Adding devices to a network via a zero-knowledge protocol

Patent metadata

Field	Value
Publication number	US-2023319026-A1
Application number	US-202217709882-A
Country	US
Kind code	A1
Filing date	Mar 31, 2022
Priority date	Mar 31, 2022
Publication date	Oct 5, 2023
Grant date	—

Abstract

Methods, apparatus, and computer program products for adding devices to a network via a zero-knowledge protocol are disclosed. One method includes implementing, by a processor, a zero-knowledge protocol configured to establish digital trust relationships between the processor and computing devices attempting to join a network and adding each computing device to the network that successfully establishes a respective digital trust relationship with the processor via the zero-knowledge protocol. Apparatus and computer program products that include hardware and/or software that can perform the methods for adding devices to a network via a zero-knowledge protocol are also disclosed herein

First claim

What is claimed is:

1 . An apparatus, comprising:
a processor; and a memory configured to store code executable by the processor to:
implement a zero-knowledge protocol configured to establish digital trust relationships between the processor and computing devices attempting to join a network, and
add each computing device to the network that successfully establishes a respective digital trust relationship with the processor via the zero-knowledge protocol.

2 . The apparatus of claim 1 , wherein:
successfully establishing the respective digital trust relationship with the processor via the zero-knowledge protocol comprises the processor generating a respective new digital certificate for each respective computing device attempting to join the network based on authentication data exchanged between the processor and each respective computing device; and the processor is configured to add each respective computing device to the network responsive to the processor validating each respective new digital certificate corresponding to each respective computing device attempting to join the network.

3 . The apparatus of claim 1 , wherein establishing the digital trust relationships with the processor via the zero-knowledge protocol is based on the processor exchanging a minimal amount of common knowledge data with each respective computing device attempting to join the network.

4 . The apparatus of claim 1 , wherein establishing the digital trust relationships with the processor via the zero-knowledge protocol is based on the processor exchanging a predetermined amount of common knowledge data with each respective computing device attempting to join the network.

5 . The apparatus of claim 1 , wherein establishing the digital trust relationships with the processor via the zero-knowledge protocol is based on the processor exchanging a predetermined minimal amount of common knowledge data with each respective computing device attempting to join the network.

6 . The apparatus of claim 1 , wherein successfully establishing each respective digital trust relationship with each respective computing device via the zero-knowledge protocol comprises the processor mutually authenticating each respective computing device attempting to join the network.

7 . The apparatus of claim 6 , wherein mutually authenticating each respective computing device comprises the processor exchanging with each respective computing device, respective pairs of public keys generated from random elliptic curve cryptography (ECC) points and exchanging respective pairs of Schnorr Zero-Knowledge Proofs (ZKPs) corresponding to the respective pairs of public keys.

8 . The apparatus of claim 7 , wherein the respective pairs of ZKPs include synchronized time and secret properties.

9 . The apparatus of claim 8 , wherein, in mutually authenticating each respective computing device, the processor is configured to:
receive a Zero-Knowledge signature from a computing device, wherein the received Zero-Knowledge signature is based on the exchanged pairs of public keys, the exchanged pairs of ZKPs, and the synchronized time and secret properties; and verify the received Zero-Knowledge signature for the computing device.

10 . The apparatus of claim 9 , wherein, in mutually authenticating each respective computing device via the zero-knowledge protocol, the processor is further configured to establish a trust anchor with the computing device based on verifying the received Zero-Knowledge signature for the computing device.

11 . The apparatus of claim 10 , wherein the processor is further configured to:
utilize the established trust anchor to generate a new digital certificate for the computing device; and authenticate the computing device via the new digital certificate.

12 . The apparatus of claim 11 , wherein the new digital certificate authenticates the computing device for a particular role in the network.

13 . A method, comprising:
implementing, by a processor, a zero-knowledge protocol configured to establish digital trust relationships between the processor and computing devices attempting to join a network; and adding each computing device to the network that successfully establishes a respective digital trust relationship with the processor via the zero-knowledge protocol.

14 . The method of claim 13 , wherein:
successfully establishing the respective digital trust relationship with the processor via the zero-knowledge protocol comprises generating a respective new digital certificate for each respective computing device attempting to join the network based on authentication data exchanged between the processor and each respective computing device; and each respective computing device is added to the network responsive to validating each respective new digital certificate corresponding to each respective computing device attempting to join the network.

15 . The method of claim 13 , wherein establishing the digital trust relationships with the processor via the zero-knowledge protocol is based exchanging a minimal amount of common knowledge data between the processor and each respective computing device attempting to join the network.

16 . The method of claim 13 , wherein successfully establishing each respective digital trust relationship with each respective computing device via the zero-knowledge protocol comprises mutually authenticating the processor and each respective computing device attempting to join the network.

17 . A computer program product comprising a computer-readable storage device including code embodied therewith, the code executable by a processor to cause the processor to:
implement a zero-knowledge protocol configured to establish digital trust relationships between the processor and computing devices attempting to join a network; and add each computing device to the network that successfully establishes a respective digital trust relationship with the processor via the zero-knowledge protocol.

18 . The computer program product of claim 17 , wherein:
the code to successfully establish the respective digital trust relationship with the processor via the zero-knowledge protocol comprises code that causes the processor to generate a respective new digital certificate for each respective computing device attempting to join the network based on authentication data exchanged between the processor and each respective computing device; and the code that adds each respective computing device to the network comprises code that causes the processor to add each respective computing device to the network responsive to the processor validating each respective new digital certificate corresponding to each respective computing device attempting to join the network.

19 . The computer program product of claim 17 , wherein the code to establish the digital trust relationships with the processor via the zero-knowledge protocol comprises code that causes the processor to exchange a minimal amount of common knowledge data between the processor and each respective computing device attempting to join the network.

20 . The computer program product of claim 17 , wherein the code to successfully establish each respective digital trust relationship with each respective computing device via the zero-knowledge protocol comprises code that causes the processor to mutually authenticate each respective computing device attempting to join the network.

Assignees

• Lenovo United States Inc

Inventors

• Waltermann Rod D
• Stolbikov Igor
• Ray Ratan
• Zugasti Alfredo

Classifications

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title