Dynamic group membership for devices
Some embodiments provide a method for a first device that identifies definitions of different groups of devices, each of which is defined by a set of properties required for a device to be a member. The method monitors properties of the first device to determine when the device is eligible for membership in a group. When the first device is eligible for membership in a first group of which the device is not a member, the method sends an application for membership in the first group signed with at least a private key of the device to at least one other device that is a member of the first group. When the first device becomes ineligible for membership in a second group of which the first device is a member, the method removes the device from the second group and notifies other devices that are members of the second group.
1. A method implemented by a first computing device, the method comprising:
establishing at least one cryptographic key;
identifying, based on the at least one cryptographic key, a particular synchronization sub-group to which the at least one cryptographic key corresponds, wherein the particular synchronization sub-group is identified based on a file type associated with the at least one cryptographic key, a software application with which the at least one cryptographic key is associated, or some combination thereof;
tagging the at least one cryptographic key as being included in the particular synchronization sub-group; and
in response to determining that the first computing device and a second computing device both participate in the particular synchronization sub-group:
forming a secure channel with the second computing device,
encrypting, based on requirements of the secure channel used for communicating with the second computing device, the at least one cryptographic key to produce at least one encrypted cryptographic key, and
sending, over the secure channel, the at least one encrypted cryptographic key to the second computing device.
2. The method of claim 1 , wherein the secure channel is formed with the second computing device using an Off-the-Record (OTR) messaging protocol.
3. The method of claim 1 , wherein establishing the at least one cryptographic key comprises:
receiving information through an application executing on the first computing device, and
generating the at least one cryptographic key based on the information.
4. The method of claim 3 , wherein the information comprises:
a username and a password, and/or
a cryptographic credential.
5. The method of claim 1 , wherein the at least one cryptographic key is encrypted using a shared key for encrypting messages transmitted over the secure channel.
6. The method of claim 1 , further comprising, prior to sending the at least one encrypted cryptographic key to the second computing device:
encrypting the at least one encrypted cryptographic key using an additional key that is required to be possessed by both the first and second computing devices in order to participate in the particular synchronization sub-group.
7. At least one non-transitory computer readable storage medium configured to store instructions that, when executed by at least one processor included in a first computing device, cause the first computing device to carry out steps that include:
establishing at least one cryptographic key;
identifying, based on the at least one cryptographic key, a particular synchronization sub-group to which the at least one cryptographic key corresponds, wherein the particular synchronization sub-group is identified based on a file type associated with the at least one cryptographic key, a software application with which the at least one cryptographic key is associated, or some combination thereof;
tagging the at least one cryptographic key as being included in the particular synchronization sub-group; and
in response to determining that the first computing device and a second computing device both participate in the particular synchronization sub-group:
forming a secure channel with the second computing device,
encrypting, based on requirements of the secure channel used for communicating with the second computing device, the at least one cryptographic key to produce at least one encrypted cryptographic key, and
sending, over the secure channel, the at least one encrypted cryptographic key to the second computing device.
8. The at least one non-transitory computer readable storage medium of claim 7 , wherein the secure channel is formed with the second computing device using an Off-the-Record (OTR) messaging protocol.
9. The at least one non-transitory computer readable storage medium of claim 7 , wherein establishing the at least one cryptographic key comprises:
receiving information through an application executing on the first computing device, and
generating the at least one cryptographic key based on the information.
10. The at least one non-transitory computer readable storage medium of claim 9 , wherein the information comprises:
a username and a password, and/or
a cryptographic credential.
11. The at least one non-transitory computer readable storage medium of claim 7 , wherein the at least one cryptographic key is encrypted using a shared key for encrypting messages transmitted over the secure channel.
12. The at least one non-transitory computer readable storage medium of claim 7 , wherein the steps further include, prior to sending the at least one encrypted cryptographic key to the second computing device:
encrypting the at least one encrypted cryptographic key using an additional key that is required to be possessed by both the first and second computing devices in order to participate in the particular synchronization sub-group.
13. A first computing device, comprising:
at least one processor; and
at least one memory storing instructions that, when executed by the at least one processor, cause the first computing device to carry out steps that include:
establishing at least one cryptographic key;
identifying, based on the at least one cryptographic key, a particular synchronization sub-group to which the at least one cryptographic key corresponds, wherein the particular synchronization sub-group is identified based on a file type associated with the at least one cryptographic key, a software application with which the at least one cryptographic key is associated, or some combination thereof;
tagging the at least one cryptographic key as being included in the particular synchronization sub-group; and
in response to determining that the first computing device and a second computing device both participate in the particular synchronization sub-group:
forming a secure channel with the second computing device,
encrypting, based on requirements of the secure channel used for communicating with the second computing device, the at least one cryptographic key to produce at least one encrypted cryptographic key, and
sending, over the secure channel, the at least one encrypted cryptographic key to the second computing device.
14. The first computing device of claim 13 , wherein the secure channel is formed with the second computing device using an Off-the-Record (OTR) messaging protocol.
15. The first computing device of claim 13 , wherein establishing the at least one cryptographic key comprises:
receiving information through an application executing on the first computing device, and
generating the at least one cryptographic key based on the information.
16. The first computing device of claim 15 , wherein the information comprises:
a username and a password, and/or
a cryptographic credential.
17. The first computing device of claim 13 , wherein the at least one cryptographic key is encrypted using a shared key for encrypting messages transmitted over the secure channel.