Skip to content

Commit 70d8d7b

Browse files
sameeragsameerag
committed
Draft for DBSC(E)
1 parent 1b70ec6 commit 70d8d7b

11 files changed

+512
-22
lines changed

‎DBSC-E/DeviceRegistration.svg

+1
Loading

‎DBSC-E/DeviceRegistration.txt

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
title Device registration
2+
3+
autonumber 1
4+
participant "Device registration client" as D
5+
participant "Attestation service" as A
6+
7+
note over D, A: Provisioning ...
8+
D->>A: Register device (DeviceKey, AIK for KG, AIK for TPM, AIK for Software)
9+
A->>D: 200 OK
10+

‎DBSC-E/IDPCallsPrivateLocalKeyHelper.svg

+1
Loading

‎DBSC-E/IDPCallsPrivateLocalKeyHelper.txt

+92
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
title IdP calls a private Local Key Helper
2+
3+
autonumber 1
4+
participant "Relying Party" as W
5+
participant "IdP" as I
6+
participant "Browser" as B
7+
participant "Local Key Helper" as P
8+
9+
note over W, P: IdP life...
10+
B->>I: Any request
11+
I->>B: Any response\nSec-Session-HelperIdList: [HelperId1, HelperId2], HelperCacheTime
12+
B->>B: Cache HelperId for IDPURL for HelperCacheTime
13+
14+
note over W, P: Sign in...
15+
W->>B: Start sign in (302)\nSec-Session-Registration: path, RPChallenge,... \nSec-Session-GenerateKey: RPURL, IDPURL, extraParams
16+
B->>B: Check for cached HelperId for IDPURL
17+
18+
alt Cached HelperId present (99.99% cases)
19+
20+
B->>B: currentHelperId = Evaluate policy for (IdP, [HelperId1, HelperId2...])
21+
22+
B->>P: Pre-gen key and attest (RPURL, IDPURL, extraParams...)
23+
24+
P->>P: Generate Key
25+
26+
loop For each device
27+
P->>P: create binding statement S(publicKey, AIK)
28+
end
29+
30+
P->>B: Return: KeyId, \narray of binding statements [BindingStatement1 {extraClaims....}, \nBindingStatement2 {extraCalims...}]
31+
B->>B: Remember this key is for RP (and maybe path)
32+
33+
B->>I: Load sign-in (follow the 302)\n\nx-ms-RefreshTokenCredential1{nonce}\nx-ms-DeviceCredential1{nonce}\nx-ms-RefreshTokenCredential2{nonce}\nx-ms-DeviceCredential2{nonce} ...\n\nSec-Session-BindingInfo: KeyId, PublicKey, \narray of binding statements [BindingStatement1 {extraClaims....}, \nBindingStatement2 {extraCalims...}]
34+
35+
opt nonce is stale
36+
I->>B: 302 to IdP with qs parameter sso_nonce=new_nonce\nSec-Session-GenerateKey: RPURL, IDPURL, extraParams
37+
B->>I: Load sign-in\n\nx-ms-RefreshTokenCredential1{new_nonce}\nx-ms-DeviceCredential1{new_nonce}\nx-ms-RefreshTokenCredential2{new_nonce}\nx-ms-DeviceCredential2{new_nonce} ...\n\nSec-Session-BindingInfo: KeyId, PublicKey, \narray of binding statements [BindingStatement1 {extraClaims....}, \nBindingStatement2 {extraCalims...}]
38+
end
39+
40+
else No cached HelperId present
41+
42+
43+
B->>I: Load sign-in (follow the 302)\n\nx-ms-RefreshTokenCredential1{nonce}\nx-ms-DeviceCredential1{nonce}\nx-ms-RefreshTokenCredential2{nonce}\nx-ms-DeviceCredential2{nonce} ... \n\nSec-Session-HelperDiscoveryNeeded: RPURL, IDPURL, extraParams
44+
45+
note over I, B: No binding info present, but the reequest has GenerratKey, so IdP issues helper id list
46+
47+
I->>B: 302 to IdP with qs parameter sso_nonce=new_nonce\n\nSec-Session-GenerateKey: RPURL, IDPURL, extraParams\nSec-Session-HelperIdList: [HelperId1, HelperId2], HelperCacheTime
48+
B->>B: Cache HelperId for IDPURL for HelperCacheTime
49+
50+
B->>B: currentHelperId = Evaluate policy for (IdP, [HelperId1])
51+
B->>P: Pre-gen key and attest (RPURL, IDPURL, extraParams...)
52+
53+
P->>P: Generate Key
54+
55+
loop For each device
56+
P->>P: create binding statement S(publicKey, AIK)
57+
end
58+
59+
P->>B: Return: KeyId, \narray of binding statements [BindingStatement1 {extraClaims....}, \nBindingStatement2 {extraCalims...}]
60+
B->>B: Remember this key is for RP (and maybe path)
61+
62+
B->>I: Load sign-in\n\nx-ms-RefreshTokenCredential1{new_nonce}\nx-ms-DeviceCredential1{new_nonce}\n x-ms-RefreshTokenCredential2{new_nonce}\n x-ms-DeviceCredential2{new_nonce} ... \n\nSec-Session-BindingInfo: KeyId, PublicKey, \narray of binding statements [BindingStatement1 {extraClaims....}, \nBindingStatement2 {extraCalims...}]
63+
64+
65+
end
66+
67+
opt SSO information is not sufficient
68+
I->>B: Sign in ceremony
69+
B->>I: Sign done
70+
end
71+
72+
I->>B: Authorization code, KeyId
73+
74+
75+
note over W, B: Since DBSC session has been initialized already for RP, browser needs to generate JWT on redirect back
76+
B->>P: Request Sign JWT (path, RPChallenge, extraParams)
77+
P->>B: Return JWT Signature
78+
note over W, B: JWT is appended by the browser before returning the response from IDP back to the RP
79+
B->>W: Authorization code, KeyId, JWT
80+
W->>I: (confidential client request) redeem authorization code
81+
I->>W: (confidential client response) return id_token
82+
W->>W: parse id_token and validate binding, match with the JWT from the previous
83+
W->>B: Bound AuthCookie
84+
85+
note over W, P: Refresh DBSC...
86+
B->>W: GET /securesession/refresh (sessionID)
87+
W->>B: Challenge, **extraParams**
88+
B->>P: Request Sign JWT (sessionID, RPChallenge, **extraParams**)
89+
P->>B: Return JWT Signature
90+
B->>W: GET /securesession/refresh (JWT)
91+
W->>W: Validate JWT (w/public key on file)
92+
W->>B: AuthCookie

‎DBSC-E/IDPCallsPublicLocalKeyHelper.svg

+1
Loading

‎DBSC-E/IDPCallsPublicLocalKeyHelper.txt

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
title IdP calls a public Local Key Helper
2+
3+
autonumber 1
4+
participant "Relying Party" as W
5+
participant "IdP" as I
6+
participant "Browser" as B
7+
participant "Local Key Helper" as P
8+
participant "AttestationService" as A
9+
10+
note over W, A: Sign in...
11+
W->>B: Start sign in (302)
12+
B->>I: Load sign-in (follow the 302)
13+
14+
I->>B: Sec-Session-GenerateKey: \nRPUrl, IDPUrl, challenge=nonce, extraParams...\n\nSec-Session-HelperIdList: \n[HelperId1, HelperId2], HelperCacheTime
15+
B->>B: currentHelperId = \nEvaluate policy for (IdP, [HelperId1, HelperId2,...])
16+
B->>P: Pre-gen key and \nattest (RPUrl, IDPUrl, \nchallenge=nonce, extraParams...)
17+
18+
P->>P: Generate Key
19+
20+
P->>A: Get Binding Statement \n(publicKey, AIK, challenge=nonce)
21+
A->>P: Return binding statement \n{ nonce, thumbprint(publicKey), extraClaims... }
22+
P->>B: KeyId, \nReturn binding statement \n{ nonce, thumbprint(publicKey), extraClaims... }
23+
B->>B: Remember this key is for RP (and maybe path)
24+
B->>I: Sec-Session-Keys: KeyId, \nBinding statement \n{ nonce, thumbprint(publicKey), extraClaims... }
25+
I->>I: validate signature on the binding statement \n& nonce, store thumbprint
26+
27+
I->>B: Sign in ceremony
28+
B->>I: Sign done
29+
30+
I->>B: Auth tokens (with thumbprint), \nKeyId
31+
B->>W: Auth tokens (with thumbprint), \nKeyId
32+
33+
note over W, A: Initiate DBSC ...
34+
W->>B: StartSession \n(challenge=nonce, token?, KeyId?, **extraParams...**)
35+
B->>P: Request Sign JWT \n(uri, challenge=nonce,\n token?, keyId?, **extraParams...**)
36+
P->>B: Return JWT Signature
37+
B->>W: POST /securesession/startsession (JWT, tokens)
38+
W->>W: Validate JWT, \n(w/ match thumbprint \nin the tokens)
39+
W->>B: AuthCookie
40+
41+
note over W, A: Refresh DBSC...
42+
B->>W: GET /securesession/refresh (sessionID)
43+
W->>B: Challenge, **extraParams...**
44+
B->>P: Request Sign JWT (sessionID, **extraParams...**)
45+
P->>B: Return JWT Signature
46+
B->>W: GET /securesession/refresh (JWT)
47+
W->>W: Validate JWT \n(w/public key on file)
48+
W->>B: AuthCookie

‎DBSC-E/IDPSameAsRP-CallsPublicLocalKeyHelper.svg

+1
Loading

‎DBSC-E/IDPSameAsRP-CallsPublicLocalKeyHelper.txt

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
title IdP same as RP, calls a public Local Key Helper
2+
3+
autonumber 1
4+
participant "Relying Party" as W
5+
participant "IdP" as I
6+
participant "Browser" as B
7+
participant "Local Key Helper" as P
8+
participant "AttestationService" as A
9+
10+
note over W, A: Sign in...
11+
W->>B: Start sign in (302) \n\nSec-Session-GenerateKey: \nRPUrl, IDPUrl, challenge=nonce, extraParams...\n\nSec-Session-HelperIdList: \n[HelperId1, HelperId2], HelperCacheTime
12+
13+
B->>B: currentHelperId = \nEvaluate policy for (IdP, [HelperId1, HelperId2,...])
14+
B->>P: Pre-gen key and \nattest (RPUrl, IDPUrl, challenge=nonce, extratParams...)
15+
16+
P->>P: Generate Key
17+
18+
P->>A: Get Binding Statement \n (publicKey, AIK, challenge=nonce)
19+
A->>P: Return binding statement \n{ nonce, thumbprint(publicKey), extraClaims... }
20+
P->>B: KeyId, \nReturn binding statement \n{ nonce, thumbprint(publicKey), extraClaims... }
21+
B->>B: Remember this key is for RP (and maybe path)
22+
B->>I: Load sign-in \nSec-Session-Keys: KeyId, \nBinding statement \n{ nonce, thumbprint(publicKey), extraClaims... }
23+
I->>I: validate signature \non the binding statement and nonce, \nstore thumbprint
24+
25+
I->>B: Sign in ceremony
26+
B->>I: Sign done
27+
28+
I->>W: API(Auth tokens with thumbprint, KeyId)
29+
30+
note over W, A: Initiate DBSC ...
31+
W->>B: 200 OK \nSec-Session-Registration: \npath, RPChallenge, token?, KeyId, extraParams
32+
B->>P: Request Sign JWT (uri, challenge, token?, keyId?, **extraParams...**)
33+
P->>B: Return JWT Signature
34+
B->>W: POST /securesession/startsession (JWT, tokens)
35+
W->>W: Validate JWT, \n(w/ match thumbprint in the tokens)
36+
W->>B: AuthCookie
37+
38+
note over W, A: Refresh DBSC...
39+
B->>W: GET /securesession/refresh (sessionID)
40+
W->>B: Challenge, **extraParams...**
41+
B->>P: Request Sign JWT (sessionID, **extraParams...**)
42+
P->>B: Return JWT Signature
43+
B->>W: GET /securesession/refresh (JWT)
44+
W->>W: Validate JWT (w/public key on file)
45+
W->>B: AuthCookie

0 commit comments

Comments
 (0)