Storage and retrieval of dispersed storage network access information
View Patent ↗A method begins by a dispersed storage (DS) processing module receiving a certificate signing request (CSR) from a user device. The method continues with the DS processing module generating a set of hidden passwords based on the CSR and accessing a set of authenticating units to obtain a set of passkeys. The method continues with the DS processing module retrieving a set of encrypted shares and decrypting the set of encrypted shares to produce a set of encoded shares. The method continues with the DS processing module decoding the set of encoded shares to recapture a private key and generating a user signed certificate based on the private key. The method continues with the DS processing module discarding the private key to substantially protect the private key from the user device and outputting the user signed certificate to the user device.
1. A method for execution by a computing device, the method comprises:
receiving a certificate signing request (CSR) from a user device regarding a user, wherein the CSR includes user information regarding the user;
generating a set of hidden passwords based on the user information;
accessing a set of authenticating units to obtain a set of passkeys based on the set of hidden passwords and a set of random numbers;
retrieving a set of encrypted shares based on the user information from the set of authenticating units;
decrypting the set of encrypted shares based on the set of passkeys and the set of random numbers to produce a set of encoded shares;
decoding, in accordance with a share encoding function, the set of encoded shares to recapture a private key associated with the user;
generating a user signed certificate based on the private key;
discarding the private key to substantially protect the private key from the user device; and
outputting the user signed certificate to the user device.
2. The method of claim 1 , wherein accessing the set of authenticating units comprises:
generating the set of random numbers;
generating a set of blinded passwords based on the set of hidden passwords and the set of random numbers;
identifying the set of authenticating units based on the user information;
outputting the set of blinded passwords to set of identified authenticating units; and
receiving the set of passkeys from the set of identified authenticating units.
3. The method of claim 1 , wherein accessing the set of authenticating units comprises:
generating the set of random numbers;
generating a set of blinded passwords based on the set of hidden passwords and the set of random numbers;
identifying the set of authenticating units based on the user information;
retrieving a set of recovered random numbers from the set of identified authenticating units; and
generating the set of passkeys based on the set of blinded passwords and the set of recovered random numbers.
4. The method of claim 1 , wherein the decrypting the set of encrypted shares comprises:
generating a set of encryption keys based on the set of passkeys and the set of random numbers; and
decrypting the set of encrypted shares utilizing the set of encryption keys to reproduce the set of encoded shares.
5. The method of claim 1 , wherein the decoding the set of encoded shares comprises at least one of:
decoding the set of encoded shares using a secret share function as the share encoding function; and
decoding the set of encoded shares using a dispersed storage error encoding function as the share encoding function.
6. The method of claim 1 , wherein the generating a user signed certificate comprises:
generating, on behalf of the user, a certification signature based on the private key; and
generating the signed certificate based on a certificate of the CSR and the certification signature such that the user device uses the signed certificate to obtain a certificate authority signed certificate from a certificate authority to access a dispersed storage network.
7. An authentication token comprises:
memory; and
a processing module, wherein the memory stores operational instructions that, when executed by the processing module, causes the processing module to:
receive a certificate signing request (CSR) from a user device regarding a user, wherein the CSR includes user information regarding the user;
generate a set of hidden passwords based on the user information;
access a set of authenticating units to obtain a set of passkeys based on the set of hidden passwords and a set of random numbers;
retrieve, from the memory, a set of encrypted shares based on the user information;
decrypt the set of encrypted shares based on the set of passkeys and the set of random numbers to produce a set of encoded shares;
decode, in accordance with a share encoding function, the set of encoded shares to recapture a private key associated with the user;
generate a user signed certificate based on the private key;
discard the private key to substantially protect the private key from the user device; and
outputting the user signed certificate to the user device.
8. The authentication token of claim 7 , wherein the processing module functions to access the set of authenticating units by:
generating the set of random numbers;
generating a set of blinded passwords based on the set of hidden passwords and the set of random numbers;
identifying the set of authenticating units based on the user information;
outputting the set of blinded passwords to set of identified authenticating units; and
receiving the set of passkeys from the set of identified authenticating units.
9. The authentication token of claim 7 , wherein the processing module functions to access the set of authenticating units by:
generating the set of random numbers;
generating a set of blinded passwords based on the set of hidden passwords and the set of random numbers;
identifying the set of authenticating units based on the user information;
retrieving a set of recovered random numbers from the set of identified authenticating units; and
generating the set of passkeys based on the set of blinded passwords and the set of recovered random numbers.
10. The authentication token of claim 7 , wherein the processing module functions to decrypt the set of encrypted shares by:
generating a set of encryption keys based on the set of passkeys and the set of random numbers; and
decrypting the set of encrypted shares utilizing the set of encryption keys to reproduce the set of encoded shares.
11. The authentication token of claim 7 , wherein the processing module functions to decode the set of encoded shares by at least one of:
decoding the set of encoded shares using a secret share function as the share encoding function; and
decoding the set of encoded shares using a dispersed storage error encoding function as the share encoding function.
12. The authentication token of claim 7 , wherein the processing module functions to generate a user signed certificate by:
generating, on behalf of the user, a certification signature based on the private key; and
generating the signed certificate based on a certificate of the CSR and the certification signature such that the user device uses the signed certificate to obtain a certificate authority signed certificate from a certificate authority to access a dispersed storage network.