Verisign, Inc.

Cisco Technology, Inc.

Stephen Daniel James

Andrew Fregly

Andrew Cathrow

Eric Osterweil

Daniel Schonfeld

Arunabho Das

Souheil Ben Yacoub

David A Friedman

Lee Alan Shombert

Jennifer Carle

In one embodiment, a delegation engine automatically provisions a device connected to a network to securely identify and interact with external services. As a device boots in a deployment environment, the delegation engine generates a search domain name based on a manufacturer-supplied domain name and a domain name associated with the deployment environment. The delegation engine then searches a Domain Name System (DNS) to retrieve a delegation record stored at the search domain name. After verifying a manufacturer signature associated with the delegation record, the delegation engine configures the device based on service discovery information included in the delegation record. Because the delegation engine automates the provisioning process, the time required to provision devices is acceptable irrespective of the number of the devices. Further, because the delegation engine verifies the delegation record, the delegation engine does not expose the device to security risks during the provisioning process.

Identifying trusted configuration information to perform service discovery

Provided herein is a method for registering an IoT device with a DNS registry. The method can include obtaining, at a DNS server, an identifier, IP address, and a public key of an asymmetric key pair associated with the IoT device from a network gateway device that is in communication with the IoT device, wherein the asymmetric key pair is provisioned onto the IoT device and an associated private key stored within a memory of the IoT device at a time that IoT device is manufactured or during a predetermined time window after manufacturing; creating at least one DNS record for the IoT device; assigning a domain name associated with the internet protocol ('IP') address to the IoT device; storing the identifier, IP address, the domain name, and the public key in the at least one DNS record; and providing confirmation of the registration to the IoT device.

Registering, managing, and communicating with IoT devices using domain name system processes

Systems and methods for automating client-side synchronization and discovery of public keys and certificates of external contacts include a key synchronizer at a client device. The key synchronizer obtains, from the client device, an external contact associated with an external domain outside of a local domain of the client device and then identifies, based on the external domain, a public key registry outside of the local domain. The key synchronizer obtains, from the public key registry, a registry-supplied public key or digital certificate for the external contact and then stores the registry-supplied key as a locally-stored key in the local key store such that the client device can obtain and apply the locally-stored key to secure an email targeting the external contact as a recipient of the email.

Systems and methods for automating client-side synchronization of public keys of external contacts

A method, system, apparatus, and computer-readable memory containing instructions include receiving, at an agent operating on a client device, a (domain name system) DNS resolution request for a domain name. The DNS resolution request is transmitted to a first DNS server including a firewall service and a second DNS server within a local network to the client device. Responses to the DNS resolution request from the first and second DNS server are received. The agent determines how to resolve the DNS resolution request based on one or more of the received responses.

Domain name resolution

In one embodiment, a security provisioning service automatically establishes trust in a device. Upon receiving a provisioning request, a security provisioning service identifies a verification item that is associated with the provisioning request. The security provisioning service performs one or more verification operations based on the provisioning request to determine whether the provisioning request is authorized. If the provisioning request is authorized, then the provisioning service establishes a verifiable identification for the device that is assured by the secure provisioning service and then executes the provisioning request. By automatically performing the verification operations to establish trust in the device, the provisioning service eliminates manual identification assurance operations that are performed as part of a conventional security provisioning process. Reducing the time and effort required to perform security provisioning increases the number of devices likely to implement security processes that increase the overall security of interacting using the Internet.

Automating internet of things security provisioning

Embodiments relate to systems, devices, and computing-implemented methods for resolving DNS requests by sending, from a device, a first DNS request for a domain name associated with a local service device to a DNS firewall server. The DNS firewall server can send a response that includes a status indicating a server failure in response to determining that the first DNS request is associated with a customer of a DNS firewall service and determining that a record associated with the domain name cannot be found. The device can receive the response and send a second DNS request to an internal DNS server in response to the status indicating the server failure.

Systems, devices, and methods for improved domain name system firewall protection

The present disclosure provides systems, methods, and products for high performance implementation of traffic management rules. In various embodiments, traffic management rules, such as DNS traffic management rules, are functionally expressed as rows in one or more lookup tables that are deployed to DNS resolution servers. The DNS resolution server uses the domain name, resource record type, traffic management rule types, and/or traffic management variable values to search for or look up an answer, from among multiple answers corresponding to the domain name and resource record type that meets the traffic management criteria. This look up is done without executing conventional traffic management code or scripts.

High performance DNS traffic management

Provided is a method for establishing ownership of a component of an internet of things ('IoT') device. The method comprises receiving, at a registration service, a request to register the component of the IoT device, the request comprising a public key of the component of the IoT device, an identifier of the component of the IoT device, and a public key of an owner of the component of the IoT device; determining a qualified name for the component of the IoT device based on a name associated with the owner of the component of the IoT device; generating one or more domain name system ('DNS') records for the component of the IoT device, the one or more DNS records comprising an authentication file that identifies a chain of ownership of the component of the IoT device; and storing the one or more DNS records in a registry.

Systems and methods for establishing ownership and delegation ownership of IOT devices using domain name system services

Registering, managing, and communicating with IOT devices using domain name system processes

Techniques for implementing a firewall in a gateway network element between two IP based networks is provided. Packets can be filtered out that specify the gateway network element as the source, where the packet comes from the network that is not visible to the other network. For example, if a packet on DCC going to the gateway network element specifies the gateway network element as the source, the packet can be discarded.

Growing community of inventors

South Riding, VA, United States of America

Stephen Daniel James