Credential dependency encoding and verification based on other credential resources
Various systems and methods of establishing and providing credential dependency information in RESTful transactions are described. In an example, accessing credential resource dependencies may be performed by a credential management service (CMS) or other server, with operations including: receiving a request for a credential resource in a Representation State Transfer (RESTful) communication; identifying the credential resource which has a credential path that indicates a dependency associated with a credential; identifying dependency characteristics of the credential resource, based on the dependency; populating the credential resource to include a dependent credential, based on the dependency characteristics; and transmitting the populated credential resource in response to the request. In further examples, the credential resource and the credential path within the credential resource may be established, such as by defining paths to trust anchor entries, or dependencies to a trusted computing key of a trusted computing module that attests to trust properties.
1. A device, comprising:
circuitry to provide a plurality of layers, including a first, higher-layer trusted computing security component and a second, lower-layer trusted computing security component, the lower-layer trusted computing security component operable at a lower layer relative to the higher-layer trusted computing security component, wherein the lower-layer trusted computing security component is an embedded certificate authority (ECA), and wherein the ECA is dependent on a certificate authority; and
a memory device including instructions embodied thereon, wherein the instructions, which when executed by the circuitry, configure the circuitry to:
receive a certificate signing request at the lower-layer trusted computing security component, the certificate signing request provided from the higher-layer trusted computing security component;
validate information in the certificate signing request, wherein to validate includes:
verification that a signature of the certificate signing request was created using a key issued by the lower-layer trusted computing security component; and
verification of an identifier in the certificate signing request;
issue a signed certificate in response to validating information in the certificate signing request, the signed certificate to be signed using a key of the lower-layer trusted computing security component; and
provide the signed certificate to the higher-layer trusted computing security component,
wherein the signed certificate is used by the device to verify that the lower-layer trusted computing security component has established trust in the higher-layer trusted computing security component, and
wherein the signed certificate is used by the device to sign an attribute certificate which includes attestation information that pertains to a layer-specific end-entity certificate.
2. The device of claim 1 , wherein a consumer of an ECA-issued certificate traces trust dependencies through a plurality of layers to a trust anchor.
3. The device of claim 2 , wherein the trust anchor is a manufacturer root certificate authority (CA).
4. The device of claim 1 , wherein the circuitry is implemented via a System on a Chip (SoC).
5. At least one non-transitory machine-readable medium comprising instructions that, when executed by circuitry of a device, cause the circuitry to perform operations to:
receive a certificate signing request at a first, lower-layer trusted computing security component, the certificate signing request provided from a second, higher-layer trusted computing security component, the lower-layer trusted computing security component to operate at a lower layer relative to the higher-layer trusted computing security component, wherein the lower-layer trusted computing security component is an embedded certificate authority (ECA), and wherein the ECA is dependent on a certificate authority;
validate information in the certificate signing request, wherein to validate includes:
verification that a signature of the certificate signing request was created using a key issued by the lower-layer trusted computing security component; and
verification of an identifier in the certificate signing request;
issue a signed certificate in response to validating information in the certificate signing request, the signed certificate to be signed using a key of the lower-layer trusted computing security component; and
provide the signed certificate to the higher-layer trusted computing security component;
wherein the signed certificate is used by the device to verify that the lower-layer trusted computing security component has established trust in the higher-layer trusted computing security component, and
wherein the signed certificate is used by the device to sign an attribute certificate which includes attestation information that pertains to a layer-specific end-entity certificate.
6. The at least one non-transitory machine-readable medium of claim 5 , wherein a consumer of an ECA-issued certificate traces trust dependencies through a plurality of layers to a trust anchor.
7. The at least one non-transitory machine-readable medium of claim 6 , wherein the trust anchor is a manufacturer root certificate authority (CA).
8. The at least one non-transitory machine-readable medium of claim 5 , wherein the circuitry is implemented via a System on a Chip (SoC).
9. A method performed by a device, comprising:
receiving a certificate signing request at a first, lower-layer trusted computing security component of the device, the certificate signing request provided from a second, higher-layer trusted computing security component of the device, the lower-layer trusted computing security component to operate at a lower layer relative to the higher-layer trusted computing security component, wherein the lower-layer trusted computing security component is an embedded certificate authority (ECA), and wherein the ECA is dependent on a certificate authority;
validating information in the certificate signing request, wherein the validating includes:
verifying that a signature of the certificate signing request was created using a key issued by the lower-layer trusted computing security component; and
verifying an identifier in the certificate signing request;
issuing a signed certificate in response to validating information in the certificate signing request, the signed certificate to be signed using a key of the lower-layer trusted computing security component; and
providing the signed certificate to the higher-layer trusted computing security component;
wherein the signed certificate is used by the device to verify that the lower-layer trusted computing security component has established trust in the higher-layer trusted computing security component, and
wherein the signed certificate is used by the device to sign an attribute certificate which includes attestation information that pertains to a layer-specific end-entity certificate.
10. The method of claim 9 , wherein a consumer of an ECA-issued certificate traces trust dependencies through a plurality of layers to a trust anchor.
11. The method of claim 10 , wherein the trust anchor is a manufacturer root certificate authority (CA).