ALTERNATE DNS ROOT NAMESERVICE FOR DNSSEC PURPOSES

SERVICE DE REMPLACEMENT DE NOMS A RACINES DE SYSTEME DE NOMS DE DOMAINE POUR FINS DE PROTOCOLE DNSSEC

English Abstract

The Internet DNS (Domain Name System) may be integrity protected with the
deployment of the DNSSEC protocol extension at the root zone. The inventive
methods
allow a common DNSSEC-related cryptographic key configuration, also called
trust
anchor, to be used for a number of independent alternate root nameservice
operators,
each operating its own set of root nameservers. A single root signing entity
feeds each
nameserver operators with its own version of the signed DNS root zone. The
inventive
processes allow these versions to coexist on the public Internet gracefully.
It thus
allows the load on root nameservers to be shared, and a DNS resolver to switch
from
one alternate nameservice operator to the other with minimal disturbance. The
preferred embodiment is such that the exact same substantive root zone
contents is
delivered either by the official DNS root zone or an alternate root
nameservice fed by
an independent root signing entity.

Claims

-12-
CLAIMS
What is claimed is:

1. A method of servicing a signed DNS root zone to a network from at least one
host in a first set of hosts where
a) substantially the same DNS root zone is being serviced concurrently from
at least one node in a second set of hosts,
b) the zone apex NS RRset serviced from hosts in said first set contains the
respective domain names of hosts in said first set and is signed with a
digital signature key pair, and
c) the zone apex NS RRset serviced from hosts in said second set contains
the respective domain names of hosts in said second set and is signed
with said digital signature key pair.

2. A method of preparing a DNS root zone for DNSSEC service to a network where
a) a plurality of variants is prepared with substantially the same signed DNS
root zone contents,
b) each of said plurality of variants has a zone apex NS RRset containing a
set of domain names non intersecting with other variants,
c) each of said plurality of variants has its zone apex NS RRset signed with
a common digital signature key pair, and
d) each of said plurality of variants have signature inception and expiration
times allowing ordinarily concurrent DNSSEC servicing of said DNS root
zone.