TPM Private Key Duplication for Multi-Device Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems require separate cryptographic keys for each user device, leading to inefficient key management and storage across multiple devices and Relying Parties, complicating authentication processes.
Innovation Solution
A method for duplicating a user private key from a first user device to a second user device using a Trusted Platform Module (TPM) and a Duplication Service, ensuring secure key duplication with policies and user secrets to maintain key integrity and authorization across devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate cryptographic keys are stored in each user device, then security and key integrity are maintained, but key management complexity and storage requirements increase
Solution Approach 1:
The patent implements key duplication by creating copies of the user's private key and storing them in multiple authenticators across different devices. The duplication service facilitates this by receiving the private key from the source authenticator and distributing it to destination authenticators, allowing the same key to exist in multiple locations while maintaining security through encrypted transmission and storage.
2Reliability
If separate cryptographic keys are used for each device, then security is maintained, but authentication efficiency and user convenience deteriorate
Solution Approach 1:
The patent merges multiple separate key instances into a single unified private key that is duplicated across devices. Instead of requiring users to manage different keys for different devices, the system combines the key management into one master private key that can be securely copied to multiple authenticators, simplifying the authentication process while maintaining security through the duplication service's controlled distribution mechanism.
3Adaptability or versatility
If multiple public keys are stored by Relying Parties for each user device, then device-specific authentication is enabled, but storage requirements and management overhead increase
Solution Approach 1:
The patent implements universality by enabling a single private key to serve multiple devices simultaneously. The duplicated private key in each authenticator generates the same public key, allowing one public key to represent multiple devices for a given user. This eliminates the need for Relying Parties to store separate public keys for each device, as the same public key can authenticate across all devices associated with that user's private key.
Data Source
AI summary
In embodiments, a method is provided for duplicating a user private key to multiple user devices so that websites and services don't need a separate public key for each user device. A Duplication Service is authorized by the user to cause the creation of the initial user private key in a user device. The Duplication Service associates the key's properties with a set of policies (e.g., using a TPM key template) that allow and restrict duplication. The process protects the user's private key from exposure to the Duplication Service with a user secret entered at a second user device to decrypt the duplicated key.