OPT-IN PROCESS AND NAMESERVER SYSTEM FOR IETF DNSSEC

摘要

The process of signing and then publishing a DNS zone according to the IETF
DNSSEC protocols is improved by the present invention, in order to facilitate
the
DNSSEC deployment until most of the DNS zones are signed. The prior art
situation is
that a second-level domain, e.g. example.com, often faces an unwanted status
of
"DNSSEC island of security," and a challenging task of "trust anchor key" out-
of-band
distribution. The invention somehow fixes such broken DNSSEC chains of trust,
e.g. it
fills the gap between a DNSSEC island of security and its signed grandparent
or
ancestor. The invention is deemed useful for the introduction of DNS root
nameservice
substitution for DNSSEC support purposes, and allows opt-in while NSEC3 opt-
out is
awaiting deployment in large TLDs.