing device for negotiating session encryption-keys with another computing device, which is part of a system registered with an Internet domain name service as an authoritative name-server for an Internet domain name, and which is connected to the client computing device by a network, the method utilizing Internet domain name service tunneling to employ pre-shared shared-secret key-derivation keys to generate and securely exchange symmetric session encryption-keys, the method comprising:
obtaining from a machine-readable data storage mechanism associated with the client computing device a device-unique identity token cryptographically bound to said computing device;
generating a domain name by appending a “dot” character to said device-unique identity token and then concatenating the appended device-unique identity token with the Internet domain name registered to said authoritative name-server;
transmitting said domain name in a request for said authoritative name-server's internet protocol address to an arbitrary public domain name service device over the network communicatively coupled to the client computing device thereby causing the public domain name service device to, upon not finding a match between the generated domain name and an Internet address database, forward a domain name service request for said generated domain name to the authoritative name-server;
receiving a domain name service response including an Internet Protocol address provided by the authoritative name-server, an encrypted handshake message and a random nonce;
obtaining from the machine-readable data storage mechanism associated with the client computing device a shared-secret key-derivation key;
generate a matching symmetric session encryption-key by combining the random nonce and the shared-secret key-derivation key and performing cryptographic operations on the appended device-unique identity token;
decrypting the encrypted handshake message with said session encryption-key; and
verifying the handshake message was successfully decrypted.
2. The method of claim 1 , wherein the Internet Protocol address provided by the authoritative name-server in the domain name service response is an Internet Protocol address of a remote system different than the authoritative name-server, wherein the different remote system is provided the generated session encryption-key facilitating establishment by the client computing device of an encrypted session with the different remote system.
3. The method of claim 1 , wherein additional transaction data is transmitted from the client computing device to the authoritative-name server or received by the client computing device from the authoritative name server, by virtue of said additional transaction data being incorporated in text resource record or other fields included in one or more domain name service requests and/or domain name service response messages.
4. The method of claim 3 , wherein the additional transaction data includes at least one of challenge-response strings and cipher suites.
5. The method of claim 1 , wherein the client computing device is one of a plurality of computing devices that exchange matching symmetric session encryption-keys using the authoritative name-server operating as a key-exchange broker in order to provision and exchange symmetric session encryption-keys to perform data encryption and decryption for confidentiality protection of communications between the plurality of computing devices.
6. A non-transitory computer readable medium on which is stored instructions which, when executed by the client computing device, executes the method of claim 1 .
7. A method performed by a computing device, which is part of a system registered with an internet domain name service as an authoritative name-server for an Internet domain name, for negotiating session encryption-keys with a client computing device, which is connected to the computing device by a network,
the method utilizing Internet domain name service tunneling to employ pre-shared shared-secret key-derivation keys to generate and securely exchange symmetric session encryption-keys, the method comprising:
receiving, from a public domain name service device, a domain name service request, for a requested domain name, comprised of a character string with a “dot” character appended to the end of the character string and concatenated to the Internet domain name registered to said authoritative name-server,
wherein the requested domain name does not have a match in an Internet address database searched by the public domain name service device;
parsing the character string to acquire a device-unique identity token for the client computer device;
using the device-unique identity token to retrieve a shared-secret key-derivation key associated with the client computing device;
generating a random nonce;
generating a session encryption-key by combining said random nonce with said shared-secret key-derivation key and performing cryptographic operations on the appended character string;
generating a handshake message;
encrypting said handshake message with said session encryption-key;
transmitting an Internet Protocol address, the encrypted handshake message and the random nonce to the client computing device over the network.
8. The method of claim 7 , wherein the Internet Protocol address is provided by the authoritative name-server in a domain name service response and is an Internet Protocol address of a remote system different than the authoritative name-server, wherein the different remote system is providing the generated session encryption-key facilitating establishment by the client computing device of an encrypted session with the different remote system.
9. The method of claim 7 , wherein additional transaction data is transmitted from the computing device to the client computing device or received by the computing device from the client computing device, by virtue of said additional transaction data being incorporated in text resource record or other fields included in one or more domain name service requests and/or domain name service response messages.
10. The method of claim 9 , wherein the additional transaction data includes at least one of challenge-response strings and cipher suites.
11. A non-transitory computer readable medium on which is stored instructions which, when executed by the computing device, executes the method of claim 7 .