METHOD AND SYSTEM FOR DISTRIBUTED CRYPTOGRAPHIC KEY PROVISIONING AND STORAGE VIA ELLIPTIC CURVE CRYPTOGRAPHY

• US 20190028275A1
• Filed: 09/11/2018
• Published: 01/24/2019
• Est. Priority Date: 01/20/2016
• Status: Active Grant

• Current Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Original Assignee: Mastercard International Incorporated (MasterCard Incorporated)
• Inventors: Davis, Steven Charles
• Granted Patent: US 10,396,988 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3066 involving algebraic varieties, e.g. elliptic or hyper-elliptic curves

Abstract

A method for distributing multiple cryptographic keys used to access data includes: receiving a data signal superimposed with an access key request, wherein the access key request includes at least a number, n, greater than 1, of requested keys; generating n key pairs using a key pair generation algorithm, wherein each key pair includes a private key and a public key; deriving an access private key by applying the private key included in each of the n key pairs to a key derivation algorithm; generating an access public key corresponding to the derived access private key using the key pair generation algorithm; and electronically transmitting a data signal superimposed with a private key included in one of the n key pairs for each of the n key pairs.

Claims

1. A method for distributing multiple cryptographic keys used to access data, comprising:

receiving, by a receiving device of a processing server, a data signal superimposed with an access key request, wherein the access key request includes at least a number, n, greater than 2, of requested keys;

generating, by the processing server, n key pairs using a key pair generation algorithm, wherein each key pair includes a private key and a public key;

deriving, by the processing server, an access private key by applying the private key included in each of the n key pairs to a key derivation algorithm;

generating, by the processing server, an access public key corresponding to the derived access private key using the key pair generation algorithm; and

electronically transmitting, by a transmitting device of the processing server, a data signal superimposed with a private key included in one of the n key pairs for each of then key pairs.

2. The method of claim 1, further comprising:

storing, in a memory of the processing server, a transfer key pair including a transfer public key and a transfer private key;

receiving, by the receiving device of the processing server, a data signal superimposed with a shared public key from each of n computing devices;

generating, by the processing server, n shared secrets, wherein each shared secret is generated using a shared public key of the n shared public keys and the transfer private key and the key pair generation algorithm; and

encrypting, by the processing server, the private key included in each of the n key pairs with one of the n shared secrets using an encryption algorithm, wherein

the private key included superimposed in the electronically transmitted data signal is the respective encrypted private key.

3. The method of claim 2, further comprising:

electronically transmitting, by the transmitting device of the processing server, a data signal superimposed with the transfer public key to the n computing devices.

4. The method of claim 3, wherein the data signal superimposed with the transfer public key is electronically transmitted to the n computing devices prior to receiving the data signal superimposed with the shared public key.

5. The method of claim 3, wherein each data signal superimposed with the transfer public key is a same data signal as each data signal superimposed with an encrypted private key.

6. The method of claim 2, wherein the transmitted data signal is electronically transmitted to a node in a blockchain network and where the encrypted private key is included in a transaction request that further includes a destination address corresponding to the respective shared public key.

7. The method of claim 1, wherein the key pair generation algorithm is an elliptic curve key agreement scheme.

8. The method of claim 7, wherein the elliptic curve key agreement scheme is the elliptic curve Diffie-Hellman key agreement protocol.

9. The method of claim 1, wherein the key derivation algorithm includes use of an XOR logical operation.

10. The method of claim 1, further comprising:

electronically transmitting, by the transmitting device of the processing server, a data signal superimposed with a transaction request to a node in a blockchain network, wherein the transaction request includes at least a destination address signed using the derived access private key.

11. A system for distributing multiple cryptographic keys used to access data, comprising:

a transmitting device of a processing server;

a receiving device of the processing server configured to receive a data signal superimposed with an access key request, wherein the access key request includes at least a number, n, greater than 2, of requested keys; and

a processor of the processing server configured to

generate n key pairs using a key pair generation algorithm, wherein each key pair includes a private key and a public key,

derive an access private key by applying the private key included in each of the n key pairs to a key derivation algorithm, and

the generation module of the processing server is further configured to generate an access public key corresponding to the derived access private key using the key pair generation algorithm, wherein

the transmitting device of the processing server is configured to electronically transmit a data signal superimposed with a private key included in one of the n key pairs for each of the n key pairs.

12. The system of claim 11, further comprising:

a memory of the processing server configured to store a transfer key pair including a transfer public key and a transfer private key, wherein

the receiving device of the processing server is further configured to receive a data signal superimposed with a shared public key from each of n computing devices,

the processor of the processing server is further configured to generate n shared secrets, wherein each shared secret is generated using a shared public key of the n shared public keys and the transfer private key and the key pair generation algorithm, and encrypt the private key included in each of the n key pairs with one of the n shared secrets using an encryption algorithm, and

the private key included superimposed in the electronically transmitted data signal is the respective encrypted private key.

13. The system of claim 12, wherein the transmitting device of the processing server is further configured to electronically transmit a data signal superimposed with the transfer public key to the n computing devices.

14. The system of claim 13, wherein the data signal superimposed with the transfer public key is electronically transmitted to the n computing devices prior to receiving the data signal superimposed with the shared public key.

15. The system of claim 13, wherein each data signal superimposed with the transfer public key is a same data signal as each data signal superimposed with an encrypted private key.

16. The system of claim 12, wherein the transmitted data signal is electronically transmitted to a node in a blockchain network and where the encrypted private key is included in a transaction request that further includes a destination address corresponding to the respective shared public key.

17. The system of claim 11, wherein the key pair generation algorithm is an elliptic curve key agreement scheme.

18. The system of claim 17, wherein the elliptic curve key agreement scheme is the elliptic curve Diffie-Hellman key agreement protocol.

19. The system of claim 11, wherein the key derivation algorithm includes use of an XOR logical operation.

20. The system of claim 11, wherein the transmitting device of the processing server is further configured to electronically transmit a data signal superimposed with a transaction request to a node in a blockchain network, wherein the transaction request includes at least a destination address signed using the derived access private key.