Cryptographic material sharing among entities with no direct trust relationship or connectivity
AssigneeAkamai Technologies, Inc.
InventorsRupinder Gill, Punit Kandoi, Venukrishna Prasad, Seetharama Ayyadevara
Life of this patent
Estimating the term…
Abstract
A mechanism to share cryptographic material across entities that may not have a direct trust relationship between or among each other, or no network connectivity, or some combination thereof, but where participating entities do share a trust relationship (or trusted connection(s)) with a common entity, sometimes referred to herein as a “conduit” entity. This technique enables such entities to leverage their trust relationship with a common “conduit” entity to share cryptographic material between or among themselves.
Claims19
A method of sharing cryptographic material among a set of computing entities, wherein given computing entities do not share a direct trust relationship or network connectivity with one another, comprising:
- at a conduit entity with which each of the set of computing entities shares a trusted communication path:
- storing an indication that identifies a given one of the computing entities as a leader entity, wherein the cryptographic material to be shared is generated by the leader entity;
- storing a value representing a synchronization state, the value having been generated by the leader entity applying a given function to the cryptographic material;
- receiving a message from a computing entity that is not the leader entity and, in response, determining whether the computing entity has the cryptographic material;
- when it is determined that the computing entity does not have the cryptographic material, initiating a synchronization protocol among the computing entity, the conduit entity and the leader entity to provide the cryptographic material from the leader entity to the computing entity via the conduit entity, the conduit entity being restricted from viewing the cryptographic material as the cryptographic material passes through to the computing entity.
A computer program product comprising a non-transitory computer readable medium holding computer program instructions, the computer program instructions executed by a hardware processor on a conduit entity, the computer program instructions configured to facilitate sharing of cryptographic material among a set of computing entities by:
- storing an indication that identifies a given one of the computing entities as a leader entity, wherein the cryptographic material to be shared is generated by the leader entity;
- storing a value representing a synchronization state, the value having been generated by the leader entity applying a given function to the cryptographic material;
- receiving a message from a computing entity that is not the leader entity and, in response, determining whether the computing entity has the cryptographic material;
- and
- when it is determined that the computing entity does not have the cryptographic material, initiating a synchronization protocol among the computing entity, the conduit entity and the leader entity to provide the cryptographic material from the leader entity to the computing entity via the conduit entity, the conduit entity being restricted from viewing the cryptographic material as the cryptographic material passes through to the computing entity;
- wherein each of a set of computing entities shares a trusted communication path with the conduct entity that executes the synchronization protocol.
An apparatus, comprising:
- a hardware processor;
- and
- computer memory storing computer program instructions executed by the hardware processor and configured to provide a conduit for secure transfer of material between a set of computing entities each connected to the apparatus over a secure transmission path, the material having been generated at a computing entity acting as a leader, the material between transferred from the leader to a given one of the computing entities via the apparatus when it is determined by the apparatus that the given one of the computing entities does not then possess the material and in response the apparatus initiates a synchronization protocol among the apparatus, the given computing entity and the leader, wherein prior to transfer the material is encrypted by the leader using a public key of the given computing entity, the public key having been provided to the leader by the apparatus, wherein a private key necessary to recover the material is not held by the apparatus such that the apparatus is restricted from viewing the material as the material passes through to the given computing entity;
- wherein the computer program instructions are further configured to store a value representing a synchronization state, the value having been generated by the leader applying a given function to the material.
Dependencies are inferred from the claim text.