Digital credential issuing system and method
A digital credential issuing system and method use public storage and encryption to provide a more secure digital credential issuing process because there is no direct interaction between the credential issuer and an entity requesting a new credential. The new credential may be secured, such as by using encryption, so that the newly issued credential may be uploaded to the public storage and then decrypted and used by only the particular entity for which the new credential is intended.
1. A credential issuing system, comprising:
public storage;
a credential issuer coupled to the public storage to communicate credential information between the credential issuer and the public storage;
an entity device coupled to the public storage but not coupled to the credential issuer, the credential issuer communicating the credential information only between the entity device and the public storage, the public storage being an intermediary between the entity device and the credential issuer without any communication between the entity device and the credential issuer;
a policy store coupled to the credential issuer, the policy store having a plurality of security policy rules, wherein each security policy rule indicates whether a new credential is to be issued to a particular entity that uses the entity device by determining whether a device identifier and/or a function identifier for the entity device matches authorized device identifiers and/or function identifiers specific to the particular entity;
wherein the credential issuer generates a secured new credential that is encrypted for the particular entity in response to a request for a new credential and uploads the secured new credential for the particular entity to the public storage; and
the entity device having a processor and a memory that retrieves the secured new credential from the public storage and decrypts the secured new credential to provide the new credential to the particular entity without communication directly between the entity device and the credential issuer.
2. The system of claim 1 , wherein the credential issuer retrieves a public key of a public key pair for the particular entity from the public storage and encrypts the new credential using the retrieved public key.
3. The system of claim 2 , wherein the entity device decrypts the secured new credential using a secret key from the public key pair.
4. The system of claim 1 , wherein the request for the new credential includes an identity of the particular entity and wherein the credential issuer encrypts the new credential using an ID-based encryption process on the identity to form the secured new credential.
5. The system of claim 4 , wherein the entity device decrypts the secured new credential using a private key of the identity from a trusted source.
6. The system of claim 1 , wherein the credential issuer generates a public key pair and encrypts the secured new credential using a shared key from the particular entity.
7. The system of claim 6 , wherein the entity device generates the shared key, encrypts the shared key using the public key of the credential issuer and uploads the request for the new credential and the encrypted shared key to the public storage.
8. The system of claim 7 , wherein the credential issuer decrypts the encrypted shared key using a private key of the public key pair to reveal the shared key.
9. The system of claim 1 , wherein the public storage stores previously generated credentials for one or more particular entities and wherein the entity device accesses the public storage to retrieve a previously generated credential for the particular entity.
10. The system of claim 1 , wherein the credential issuer retrieves the request for the new credential for the particular entity from the public storage and generates a credential element in response to the request for the new credential.
11. A method for issuing a credential, comprising:
generating, by a credential issuer, a new secured credential for a particular entity that is encrypted in response to a request for a new credential using a policy store, the policy store having a plurality of security policy rules, wherein each security policy rule indicates whether a new credential is to be issued to the particular entity by determining whether a device identifier and/or a function identifier for an entity device matches authorized device identifiers and/or function identifiers specific to the particular entity; and
uploading, by the credential issuer, the new secured credential to a public storage, the public storage being an intermediary between the entity device of the particular entity and the credential issuer without any communication between the entity device and the credential issuer, such that the entity device retrieves the new secured credential from the public storage and decrypts the secured new credential to provide the new credential to the particular entity without communication directly between the entity device and the credential issuer.
12. The method of claim 11 , wherein encrypting the new credential further comprises retrieving a public key of a public key pair for the particular entity from the public storage and encrypting the new credential using the retrieved public key.
13. The method of claim 12 further comprising retrieving by the particular entity the secured new credential from the public storage and decrypting the secured new credential using a secret key from the public key pair.
14. The method of claim 11 , wherein the request for the new credential includes an identity of the particular entity and wherein encrypting the new credential further comprises encrypting the new credential using an ID-based encryption process on the identity to form the secured new credential.
15. The method of claim 14 further comprising retrieving by the particular entity the secured new credential from the public storage and decrypting the secured new credential using a private key of the identity from a trusted source.
16. The method of claim 11 , wherein encrypting the new credential further comprises generating a public key pair and encrypting the secured new credential using a shared key from the particular entity.
17. The method of claim 16 further comprising generating by the particular entity the shared key, encrypting the shared key using the public key of a credential element and uploading the request for the new credential and the encrypted shared key to the public storage.
18. The method of claim 17 further comprising decrypting by the credential element the encrypted shared key using a private key of the public key pair to reveal the shared key.
19. The method of claim 11 further comprising storing in the public storage previously generated credentials for one or more particular entities and retrieving, by the entity device, a previously generated credential for the particular entity.
20. The method of claim 11 further comprising retrieving the request for the new credential for the particular entity from the public storage.