Template-based distributed certificate issuance in a multi-tenant environment
One example method may include generating a template transaction certificate by one or more entities which verify proof of ownership of attributes incorporated into the template transaction certificate, and generating one or more operational transaction certificates by the one or more entities which verified proof of ownership of the template transaction certificate.
1. A method, comprising:
encrypting information including one or more attributes of one or more entities requesting operational transaction certificates for validating transactions in a distributed database,
generating a template transaction certificate for the one or more entities based on the encrypted information of one or more attributes and a key certificate that is jointly owned through the use of digital threshold signatures, the encrypted information included in the template transaction certificate to verify proof of ownership of the one or more attributes,
generating operational transaction certificates by the one or more entities based on the template transaction certificate, and
issuing one or more tokens for validating corresponding ones of the transactions recorded in the distributed database, each of the one or more tokens including one of the operational transaction certificates including the encrypted information verifying the proof of ownership of the one or more attributes.
2. The method of claim 1 , further comprising:
performing a refresh operation to obtain the one or more attributes; and
retrieving the one or more attributes associated with one or more users responsive to the refresh operation being performed.
3. The method of claim 1 , wherein the one or more attributes are retrieved from an attribute certificate authority.
4. The method of claim 3 , further comprising responsive to retrieving the one or more attributes, returning an attribute certificate comprising an enrollment public key from an enrollment certificate acquired via the attribute certificate authority.
5. The method of claim 1 , wherein at least one of the template transaction certificate or the operational transaction certificates correspond to different levels of an audit tree, the audit tree to be used by entities with different jurisdictions or levels of privacy to decrypt and recover the attributes.
6. The method of claim 1 , further comprising:
verifying a template transaction certificate signature of the template transaction certificate; and
generating one or more keys to access template transaction certificate attribute information associated with the one or more attributes.
7. The method of claim 6 , further comprising:
concatenating a timestamp, a random value and a counter with the template transaction certificate; and
signing the template transaction certificate using a private key.
8. An apparatus, comprising:
a processor configured to
encrypt information including one or more attributes of one or more entities requesting operational transaction certificates for validating transactions in a distributed database,
generate a template transaction certificate for the one or more entities based on the encrypted information of one or more attributes and a key certificate that is jointly owned through the use of digital threshold signatures, the encrypted information included in the template transaction certificate to verify proof of ownership of the one or more attributes,
generate operational transaction certificates by the one or more entities based on the template transaction certificate, and
issue one or more tokens for validating corresponding ones of the transactions recorded in the distributed database, each of the one or more tokens including one of the operational transaction certificates including the encrypted information verifying the proof of ownership of the one or more attributes.
9. The apparatus of claim 8 , wherein the processor is further configured to
perform a refresh operation to obtain the one or more attributes, and
retrieve the one or more attributes associated with one or more users responsive to the refresh operation being performed.
10. The apparatus of claim 8 , wherein the one or more attributes are retrieved from an attribute certificate authority.
11. The apparatus of claim 10 , wherein the processor is further configured to responsive to the one or more attributes being retrieved, return an attribute certificate comprising an enrollment public key from an enrollment certificate acquired via the attribute certificate authority.
12. The apparatus of claim 8 , wherein at least one of the template transaction certificate or the operational transaction certificates correspond to different levels of an audit tree, the audit tree to be used by entities with different jurisdictions or levels of privacy to decrypt and recover the attributes.
13. The apparatus of claim 8 , wherein the processor is further configured to
verify a template transaction certificate signature of the template transaction certificate, and
generate one or more keys to access template transaction certificate attribute information associated with the one or more attributes.
14. The apparatus of claim 13 , wherein the processor is further configured to
concatenate a timestamp, a random value and a counter with the template transaction certificate, and
sign the template transaction certificate using a private key.
15. A non-transitory computer readable storage medium configured to store instructions that when executed cause a processor to perform:
encrypting information including one or more attributes of one or more entities requesting operational transaction certificates for validating transactions in a distributed database,
generating a template transaction certificate for the one or more entities based on the encrypted information of one or more attributes and a key certificate that is jointly owned through the use of digital threshold signatures, the encrypted information included in the template transaction certificate to verify proof of ownership of the one or more attributes,
generating operational transaction certificates by the one or more entities based on the template transaction certificate, and
issuing one or more tokens for validating corresponding ones of the transactions recorded in the distributed database, each of the one or more tokens including one of the operational transaction certificates including the encrypted information verifying the proof of ownership of the one or more attributes.
16. The non-transitory computer readable storage medium of claim 15 , wherein the processor is further configured to perform:
performing a refresh operation to obtain the one or more attributes; and
retrieving the one or more attributes associated with one or more users responsive to the refresh operation being performed.
17. The non-transitory computer readable storage medium of claim 15 , wherein the one or more attributes are retrieved from an attribute certificate authority.
18. The non-transitory computer readable storage medium of claim 17 , wherein the processor is further configured to perform responsive to retrieving the one or more attributes, returning an attribute certificate comprising an enrollment public key from an enrollment certificate acquired via the attribute certificate authority.
19. The non-transitory computer readable storage medium of claim 15 , wherein at least one of the template transaction certificate or the operational transaction certificates correspond to different levels of an audit tree, the audit tree to be used by entities with different jurisdictions or levels of privacy to decrypt and recover the attributes.
20. The non-transitory computer readable storage medium of claim 15 , wherein the processor is further configured to perform:
verifying a template transaction certificate signature of the template transaction certificate;
generating one or more keys to access template transaction certificate attribute information associated with the one or more attributes;
concatenating a timestamp, a random value and a counter with the template transaction certificate; and
signing the template transaction certificate using a private key.