Template-based distributed certificate issuance in a multi-tenant environment

Patent metadata

Field	Value
Publication number	US-10425399-B2
Application number	US-201715631093-A
Country	US
Kind code	B2
Filing date	Jun 23, 2017
Priority date	Jul 12, 2016
Publication date	Sep 24, 2019
Grant date	Sep 24, 2019

Abstract

One example method may include generating a template transaction certificate by one or more entities which verify proof of ownership of attributes incorporated into the template transaction certificate, and generating one or more operational transaction certificates by the one or more entities which verified proof of ownership of the template transaction certificate.

First claim

What is claimed is:

1. A method, comprising:
encrypting information including one or more attributes of one or more entities requesting operational transaction certificates for validating transactions in a distributed database,
generating a template transaction certificate for the one or more entities based on the encrypted information of one or more attributes and a key certificate that is jointly owned through the use of digital threshold signatures, the encrypted information included in the template transaction certificate to verify proof of ownership of the one or more attributes,
generating operational transaction certificates by the one or more entities based on the template transaction certificate, and
issuing one or more tokens for validating corresponding ones of the transactions recorded in the distributed database, each of the one or more tokens including one of the operational transaction certificates including the encrypted information verifying the proof of ownership of the one or more attributes.

2. The method of claim 1 , further comprising:
performing a refresh operation to obtain the one or more attributes; and
retrieving the one or more attributes associated with one or more users responsive to the refresh operation being performed.

3. The method of claim 1 , wherein the one or more attributes are retrieved from an attribute certificate authority.

4. The method of claim 3 , further comprising responsive to retrieving the one or more attributes, returning an attribute certificate comprising an enrollment public key from an enrollment certificate acquired via the attribute certificate authority.

5. The method of claim 1 , wherein at least one of the template transaction certificate or the operational transaction certificates correspond to different levels of an audit tree, the audit tree to be used by entities with different jurisdictions or levels of privacy to decrypt and recover the attributes.

6. The method of claim 1 , further comprising:
verifying a template transaction certificate signature of the template transaction certificate; and
generating one or more keys to access template transaction certificate attribute information associated with the one or more attributes.

7. The method of claim 6 , further comprising:
concatenating a timestamp, a random value and a counter with the template transaction certificate; and
signing the template transaction certificate using a private key.

8. An apparatus, comprising:
a processor configured to
encrypt information including one or more attributes of one or more entities requesting operational transaction certificates for validating transactions in a distributed database,
generate a template transaction certificate for the one or more entities based on the encrypted information of one or more attributes and a key certificate that is jointly owned through the use of digital threshold signatures, the encrypted information included in the template transaction certificate to verify proof of ownership of the one or more attributes,
generate operational transaction certificates by the one or more entities based on the template transaction certificate, and
issue one or more tokens for validating corresponding ones of the transactions recorded in the distributed database, each of the one or more tokens including one of the operational transaction certificates including the encrypted information verifying the proof of ownership of the one or more attributes.

9. The apparatus of claim 8 , wherein the processor is further configured to
perform a refresh operation to obtain the one or more attributes, and
retrieve the one or more attributes associated with one or more users responsive to the refresh operation being performed.

10. The apparatus of claim 8 , wherein the one or more attributes are retrieved from an attribute certificate authority.

11. The apparatus of claim 10 , wherein the processor is further configured to responsive to the one or more attributes being retrieved, return an attribute certificate comprising an enrollment public key from an enrollment certificate acquired via the attribute certificate authority.

12. The apparatus of claim 8 , wherein at least one of the template transaction certificate or the operational transaction certificates correspond to different levels of an audit tree, the audit tree to be used by entities with different jurisdictions or levels of privacy to decrypt and recover the attributes.

13. The apparatus of claim 8 , wherein the processor is further configured to
verify a template transaction certificate signature of the template transaction certificate, and
generate one or more keys to access template transaction certificate attribute information associated with the one or more attributes.

14. The apparatus of claim 13 , wherein the processor is further configured to
concatenate a timestamp, a random value and a counter with the template transaction certificate, and
sign the template transaction certificate using a private key.

15. A non-transitory computer readable storage medium configured to store instructions that when executed cause a processor to perform:
encrypting information including one or more attributes of one or more entities requesting operational transaction certificates for validating transactions in a distributed database,
generating a template transaction certificate for the one or more entities based on the encrypted information of one or more attributes and a key certificate that is jointly owned through the use of digital threshold signatures, the encrypted information included in the template transaction certificate to verify proof of ownership of the one or more attributes,
generating operational transaction certificates by the one or more entities based on the template transaction certificate, and
issuing one or more tokens for validating corresponding ones of the transactions recorded in the distributed database, each of the one or more tokens including one of the operational transaction certificates including the encrypted information verifying the proof of ownership of the one or more attributes.

16. The non-transitory computer readable storage medium of claim 15 , wherein the processor is further configured to perform:
performing a refresh operation to obtain the one or more attributes; and
retrieving the one or more attributes associated with one or more users responsive to the refresh operation being performed.

17. The non-transitory computer readable storage medium of claim 15 , wherein the one or more attributes are retrieved from an attribute certificate authority.

18. The non-transitory computer readable storage medium of claim 17 , wherein the processor is further configured to perform responsive to retrieving the one or more attributes, returning an attribute certificate comprising an enrollment public key from an enrollment certificate acquired via the attribute certificate authority.

19. The non-transitory computer readable storage medium of claim 15 , wherein at least one of the template transaction certificate or the operational transaction certificates correspond to different levels of an audit tree, the audit tree to be used by entities with different jurisdictions or levels of privacy to decrypt and recover the attributes.

20. The non-transitory computer readable storage medium of claim 15 , wherein the processor is further configured to perform:
verifying a template transaction certificate signature of the template transaction certificate;

Assignees

• IBM

Inventors

• Kravitz David W
• Ponceleon Dulce B
• Masini Diego A
• Geagan Iii John B
• Smith Brian K

Classifications

• G06F21/645

  using a third party · CPC title

• H04L9/3236

  using cryptographic hash functions · CPC title

• H04L9/0841

  involving Diffie-Hellman or related key agreement protocols · CPC title

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• H04L9/0836

  using tree structure or hierarchical structure · CPC title