US 12,457,101 B1
Systems and methods using DNS tunneling for fast symmetric session encryption key establishment using a computing device
James E. Bennison, Oakton, VA (US)
Filed by James E. Bennison, Oakton, VA (US)
Filed on Jan. 7, 2025, as Appl. No. 19/012,244.
Int. Cl. H04L 9/08 (2006.01); H04L 61/4511 (2022.01)
CPC H04L 9/0861 (2013.01) [H04L 9/0825 (2013.01); H04L 61/4511 (2022.05)] 11 Claims
OG exemplary drawing
 
1. A method performed by a client computing device for negotiating session encryption-keys with another computing device, which is part of a system registered with an Internet domain name service as an authoritative name-server for an Internet domain name, and which is connected to the client computing device by a network, the method utilizing Internet domain name service tunneling to employ pre-shared shared-secret key-derivation keys to generate and securely exchange symmetric session encryption-keys, the method comprising:
obtaining from a machine-readable data storage mechanism associated with the client computing device a device-unique identity token cryptographically bound to said computing device;
generating a domain name by appending a “dot” character to said device-unique identity token and then concatenating the appended device-unique identity token with the Internet domain name registered to said authoritative name-server;
transmitting said domain name in a request for said authoritative name-server's internet protocol address to an arbitrary public domain name service device over the network communicatively coupled to the client computing device thereby causing the public domain name service device to, upon not finding a match between the generated domain name and an Internet address database, forward a domain name service request for said generated domain name to the authoritative name-server;
receiving a domain name service response including an Internet Protocol address provided by the authoritative name-server, an encrypted handshake message and a random nonce;
obtaining from the machine-readable data storage mechanism associated with the client computing device a shared-secret key-derivation key;
generate a matching symmetric session encryption-key by combining the random nonce and the shared-secret key-derivation key and performing cryptographic operations on the appended device-unique identity token;
decrypting the encrypted handshake message with said session encryption-key; and
verifying the handshake message was successfully decrypted.