Verisign, Inc.

Emc Corporation

Rsa Security Inc.

Emc IP Holding Company LLC

Rsa Data Security, Inc.

Burton S Kaliski, Jr

Glen S Wiley

Ari Juels

Eric Osterweil

John Gordon Brainard

Swapneel Sheth

Daniel Vernon Bailey

Andrew Fregly

Shumon Huque

Karthik Shyamsunder

Scott Hollenbeck

Ronald L Rivest

Magnus Nyström

Daniel Schonfeld

Frank Scalzo

Joseph M Waldron

Neel Goyal

Duane Wessels

Matthew John Robshaw

Valinder Mangat

Kevin Bowers

Alina Oprea

Andrew Kaizer

Yiqun Lisa Yin

Allison Mankin

Paul Neil Fahn

Bjorn Markus Jakobsson

Patrick Kane

Jeffrey Hoffstein

John P Field

Michael Szydlo

Paul Tidwell

Markus Jakobsson

James Townsend

Hari Sola

Moses Liskov

Dung Huynh

Daniel Bennett Lieman

Pedro Vasquez

Techniques for provisioning a key server to facilitate secure communications between a web server and a client by providing the client with a first data structure including information on how the web server may obtain a target symmetric key are presented. The techniques can include: provisioning the key server with a second data structure including information on how the key server may generate the first data structure; receiving a request on behalf of a web server for a third data structure comprising information on how the client may obtain the first data structure from the key server; and obtaining the third data structure, such that the third data structure is published in association with an identification of the web server, and such that the client uses the third data structure to obtain the first data structure and uses the first data structure to communicate with the web server.

Symmetric-key infrastructure

Techniques for signing internet data are disclosed. The techniques include accessing a plurality of internet data records. The techniques also include generating, using at least one electronic processor, leaf nodes from the plurality of internet data records, and constructing a recursive hash tree from the plurality of leaf nodes. The techniques also include deriving information sufficient to validate the root node, and publishing, in an internet public key infrastructure (PKI) as a synthesized public key, the information sufficient to validate the root node. The techniques also include providing, through the internet and as a signature on at least one of the plurality of internet data records, validation data including sibling path data from the recursive hash tree, such that an internet client validates the at least one of the internet data records using at least the validation data and the synthesized public key.

Hash-based digital signatures for hierarchical internet public key infrastructure

One or more DNS services are provided that are configured to not only tolerate some commonly observed DNSSEC misconfigurations (while still providing DNSSEC's security guarantees), but also provide a more intelligent DNS resolution process informed by DNSSEC.

Strengthening integrity assurances for DNS data

Provided is a method for providing Registration Data Access Protocol ('RDAP') responses. The method includes obtaining, at a RDAP client over a network, a RDAP query for RDAP data from a user; providing, by the RDAP client, the RDAP query and a cryptographic credential to a RDAP server, wherein the RDAP server communicates with one or more thick RDAP servers to provide respective thick RDAP answers to the RDAP query, wherein at least one the respective thick RDAP answers are encrypted using a symmetric or asymmetric cryptographic key associated with the cryptographic credential of the RDAP client; obtaining a consolidated thick RDAP answer to the RDAP query from the RDAP server; decrypting the consolidated thick RDAP answer using a symmetric or asymmetric cryptographic key associated with the cryptographic credential; and providing the thick RDAP answer that is decrypted to the user.

GTLD domain name registries RDAP architecture

Techniques for allowing third-party DNS service providers to programmatically initiate changes to DNS resource records using an interface provided by a registrar or registry are disclosed. Further, techniques for validating change requests received at such an interface are disclosed. The disclosed techniques reduce errors and increase convenience.

Integrated DNS service provider services using certificate-based authentication

Systems and methods for updating a Domain Name System (DNS) registry are disclosed. Embodiments perform operations including maintaining a domain name record of a DNS registrant recorded in a database of the DNS registry by a primary DNS interface. The operations also include receiving a request to update the domain name record of the DNS registrant via a secondary DNS interface. The operations further include modifying the domain name record of the DNS registrant in the DNS database in accordance with the request.

Shared registration system

Systems, methods, and computer products for associating a network identifier with a network address enable operations that may include: receiving a network identifier associated with a first network; obtaining an identification of a proof provider; sending, to the proof provider, a network address associated with a second network, wherein the proof provider is configured to generate a signed association of the network identifier with the network address using a private key of the proof provider; obtaining the signed association; and providing, to the second network, at least the signed association. The second network may be configured to validate the signed association and store the signed association.

Delegated agent proof of network identifier control

In one aspect, authentication information is received from a first processing device in a second processing device, and a digital signature is generated in the second processing device by signing data that incorporates at least a portion of the received authentication information. The received authentication information is generated at least in part from a secret seed stored in the first processing device. The received authentication information may be combined with the digital signature generated by the second processing device to form a joint signature that is transmitted to an authentication server. In an illustrative embodiment, the received authentication information comprises a tokencode and the digital signature is generated by signing data that incorporates the tokencode. The data that is signed to generate the digital signature may comprise an electronic document having the tokencode appended thereto.

Authentication methods and apparatus for generating digital signatures

In one embodiment, a domain-name based framework implemented in a digital assistant ecosystem uses domain names as unique identifiers for request types, requesting entities, responders, and target entities embedded in a natural language request. Further, the framework enables interpreting natural language requests according to domain ontologies associated with different responders. A domain ontology operates as a keyword dictionary for a given responder and defines the keywords and corresponding allowable values to be used for request types and request parameters. The domain-name based framework thus enables the digital assistant to interact with any responder that supports a domain ontology to generate precise and complete responses to natural language based requests.

Domain-name based operating environment for digital assistants and responders

Systems and methods for out-of-band communications in the domain name system (DNS) are disclosed. Embodiments include a system for negotiating DNS services in the DNS. The system includes an in-band communication channel connecting a first party and a second party, and one or more out-of-band communication channels connecting the first party and the second party. The first party performs messaging for the DNS services with the second party using the in-band communication channel. Further, the first party advertises terms of the DNS service offered by the second party using the one or more out-of-band communication channels.

Balancing visibility in the domain name system

In one embodiment, a zone resiliency application indicates that an authoritative name server is in a degraded state. In operation, the zone resiliency application determines that the authoritative name server is in a degraded state. The zone resiliency application then generates a status record that indicates the degraded state. Subsequently, the zone resiliency application associates the status record with a domain name service (DNS) response to a DNS query. The zone resiliency application then transmits the DNS response and the associated status record to a requester.

Techniques for indicating a degraded state of an authoritative name server

Alias-based access of entity information over voice-enabled digital assistants

Growing community of inventors

McLean, VA, United States of America

Burton S Kaliski, Jr