PRIVATE KEY DECRYPTION SYSTEM AND METHOD OF USE

• US 20180337774A1
• Filed: 07/13/2018
• Published: 11/22/2018
• Est. Priority Date: 05/19/2015
• Status: Active Grant

• Current Assignee: Coinbase, Inc.
• Original Assignee: Coinbase, Inc.
• Inventors: Alness, Andrew E., Hudon, James Bradley
• Granted Patent: US 10,644,879 B2
• Time in Patent Office: Days
• CPC Class Codes: G06Q 20/065 using e-cash
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067

Abstract

A key ceremony application creates bundles for custodians encrypted with their passphrases. Each bundle includes master key share. The master key shares are combined to store an operational master key. The operational master key is used for private key encryption during a checkout process. The operational private key is used for private key decryption for transaction signing in a payment process. The bundles further include TLS keys for authenticated requests to create an API key for a web application to communicate with a service and to unfreeze the system after it has been frozen by an administrator.

Claims

1. A host computer system comprising:

a service;

a master key loader configured to store an operational master key in memory of the service;

a database having an address and an encrypted private key stored in association with one another;

a web application configured to receive a request for payment to a bitcoin address, the request for payment including an amount of bitcoin to be paid, generate an unsigned transaction in response to receiving the request for payment, the unsigned transaction including the amount of bitcoin to be paid in the request from payment, and request a signing of the unsigned transaction to create a signed transaction; and

a payment module configured to receive the request for signing the transaction, determine the address corresponding to the bitcoin address in the unsigned transaction, determine the encrypted private key stored in association with the address, decrypt the encrypted private key with the operational master key to generate a decrypted private key, and sign the transaction with the decrypted private key to create the signed transaction, the web application configured to receive the signed transaction, and broadcast the signed transaction over the bitcoin network.

2. The host computer system of claim 1, further comprising:

a checkout module configured to generate an address and a private key, encrypt the private key with the operational master key to generate an encrypted private key.

3. The host computer system of claim 1, further comprising a freeze flag logic configured to detect a freeze flag on-state, disallow signing of the transaction in response to detecting the freeze flag on-state, detect a freeze flag off-state, and allow signing of the transaction in response to detecting the freeze flag off-state.

4. The host computer system of claim 3, wherein the freeze flag logic is configured to receive at least a plurality of authenticated requests to unfreeze transaction signing, and allows signing of the transactions upon a determination by the service that the plurality of authenticated requests is at least equal to a predetermined number.

5. The host computer system of claim 1, further comprising:

a key ceremony application configured to create a for-distribution master key, store the for-distribution master key in the memory, split the for-distribution master key into N shares, distribute the N shares among N custodians, clear the for-distribution master key from the memory; and

a master key loader configured to receive at least M of the N shares, where M is equal to or less than N, and derive the operational master key from the M shares before storing the operational master key in the memory.

6. The host computer system of claim 1, wherein the web application is configured to receive, prior to receiving the request for payment from a customer computer system, a request for address, and request an address from the checkout module, the checkout module configured to receive the request for address for generating the address and the private key in response to the request for address, store the address and the encrypted private key in association with one another, and provide the address to the web application, the web application configured to receive the address from the service, and transmit the address to the customer computer system.

7. A method of transacting bitcoin comprising:

storing, by a service, an operational master key in memory of a service; and

storing, by the service, the address and the encrypted private key in association with one another;

receiving, by a web application, a request for payment to a bitcoin address, the request for payment including an amount of bitcoin to be paid;

generating, by the web application, an unsigned transaction in response to receiving the request for payment, the unsigned transaction including the amount of bitcoin to be paid in the request from payment;

requesting, by the web application, a signing of the unsigned transaction to create a signed transaction;

receiving, by the service, the request for signing the transaction;

determining, by the service, the address corresponding to the bitcoin address in the unsigned transaction;

determining, by the service, the encrypted private key stored in association with the address;

decrypting, by the service, the encrypted private key with the operational master key to generate a decrypted private key;

signing, by the service, the transaction with the decrypted private key to create the signed transaction;

receiving, by the web application, the signed transaction; and

broadcasting, by the web application, the signed transaction over the bitcoin network.

8. The method of claim 7, further comprising:

generating, by the service, an address and a private key; and

encrypting, by the service, the private key with the operational master key to generate an encrypted private key.

9. The method of claim 7, further comprising:

detecting, by the service, a freeze flag on-state;

disallowing, by the service, signing of the transaction in response to detecting the freeze flag on-state;

detecting, by the service, a freeze flag off-state; and

allowing, by the service, signing of the transaction in response to detecting the freeze flag off-state.

10. The method of claim 9, further comprising:

receiving, by the service, at least a plurality of authenticated requests to unfreeze transaction signing, the service allowing signing of the transactions upon a determination by the service that the plurality of authenticated requests is at least equal to a predetermined number.

11. The method of claim 7, further comprising:

creating, by a key ceremony application, a for-distribution master key;

storing, by the key ceremony application, the for-distribution master key in the memory;

splitting, by the key ceremony application, the for-distribution master key into N shares;

distributing, by the key ceremony application, the N shares among N custodians;

clearing, by the key ceremony application, the for-distribution master key from the memory;

receiving, by the service, at least M of the N shares, where M is equal to or less than N; and

deriving, by the service, the operational master key from the M shares before storing the operational master key in the memory.

12. The method of claim 7, further comprising:

receiving, by the web application prior to receiving the request for payment from a customer computer system, a request for address;

requesting, by the web application, an address from a service;

receiving, by the service, the request for address for generating, by the service, the address and the private key in response to receiving the request for address, and storing, by the service, the address and the encrypted private key in association with one another;

providing, by the service, the address to the web application;

receiving, by the web application, the address from the service;

transmitting, by the web application, the address to the customer computer system.

13. A computer-readable medium having stored thereon a set of instructions that, when executed by a processor of a computer carries out a method of transacting bitcoin comprising:

storing, by a service, an operational master key in memory of a service; and

storing, by the service, the address and the encrypted private key in association with one another;

receiving, by a web application, a request for payment to a bitcoin address, the request for payment including an amount of bitcoin to be paid;

generating, by the web application, an unsigned transaction in response to receiving the request for payment, the unsigned transaction including the amount of bitcoin to be paid in the request from payment;

requesting, by the web application, a signing of the unsigned transaction to create a signed transaction;

receiving, by the service, the request for signing the transaction;

determining, by the service, the address corresponding to the bitcoin address in the unsigned transaction;

determining, by the service, the encrypted private key stored in association with the address;

decrypting, by the service, the encrypted private key with the operational master key to generate a decrypted private key;

signing, by the service, the transaction with the decrypted private key to create the signed transaction;

receiving, by the web application, the signed transaction; and

broadcasting, by the web application, the signed transaction over the bitcoin network.