Symmetric-key infrastructure
Techniques for provisioning a key server to facilitate secure communications between a web server and a client by providing the client with a first data structure including information on how the web server may obtain a target symmetric key are presented. The techniques can include: provisioning the key server with a second data structure including information on how the key server may generate the first data structure; receiving a request on behalf of a web server for a third data structure comprising information on how the client may obtain the first data structure from the key server; and obtaining the third data structure, such that the third data structure is published in association with an identification of the web server, and such that the client uses the third data structure to obtain the first data structure and uses the first data structure to communicate with the web server.
1 . A method to establish communication between a client and a server, the method comprising:
receiving, by a first key server of a plurality of key servers, a first request from the client to establish a connection for use by the client and the server;
sending, by the first key server, a second request to a name server to request a key server record for identifying a second key server of the plurality of key servers, the second key server being associated with the server;
determining, by the first key server, information to obtain a symmetric key for use by the client to establish the connection; and
sending, by the first key server, the information to the client.
2 . The method of claim 1 , wherein the name server comprises a domain name system (DNS) server including a DNS resource record specifying the second key server associated with the server.
3 . The method of claim 1 , further comprising establishing a connection between the client and the first key server using a public-key cryptography.
4 . The method of claim 1 , wherein the first key server comprises a recursive key server and the second key server comprises an authoritative key server.
5 . The method of claim 1 , wherein the information sent to the client to obtain a symmetric key is sufficient for the server to obtain the symmetric key.
6 . The method of claim 1 , further comprising:
sending, by the first key server, a third request to the second key server; and
receiving, by the first key sever, a response to the third request, the response comprising a referral to a third key server.
7 . The method of claim 1 , further comprising:
sending, by the first key server, information to access the second key server to a third key server that lacks information to access the second key server.
8 . The method of claim 1 , wherein the information to obtain the symmetric key comprises one or more of: a key generation method, a key origin, a key server name, a web server name, a client identifier, a counter, a nonce, a validity period, a key identifier, a key type, an algorithm identifier, a key usage restriction, or a policy.
9 . The method of claim 1 , wherein the information to obtain the symmetric key comprises one or more parameters wrapped along with the symmetric key, the one or more parameters being associated with provenance for the symmetric key.
10 . The method of claim 1 , wherein the server comprises a web server, wherein the first key server comprises a recursive key server, and the second key server comprises an authoritative key server.
11 . A system for establishing communication between a client and a server, the system comprising a server computer communicatively coupled to the internet and configured to perform operations comprising:
receiving, by a first key server of a plurality of key servers, a first request from the client to establish a connection for use by the client and the server;
sending, by the first key server, a second request to a name server to request a key server record for identifying a second key server of the plurality of key servers, the second key server being associated with the server;
determining, by the first key server, information to obtain a symmetric key for use by the client to establish the connection; and
sending, by the first key server, the information to the client.
12 . The system of claim 11 , wherein the name server comprises a domain name system (DNS) server including a DNS resource record specifying the second key server associated with the server.
13 . The system of claim 11 , wherein the operations further comprise establishing a connection between the client and the first key server using a public-key cryptography.
14 . The system of claim 11 , wherein the first key server comprises a recursive key server and the second key server comprises an authoritative key server.
15 . The system of claim 11 , wherein the information sent to the client to obtain a symmetric key is sufficient for the server to obtain the symmetric key.
16 . The system of claim 11 , wherein the operations further comprise:
sending, by the first key server, a third request to the second key server; and
receiving, by the first key sever, a response to the third request, the response comprising a referral to a third key sever.
17 . The system of claim 11 , wherein the operations further comprise:
sending, by the first key server, information to access the second key server to a third key server that lacks information to access the second key server.
18 . The system of claim 11 , wherein the information to obtain the symmetric key comprises one or more of a key generation method, a key origin, a key server name, a web server name, a client identifier, a counter, a nonce, a validity period, a key identifier, a key type, an algorithm identifier, a key usage restriction, or a policy.
19 . The system of claim 11 , wherein the information to obtain the symmetric key comprises one or more parameters wrapped along with the symmetric key, the one or more parameters being associated with provenance for the symmetric key.
20 . A non-transitory computer-readable storage medium containing instructions that, when executed by a processor, cause the processor to perform a method comprising:
receiving, by a first key server of a plurality of key servers, a first request from the client to establish a connection for use by a client and a server;
sending, by the plurality of key servers, a second request to a name server to request a key server record for identifying a second key server of the plurality of key servers, the second key server being associated with the server;
determining, by the plurality of key servers, information to obtain a symmetric key for use by the client to establish the connection; and
sending, by the plurality of key servers, the information to the client.