SECURITY SYSTEM FORMING PART OF A BITCOIN HOST COMPUTER

• US 20160344543A1
• Filed: 05/19/2015
• Published: 11/24/2016
• Est. Priority Date: 05/19/2015
• Status: Active Grant

• Current Assignee: Coinbase, Inc.
• Original Assignee: Coinbase, Inc.
• Inventors: Alness, Andrew E., Hudon, James Bradley
• Granted Patent: US 9,735,958 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/065 using e-cash
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067

Abstract

A key ceremony application creates bundles for custodians encrypted with their passphrases. Each bundle includes master key share. The master key shares are combined to store an operational master key. The operational master key is used for private key encryption during a checkout process. The operational private key is used for private key decryption for transaction signing in a payment process. The bundles further include TLS keys for authenticated requests to create an API key for a web application to communicate with a service and to unfreeze the system after it has been frozen by an administrator.

Claims

1. A host computer system comprising:

a key ceremony application configured to create a for-distribution master key,

store the for-distribution master key in the memory,

split the for-distribution master key into N shares,

distribute the N shares among N custodians, and

clear the for-distribution master key from the memory.

2. The host computer system of claim 1, wherein the key ceremony application is configured to create a custodian transport layer security (TLS) key for each custodian, bundle a respective custodian TLS key with a respective share in a respective bundle, and distribute the respective bundles to the respective custodians.

3. The host computer system of claim 2, wherein the key ceremony application is configured to receive a passphrase from each custodian, and encrypt each bundle with a respective passphrase of a respective custodian.

4. A method of distributing security data to custodians comprising:

creating, by a key ceremony application, a for-distribution master key;

storing, by the key ceremony application, the for-distribution master key in the memory;

splitting, by the key ceremony application, the for-distribution master key into N shares;

distributing, by the key ceremony application, the N shares among N custodians; and

clearing, by the key ceremony application, the for-distribution master key from the memory.

5. The method of claim 4, further comprising:

creating, by the key ceremony application, a custodian transport layer security (TLS) key for each custodian;

bundling, by the key ceremony application, a respective custodian TLS key with a respective share in a respective bundle; and

distributing, by the service, the respective bundles to the respective custodians.

6. The method of claim 5, further comprising:

receiving a passphrase from each custodian; and

encrypting each bundle with a respective passphrase of a respective custodian.

7. A computer-readable medium having stored thereon a set of instructions that, when executed by a processor of a computer carries out a method of distributing security data to custodians comprising:

creating, by a key ceremony application, a for-distribution master key;

storing, by the key ceremony application, the for-distribution master key in the memory;

splitting, by the key ceremony application, the for-distribution master key into N shares;

distributing, by the key ceremony application, the N shares among N custodians; and

clearing, by the key ceremony application, the for-distribution master key from the memory.

8-63. -63. (canceled)