Cryptographic participant vouching

Abstract

Aspects of the subject technology include receiving, by a first device, a voucher data item, from a second device, providing, by the first device, an invitation to at least a third device to join a group communication session with at least the first device, and providing, by the first device, the voucher data item to at least the third device to verify that the first device is vouched for by the second device for participation in the group communication session initiated by the first device. The voucher data item may include participant information associated with the second device. The voucher data item may also be signed with a key associated with the second device.

What is claimed is: 
     
         1 . A method comprising:
 receiving, by a first device, a voucher data item, from a second device, wherein:
 the voucher data item includes participant information associated with the second device, and 
 the voucher data item is signed with a key associated with the second device; 
   providing, by the first device, an invitation to at least a third device to join a group communication session with at least the first device; and   providing, by the first device, the voucher data item to at least the third device to verify that the first device is vouched for by the second device for participation in the group communication session initiated by the first device.   
     
     
         2 . The method of  claim 1 , further comprising:
 determining whether an account associated with the first device is different than an account associated with the second device; and   receiving the voucher data item in response to determining that the account associated with the first device is different than the account associated with the second device.   
     
     
         3 . The method of  claim 1 , wherein the voucher data item further includes an expiration time for determining whether the voucher data item is expired. 
     
     
         4 . The method of  claim 1 , wherein the participant information associated with the second device includes one or more group communication session participant identifiers associated with one or more of the group communication session and the second device. 
     
     
         5 . The method of  claim 1 , wherein the voucher data item includes a signature generated by the second device with a private key associated with the second device such that the signature can be verified by a public key associated with the second device. 
     
     
         6 . The method of  claim 1 , further comprising generating, by the first device, a group communication session control message including the voucher data item, wherein providing, by the first device, the voucher data item to at least the third device comprises providing the voucher data item to the third device via the group communication session control message. 
     
     
         7 . The method of  claim 6 , wherein providing, by the first device, the voucher data item to at least the third device further comprises sending the group communication session control message to a group communication session service that is constructed to forward the group communication session control message to the second device and the third device. 
     
     
         8 . The method of  claim 6 , wherein the group communication session control message further includes an invitation to join the group communication session. 
     
     
         9 . The method of  claim 1 , further comprising, in response to the voucher data item not being verified by the third device:
 joining the group communication session in response to receiving a join message;   generating a group communication session control message including the voucher data item; and   transmitting the group communication session control message to at least the second device and the third device.   
     
     
         10 . The method of  claim 9 , wherein the group communication session control message includes a notification indicating that the first device is associated with the second device based on the voucher data item. 
     
     
         11 . A method comprising:
 receiving, by a first device and from a second device, an invitation to join a group communication session and a voucher data item, wherein the voucher data item is signed by a third device and includes first participant information associated with the third device;   retrieving, by the first device, a key associated with the third device;   obtaining, by the first device, second participant information associated with the third device;   verifying, by the first device, the voucher data item based on the key and a comparison of the first and second participant information to verify that the third device has vouched for the second device; and   in response to verifying the voucher data item, joining the group communication session.   
     
     
         12 . The method of  claim 11 , wherein the key comprises a public key associated with the third device and the voucher data item includes a signature generated by the third device with a private key corresponding to the public key. 
     
     
         13 . The method of  claim 12 , wherein retrieving the key associated with the third device includes querying a device management server for the public key associated with the third device. 
     
     
         14 . The method of  claim 11 , wherein verifying the voucher data item includes:
 deriving the first participant information from the voucher data item with the key associated with the third device; and   determining that the first participant information matches the second participant information.   
     
     
         15 . The method of  claim 11 , further comprising:
 determining whether the voucher data item is expired based on an expiration time corresponding to the voucher data item; and   rejecting the invitation in response to determining that the voucher data item is expired.   
     
     
         16 . The method of  claim 11 , wherein the first participant information associated with the third device includes one or more group communication session participant identifiers associated with one or more of the group communication session and the third device. 
     
     
         17 . The method of  claim 11 , further comprising receiving a group communication session control message generated by the second device that includes an invitation to join the group communication session initiated by the second device. 
     
     
         18 . The method of  claim 11 , wherein receiving the voucher data item comprises receiving, from the second device, a group communication session control message including the voucher data item. 
     
     
         19 . The method of  claim 18 , wherein the group communication session control message comprises a notification indicating that the second device is associated with the third device. 
     
     
         20 . A non-transitory computer-readable medium comprising computer-readable instructions that, when executed by a processor, cause the processor to perform one or more operations comprising:
 receiving, by a first device, a voucher data item, from a second device, wherein:
 the voucher data item includes participant information associated with the second device, and 
 the voucher data item is signed with a key associated with the second device; 
   providing, by the first device, an invitation to at least a third device to join a group communication session with at least the first device; and   providing the voucher data item to at least the third device to verify that the first device is vouched for by the second device for participation in the group communication session initiated by the first device.