Key Derivation for Multi-Entity Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems require users to manage multiple usernames and passwords for different relying parties, which can be cumbersome and insecure, especially when reusing the same credentials across entities.
Innovation Solution
A system and method for generating multiple cryptographic keys using a key derivation function, where a derived public key is paired with a derived private key, allowing authentication across multiple relying parties without the need for multiple usernames and passwords.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If users manage multiple usernames and passwords for different relying parties, then authentication can be performed across multiple entities, but the complexity of credential management increases and security risks increase due to potential reuse
Solution Approach 1:
The system segments the authentication credentials by deriving multiple distinct key pairs from a single master seed. Each derived key pair is specifically tailored for a particular relying party or authentication purpose, eliminating the need for users to manually manage multiple passwords while maintaining the ability to authenticate across multiple entities. The segmentation occurs in the cryptographic key space rather than in user-managed credentials.
Solution Approach 2:
A single master seed serves multiple functions by being able to derive any number of key pairs needed for different relying parties. This universal seed replaces the need for multiple separate passwords, providing multi-functionality at the cryptographic level while simplifying user credential management. The master seed can generate keys for current and future relying parties without requiring users to create new passwords manually.
2Ease of operation
If users reuse the same username and password for multiple relying parties, then credential management becomes simpler, but security risks increase
Solution Approach 1:
The system segments the cryptographic keys so that each relying party receives a unique derived key pair from the master seed. This segmentation ensures that compromising one relying party's credentials does not expose credentials for other relying parties, maintaining security isolation while keeping credential management simple for users who only need to protect their single master seed.
Solution Approach 2:
The master seed acts as an intermediary that automatically generates unique credentials for each relying party. Users never directly handle or reuse passwords for different parties; instead, the master seed mediates the credential generation process, automatically producing secure, unique credentials for each authentication context without requiring user intervention or password reuse.
3Reliability
If multiple cryptographic key pairs are generated for multiple relying parties, then authentication security is improved, but the complexity of key management increases
Solution Approach 1:
The system merges the management of multiple key pairs into a single master seed. Instead of users managing separate passwords for each relying party, all cryptographic keys are combined under the control of one master seed through hierarchical deterministic derivation. This reduces key management complexity from the user perspective while maintaining the security benefits of having distinct credentials for each relying party.
Solution Approach 2:
The master seed is established in advance as the root of trust, and all future key pairs are preliminarily configured to be derivable from it. This preliminary action allows the system to generate any number of key pairs as needed without requiring users to perform complex key management operations. The derivation relationships are pre-established through the hierarchical deterministic structure, simplifying ongoing key management.
Data Source
AI summary
In some embodiments, a non-transitory processor-readable medium stores code representing instructions configured to be executed by a processor. The code includes code to cause the processor to receive, at a first compute device, (1) a message signed using a signature associated with a derived private key of a second compute device, and (2) an identifier. The code further includes code to cause the processor to retrieve, using the identifier, an ascendant public key associated with the second compute device. The code further includes code to cause the processor to generate, using a key derivation function with the ascendant public key and the identifier as inputs, a derived public key that is paired with the derived private key. The code further includes code to cause the processor to authenticate the second compute device by verifying the signature using the derived public key.