Verisign, Inc.

David Blacka

Sean Mountcastle

James Gould

Srikanth Veeramachaneni

Ramakant Pandrangi

Tarik Essawi

David Smith

Arunabho Das

S Daniel James

Scott Stewart

Ravinder Bhalla

Srikanth Veeramachani

A method for adding a blacklisted site to a whitelist. At least one whitelisting query may be generated for an encoded domain in the tag format: a nonce, a hash, a blocked-domain, and a static domain, each separated by a delimiter. The nonce is a unique identifier for the at least one query. The hash is a cryptographic hash of an IP address of the user, a normalized timestamp, and the blocked domain. The static domain is a constant domain representing the at least one query. The at least one query may be sent to a first recursive DNS server. The first recursive DNS server may create a message including whitelist information. The first recursive DNS server may send the message to a second recursive DNS server.

System and method for adding a whitelist entry via DNS

Implementations relate to systems and methods for pre-signing of DNSSEC enabled zones into record sets. A domain name system (DNS) can receive and/or impose a set of DNS policies desired by an administrator, or the DNS operator itself to govern domain name resolution with security extensions (DNSSEC) for a Web domain. The DNS can generate a set of answers to user questions directed to the domain based on the set of policies. Those answers which differ or vary based on policy rules can be stored as variant answers, and can be labeled with a variant ID. The variant answers can be pre-signed and stored in the DNS. Because key data and other information is generated and stored before a DNS request is received, the requested variant answer can be returned with greater responsiveness and security.

Systems and methods for pre-signing of DNSSEC enabled zones into record sets

Systems and methods for instantaneously updating a DNS system database containing DNS records using partitions and atomic switching are disclosed. In one or more implementations, the system may include clients, a network, and a DNS system. Clients may communicate with the DNS system using the network in order to provide DNS record updates to a DNS system database. The DNS system includes distributed denial of service ('DDOS') protection proxies, a firewall, and zone relays, allowing clients to specify which name servers are authorized to communicate with the DNS system. The DNS system also supports bulk updates of DNS records without causing clients to experience a reduction in performance, by writing DNS records to a hard disk and simultaneously saving the DNS records to the database in batches.

Secondary service updates into DNS system

A method for adding a blacklisted site to a whitelist includes requesting a blacklisted site via a network, the blacklisted site having a domain name of the format &#x3c;blocked-domain&#x3e;. The method includes generating queries for an encoded domain, the encoded domain being of the format &#x3c;nonce&#x3e;.&#x3c;hash&#x3e;.&#x3c;blocked-domain&#x3e;.&#x3c;static domain&#x3e;, sending the queries to a recursive DNS server, and sending responses based on the queries to a cache of a web browser. The method includes requesting by the web browser the blacklisted site, adding the blacklisted site to the whitelist, sending an IP address corresponding to the blacklisted site to the web browsers, and accessing the blacklisted site.

Systems and methods of performing incremental DNSSEC signing at a registry are described in which digital signature operations may be performed as part of a single transaction including DNS add, update, and/or delete operations and the like. Exemplary methods may include receiving a domain command from a requester, the domain command including an identifier of a domain. The received domain command may be executed with respect to data stored by the registry for the domain. As part of an individual transaction including the execution of the domain command, the registry may also sign DNSSEC records for the domain using a private key of an authoritative server. After the DNSSEC records have been signed, the registry may incrementally publish the signed DNSSEC records to a separate server. Exemplary methods may also include 'took-aside' operations in which, for example, add, update, and/or delete operations may be executed on data stored in a registry database and reported to a requester, prior to applying digital-signatures to the DNSSEC data. After reporting that the instructions have been executed, the registry may generate a digital signature based on the add, update, and/or delete changes, and commit the digital signature to a registry resolution database.

Growing community of inventors

Reston, VA, United States of America

David Blacka