Hash Chain Credential Delegation in Trusted Execution Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing credential management systems for mobile devices are complex and brittle, requiring explicit migration protocols and rule sets, which can lead to inflexibility and high complexity, especially in credential transfer and delegation processes.
Innovation Solution
A lightweight delegation system using self-provisioning capabilities of OnBoard Credentials (ObC) with device attestation, employing a hash chain mechanism to securely transfer and delegate symmetric secrets between devices, ensuring authentication and authorization through cryptographic hash functions and platform certificates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If explicit migration protocols and rule sets are used for credential transfer, then security is maintained, but device complexity and system brittleness increase
Solution Approach 1:
The patent extracts the credential migration logic from complex explicit protocols and rule sets, replacing it with a simplified hash chain mechanism. The credential secret is transformed through cryptographic hashing into a delegation chain that inherently encodes migration rules, eliminating the need for separate migration protocol specifications and reducing system complexity while maintaining security.
Solution Approach 2:
The patent changes the parameter representation of credentials from structured credential data requiring protocol interpretation to cryptographic hash values that naturally form a delegation chain. This parameter transformation allows the system to maintain security through cryptographic guarantees while simplifying the operational complexity of credential migration and delegation.
2Reliability
If traditional credential delegation methods are used, then authentication security is maintained, but flexibility and ease of operation decrease
Solution Approach 1:
The patent implements self-service credential delegation where the hash chain mechanism automatically manages credential propagation without requiring explicit migration protocols or rule sets. The system serves itself by using cryptographic transformations to inherently encode and enforce delegation rules, eliminating the need for complex external control mechanisms and improving operational flexibility.
Solution Approach 2:
The patent performs preliminary cryptographic hashing of the credential secret to create a delegation chain before any credential transfer occurs. This preliminary action pre-establishes the rules and constraints of credential delegation in the cryptographic structure itself, allowing flexible and secure credential propagation without requiring complex runtime protocol negotiations or rule interpretations.
3Reliability
If cryptographic protocols with credentials are used for security, then security is improved, but system cost and inflexibility increase
Solution Approach 1:
The patent creates a universal credential delegation mechanism using hash chains that can be applied across multiple distributed applications and services. The same cryptographic primitive serves multiple functions: authentication, authorization, credential propagation, and policy enforcement, eliminating the need for separate complex systems for each function and improving adaptability while maintaining security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for providing secret delegation may comprise receiving a credential secret applied to an algorithm associated with a distributed application in a trusted execution environment, causing delegation of the credential secret from one communication device to at least one other communication device, and modifying the credential secret prior to transfer of a modified version of the credential secret to the at least one other communication device in a manner that enables a generation of the credential secret to be determined. An apparatus and computer program product corresponding to the method are also provided.