Communication-efficient device delegation
Techniques are provided for communication-efficient device delegation. One method comprises, in response to a request for a new signing key of a given device, determining a number of new signing key requests received for the user of the given device; determining a new public verification key of the given device for an identity-based signature scheme by traversing a cryptographic hash chain backwards from a position of an initial selected value of the cryptographic hash chain; computing a new signing key based on public parameters and secret parameters of a backup component and the initial selected value; and providing the new public verification key and the new signing key to the given device. The given device authenticates to an authentication service using an identity-based signature computed using the new signing key. The request for the new signing key is submitted, for example, when the given device is lost, damaged, unavailable or stolen.
1. A method, comprising:
in response to a request for a new signing key of a given device, at least one processing device of a backup component performs the following steps:
determining a number of new signing key requests that have been received for a user of the given device;
determining a new public verification key of the given device for an identity-based signature scheme by traversing a cryptographic hash chain comprised of a plurality of hash values, from a position of an initial selected value of the cryptographic hash chain backwards in the cryptographic hash chain based on the number of new signing key requests, wherein the cryptographic hash chain is computed from a seed value construct of the backup component and is traversed by skipping a number of hash values of the chain to determine the new public verification key;
computing a new signing key of the given device based on one or more public parameters of the backup component, one or more secret parameters of the backup component, the number of hash values of the chain to be skipped, and the initial selected value; and
providing the new public verification key of the given device and the new signing key of the given device to the given device, wherein the given device authenticates to an authentication service for the identity-based signature scheme using an identity-based signature that is computed by the given device using the new signing key, the one or more public parameters of the backup component and an authentication challenge string.
2. The method of claim 1 , further comprising a step of the backup component providing the number of new signing key requests to the given device.
3. The method of claim 1 , wherein the given device provides the number of new signing key requests to the authentication service and wherein the authentication service validates the provided number of new signing key requests.
4. The method of claim 1 , wherein the given device provides the new public verification key of the given device to the authentication service and wherein the authentication service validates the new public verification key of the given device by comparing the new public verification key of the given device to at least one prior version of the public verification key of the user of the given device.
5. The method of claim 4 , wherein the authentication service validates the new public verification key of the given device, the one or more public parameters of the backup component and the authentication challenge string using the new public verification key of the given device.
6. The method of claim 4 , wherein the authentication service authenticates the given device upon validating the new public verification key of the given device.
7. The method of claim 1 , wherein the request for the new signing key of the given device is submitted when the given device is one or more of lost, damaged, unavailable and stolen.
8. A system, comprising:
a memory; and
at least one processing device, coupled to the memory, operative to implement the following steps: in response to a request for a new signing key of a given device, a backup component performs the following steps:
determining a number of new signing key requests that have been received for a user of the given device;
determining a new public verification key of the given device for an identity-based signature scheme by traversing a cryptographic hash chain comprised of a plurality of hash values, from a position of an initial selected value of the cryptographic hash chain backwards in the cryptographic hash chain based on the number of new signing key requests, wherein the cryptographic hash chain is computed from a seed value construct of the backup component and is traversed by skipping a number of hash values of the chain to determine the new public verification key;
computing a new signing key of the given device based on one or more public parameters of the backup component, one or more secret parameters of the backup component, the number of hash values of the chain to be skipped, and the initial selected value; and
providing the new public verification key of the given device and the new signing key of the given device to the given device, wherein the given device authenticates to an authentication service for the identity-based signature scheme using an identity-based signature that is computed by the given device using the new signing key, the one or more public parameters of the backup component and an authentication challenge string.
9. The system of claim 8 , further comprising a step of the backup component providing the number of new signing key requests to the given device.
10. The system of claim 8 , wherein the given device provides the number of new signing key requests to the authentication service and wherein the authentication service validates the provided number of new signing key requests.
11. The system of claim 8 , wherein the given device provides the new public verification key of the given device to the authentication service and wherein the authentication service validates the new public verification key of the given device by comparing the new public verification key of the given device to at least one prior version of the public verification key of the user of the given device.
12. The system of claim 11 , wherein the authentication service validates the new public verification key of the given device, the one or more public parameters of the backup component and the authentication challenge string using the new public verification key of the given device.
13. The system of claim 11 , wherein the authentication service authenticates the given device upon validating the new public verification key of the given device.
14. The system of claim 8 , wherein the request for the new signing key of the given device is submitted when the given device is one or more of lost, damaged, unavailable and stolen.
15. A computer program product, comprising a tangible machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps:
in response to a request for a new signing key of a given device, a backup component performs the following steps:
determining a number of new signing key requests that have been received for a user of the given device;
determining a new public verification key of the given device for an identity-based signature scheme by traversing a cryptographic hash chain comprised of a plurality of hash values, from a position of an initial selected value of the cryptographic hash chain backwards in the cryptographic hash chain based on the number of new signing key requests, wherein the cryptographic hash chain is computed from a seed value construct of the backup component and is traversed by skipping a number of hash values of the chain to determine the new public verification key;
computing a new signing key of the given device based on one or more public parameters of the backup component, one or more secret parameters of the backup component, the number of hash values of the chain to be skipped, and the initial selected value; and
providing the new public verification key of the given device and the new signing key of the given device to the given device, wherein the given device authenticates to an authentication service for the identity-based signature scheme using an identity-based signature that is computed by the given device using the new signing key, the one or more public parameters of the backup component and an authentication challenge string.
16. The computer program product of claim 15 , further comprising a step of the backup component providing the number of new signing key requests to the given device.
17. The computer program product of claim 15 , wherein the given device provides the number of new signing key requests to the authentication service and wherein the authentication service validates the provided number of new signing key requests.
18. The computer program product of claim 15 , wherein the given device provides the new public verification key of the given device to the authentication service and wherein the authentication service validates the new public verification key of the given device by comparing the new public verification key of the given device to at least one prior version of the public verification key of the user of the given device.
19. The computer program product of claim 18 , wherein the authentication service validates the new public verification key of the given device, the one or more public parameters of the backup component and the authentication challenge string using the new public verification key of the given device, and authenticates the given device upon validating the new public verification key of the given device.
20. The computer program product of claim 15 , wherein the request for the new signing key of the given device is submitted when the given device is one or more of lost, damaged, unavailable and stolen.