Collapsing chained credentials
View Patent ↗An intermediate entity can generate a necessary credential to allow two other entities to bypass the intermediate entity when establishing communications between two other entities in a computing system represented by either a directed or an undirected graph. The intermediate entity receives credentials for communications links between itself and each of the other two entities. The intermediate entity also receives a chaining parameter associated with the intermediate entity. With the two credentials and the chaining parameter, the intermediate entity can compute a necessary credential to allow communication between the other two entities. In addition, the intermediate entity can compute the necessary credential independent of a security manager during the computation operation.
1. A computer program storage medium encoding a computer program for executing on a computer system a computer process for generating a computed credential for establishing a communications link between a first node (N i ) and a second node (N k ) in a computing system, wherein the computing system includes at least the first node (N i ), the second node (N k ), and a third node (N i ), the computer process comprising:
receiving a first credential for establishing a communications link between the third node (N j ) and the first node (N i ), wherein the first credential includes (p i r j 2 ) e mod N, wherein e is a public exponent, N is a public modulus, p i is a random prime number associated with the first node (N i ) and privately stored by a security manager, and r j is a random prime number associated with the third node (N j ) and privately stored by the security manager, such that N −1/3e <p i, r j <N −1/3 ;
receiving a second credential for establishing a communications link between the third node (N j ) and the second node (N k );
receiving a chaining parameter associated with the third node (N j );
computing the computed credential for establishing the communications link between the first node (N i ) and the second node (N k ) based on the first credential, the second credential, and the chaining parameter; and
sending the computed credential to the first node (N i ) to allow the first node (N i ) to access the second node (N k ).
2. The computer program storage medium of claim 1 wherein the computing operation comprises:
multiplying the first credential, the second credential, and the chaining parameter to generate the computed credential for establishing the communications link between the first node (N i ) and the second node (N k ).
3. The computer program storage medium of claim 1 wherein the operation of receiving the first credential comprises receiving the first credential by the third node (N j ) from the first node (N i ), and the operation of receiving the second credential comprises receiving the second credential by the third node (N j ) from a security manager.
4. The computer program storage medium of claim 1 ,wherein the first node (N i ) is a manager and the third node (N j ) is a subordinate in a manager-subordinate relationship.
5. The computer program storage medium of claim 1 wherein p j is a random prime number associated with the third node (N j ) and privately stored by the security manager such that N −1/3e <p j<N −1/3 , and the operation of receiving a chaining parameter comprises:
receiving the chaining parameter equaling (p j r j 2 ) −e mod N from the security manager.
6. The computer program storage medium of claim 1 wherein the operation of receiving the first credential comprises receiving the first credential by the third node (N j ) from the security manager, and the operation of receiving the second credential comprises receiving the second credential by the third node (N j ) from the security manager.
7. The computer program storage medium of claim 1 wherein the computer process further comprises:
receiving a chaining parameter associated with the first node (N i ).
8. The computer program storage medium of claim 7 wherein the operation of receiving the first credential comprises computing the first credential based on the chaining parameter associated with the first node (N i ).
9. The computer program storage medium of claim 1 wherein the operation of receiving the first credential comprises retrieving the first credential from a storage location accessible to the third node (N j ).
10. The computer program storage medium of claim 1 wherein the operation of receiving the second credential comprises retrieving the second credential from a storage location accessible to the third node (N j ).
11. The computer program storage medium of claim 1 wherein the operation of receiving the chaining parameter comprises retrieving the chaining parameter from a storage location accessible to the third node (N j ).
12. A computer program storage medium encoding a computer program for executing on a computer system a computer process for generating a computed credential for establishing a communications link between a first node (N i ) and a second node (N k ) in a computing system, wherein the computing system includes at least the first node (N i ), the second node (N k ), and a third node (N j ), the computer process comprising:
receiving a first credential for establishing a communications link between the third node (N j ) and the first node (N i );
receiving a second credential for establishing a communications link between the third node (N j ) and the second node (N k ), the second credential including (p j r k 2 ) e mod N, wherein e is a public exponent, N is a public modulus, p j is a random prime number associated with the third node (N j ) and privately stored by a security manager, and r k is a random prime number associated with the second node (N k ) and privately stored by the security manager, such that N −1/3e <p j, r k <N −1/3 ;
receiving a chaining parameter associated with the third node (N j );
computing the computed credential for establishing the communications link between the first node (N i ) and the second node (N k ) based on the first credential, the second credential, and the chaining parameter; and
sending the computed credential to the first node (N i ) to allow the first node (N i ) to access the second node (N k ).
13. The computer program storage medium of claim 12 wherein the third node (N j ) is a manager and the second node is a subordinate in a manager-subordinate relationship.
14. A method of generating a computed credential for establishing a communications link between a first node (N i ) and a second node (N k ) in a computing system, wherein the computing system includes at least the first node (N i ), the second node (N k ), and a third node (N j ), the method comprising:
receiving a first credential for establishing a communications link between the third node (N j ) and the first node (N i ), the first credential including (p i r j 2 ) e mod N, wherein e is a public exponent, N is a public modulus, p i is a random prime number associated with the first node and privately stored by a security manager, and r j is a random prime number associated with the third node and privately stored by the security manager, such that N −1/3e <p i, r j <N −1/3 ;
receiving a second credential for establishing a communications link between the third node (N j ) and the second node (N k );
receiving a chaining parameter associated with the third node (N j ); and
computing the computed credential for establishing the communications link between the first node (N i ) and the second node (N k ) based on the first credential, the second credential, and the chaining parameter; and
sending the computed credential to the first node (N i ) to allow the first node (N i ) to access the second node (N k ).
15. The method of claim 14 wherein the computing operation comprises:
multiplying the first credential, the second credential, and the chaining parameter to generate the computed credential for establishing the communications link between the first node (N i ) and the second node (N i ).
16. The method of claim 14 wherein the operation of receiving the first credential comprises receiving the first credential by the third node (N j ) from the first node (N i ), and the operation of receiving the second credential comprises receiving the second credential by the third node (N j ) from the security manager.
17. The method of claim 14 further comprising:
receiving a chaining parameter associated with the first node (N i ).
18. The method of claim 17 wherein the operation of receiving the first credential comprises computing the first credential based on the chaining parameter associated with the first node (N i ).
19. The method of claim 14 wherein the operation of receiving the first credential comprises receiving the first credential by the third node (N j ) from the security manager, and the operation of receiving the second credential comprises receiving the second credential by the third node (N j ) from the security manager.
20. The method of claim 14 wherein the operation of receiving the first credential comprises retrieving the first credential from a storage location accessible to the third node (N j ).
21. The method of claim 14 wherein the operation of receiving the second credential comprises retrieving the second credential from a storage location accessible to the third node (N j ).
22. The method of claim 14 wherein the operation of receiving the chaining parameter comprises retrieving the chaining parameter from a storage location accessible to the third node (N j ).