Blockchain-based secure credential and token management across multiple devices

1. A processor implemented method for blockchain-based secure credential and token management for open identity management that enables a first device to provision at least one additional device to present tokens issued to the first device, the method comprising:

creating, using a hardware-based cryptographic processor on a first device associated with an end user, a first set of credentials comprising a blockchain-compatible public-private key pair associated with the end user, wherein the blockchain-compatible public-private key pair comprises an end user public key and an end user private key, wherein the end user public key is published and the end user private key is protected by at least one of the end user's password, biometric or PIN code;

obtaining and caching at least one attestation token from at least one attestation issuing party, wherein the at least one attestation token is restricted by default to be unusable from any device other than the first device, and the at least one attestation issuing party attests information that they are authorized to validate with reference to the end user;

providing the at least one attestation token to at least one relying party, wherein the validity of the at least one attestation token is determined using a blockchain; and

signing a trust record on the blockchain using the first device associated with the end user to indicate that the first set of credentials trusts a second set of credentials associated with a second user device as long as the first set of credentials are valid, to indicate to the at least one relying party that the at least one attestation token presented by the second set of credentials from the second device are acceptable to the blockchain, wherein signing the trust record on the blockchain overcomes the restriction by default that the at least one attestation token is to be unusable from any device other than the first device, wherein the trust record indicates a quorum of credentials associated with the second set of credentials are needed to sign to revoke the first set of credentials.

2. The processor implemented method of claim 1 , further comprising:

delegating a revoke privilege to the second device that signs a revoke record on the blockchain referencing the first device to decommission the first device.

3. The processor implemented method of claim 1 , further comprising:

registering delegate credentials and a policy for delegation for the first device on the blockchain.

4. The processor implemented method of claim 3 , wherein the delegate credentials comprise designating that the second set of credentials on the second device has permissions to revoke the first set of credentials on the first device, so that the second device can revoke the first set of credentials on the first device by signing a blockchain transaction from the second device.

5. The processor implemented method of claim 3 , wherein the delegate credentials comprise designating at least one device other than the first device to have permission to take over the first set of credentials from the first device and assign the first set of credentials to a new device, by designating that the at least one device have to sign a take over transaction on the blockchain.

6. The processor implemented method of claim 1 , wherein when the at least one attestation issuing party issues at least one attestation token to the first device associated with end user, the at least one attestation token is registered on the blockchain by associating the at least one attestation token with the public key of the end user and are signed by the issuing party private key.

7. The processor implemented method of claim 1 , wherein an attestation token is revoked by signing a revoke record using a private key associated with a revoker device and making an entry in the blockchain only when a public key of the revoker device is either the public key of the end user to which the attestation token was issued by the at least one attestation issuing party or the public key of the at least one attestation issuing party.

8. A system for blockchain-based secure credential and token management for open identity management that enables a first device to provision at least one additional device to present tokens issued to the first device, the system comprising:

a hardware-based cryptographic processor that is configured to create, on the first device associated with an end user, a first set of credentials comprising a blockchain-compatible public-private key pair associated with the end user, wherein the blockchain-compatible public-private key pair comprises an end user public key and an end user private key, wherein the end user public key is published and the end user private key is protected by at least one of the end user's password, biometric or PIN code;

a device processor; and

a non-transitory computer readable storage medium comprising one or more modules executable by said device processor, wherein said one or more modules comprises

an attestation token management module that obtains and caches at least one attestation token from at least one attestation issuing party, wherein the at least one attestation token is restricted by default to be unusable from any device other than the first device, and the at least one attestation issuing party attest information that they are authorized to validate with reference to the end user;

an attestation token providing module that provides the at least one attestation token to at least one relying party device associated with at least one relying party, wherein the validity of the at least one attestation token is determined using a blockchain; and

a trust record signing module that signs a trust record on the blockchain using the first device associated with the end user to indicate that the first set of credentials trusts a second set of credentials associated with a second user device as long as the first set of credentials are valid, to indicate to the at least one relying party that the at least one attestation token presented by the second set of credentials from the second device are acceptable to the blockchain, wherein signing the trust record on the blockchain overcomes the restriction by default that the at least one attestation token is to be unusable from any device other than the first device, wherein the trust record indicates a quorum of credentials associated with the second set of credentials are needed to sign to revoke the first set of credentials.

9. The system of claim 8 , wherein said one or more modules further comprises

a device decommissioning module that delegates a revoke privilege to the second device that signs a revoke record on the blockchain referencing the first device to decommission the first device; and

a credential registering module that registers delegate credentials and a policy for delegation for the first device on the blockchain.

10. The system of claim 8 , wherein said at least one relying party device comprise

a token validation module that validates the at least one attestation token that is signed using a second set of credentials and a second private key that is associated with a second device by checking that a token ID is not revoked, a public key that is associated with the second set of credentials is not revoked, and that trust exists between the first set of credentials and the second set of credentials; and

a trust checking module that checks whether trust exists between the first set of credentials and the second set of credentials based on whether they are equal, or whether a sequence of records exists in a trust credentials record in the blockchain which establish a trust relationship between the first set of credentials and the second set of credentials.

11. The system of claim 10 , wherein the delegate credentials comprise designating that the second set of credentials on the second device has permissions to revoke the first set of credentials on the first device, so that the second device can revoke the first set of credentials on the first device by signing a blockchain transaction from the second device, and wherein the delegate credentials comprise designating at least one device other than the first device to have permission to take over the first set of credentials from the first device and assign the first set of credentials to a new device, by designating that the at least one device have to sign a takeover transaction on the blockchain.

12. The system of claim 8 , wherein when the attestation issuing party issues at least one attestation token to the first device associated with end user, the at least one attestation token is registered on the blockchain by associating the at least one attestation token with the public key of the end user and are signed by the issuing party private key.

13. The system of claim 8 , wherein an attestation token is revoked by signing a revoke record using a private key associated with a revoker device and making an entry in the blockchain only when a public key of the revoker device is either the public key of the end user to which the attestation token was issued by the at least one attestation issuing party or the public key of the at least one attestation issuing party.

14. One or more non-transitory computer readable storage mediums storing one or more sequences of instructions, which when executed by one or more processors, causes a processor implemented method for blockchain-based secure credential and token management for open identity management that enables a first device to provision at least one additional device to present tokens issued to the first device by performing the steps of:

obtaining a first set of credentials comprising a blockchain-compatible public-private key pair associated with the end user, wherein the first set of credentials are created by a hardware-based cryptographic processor on the first device associated with an end user, wherein the blockchain-compatible public-private key pair comprises an end user public key and an end user private key, wherein the end user public key is published and the end user private key is protected by at least one of the end user's password, biometric or PIN code;

obtaining and caching at least one attestation token from at least one attestation issuing party, wherein the at least one attestation token is restricted by default to be unusable from any device other than the first device, and the at least one attestation issuing party attests information that they are authorized to validate with reference to the end user;

providing the at least one attestation token to at least one relying party, wherein the validity of the at least one attestation token is determined using a blockchain; and

signing a trust record on the blockchain using the first device associated with the end user to indicate that the first set of credentials trusts a second set of credentials associated with a second user device as long as the first set of credentials are valid, to indicate to the at least one relying party that the at least one attestation token presented by the second set of credentials from the second device are acceptable to the blockchain, wherein signing the trust record on the blockchain overcomes the restriction by default that the at least one attestation tokens is to be unusable from any device other than the first device, wherein the trust record indicates a quorum of credentials associated with the second set of credentials are needed to sign to revoke the first set of credentials.

15. The one or more non-transitory computer readable storage mediums storing the one or more sequences of instructions of claim 14 , which when executed by the one or more processors further causes delegating a revoke privilege to the second device that signs a revoke record on the blockchain referencing the first device to decommission the first device.

16. The one or more non-transitory computer readable storage mediums storing the one or more sequences of instructions of claim 15 , which when executed by the one or more processors further causes registering delegate credentials and a policy for delegation for the first device on the blockchain.

17. The one or more non-transitory computer readable storage mediums storing the one or more sequences of instructions of claim 16 , wherein the delegate credentials comprise designating that the second set of credentials on the second device has permissions to revoke the first set of credentials on the first device, so that the second device can revoke the first set of credentials on the first device by signing a blockchain transaction from the second device.

18. The one or more non-transitory computer readable storage mediums of claim 16 , wherein the delegate credentials comprise designating at least one device other than the first device to have permission to take over the first set of credentials from the first device and assign the first set of credentials to a new device, by designating that the at least one device have to sign a take over transaction on the blockchain.

19. The one or more non-transitory computer readable storage mediums of claim 14 , wherein when the at least one attestation issuing party issues at least one attestation token to the first device associated with end user, the at least one attestation token is registered on the blockchain by associating the at least one attestation token with the public key of the end user and are signed by the issuing party private key.

20. The one or more non-transitory computer readable storage mediums of claim 14 , wherein an attestation token is revoked by signing a revoke record using a private key associated with a revoker device and making an entry in the blockchain only when a public key of the revoker device is either the public key of the end user to which the attestation token was issued by the at least one attestation issuing party or the public key of the at least one attestation issuing party.