Trust and identity management systems and methods
The disclosure relates to, among other things, systems and methods for facilitating the secure recording and use of assertions made by entities regarding other entities. Embodiments of the disclosed systems and methods provide mechanisms to make assertions in an authentic and authoritative manner and enable discovery and reliance on those assertions using trusted distributed ledgers and/or derivatives of the same. Various embodiments may be used in connection with establishing security associations and/or secure communication channels between entities and/or the secure management of governed electronic resources.
1. A method for establishing a shared cryptographic key between a first system and a second system, the method comprising:
receiving, at the first system from the second system, a key establishment request message, the key establishment request message comprising an indication of a long-term secret key of the second system, an indication of an ephemeral secret key of the second system, identification information associated with the second system, and a key establishment request message time stamp;
generating a first check value based on the indication of the long-term secret key of the second system and the identification information associated with the second system;
transmitting, from the first system to a trusted assertion management system, a query requesting an indication of whether the first check value is included in a first ledger database maintained by the trusted assertion management system;
receiving, at the first system from the trusted assertion management system, an indication that the first check value is included in the first ledger database managed by the trusted assertion management system;
generating, in response to receiving the indication that the first check value is included in the first ledger database, a cryptographic key based at least in part on an indication of a long-term secret key of the first system, an indication of an ephemeral secret key of the first system, a time stamp associated with the first system, and information included in the key establishment request message; and
generating a key establishment response message, the key establishment response message comprising the indication of a long-term secret key of the first system, the indication of the ephemeral secret key of the first system, identification information associated with the first system, and the time stamp associated with the first system.
2. The method of claim 1 , wherein the method further comprises transmitting, from the first system to the second system, the key establishment response message.
3. The method of claim 1 , wherein the first ledger database comprises cryptographically-linked ledger entries.
4. The method of claim 3 , wherein the first ledger database comprises a blockchain ledger.
5. The method of claim 1 , wherein the first ledger database comprises at least one entry binding the indication of the long-term secret key of the second system and the identification information associated with the second system.
6. The method of claim 1 , wherein generating the first check value comprises generating a hash value based on the indication of the long-term secret key of the second system and the identification information associated with the second system.
7. The method of claim 1 , wherein the first ledger database comprises entries generated based on information included in a second ledger database.
8. The method of claim 1 , wherein the first ledger database comprises entries generated based on information included in a plurality of other ledger databases.
9. The method of claim 1 , wherein the first ledger database comprises entries generated by hashing information included in at least one other ledger database.
10. The method of claim 1 , wherein the key establishment request message comprises an indication specifying a key establishment protocol.
11. The method of claim 10 , wherein generating the first check value, transmitting the query, and generating the cryptographic key is based, at least in part, on the indication specifying a key establishment protocol.
12. The method of claim 1 , wherein the indication of a long-term secret key of the second system comprises the long-term secret key of the second system.
13. The method of claim 1 , wherein the indication of a long-term secret key of the second system comprises a hash of the long-term secret key of the second system.
14. The method of claim 1 , wherein the indication of the ephemeral secret key of the second system comprises the ephemeral secret key of the second system.
15. The method of claim 1 , wherein the indication of a long-term secret key of the first system comprises the long-term secret key of the first system.
16. The method of claim 1 , wherein the indication of a long-term secret key of the first system comprises a hash of the long-term secret key of the first system.
17. The method of claim 1 , wherein the indication of the ephemeral secret key of the first system comprises the ephemeral secret key of the first system.