User-session management in a zero-knowledge environment
Examples of the present disclosure describe systems and methods relating to user-session management in a zero-knowledge environment. When a user authenticates with a computing service to begin a session, a credential-cipher key is used to encrypt the user's authentication credentials, thereby generating session-resume data. The computing service stores the credential-cipher key, such that it is not retained by the user's computing device. Accordingly, when the user resumes the session, a resume request is generated to retrieve the credential-cipher key from the computing service, wherein the request is validated before providing the key. Upon successful validation, the computing service provides the credential-cipher key, which is then used to decrypt the session-resume data and regain access to the user's authentication credentials. The encrypted user data may then be decrypted, thereby obviating the need for the user to re-authenticate, while still retaining the privacy and security benefits of the zero-knowledge environment.
1. A system comprising:
at least one processor; and
memory storing instructions that, when executed by the at least one processor, causes the system to perform a set of operations, the set of operations comprising:
receiving authentication credentials from a user to begin a session with a computing service, wherein the authentication credentials are used to generate encrypted user data associated with the computing service;
generating a credential-cipher key;
providing, to the computing service, the credential-cipher key for storage;
receiving, from the computing service, a device key, wherein the device key is associated with the credential-cipher key;
encrypting, using the credential-cipher key, the authentication credentials to generate session-resume data;
storing the generated session-resume data; and
deleting the credential-cipher key from the system.
2. The system of claim 1 , wherein the set of operations further comprises:
receiving an indication to resume the session from the user;
generating a resume request for the credential-cipher key, wherein the resume request is signed using the device key;
providing the generated resume request to the computing service;
when the credential-cipher key is received from the computing service in response to the resume request, decrypting the session-resume data using the credential-cipher key to recover the authentication credentials;
decrypting the encrypted user data using the recovered authentication credentials to generate decrypted user data; and
resuming the session based on the decrypted user data.
3. The system of claim 2 , wherein the set of operations further comprises:
when the credential-cipher key is not received from the computing service, generating a prompt for authentication credentials; and
presenting the generated prompt to the user.
4. The system of claim 2 , wherein a second device key is received when the credential-cipher key is received from the computing service, and wherein the set of operations further comprises storing the second device key.
5. The system of claim 1 , wherein providing the credential-cipher key to the computing service for storage comprises signing the credential-cipher key using a session key provided by the computing service.
6. The system of claim 1 , wherein receiving the authentication credentials from the user further comprises receiving a user indication that the authentication credentials should be stored to enable the session to later be resumed.
7. The system of claim 1 , wherein the authentication credentials comprise at least one of:
a master password; and
a cryptographic key.
8. A method for managing a user session of a computing service, comprising:
receiving, by a computing device, authentication credentials from a user to begin a session with the computing service, wherein the authentication credentials are used to generate encrypted user data associated with the computing service;
encrypting, using a credential-cipher key, the authentication credentials to generate session-resume data, wherein the credential-cipher key is not retained by the computing device;
storing the generated session-resume data;
receiving, from the user, an indication to resume the session;
generating a resume request to access the credential-cipher key from the computing service;
decrypting the session-resume data using the received credential-cipher key to recover the authentication credentials;
decrypting the encrypted user data using the recovered authentication credentials to generate decrypted user data; and
resuming the session based on the decrypted user data.
9. The method of claim 8 , further comprising receiving, from the computing service, a device key associated with the credential-cipher key, and wherein the device key is used to sign the resume request.
10. The method of claim 9 , wherein a second device key is received when the credential-cipher key is accessed from the computing service, and wherein the method further comprises storing the second device key.
11. The method of claim 8 , wherein the indication to resume the session comprises receiving an indication to open an application associated with the computing service.
12. The method of claim 8 , wherein receiving the authentication credentials from the user further comprises receiving a user indication that session-resume data should be generated and stored to enable the session to later be resumed.
13. The method of claim 8 , wherein the authentication credentials comprise at least one of:
a master password; and
a cryptographic key.
14. A method for managing a user session of a computing service, comprising:
receiving, by a computing device, authentication credentials from a user to begin a session with the computing service, wherein the authentication credentials are used to generate encrypted user data associated with the computing service;
generating a credential-cipher key;
providing, to the computing service, the credential-cipher key for storage;
receiving, from the computing service, a device key, wherein the device key is associated with the credential-cipher key by the computing service;
encrypting, using the credential-cipher key, the authentication credentials to generate session-resume data;
storing the generated session-resume data; and
deleting the credential-cipher key from the computing device.
15. The method of claim 14 , further comprising:
receiving an indication to resume the session from the user;
generating a resume request for the credential-cipher key, wherein the resume request is signed using the device key;
providing the generated resume request to the computing service;
when the credential-cipher key is received from the computing service in response to the resume request, decrypting the session-resume data using the credential-cipher key to recover the authentication credentials;
decrypting the encrypted user data using the recovered authentication credentials to generate decrypted user data; and
resuming the session based on the decrypted user data.
16. The method of claim 15 , further comprising:
when the credential-cipher key is not received from the computing service, generating a prompt for authentication credentials; and
presenting the generated prompt to the user.
17. The method of claim 15 , wherein a second device key is received when the credential-cipher key is received from the computing service, and wherein the method further comprises storing the second device key.
18. The method of claim 14 , wherein providing the credential-cipher key to the computing service for storage comprises signing the credential-cipher key using a session key provided by the computing service.
19. The method of claim 14 , wherein receiving the authentication credentials from the user further comprises receiving a user indication that session-resume data should be generated and stored to enable the session to later be resumed.
20. The method of claim 14 , wherein the authentication credentials comprise at least one of:
a master password; and
a cryptographic key.