Improving decentralization of last resort recovery using secrets
Reinstating access to a system of an admin whose certificate is invalid or expired is disclosed using a secret that is remapped. When the admin's certificate is expired, the admin may send a request for reinstatement to tenant admins. The voting operation is based on shares of a secret that have been distributed to validators. When the shares are successfully reconstructed to obtain the secret, the voting operation is affirmed or allowed to proceed. The secret is remapped after a period of time. Remapping the secret includes creating a new secret and distributing new shares of the new secret to a different set of validators.
1 . A method comprising:
distributing shares of a secret to a set of validators;
after a period of time, remapping the secret to a new set of validators;
distributing the shares of the secret to the new set of validators based on the remapping;
receiving a request for reinstatement from a requestor after the remapping, wherein a voting operation is performed in response to the requestor losing access to the system and the requestor is purporting to be an admin, wherein a certificate of the admin has expired and the admin cannot access the system;
reconstructing the secret from a sufficient number of the shares if the requestor passes identity tests performed by the sufficient number of the set of new validators during the voting operation, wherein the requester is reinstated as an admin if the secret is successfully reconstructed, wherein the sufficient number is at least a majority of the set of new validators.
2 . The method of claim 1 , wherein remapping the secret includes generating a new secret and dividing the new secret into new shares and distributing the new shares to the new set of validators.
3 . The method of claim 2 , further comprising detecting that the requestor is an attacker when the request is related to the secret rather than the new secret or when the request is directed to the set of validators rather than the new set of validators.
4 . The method of claim 1 , wherein the identity tests include log-based tests, identity validation tests, digital asset related tests, and/or geographical validation tests.
5 . The method of claim 1 , wherein the new set of validators includes validators that use different characteristics to perform identity tests.
6 . The method of claim 5 , further comprising organizing the validators into groups, wherein each group is associated with characteristics that are different from characteristics of other groups, wherein at least one validator in each of the groups receives one of the shares.
7 . The method of claim 1 , wherein the validators include other admins, other tenant admins, and/or applications.
8 . The method of claim 1 , further comprising terminating the voting operation when the new secret cannot be reconstructed, when an insufficient number of the new shares are received, and/or one or more of the new shares is counterfeit.
9 . A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
distributing shares of a secret to a set of validators;
after a period of time, remapping the secret to a new set of validators, wherein remapping the secret includes:
generating a new secret and dividing the new secret into new shares;
distributing the new shares to a new set of validators;
receiving a request for reinstatement from a requestor after the new secret has been generated, wherein a voting operation is performed in response to the requestor losing access to the system and the requestor is purporting to be the admin, wherein a certificate of the admin has expired and the admin cannot access the system;
reconstructing the new secret from a sufficient number of the new shares if the requestor passes identity tests performed by the sufficient number of the set of new validators during the voting operation, wherein the requester is reinstated as an admin if the new secret is successfully reconstructed, wherein the sufficient number is at least a majority of the new set of validators.
10 . The non-transitory storage medium of claim 9 , further comprising detecting that the requestor is an attacker when the request is related to the secret rather than the new secret or when the request is directed to the set of validators rather than the new set of validators.
11 . The non-transitory storage medium of claim 9 , wherein the identity tests include log-based tests, identity validation tests, digital asset related tests, and/or geographical validation tests.
12 . The non-transitory storage medium of claim 9 , wherein the new set of validators includes validators that use different characteristics to perform identity tests.
13 . The non-transitory storage medium of claim 12 , further comprising organizing the validators into groups, wherein each group is associated with characteristics that are different from characteristics of other groups, wherein at least one validator in each of the groups receives one of the shares.
14 . The non-transitory storage medium of claim 9 , wherein the validators include other admins, other tenant admins, and/or applications.
15 . The non-transitory storage medium of claim 9 , further comprising terminating the voting operation when the new secret cannot be reconstructed, when an insufficient number of the new shares are received, and/or one or more of the new shares is counterfeit.
16 . A method comprising:
distributing shares of a secret to a set of validators;
redistributing the shares to a new set of validators or redistributing new shares of a new secret to the new set of validators;
receiving a request for reinstatement from a requestor, wherein the requestor is identified as an attacker if shares of the secret are requested or if the request is directed to the set of validators rather than the new set of validators;
receiving a number of the shares from the validators at a voting engine, wherein each of the validators in the set of validators performs an identity test prior to providing their shares to the voting engine;
reconstructing the secret if a sufficient number of the shares are received from the set of validators, wherein the requester is reinstated as an admin if the new secret is successfully reconstructed.