HK1259028B - Method and system for distributed cryptographic key - Google Patents

Description

Method and system for distributed cryptographic keys

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to and the benefit of the filing date of U.S. Patent Application No. 15/001,775, filed January 20, 2016, which is incorporated herein by reference in its entirety.

Technical Field

The present disclosure relates to the distribution of multiple cryptographic keys for accessing data, and in particular, to the use of elliptic curve cryptography to securely distribute multiple cryptographic keys that are used to derive a single key for a cryptographic key recipient to access data requiring negotiated data ownership.

Background Art

In a world with billions of computing devices, data is constantly being transmitted. Data can be transferred from one computing device to another, from one device to many others, or from many devices to a single device. In many cases, the security of data transmission can be as important as the location of the data transmission. For example, if data is properly protected so that only intended parties can view it, it can be made publicly available to facilitate access by those intended. With high security, even if publicly accessible, data is protected from compromise by any entity other than the intended party. Therefore, ensuring the security of data transmitted over public channels can be extremely important.

However, this can be difficult to achieve when data is intended for a predetermined group of entities. For example, if a party wishes to make publicly available data accessible to a group of four different individuals, the party could encrypt the data and provide each of the four individuals with a key suitable for accessing the data. In this scenario, the compromise of any one of the four keys could compromise the data being transmitted, significantly compromising security. To maintain the highest level of security, it may be in the party's best interest to distribute only a single key for accessing the data. However, the group of four individuals may not be able to identify which individual will receive the single key, or such identification may be time-consuming or inconvenient for the party.

Therefore, there is a need for a technical solution for transmitting data that enables accessibility to multiple entities using a single access key. Furthermore, there is a need for a technical solution in which a transmitting party can provide data to each of multiple entities for negotiation of ownership without the transmitting party's involvement. In such a scenario, data can be securely transmitted with minimal potential for disclosure, and only accessible to a single entity, which can be selected among the multiple entities without requiring additional involvement from the transmitting party.

Summary of the Invention

This disclosure provides a description of systems and methods for distributing multiple cryptographic keys to be used in accessing data.

A method for distributing multiple cryptographic keys for accessing data includes: receiving a data signal superimposed with an access key request by a receiving device of a processing server, wherein the access key request includes at least a number n of requested keys greater than 1; generating n key pairs by a generation module of the processing server using a key pair generation algorithm, wherein each key pair includes a private key and a public key; deriving an access private key by applying the private key contained in each of the n key pairs to the key derivation algorithm by the export module of the processing server; generating an access public key corresponding to the exported access private key by the generation module of the processing server using the key pair generation algorithm; and electronically sending a data signal superimposed with the private key contained in each of the n key pairs for each of the n key pairs through a sending device of the processing server.

A system for distributing multiple cryptographic keys for accessing data includes: a sending device of a processing server; a receiving device of the processing server configured to receive a data signal superimposed with an access key request, wherein the access key request includes at least n requested keys; a generation module of the processing server configured to generate n key pairs using a key pair generation algorithm, wherein each key pair includes a private key and a public key; and a derivation module of the processing server configured to derive an access private key by applying the private key included in each of the n key pairs to the key derivation algorithm. The generation module of the processing server is further configured to generate an access public key corresponding to the derived access private key using the key pair generation algorithm. The sending device of the processing server is configured to electronically send, for each of the n key pairs, a data signal superimposed with a private key included in one of the n key pairs.

BRIEF DESCRIPTION OF THE DRAWINGS

The scope of the present disclosure is best understood by reading the following detailed description of exemplary embodiments in conjunction with the accompanying drawings, which include the following figures:

1 is a block diagram illustrating a high-level system architecture for distributing key keys to multiple entities to negotiate reward ownership, according to an exemplary embodiment.

2 is a block diagram illustrating the processing server of FIG. 1 for distributing cryptographic keys to multiple entities for negotiating reward ownership, according to an exemplary embodiment.

3 is a flow chart illustrating the processing server of FIG. 2 generating access keys for protecting data whose ownership is negotiated by multiple entities, according to an exemplary embodiment.

4 is a flow chart illustrating a process flow for transmitting access keys using elliptic curve cryptography according to an exemplary embodiment.

5 is a flow chart illustrating an exemplary method for distributing multiple cryptographic keys used to access data, according to an exemplary embodiment.

FIG6 is a block diagram illustrating a computer system architecture according to an exemplary embodiment.

Further areas of applicability of the present disclosure will become apparent from the detailed description provided hereinafter.It should be understood that the detailed description of the exemplary embodiments is provided for illustration purposes only and is not intended to limit the scope of the present disclosure.

DETAILED DESCRIPTION

Glossary

Blockchain - A ledger of all transactions that conform to one or more standards or conventions associated with blockchain. One or more computing devices may comprise a blockchain network, which may be configured to process and record transactions as part of blocks in a blockchain. Once a block is completed, it is added to the blockchain, thereby updating the transaction record. In many cases, a blockchain may be a chronological ledger of transactions, or it may be presented in any other order suitable for the blockchain network. In some configurations, a blockchain may be a ledger of monetary transactions, where transactions recorded in the blockchain may include a destination address and a monetary amount, such that the blockchain records how much money is attributed to a particular address. In some such configurations, the blockchain may utilize a blockchain-based digital currency, which may be unique to the respective blockchain. In some cases, additional information, such as a source address and a timestamp, may be captured. In some embodiments, a blockchain may also comprise additional, and in some cases arbitrary, data that is validated and verified by the blockchain network through proof-of-work and/or any other suitable verification technique. In some cases, such data may be included in the blockchain as part of a transaction, for example, in additional data appended to the transaction data. In some cases, the inclusion of such data in the blockchain may constitute a transaction. In such cases, the blockchain may not be directly associated with a specific digital, virtual, fiat, or other type of currency. A blockchain can be private, where only authorized systems or devices can access the blockchain, or public, where the blockchain can be accessed by any device or system. In either case, the ability of a device or system to add transactions to the blockchain may be restricted.

System for cryptographic key distribution via elliptic curve cryptography

FIG. 1 illustrates a system 100 for transmitting cryptographic keys for secure transmission of data using elliptic curve cryptography.

The system 100 may include a processing server 102. The processing server 102, discussed in more detail below, may be configured to generate a plurality of cryptographic keys for distribution using elliptic curve cryptography, which are used in accessibility of data to a plurality of computing devices 104a, 104b, and 104c. This is accomplished in a manner requiring processing on a computer that is specifically programmed to perform the functions disclosed herein, which cannot be performed on a general-purpose computer and cannot be accomplished realistically through mental processes or pencil and paper, and thereby provides a technical solution to negotiate reward ownership in the secure transmission of data. The processing server 102 may receive an access key request that may request a plurality of keys to be distributed to the computing devices 104a, 104b, and 104c for use in accessing data. The access key request may be received from an external device, such as another computing device or system, such as via electronic transmission from such a device or system using a suitable communication network (e.g., a local area network, a wide area network, radio frequency, Bluetooth, near field communication, the Internet, etc.), or may be received via one or more input devices connected to processing server 102 (e.g., accessible by a user of processing server 102). The access key request may specify the number n of computing devices for which access keys are being requested. In the example shown in FIG1 , the access key request may be for three access keys.

The processing server 102 can then generate the requested number of n key pairs. Each key pair can include a private key and a public key, referred to herein as a "reward" key pair, including the "reward" private key and public key. The processing server 102 can use a suitable key pair generation algorithm in generating the requested number of key pairs. In an exemplary embodiment, the key pair generation algorithm can be an elliptic curve key agreement scheme. In another embodiment, as will be appreciated by those skilled in the art, an elliptic curve Diffie-Hellman (ECDH) key agreement protocol can be used to generate each of the n key pairs. In any case, the key pair generation algorithm can be a key pair generation algorithm suitable for using a shared secret, which is discussed in more detail below.

Once n reward key pairs have been generated, the processing server 102 can derive the access private key by applying the reward private key from each of the n reward key pairs to a key derivation algorithm. In some embodiments, the key derivation algorithm can include the use of an XOR logical operation. In an exemplary embodiment, the key derivation algorithm can be such that a change in the ordering or sequencing of the reward private keys in the derived access private key can result in the same access private key. In such an embodiment, any entity in possession of each reward private key and knowing the key derivation algorithm used can reproduce the access private key regardless of the ordering or sequencing of the reward private keys.

Processing server 102 may also be configured to generate a public access key corresponding to the derived private access key. The public access key may be generated using a key pair generation algorithm, which may be the same key pair generation algorithm used to generate the reward key pair. For example, in an exemplary embodiment, processing server 102 may use the ECDH key agreement protocol to generate the public access key as part of a key pair with the derived private access key.

The processing server 102 can use the derived private access key to restrict access to data. Any suitable method for restricting access to data using a private key can be used. For example, in one example, the data can be encrypted using the private access key and a suitable encryption algorithm. In another example, the data to which access is restricted can be an amount of blockchain currency available via the blockchain network 106. In such an example, the public access key can be used to generate a destination address for the amount of blockchain currency, where the private access key is used to sign the destination address and provide access to the blockchain currency associated therewith. Using the blockchain network 106 to transmit and access blockchain currency using key pairs will be apparent to those skilled in the relevant art.

Once processing server 102 has restricted access to the desired data using the private access key, processing server 102 can electronically send a private reward key to each computing device 104a, 104b, and 104c, such that each computing device receives a different private reward key. For example, in the example shown in FIG1 , processing server 102 can generate private reward keys Ka, Kb, and Kc, which can be electronically sent to computing devices 104a, 104b, and 104c, respectively. In some embodiments, the private reward key can be superimposed on a data signal electronically sent to the respective computing devices 104a, 104b, and 104c using the Internet or another suitable communication network.

In an exemplary embodiment, the reward private key may be encrypted prior to transmission using the shared secret. In such an embodiment, processing server 102 and each computing device 104a, 104b, and 104c may generate a key pair for transmission, encryption, and decryption of the reward private key using the shared secret. Processing server 102 and computing devices 104a, 104b, and 104c may each generate a key pair using the same key pair generation algorithm, which may be the ECDH key agreement protocol or another algorithm suitable for use with the shared secret. Using the key pair generation algorithm, processing server 102 may generate a key pair, referred to herein as a "transport" key pair, comprising a "transport" private key and a public key. Each computing device 104a, 104b, and 104c may generate a key pair using the key pair generation algorithm, referred to herein as a "device" key pair, comprising a "device" private key and a public key. Each computing device 104a, 104b, and 104c may electronically send its associated device public key to processing server 102 using a suitable communication method. The processing server 102 may also electronically transmit the transfer public key to each of the computing devices 104a, 104b, and 104c. In some cases, the transfer public key may be sent along with the encrypted reward private key (e.g., in the same or accompanying transmission).

After processing server 102 has received the device public keys from computing devices 104a, 104b, and 104c, processing server 102 may generate a shared secret. The shared secret may be generated using the transport private key and the device public key in combination with the key pair generation algorithm used in generating the respective keys. The shared secret may be an equivalent secret when generated using the private key of the first key pair and the public key of the second key pair, or when generated using the public key of the first key pair and the private key of the second key pair. For example, in the illustrated example, processing server 102 may use the transport private key generated by processing server 102 and the device public key received from processing server 102 to generate a shared secret for transmitting the reward private key Ka to computing device 104a. Computing device 104a may use the transport public key received from processing server 102 and the device private key generated by computing device 104a to generate an equivalent shared secret.

Once processing server 102 has generated a shared secret associated with computing devices 104a, 104b, and 104c (e.g., using the device public key of that particular computing device), processing server 102 may use the associated shared secret to encrypt the reward private key being transmitted to that computing device 104a, 104b, and 104c. Any suitable encryption algorithm may be used, such as the AES256 encryption algorithm. The encrypted reward private key may then be electronically transmitted to the associated computing devices 104a, 104b, and 104c using any suitable communication method. In some cases, processing server 102 may include a transmission public key in the electronic communication used to transmit the encrypted reward private key.

Each computing device 104a, 104b, and 104c can generate a shared secret for decrypting the received encrypted reward private key. The shared secret can be generated using the transmission public key electronically sent by processing server 102 and the computing device's generated device private key. The shared secret can be generated using a key pair generation algorithm used by computing devices 104a, 104b, and 104c and processing server 102 to generate the corresponding key pair. Computing devices 104a, 104b, and 104c can use the shared secret to decrypt the reward private key using an appropriate encryption algorithm used by processing server 102. For example, computing devices 104a, 104b, and 104c can use the AES256 algorithm to decrypt the reward private key using the shared secret.

Once each computing device 104a, 104b, and 104c has received and decrypted (if applicable) its corresponding reward private key, computing devices 104a, 104b, and 104c can negotiate possession of each reward private key. In some cases, users associated with computing devices 104a, 104b, or 104c can negotiate possession of the reward private key without using computing devices 104a, 104b, and 104c. For example, in the example shown, the three users of computing devices 104a, 104b, and 104c can negotiate offline to agree that the user of computing device 104a will collect each reward private key. In this case, computing devices 104b and 104c can electronically send their reward private keys to computing device 104a using a suitable communication method.

In some embodiments, the reward private key can be transmitted between computing devices 104a, 104b, and 104c using a shared secret. In such an embodiment, computing devices 104a, 104b, and 104c can exchange their associated device public keys to generate a shared secret for encrypting the reward private key for transmission. For example, computing device 104b can use the device private key generated by computing device 104b and the device public key generated by computing device 104a to generate a shared secret for encrypting the reward private key Kb, and then encrypt the reward private key Kb using the shared secret. Computing device 104b can then electronically send the encrypted reward private key Kb to computing device 104a using a suitable communication method. Computing device 104a can then use the device private key generated by computing device 104a and the device public key generated by computing device 104b to generate the shared secret and decrypt the reward private key Kb. Computing devices 104a and 104c can then repeat the process of computing device 104a receiving and decrypting the reward private key Kc.

Once the computing device 104a, 104b, or 104c possesses each reward private key, the computing device 104a, 104b, or 104c can derive an access private key using the key derivation algorithm used by the processing server 102 in its derivation. The computing device 104a, 104b, or 104c can use the access private key to access the data being transferred. For example, if the data is a blockchain currency associated with the blockchain network 106, the computing device 104a, 104b, or 104c can use the access private key as a signature to access the blockchain currency transferred to the destination address generated using the access public key.

The methods and systems discussed herein can enable the transmission of data that can be accessed using a single private key that must be derived via multiple keys distributed to multiple entities. By using keys distributed to multiple entities, data can remain secure until negotiated by multiple entities without requiring the participation of the transmitting party. Additionally, because the access key is derived using the keys distributed to each entity, the data can have a significantly higher level of security than using a single key, which can provide greater protection for the data, particularly in situations where the data is publicly available but inaccessible, such as in blockchain network 106. The use of elliptic curve cryptography can provide even greater protection, as even the exchange of private keys can have an enhanced level of protection in their transmission. Thus, the methods and systems discussed herein can provide improved protection in both the transmission of data and the transmission of keys used to access the transmitted data.

The use of the methods and systems discussed herein may also be beneficial in the storage of cryptographic keys used to access secure data. For example, an entity may store data securely and use the methods discussed herein to generate a single private key to encrypt the data, wherein the reward private keys used to derive the single private key are distributed to multiple different computing systems, and the single private key is discarded. In this case, if the cryptographic key repository for one of the computing systems is compromised, the data may still be secure because the entity gaining access to the reward private keys will not be able to derive the single private key used to encrypt the data. The compromised private key can be provided to other computing systems, from which the single private key can be derived, and the process repeated to generate a new set of reward private keys. In this case, the data can remain secure at any time if any of the cryptographic key repositories are compromised. Thus, the methods discussed herein may be beneficial in providing secure distributed cryptographic key storage.

Processing Server

FIG2 illustrates an embodiment of a processing server 102 of system 100. As will be apparent to those skilled in the relevant art(s), the embodiment of processing server 102 illustrated in FIG2 is provided for illustration only and may not be exhaustive of all possible configurations of processing server 102 suitable for performing the functions discussed herein. For example, the computer system illustrated in FIG6 and discussed in greater detail below may be a suitable configuration for processing server 102.

Processing server 102 may include a receiving device 202. Receiving device 202 may be configured to receive data over one or more networks via one or more network protocols. In some cases, receiving device 202 may also be configured to receive data from computing devices 104a, 104b, and 104c, blockchain network 106, and other entities via a suitable communication network (such as a local area network, a wide area network, a radio frequency network, the Internet). In some embodiments, receiving device 202 may be comprised of multiple devices, such as different receiving devices for receiving data over different networks, such as a first receiving device for receiving data via near-field communication and a second receiving device for receiving data over the Internet. Receiving device 202 may receive an electronically transmitted data signal, wherein data may be superimposed on the data signal and decoded, parsed, read, or otherwise obtained by receiving the data signal at receiving device 202. In some cases, receiving device 202 may include a parsing module for parsing the received data signal to obtain the superimposed data. For example, receiving device 202 may include a parser program configured to receive and transform received data signals into usable input for execution by a processing device to perform the functions of the methods and systems described herein.

The receiving device 202 can be configured to receive data signals electronically transmitted by the computing devices 104a, 104b, and 104c for performing the functions discussed herein. The data signals electronically transmitted by the computing devices 104a, 104b, or 104c can be superimposed with a device public key, for example, to generate a shared secret. The receiving device 202 can also receive data signals from additional devices and systems, such as from the blockchain network 106 and/or nodes associated therewith, for transmitting data (e.g., blockchain currency) via the blockchain network 106, and such as external computing devices that submit access key requests. In some cases, the receiving device 202 can receive data signals superimposed with access key requests for n reward private keys for accessing data from the computing devices 104a, 104b, and 104c to receive one of the reward private keys.

Processing server 102 may also include a communication module 204. Communication module 204 may be configured to transfer data between modules, engines, databases, memories, and other components of processing server 102 for performing the functions discussed herein. Communication module 204 may be comprised of one or more communication types and utilize various communication methods for communication within the computing device. For example, communication module 204 may include a bus, contact pin connectors, wires, etc. In some embodiments, communication module 204 may also be configured to facilitate communication between internal components of processing server 102 and components external to processing server 102, such as externally connected databases, display devices, input devices, etc. Processing server 102 may also include a processing device. The processing device may be configured to perform the functions of processing server 102 discussed herein, as will be apparent to those skilled in the relevant art. In some embodiments, the processing device may include and/or be comprised of multiple engines and/or modules specifically configured to perform one or more functions of the processing device, such as query module 218, generation module 206, export module 208, encryption module 210, decryption module 212, etc. As used herein, the term "module" can be software or hardware that is specifically programmed to receive input, perform one or more processes using the input, and provide output. Based on this disclosure, the inputs, outputs, and processes performed by the various modules will be apparent to those skilled in the art.

Processing server 102 may include a query module 218. Query module 218 may be configured to perform queries on a database to identify information. Query module 218 may receive one or more data values or query strings and may perform the query string on an indicated database (e.g., memory 216) based on the one or more data values or query strings to identify information stored therein. Query module 218 may then output the identified information to an appropriate engine or module of processing server 102 as needed. Query module 218 may, for example, perform a query on memory 216 to identify one or more keys received from computing devices 104a, 104b, and 104c or generated by processing server 102 for use in the methods discussed herein.

The processing server 102 may include a generation module 206. The generation module 206 may be configured to generate a key pair and a shared secret. The generation module 206 may receive as input a request that may request the generation of a key pair or a shared secret and may include information to be used therewith. The generation module 206 may perform the requested function and may output the requested data for use by another module or engine of the processing server 102. For example, the generation module 206 may be configured to generate a key pair, such as a reward key pair, using a key pair generation algorithm included in the request or otherwise indicated (e.g., and identified in the memory 216 via the query module 218). The generation module 206 may also be configured to generate a shared secret using public and private keys from two different key pairs, which may utilize the same key pair generation algorithm. In some cases, the generation module 206 may also be configured to generate a public key corresponding to a private key using a key pair generation algorithm. In an exemplary embodiment, the generation module 206 may use the ECDH key agreement protocol.

Processing server 102 may also include an export module 208. Export module 208 may be configured to export public and/or private keys. Export module 208 may receive one or more keys and a key derivation algorithm or an indication thereof as input, may derive the requested one or more keys, and may output the requested one or more keys for use by another module or engine of processing server 102. For example, export module 208 may receive multiple reward private keys generated by generation module 206 and may derive corresponding access private keys based on the multiple reward private keys using a suitable key derivation algorithm. In some embodiments, export module 208 may use an algorithm such that the ordering or ranking of the reward private keys is immaterial, as variations in the order in which the reward private keys are used in the derivation may result in the same access private key. In such embodiments, the key derivation algorithm may include use of an XOR logical operation.

The processing server 102 may also include an encryption module 210. The encryption module 210 may be configured to encrypt data using a suitable encryption algorithm, such as the AES256 algorithm. The encryption module 210 may receive as input the data to be encrypted and the key to be used, may encrypt the data using a suitable algorithm, and may output the encrypted data to another module or engine of the processing server 102 for use. In some cases, the encryption module 210 may receive as input an encryption algorithm or an indication thereof. In other cases, the encryption module 210 may identify the encryption algorithm to be used. For example, the encryption module 210 may encrypt the reward private key using a shared secret generated in association with the encryption module 210.

The processing server 102 may also include a decryption module 212. The decryption module 212 may be configured to decrypt data using a suitable encryption algorithm (such as the AES256 algorithm). The decryption module 212 may receive the data to be decrypted and the key used therefor as input, may decrypt the data using a suitable algorithm, and may output the decrypted data to another module or engine of the processing server 102 for use therefor. The input provided to the decryption module 212 may include the encryption algorithm to be used, or may include an indication thereof, such as an indication for identifying an encryption algorithm stored in the memory 216 via the query module 218. The decryption module 212 may, for example, decrypt the keys provided by the computing devices 104a, 104b, and 104c using the associated shared secret.

In some embodiments, processing server 102 may include additional modules or engines for performing the functions discussed herein. For example, processing server 102 may include additional modules for use in conjunction with blockchain network 106, such as for initiating and submitting blockchain transactions and for signing addresses and transaction requests for transferring blockchain currency using blockchain network 106. In some cases, the modules of processing server 102 shown in FIG2 and discussed herein may be configured to perform additional functions in association therewith. For example, generation module 206 may be configured to generate a blockchain destination address using an access public key.

Processing server 102 may also include a transmitting device 214. Transmitting device 214 may be configured to transmit data over one or more networks via one or more network protocols. In some cases, transmitting device 214 may be configured to transmit data to computing devices 104a, 104b, and 104c, blockchain network 106, and other entities via a suitable communications network (such as a local area network, a wide area network, a radio frequency network, or the Internet). In some embodiments, transmitting device 214 may include multiple devices, such as different transmitting devices for transmitting data over different networks, such as a first transmitting device for transmitting data via near-field communication and a second transmitting device for transmitting data over the Internet. Transmitting device 214 may electronically transmit a data signal having data superimposed thereon that can be interpreted by a receiving computing device. In some cases, transmitting device 214 may include one or more modules for superimposing, encoding, or otherwise formatting the data into a data signal suitable for transmission.

The sending device 214 can be configured to electronically send a data signal superimposed with a public key and/or a private key to the computing devices 104a, 104b, and 104c. These public keys and/or private keys can, in some cases, be encrypted using a shared secret. For example, the sending device 214 can be configured to send a data signal superimposed with an encrypted reward private key to the computing devices 104a, 104b, and 104c. The encrypted reward private key can also be superimposed with a transfer public key for use by the computing devices 104a, 104b, and 104c in generating a shared secret. The sending device 214 can also be configured to send the data signal to the blockchain network 106 for use in transferring blockchain currency.

Processing server 102 may also include memory 216. Memory 216 may be configured to store data used by processing server 102 to perform the functions discussed herein. Memory 216 may be configured to store data using suitable data formatting methods and schemas and may be any suitable type of memory, such as read-only memory, random access memory, etc. Memory 216 may include, for example, encryption keys and algorithms, communication protocols and standards, data formatting standards and protocols, program code for modules and applications for processing devices, and other data that may be suitable for use by processing server 102 in performing the functions disclosed herein, as will be apparent to those skilled in the relevant art. Memory 216 may be configured to store key pair generation algorithms, key derivation algorithms, and encryption algorithms used to perform the functions of processing server 102 discussed herein.

Access private key export

3 illustrates a process 300 for deriving a private access key for accessing data via generating multiple cryptographic keys for distribution to multiple computing devices 104a, 104b, and 104c.

In step 302, generation module 206 of processing server 102 may generate a plurality of bonus key pairs 304a, 304b, and 304c using a suitable key pair generation algorithm, which may be an elliptic curve key agreement scheme, such as the ECDH key agreement protocol. The number of bonus key pairs generated by generation module 206 may be based on an access key request received by receiving device 202 of processing server 102 or one or more input devices interfaced with processing server 102.

In the example shown in FIG3 , the generation module 206 can generate three reward key pairs 304a, 304b, and 304c, shown in FIG3 as key pair 1 304a, key pair 2 304b, and key pair 3 304c. Each reward key pair 304a, 304b, and 304c can include a reward private key and a corresponding reward public key. In step 306, the export module 208 of the processing server 102 can derive an access private key 308 using an XOR logic operation with the reward private key from each reward key pair 304a, 304b, and 304c. By using the XOR logic operation, the order of the operations used to derive the access private key 308 can be unimportant for the derived access private key. For example, in the process 300 shown in FIG3 , the key pairs 304a, 304b, and 304c can include three reward private keys R1, R2, and R3. The access secret key 308 derived using the XOR logic operation of all three keys via XOR(R1, XOR(R2, R3)) may be equivalent to the access secret key 308 derived via the operations XOR(R2, XOR(R1, R3)) and XOR(R3, XOR(R1, R2)).

The processing server 102 can then use the resulting private access key 308 to restrict access to the data. For example, the private access key 308 can be used to encrypt data or to sign a destination address for receiving blockchain currency associated with the blockchain network 106. The reward private key included in each reward key pair 304a, 304b, and 304c can be distributed among the computing devices 104a, 104b, and 104c as a means of providing access to restricted data. With distributed cryptographic key storage, an entity can use the private access key 308 to encrypt or otherwise restrict access to data, discard the private access key 308, and then distribute the reward private key in each reward key pair 304a, 304b, and 304c to computing devices. The computing devices 104a, 104b, and 104c can be part of the entity (e.g., an affiliated or controlled computing system) or can be associated trusted entities. In this case, if the key storage of any computing device 104a, 104b, and 104c is compromised, the data can remain secure.

A process for transmitting keys for data access via elliptic curve cryptography

FIG4 illustrates a process for distributing private keys via elliptic curve cryptography, such as for distributing reward private keys generated using process 300 shown in FIG3 for deriving access private keys for accessing data.

In step 402, processing server 102 may generate a plurality of reward key pairs and derive a private access key therefrom, such as using process 300 shown in FIG. 3 and discussed above. In step 404, processing server 102 and computing devices 104a, 104b, and 104c may exchange public keys for use in generating a shared secret. Computing devices 104a, 104b, and 104c may use a key pair generation algorithm, such as the ECDH key agreement protocol, to generate a device key pair, which may include a device private key and a device public key. Generation module 206 of processing server 102 may use the same key pair generation algorithm to generate a transport key pair, thereby obtaining a transport private key and a transport public key. The exchange of public keys may include electronic communication of the device public key from computing devices 104a, 104b, and 104c to processing server 102 and electronic communication of the transport public key from processing server 102 (e.g., via sending device 214) to computing devices 104a, 104b, and 104c.

In step 406, generation module 206 of processing server 102 may generate a shared secret. The shared secret may be generated using the same key pair generation algorithm (such as the ECDH key agreement protocol) using the transport private key generated by generation module 206 and the device public key received from computing devices 104a, 104b, and 104c. In step 406, computing devices 104a, 104b, and 104c may use the device private key previously generated by computing device 104a, 104b, or 104c and the transport public key received from processing server 102 to generate an equivalent shared secret using the same key pair generation algorithm.

In step 410, the encryption module 210 of the processing server may encrypt the reward private key generated in step 402 and use it to derive the access private key using a shared secret using a suitable encryption algorithm. The encryption algorithm may be, for example, the AES256 algorithm. In step 412, the sending device 214 of the processing server 102 may electronically transmit the data signal superimposed with the encrypted reward private key to the computing devices 104a, 104b, and 104c using a suitable communication network and protocol.

In step 414, computing devices 104a, 104b, and 104c may receive the data signal and parse the encrypted reward private key therefrom. In step 416, computing device 104a, 104b, or 104c may decrypt the reward private key. The reward private key may be decrypted using the same encryption algorithm used by processing server 102 using the shared secret. The decrypted reward private key, when combined with other reward private keys (e.g., received from other computing devices 104a, 104b, or 104c) using an appropriate key derivation algorithm, may be used to derive the access private key.

Exemplary method of distributing multiple cryptographic keys for accessing data

FIG5 illustrates a method 500 for distributing a plurality of cryptographic keys to a plurality of computing devices, the plurality of cryptographic keys being usable to derive access keys for accessing data.

In step 502, a data signal superimposed with an access key request may be received by a receiving device (e.g., receiving device 202) of a processing server (e.g., processing server 102), wherein the access key request includes at least n request keys greater than 1. In step 504, a generation module (e.g., generation module 206) of the processing server may generate n key pairs using a key pair generation algorithm, wherein each key pair includes a private key and a public key.

In step 506, a private access key may be derived by a derivation module of the processing server (e.g., derivation module 208) by applying the private key contained in each of the n key pairs to a key derivation algorithm. In step 508, a public access key corresponding to the derived private access key may be generated by a generation module of the processing server using the key pair generation algorithm. In step 510, a data signal superimposed with the private key contained in one of the n key pairs may be electronically transmitted by a transmitting device of the processing server (e.g., transmitting device 214) for each of the n key pairs.

In one embodiment, method 500 may further include: storing a transmission key pair including a transmission public key and a transmission private key in a memory (e.g., memory 216) of the processing server; receiving, by a receiving device of the processing server, a data signal superimposed with the shared public key from each of n computing devices (e.g., computing devices 104a, 104b, or 104c); generating, by a generation module of the processing server, n shared secrets, wherein each shared secret is generated using a shared public key from the n shared public keys, the transmission private key, and the key pair generation algorithm; and encrypting, by an encryption module (e.g., encryption module 210) of the processing server, using an encryption algorithm, the private key included in each of the n key pairs with one of the n shared secrets, wherein the private key superimposed on the electronically transmitted data signal is the corresponding encrypted private key. In a further embodiment, method 500 may further include electronically transmitting, by a sending device of the processing server, the data signal superimposed with the transmission public key to the n computing devices.

In yet another embodiment, a data signal superimposed with the transmitted public key may be electronically transmitted to n computing devices prior to receiving a data signal superimposed with the shared public key. In yet another further embodiment, each data signal superimposed with the transmitted public key may be the same data signal as each data signal superimposed with the encrypted private key. In yet another embodiment, the transmitted data signal may be electronically transmitted to a node in a blockchain network (e.g., blockchain network 106), wherein the encrypted private key is included in a transaction request that also includes a destination address corresponding to the respective shared public key.

In some embodiments, the key pair generation algorithm may be an elliptic curve key agreement scheme. In further embodiments, the elliptic curve key agreement scheme may be an elliptic curve Diffie-Hellman key agreement protocol. In one embodiment, the key derivation algorithm may include using an XOR logical operation. In some embodiments, method 500 may further include electronically transmitting, via a sending device of the processing server, a data signal superimposed with a transaction request to a node in the blockchain network, wherein the transaction request includes at least a destination address signed using the derived private access key.

Computer system architecture

FIG6 illustrates a computer system 600 in which embodiments of the present disclosure, or portions thereof, may be implemented as computer-readable code. For example, the processing server 102 of FIG1 may be implemented in the computer system 600 using hardware, software, firmware, a non-transitory computer-readable medium having instructions stored thereon, or a combination thereof, and may be implemented in one or more computer systems or other processing systems. Hardware, software, or any combination thereof may embody the modules and components for implementing the methods of FIG3-5.

If programmable logic is used, such logic can be executed on a commercially available processing platform or a dedicated device. Those skilled in the art will appreciate that various computer system configurations can be used to practice the embodiments of the disclosed subject matter, including multi-core multiprocessor systems, minicomputers, mainframe computers, computers linked or clustered with distributed functionality, and conventional or microcomputers that can be embedded in virtually any device. For example, the above embodiments can be implemented using at least one processor device and memory.

The processor units or devices discussed herein may be a single processor, a plurality of processors, or a combination thereof. A processor device may have one or more processor "cores." As discussed herein, the terms "computer program medium," "non-transitory computer-readable medium," and "computer-usable medium" are generally used to refer to tangible media, such as removable storage unit 618, removable storage unit 622, and a hard disk installed in hard disk drive 612.

Various embodiments of the present disclosure are described based on this exemplary computer system 600. After reading this specification, it will be apparent to those skilled in the relevant art how to implement the present disclosure using other computer systems and/or computer architectures. Although operations may be described as sequential processes, some operations may actually be performed in parallel, concurrently, and/or in a distributed environment, and program code may be stored locally or remotely for access by single or multiple processor machines. Additionally, in some embodiments, the order of operations may be rearranged without departing from the spirit of the disclosed subject matter.

Processor device 604 can be a dedicated or general purpose processor device specifically configured to perform the functions discussed herein. Processor device 604 can be connected to communication infrastructure 606, such as bus, message queue, network, multi-core message passing scheme etc. The network can be any network suitable for performing the functions disclosed herein, and can include local area network (LAN), wide area network (WAN), wireless network (such as WiFi), mobile communication network, satellite network, Internet, optical fiber, coaxial cable, infrared, radio frequency (RF) or any combination thereof. Other suitable network types and configurations will be apparent to those skilled in the art. Computer system 600 can also include main memory 608 (for example, random access memory, read-only memory, etc.), and can also include auxiliary storage 610. The auxiliary storage 610 can include hard disk drive 612 and removable storage drive 614, such as floppy disk drive, tape drive, optical disk drive, flash memory etc.

Removable storage drive 614 can read from and/or write to removable storage unit 618 in a known manner. Removable storage unit 618 can include removable storage media that removable storage drive 614 can read from and write to. For example, if removable storage drive 614 is a floppy disk drive or a universal serial bus port, removable storage unit 618 can be a floppy disk or a portable flash drive, respectively. In one embodiment, removable storage unit 618 can be a non-transitory computer-readable recording medium.

In some embodiments, secondary memory 610 may include alternative means for allowing computer programs or other instructions to be loaded into computer system 600, such as a removable storage unit 622 and interface 620. Examples of such means may include a program cartridge and cartridge interface (e.g., as found in video game systems), a removable memory chip (e.g., EEPROM, PROM, etc.) and associated socket, as well as other removable storage units 622 and interfaces 620, as will be apparent to persons skilled in the relevant art(s).

Data stored in the computer system 600 (e.g., in the main memory 608 and/or the secondary memory 610) can be stored on any type of suitable computer-readable medium, such as an optical storage device (e.g., a compact disk, a digital versatile disk, a Blu-ray disk, etc.) or a magnetic tape storage device (e.g., a hard drive). The data can be configured in any type of suitable database configuration, such as a relational database, a structured query language (SQL) database, a distributed database, an object database, etc. Suitable configurations and storage types will be apparent to those skilled in the relevant art.

The computer system 600 may also include a communication interface 624. The communication interface 624 can be configured to allow software and data to be transmitted between the computer system 600 and external devices. Exemplary communication interfaces 624 may include a modem, a network interface (e.g., an Ethernet card), a communication port, a PCMCIA slot and card, etc. The software and data transmitted via the communication interface 624 may be in the form of signals, which may be electronic, electromagnetic, optical or other signals, as will be apparent to those skilled in the relevant art. The signals may travel via a communication path 626, which may be configured to carry signals and may be implemented using wires, cables, optical fibers, telephone lines, cellular phone links, radio frequency links, etc.

The computer system 600 may also include a display interface 602. The display interface 602 may be configured to allow data to be transferred between the computer system 600 and an external display 630. Exemplary display interfaces 602 may include a High-Definition Multimedia Interface (HDMI), a Digital Video Interface (DVI), a Video Graphics Array (VGA), or the like. The display 630 may be any suitable type of display for displaying data sent via the display interface 602 of the computer system 600, including cathode ray tube (CRT) displays, liquid crystal displays (LCDs), light emitting diode (LED) displays, capacitive touch displays, thin film transistor (TFT) displays, and the like.

Computer program media and computer usable media can refer to memories, such as main memory 608 and auxiliary memory 610, which can be memory semiconductors (e.g., DRAM, etc.). These computer program products can be devices for providing software to computer system 600. Computer programs (e.g., computer control logic) can be stored in main memory 608 and/or auxiliary memory 610. Computer programs can also be received via communication interface 624. When executed, these computer programs can enable computer system 600 to implement the present methods discussed herein. In particular, when executed, the computer program can enable processor device 604 to implement the methods shown in Figures 3-5. As discussed herein. Therefore, such a computer program can represent a controller of computer system 600. In the case of implementing the present disclosure using software, the software can be stored in a computer program product and loaded into computer system 600 using removable storage drive 614, interface 620 and hard disk drive 612 or communication interface 624.

The processor device 604 may include one or more modules or engines configured to perform the functions of the computer system 600. Each module or engine may be implemented using hardware, and in some cases software may also be used, such as corresponding to program code and/or a program stored in the main memory 608 or the auxiliary memory 610. In this case, the program code may be compiled by the processor device 604 (e.g., by a compilation module or engine) before being executed by the hardware of the computer system 600. For example, the program code may be source code written in a programming language that is converted into a lower-level language such as assembly language or machine code for execution by the processor device 604 and/or any additional hardware components of the computer system 600. The compilation process may include the use of lexical analysis, preprocessing, parsing, semantic analysis, syntax-guided conversion, code generation, code optimization, and any other technology applicable to converting the program code into a lower-level language suitable for controlling the computer system 600 to perform the functions disclosed herein. Those skilled in the relevant art will appreciate that such a process results in the computer system 600 being a specially configured computer system 600 that is specifically programmed to perform the functions described above.

Technology consistent with the present disclosure provides systems and methods for distributing multiple cryptographic keys used to access data, among other features. While various exemplary embodiments of the disclosed systems and methods have been described above, it should be understood that they are provided for purposes of illustration only, not limitation. This is not exhaustive and does not limit the disclosure to the precise form disclosed. In light of the above teachings, modifications and variations are possible or may be acquired from practice of the disclosure without departing from its breadth or scope.

Claims (18)

1. A method for distributing multiple cryptographic keys for accessing data, comprising: The receiving device of the processing server receives a data signal superimposed with an access key request, wherein the access key request includes at least n requested keys greater than 1; The generation module of the processing server generates n key pairs using a key pair generation algorithm, wherein each key pair includes a private key and a public key; The processing server's export module derives the access private key by applying the private key contained in each of the n key pairs to a key export algorithm. The generation module of the processing server uses the key pair generation algorithm to generate and export the public key corresponding to the private key. The transmitting device of the processing server electronically transmits a data signal for each of the n key pairs, the data signal superimposed with the private key contained in one of the n key pairs; and The processing server stores a transmission key pair, including a transmission public key and a transmission private key, in its memory. The receiving device of the processing server receives a data signal superimposed with a shared public key from each of the n computing devices; The generation module of the processing server generates n shared secrets, wherein each shared secret is generated using a shared public key from the n shared public keys, the transmission private key, and the key pair generation algorithm; and The encryption module of the processing server uses an encryption algorithm to encrypt the private key contained in each of the n key pairs using one of the n shared secrets, wherein... The private key superimposed on the data signal transmitted electronically is the corresponding encrypted private key. 2. The method according to claim 1, further comprising: The sending device of the processing server electronically transmits a data signal superimposed with the transmission public key to n computing devices. 3. The method according to claim 2, wherein, before receiving the data signal superimposed with the shared public key, the data signal superimposed with the transmission public key is electronically transmitted to the n computing devices. 4. The method according to claim 2, wherein each data signal superimposed with the public key is the same data signal as each data signal superimposed with the encrypted private key. 5. The method of claim 1, wherein the transmitted data signal is electronically transmitted to a node in the blockchain network, and wherein the encrypted private key is included in the transaction request, the transaction request further including a destination address corresponding to the shared public key. 6. The method according to claim 1, wherein the key pair generation algorithm is an elliptic curve key agreement scheme. 7. The method according to claim 6, wherein the elliptic curve key agreement scheme is an elliptic curve Diffie-Hellman key agreement protocol. 8. The method of claim 1, wherein the key derivation algorithm includes using an XOR logical operation. 9. The method according to claim 1, further comprising: The sending device of the processing server electronically transmits a data signal superimposed with a transaction request to a node in the blockchain network, wherein the transaction request includes at least a destination address signed using a derived access private key. 10. A system for distributing multiple cryptographic keys for accessing data, comprising: The device that handles the sending of data from the server; The receiving device of the processing server is configured to receive a data signal superimposed with an access key request, wherein the access key request includes at least n requested keys; The generation module of the processing server is configured to generate n key pairs using a key pair generation algorithm, wherein each key pair includes a private key and a public key; and The export module of the processing server is configured to export the access private key by applying the private key contained in each of the n key pairs to a key export algorithm, wherein... The generation module of the processing server is further configured to use the key pair generation algorithm to generate an access public key corresponding to the exported access private key. The transmitting device of the processing server is configured to electronically transmit a data signal superimposed with the private key contained in one of the n key pairs for each of the n key pairs; and The system also includes: The encryption module of the processing server; and The memory of the processing server is configured to store a transmission key pair including a transmission public key and a transmission private key, wherein, The receiving device of the processing server is further configured to receive a data signal superimposed with a shared public key from each of the n computing devices. The generation module of the processing server is further configured to generate n shared secrets, wherein each shared secret is generated using a shared public key from the n shared public keys, the transmission private key, and the key pair generation algorithm. The encryption module of the processing server is configured to use an encryption algorithm to encrypt the private key contained in each of the n key pairs using one of the n shared secrets, and The private key superimposed on the data signal transmitted electronically is the corresponding encrypted private key. 11. The system of claim 10, wherein the transmitting device of the processing server is further configured to electronically transmit a data signal superimposed with the transmission public key to the n computing devices. 12. The system of claim 11, wherein the data signal superimposed with the transmission public key is transmitted electronically to the n computing devices before receiving the data signal superimposed with the shared public key. 13. The system of claim 11, wherein each data signal superimposed with the transmission public key is the same data signal as each data signal superimposed with the encrypted private key. 14. The system of claim 10, wherein the transmitted data signal is sent electronically to a node in the blockchain network, and wherein the encrypted private key is included in a transaction request, the transaction request further including a destination address corresponding to the shared public key. 15. The system according to claim 10, wherein the key pair generation algorithm is an elliptic curve key agreement scheme. 16. The system of claim 15, wherein the elliptic curve key agreement scheme is an elliptic curve Diffie-Hellman key agreement protocol. 17. The system of claim 10, wherein the key derivation algorithm includes using an XOR logical operation. 18. The system of claim 10, wherein the sending device of the processing server is further configured to electronically send a data signal superimposed with a transaction request to a node in the blockchain network, wherein the transaction request at least includes a destination address signed using a derived access private key.