Private Key Duplication Policies for Multi-Device Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic key management systems require separate keys for each user device, leading to inefficient storage and management of public keys at relying parties and complicating the authentication process.
Innovation Solution
A method for duplicating a user private key from a first user device to a second user device using a Trusted Platform Module (TPM) and a Duplication Service, which encrypts and transfers the key securely while maintaining authorization and policy compliance, ensuring the same private key is used across multiple devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If separate keys are stored in the Authenticator of each user device, then authentication can be performed on multiple devices, but the Relying Party needs to store and manage multiple public keys for each user, increasing storage requirements and management complexity
Solution Approach 1:
The patent merges multiple device-specific key pairs into a single shared key pair that can be used across multiple user devices. The private key is stored in a secure element (HSM or TPM) and can be accessed by multiple devices, while the public key is shared across all devices. This eliminates the need for the Relying Party to manage multiple separate public keys for the same user.
Solution Approach 2:
The invention creates a universal key pair that serves multiple functions across different user devices. The same private key can authenticate the user on any number of devices, and the single public key can be used by all Relying Parties to verify the user's identity, making the key system multi-functional and device-agnostic.
2Device complexity
If a single private key is used across multiple devices, then key management is simplified and storage requirements are reduced, but security risks increase if the key is compromised on one device
Solution Approach 1:
The patent introduces a secure element (HSM or TPM) as an intermediary between the private key and the user devices. The private key never leaves the secure element and is only accessed through controlled interfaces. This mediator protects the key from compromise even if other devices are compromised, as the key remains isolated in the secure hardware environment.
Solution Approach 2:
The invention implements beforehand cushioning by using hardware security modules that are designed to protect against key compromise from the outset. The secure elements include cryptographic operations internally and provide physical security for the private key, preventing unauthorized access before it can occur.
3Reliability
If the private key is stored in a secure element like HSM or TPM, then key protection is enhanced, but the key cannot be easily duplicated to other devices without complex procedures
Solution Approach 1:
The patent implements preliminary action by establishing a trusted relationship between the secure element and the user's devices before key duplication is needed. The secure element is pre-configured with the user's public key and authentication mechanisms, allowing authorized devices to request key duplication through a simplified process that maintains security while enabling ease of operation.
Data Source
AI summary
In embodiments, a method is provided for duplicating a user private key to multiple user devices so that websites and services don't need a separate public key for each user device. A Duplication Service is authorized by the user to cause the creation of the initial user private key in a user device. The Duplication Service associates the key's properties with a set of policies (e.g., using a TPM key template) that allow and restrict duplication. The process protects the user's private key from exposure to the Duplication Service with a user secret entered at a second user device to decrypt the duplicated key.