Systems, methods, and storage media for permissioned delegation in a computing environment

1. A certificate issuer computing system for enforcing permissions delegation in a computing environment, the certificate issuer computing system having permissions to execute at least one transaction on behalf of a user the system comprising:

one or more hardware processors configured by machine-readable instructions to:

receive a permissions request, from a requesting computing system, for a permissions certificate, the permissions request specifying permissions to execute at least a subset of the at least one transaction on behalf of the user and the permissions request including a cryptographic public key associated with the requesting computing system;

transmit a login request to a user computing system associated with a user, the login request causing a login interface to be displayed on the user computing system;

receive an acceptance from the user in response to the login request;

generate a permissions certificate data structure in response to the acceptance, the permissions certificate data structure including the cryptographic public key associated with the requesting computing device, a cryptographic public key associated with the issuer computing system, a permissions indication indicating the permissions to execute the at least a subset of the at least one transaction on behalf of the user, and a certificate signature of the certificate issuer computer system private key against the certificate object; and

return the permissions certificate data structure to the requesting computing system whereby the requesting computing system will be permitted to accomplish the at least a subset of the at least one transaction on behalf of the user with a transacting party in place of the certificate issuer computing system based on possession of the permissions certificate data structure paired with a cryptographic signature based on a private cryptographic key associated with the requesting computing system.

2. The system of claim 1 , wherein the requesting computing device is configured to:

build a request for the transaction;

attach the permissions certificate to the request for the transaction;

generate a cryptographic proof of the transaction request; and

transmit the transaction request.

3. The system of claim 2 , wherein the permissions certificate is verified by at least one of; the certificate issuer verifying the signature, and/or the requesting computing system verifying the transaction proof.

4. The system of claim 1 , wherein the permissions request further specifies a public address of the certificate issuer computing system.

5. The system of claim 1 , wherein the permissions request is for multiple permissions certificates, each corresponding to a specific transaction, and the generating comprises generating multiple permissions certificates for each specific transaction.

6. The system of claim 3 , wherein the verifying further includes checking for revocation of the permissions certificate.

7. The system of claim 1 , wherein the transaction is access to at least one of computing resources and/or a physical property.

8. The system of claim 3 , wherein the permissions certificate includes an expiration condition and wherein the verifying includes checking to see if the expiration condition has been satisfied.

9. The system of claim 1 , wherein the permissions include at least one permissions domain.

10. The system of claim 1 , wherein the permission certificate is part of a tree of permissions certificates that can be used to verify a permission through a chain of multiple parties.

11. The system of claim 1 , wherein generating the permissions certificate comprises:

a) creating an empty certificate object;

b) attaching the public cryptographic key associated with the requesting computing device to the certificate object;

c) attaching a public cryptographic key associated with the certificate issuer computing system;

d) attaching a permissions object to the certificate object, the permissions object specifying the permissions and a permissions domain;

e) calculating the certificate signature of the issuer private key against the certificate object; and

f) attaching the signature to permissions object.

12. The system of claim 1 , wherein the computing environment is a decentralized computing environment.

13. The system of claim 12 , wherein the computing environment comprises a blockchain ledger stored on peer-to-peer nodes.

14. The system of claim 1 , wherein the permissions indication is a data structure indicating a subset of permissions held by the certificate issuer computer system.

15. The system of claim 1 , wherein the permission indication indicates a delegation of full rights held by the issuer computer system.

16. The system of claim 15 , wherein the permissions indication is the absence of a permissions data structure.

17. The system of claim 14 , wherein the permissions indicator indicates the right for the holder of the certificate to grant further permissions to another party.

18. The system of claim 17 , wherein the further permissions are a subset of permissions held by the certificate issuer computer system.

19. A method, implemented by a certificate issuer computing system, for permissions delegation in a computing environment, the certificate issuer computing system having permissions to execute at least one transaction on behalf of a user, the method comprising:

receiving a permissions request, from a requesting computing system for a permissions certificate, the permissions request specifying permissions to execute at least a subset of the at least one transaction on behalf of the user and a cryptographic public key associated with the requesting computing system;

transmitting a login request to a user computing system associated with a user, the login request causing a login interface to be displayed on the user computing system;

receiving an acceptance from the user in response to the login request;

generating a permissions certificate data structure in response to the acceptance, the data structure including the cryptographic public key associated with the requesting computing device, a cryptographic public key associated with the issuer computing system, a permissions indication indicating permissions to execute the at least a subset of the at least one transaction on behalf of the user, and a certificate signature of the issuer private key against the certificate object; and

returning the permissions certificate to the requesting computing system whereby the requesting computing system will be permitted to accomplish the at least a subset of the at least one transaction on behalf of the user with a transacting party in place of the issuer computing system based on possession of the permissions certificate paired with a cryptographic signature based on a private cryptographic key associated with the requesting computing system.

20. The method of claim 19 , further comprising the requesting computing device:

building a request for the transaction;

attaching the permissions certificate to the request for the transaction;

generating a cryptographic proof of the transaction request; and

transmitting the transaction request.

21. The method of claim 20 , wherein the permissions certificate is verified by at least one of; the certificate issuer verifying the signature and/or the requesting computing system verifying the transaction proof.

22. The method of claim 19 , wherein the permissions request further specifies a public address of the certificate issuer computing system.

23. The method of claim 19 , wherein the permissions request is for multiple permissions certificates, each corresponding to a specific transaction, and the generating comprises generating multiple permissions certificates for each specific transaction.

24. The method of claim 21 , wherein the verifying further includes checking for revocation of the permissions certificate.

25. The method of claim 19 , wherein the transaction is access to at least one of computing resources and/or a physical property.

26. The method of claim 21 , wherein the permissions certificate includes an expiration condition and wherein the verifying includes checking to see if the expiration condition has been satisfied.

27. The method of claim 19 , wherein the permissions include at least one permissions domain.

28. The method of claim 19 , wherein the permission certificate is part of a tree of permissions certificates that can be used to verify a permission through a chain of multiple parties.

29. The method of claim 19 , wherein generating the permissions certificate comprises:

a) creating an empty certificate object;

b) attaching the public cryptographic key associated with the requesting computing device to the certificate object;

c) attaching a public cryptographic key associated with the certificate issuer computing system;

d) attaching a permissions object to the certificate object, the permissions object specifying the permissions and a permissions domain;

e) calculating the certificate signature of the issuer private key against the certificate object; and

f) attaching the signature to permissions object.

30. The method of claim 19 , wherein the computing environment is a decentralized computing environment.

31. The method of claim 30 , wherein the computing environment comprises a blockchain ledger stored on peer-to-peer nodes.

32. The method of claim 19 , wherein the permissions indication is a data structure indicating a subset of permissions held by the certificate issuer computer system.

33. The method of claim 19 , wherein the permission indication indicates a delegation of full rights held by the issuer computer system.

34. The method of claim 33 , wherein the permissions indication is the absence of a permissions data structure.

35. The method of claim 32 , wherein the permissions indicator indicates the right for the holder of the certificate to grant further permissions to another party.

36. The method of claim 35 , wherein the further permissions are a subset of permissions held by the issuer computer system.

37. A non-transient computer-readable storage medium having instructions embodied thereon, the instructions being executable by one or more processors to perform a method, implemented by a certificate issuer computing system, for permissions delegation in a computing environment, the certificate issuer computing system having permissions to execute at least one transaction on behalf of a user, the method comprising:

receiving a permissions request, from a requesting computing system for a permissions certificate, the permissions request specifying permissions to execute at least a subset of the at least one transaction on behalf of the user and a cryptographic public key associated with the requesting computing system;

transmitting a login request to a user computing system associated with a user, the login request causing a login interface to be displayed on the user computing system;

receiving an acceptance from the user in response to the login request;

generating a permissions certificate data structure in response to the acceptance, the data structure including the cryptographic public key associated with the requesting computing device, a cryptographic public key associated with the issuer computing system, a permissions indication indicating permissions, and a certificate signature of the issuer private key against the certificate object; and

returning the permissions certificate to the requesting computing system whereby the requesting computing system will be permitted to accomplish the at least a subset of the at least one transaction on behalf of the user with a transacting party in place of the issuer computing system based on possession of the permissions certificate paired with a cryptographic signature based on a private cryptographic key associated with the requesting computing system.

38. A method for verifying a permissions certificate issued by a certificate issuer computer system for delegating transaction permissions in a computing environment, the certificate issuer computing system having permissions to execute at least one transaction on behalf of a user, the method comprising:

receiving a permissions certificate, wherein the permissions certificate was constructed by:

receiving a permissions request, from a requesting computing, system for a permissions certificate, the permissions request specifying permissions to execute at least a subset of the at least one a-transaction on behalf of a user and a cryptographic public key associated with the requesting computing system;

transmitting a login request to a user computing system associated with a user, the login request causing a login interface to be displayed on the user computing system;

receiving an acceptance from the user in response to the login request; and

generating a permissions certificate data structure in response to the acceptance, the permissions certificate data structure including the cryptographic public key associated with the requesting computing device, a cryptographic public key associated with the issuer computing system, a permissions indication indicating permissions to execute the at least a subset of the at least one transaction on behalf of the user, and a certificate

signature of the issuer private key against the certificate object;

checking the validity of the permissions certificate by at least one of; the certificate issuer verifying the signature, the requesting computing system verifying the transaction proof, a check that an expiration time specified in the permissions certificate has not passed and/or a check that the permissions certificate has not have been revoked.