Cryptographic Service Provision

Abstract: A method of providing a secure service at a computing node for a requesting party external to the computing node is described. This computing node is one of a plurality of computing nodes in a distributed computing system adapted to provide the secure service. The method comprises the following steps carried out at the computing node. A service request is received from a requesting party, wherein the service request comprises a request to generate a credential. The credential is then generated using a cryptographic key and an instance counter, wherein the cryptographic key is determined from a currently active key list of cryptographic keys for use by the computing node, wherein key lists are rotated to provide a new currently active key list at a predetermined rotation frequency, and wherein the instance counter is determined by a number of instances of performing the service within a predetermined time window. The credential is provided such that a key list reference and an instance counter value can be determined from the credential without decryption. However, the credential further comprises a key list enhancement, such that the key list enhancement is used to prevent clash between credentials having a common key list reference and a common instance counter value. A complementary method of validating such a credential is also described, together with computing apparatus adapted to perform such methods.

Patent Information

Applicants

Inventors

Specification

Documents

Application Documents