Technologies for collective authorization with hierarchical group keys
Technologies for secure collective authorization include multiple computing devices in communication over a network. A computing device may perform a join protocol with a group leader to receive a group private key that is associated with an interface implemented by the computing device. The interface may be an instance of an object model implemented by the computing device or membership of the computing device in a subsystem. The computing device receives a request for attestation to the interface, selects the group private key for the interface, and sends an attestation in response to the request. Another computing device may receive the attestation and verify the attestation with a group public key corresponding to the group private key. The group private key may be an enhanced privacy identifier (EPID) private key, and the group public key may be an EPID public key. Other embodiments are described and claimed.
1. A computing device to facilitate credential provisioning, the computing device comprising:
processor circuitry coupled to a memory, the processor circuitry hosting or coupled to key manager circuitry and group manager circuitry, wherein the processor circuitry to facilitate:
the key manager circuitry to establish a group public key associated with an interface, wherein the group public key is associated with a plurality of group private keys; and
the group manager circuitry to provision a plurality of component computing devices with the plurality of group private keys, wherein a component computing device of the plurality of component computing devices implements the interface and is provisioned with a group private key of the plurality of group private keys, wherein the interface represents a level in a hierarchy of interfaces, and wherein the group private key is associated with the interface.
2. The computing device of claim 1 , wherein the group public key comprises an enabled privacy identifier (EPID) public key, and wherein the group private key comprises an EPID private key.
3. The computing device of claim 1 , wherein to provision the plurality of component computing devices comprises to execute an EPID join protocol with the plurality of component computing devices.
4. The computing device of claim 1 , wherein the interface comprises an instance of an object model implemented by one or more component computing devices.
5. The computing device of claim 1 , wherein the interface comprises a membership of the one or more component computing devices in a subsystem.
6. The computing device of claim 1 , further comprising a system integrator circuitry to integrate the plurality of component computing devices in the subsystem.
7. A method for credential provisioning, the method comprising:
establishing, by key manager circuitry as facilitated by processor circuitry of a computing device, a group public key associated with an interface, wherein the group public key is associated with a plurality of group private keys; and
provisioning, by group manager circuitry as facilitate by the processor circuitry, a plurality of component computing devices with the plurality of group private keys, wherein a component computing device of the plurality of component computing devices implements the interface and is provisioned with a group private key of the plurality of group private keys, wherein the interface represents a level in a hierarchy of interfaces, and wherein the group private key is associated with the interface.
8. The method of claim 7 , wherein the group public key comprises an enabled privacy identifier (EPID) public key, and wherein the group private key comprises an EPID private key.
9. The method of claim 7 , wherein provisioning the plurality of component computing devices comprises executing an EPID join protocol with the plurality of component computing devices.
10. The method of claim 7 , wherein the interface comprises an instance of an object model implemented by one or more component computing devices.
11. The method of claim 7 , wherein the interface comprises a membership of the one or more component computing devices in a subsystem.
12. The method of claim 7 , further comprising integrating, by a system integrator circuitry, the plurality of component computing devices in the subsystem.
13. At least one non-transitory computer-readable medium having stored thereon instructions which, when executed, cause a computing device to perform operations comprising:
establishing, by key manager circuitry, a group public key associated with an interface, wherein the group public key is associated with a plurality of group private keys; and
provisioning, by group manager circuitry, a plurality of component computing devices with the plurality of group private keys, wherein a component computing device of the plurality of component computing devices implements the interface and is provisioned with a group private key of the plurality of group private keys, wherein the interface represents a level in a hierarchy of interfaces, and wherein the group private key is associated with the interface.
14. The non-transitory computer-readable medium of claim 13 , wherein the group public key comprises an enabled privacy identifier (EPID) public key, and wherein the group private key comprises an EPID private key.
15. The non-transitory computer-readable medium of claim 13 , wherein provisioning the plurality of component computing devices comprises executing an EPID join protocol with the plurality of component computing devices.
16. The non-transitory computer-readable medium of claim 13 , wherein the interface comprises an instance of an object model implemented by one or more component computing devices.
17. The non-transitory computer-readable medium of claim 13 , wherein the interface comprises a membership of the one or more component computing devices in a subsystem.
18. The non-transitory computer-readable medium of claim 13 , wherein the operations further comprise integrating, by a system integrator circuitry, the plurality of component computing devices in the subsystem.