Chained cryptographically signed certificates to convey and delegate trust and authority in a multiple node environment

Patent metadata

Field	Value
Publication number	US-12095931-B2
Application number	US-202217724834-A
Country	US
Kind code	B2
Filing date	Apr 20, 2022
Priority date	Apr 20, 2022
Publication date	Sep 17, 2024
Grant date	Sep 17, 2024

Abstract

An information handling system includes a memory and a processor. The memory stores an owner public key associated with an owner of the information handling system. The processor receives a cryptographically signed message including a chain of certificates that includes first and second certificates. The processor determines whether the first certificate within the chain of certificates delegates authority to a first user based on the owner public key. In response to the first certificate delegating authority to the first user, the processor determines whether the second certificate delegates authority from the first user to a second user. Based on the first and second certificates, the processor verifies the cryptographically signed message as an authoritative message. In response to the cryptographically signed message being verified as the authoritative message, the processor executes a request associated with the cryptographically signed message.

First claim

What is claimed is:

1. An information handling system comprising:
a memory to store an owner public key associated with an owner of the information handling system; and
a processor in communication with the memory, the processor to:
receive a cryptographically signed message including a chain of certificates, wherein the chain of certificates includes first and second certificates;
determine whether the first certificate within the chain of certificates delegates authority to a first user based on the owner public key;
in response to the first certificate delegating authority to the first user, determine whether the second certificate delegates authority from the first user to a second user;
based on the first and second certificates, verify the cryptographically signed message as an authoritative message; and
in response to the cryptographically signed message being verified as the authoritative message, execute a request associated with the cryptographically signed message,
wherein the first certificate includes a first user public key associated with the first user,
the chain of certificates further includes a work certificate, and
the second certificate includes a second user public key associated with the second user.

2. The information handling system of claim 1 , wherein the determination of whether the first certificate within the chain of certificates delegates authority to the first user based on the owner public key, the processor further to verify an owner signature in the first certificate with the owner public key stored in the memory.

3. The information handling system of claim 1 , wherein the determination of whether the second certificate delegates authority from the first user to a second user, the processor further to verify a first user signature in the second certificate based on the first user public key in the first certificate.

4. The information handling system of claim 1 , wherein the processor further to: verify a second user signature in the work certificate based on the second user public key in the second certificate; and in response to the second user signature being verified, verify the work certificate.

5. The information handling system of claim 1 , wherein the memory is located within a trusted platform module of the information handling system.

6. The information handling system of claim 1 , wherein the second certificate includes an access control list to indicate permissions authorized from the first user to the second user.

7. A method comprising:
storing, in a memory of an information handling system, an owner public key associated with an owner of the information handling system;
receiving, at the information handling system, a cryptographically signed message including a chain of certificates, wherein the chain of certificates includes first and second certificates;
determining, by a processor of the information handling system, whether the first certificate within the chain of certificates delegates authority to a first user based on the owner public key;
in response to the first certificate delegating authority to the first user, determining whether the second certificate delegates authority from the first user to a second user;
based on the first and second certificates, verifying the cryptographically signed message as an authoritative message; and
in response to the cryptographically signed message being verified as the authoritative message, executing, by the processor, a request associated with the cryptographically signed message,
wherein the first certificate includes a first user public key associated with the first user,
the chain of certificates further includes a work certificate, and
the second certificate includes a second user public key associated with the second user.

8. The method of claim 7 , wherein the determining of whether the first certificate within the chain of certificates delegates authority to the first user based on the owner public key, the method further comprises verifying an owner signature in the first certificate with the owner public key stored in the memory.

9. The method of claim 7 , wherein the determining of whether the second certificate delegates authority from the first user to the second user, the method further comprises verifying a first user signature in the second certificate based on the first user public key in the first certificate.

10. The method of claim 7 , further comprising: verifying a second user signature in the work certificate based on the second user public key in the second certificate; and in response to the second user signature being verified, verifying the work certificate.

11. The method of claim 7 , wherein the memory is located within a trusted platform module of the information handling system.

12. The method of claim 7 , wherein the second certificate includes an access control list to indicate permissions authorized from the first user to the second user.

13. A multiple node system comprising:
a first information handling system to:
generate a request and insert the request in a work certificate signed with a requesting user private key, wherein the requesting user private key is associated with a requesting user, wherein the work certificate is within a chain of certificates of a cryptographically signed message along with first and second certificates; and
send the cryptographically signed message; and

a second information handling system including:
a memory to store an owner public key associated with an owner of the second information handling system; and
a processor in communication with the memory, the processor to:
receive the cryptographically signed message from the first information handling system;
if a first certificate within the chain of certificates delegates authority to a first user based on the owner public key, then determine whether a second certificate delegates authority from the first user to the requesting user;
based on the first, second, and work certificates, verify the cryptographically signed message as an authoritative message; and
in response to the cryptographically signed message being the authoritative message, execute the request associated within the cryptographically signed message,

wherein the first certificate includes a first user public key associated with the first user and the second certificate includes a second user public key associated with the second user.

14. The multiple node system of claim 13 , wherein the determination of whether the first certificate within the chain of certificates delegates authority to the first user based on the owner public key, the processor further to verify an owner signature in the first certificate with the owner public key stored in the memory.

15. The multiple node environment of claim 13 , wherein the determination of whether the second certificate delegates authority from the first user to the requesting user, the processor further to verify a first user signature in the second certificate based on the first user public key in the first certificate.

Assignees

• Dell Products Lp

Inventors

• Goodman Bradley
• Hutchinson Kirk
• Sharma Anurag

Classifications

• H04L9/3247

  involving digital signatures · CPC title

• H04L9/3234

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• H04L2209/127

  Trusted platform modules [TPM] · CPC title

• H04L9/321

  involving a third party or a trusted authority · CPC title

• H04L9/0897

  involving additional devices, e.g. trusted platform module [TPM], smartcard or USB · CPC title