US9735958B2 — Key ceremony of a security system forming part of a host computer for cryptographic transactions
Document text
Research, not advice. Part of the Bitcoin research archive (October 2026). Claims labelled unverified, contested or fringe are reported, not endorsed; statuses of bills and rules are as of the date checked. Government, court and patent records are public domain; the research notes are CC BY 4.0.
US009735958B2
(12) United States Patent ( 10 ) Patent No.: US 9 ,735 , 958 B2
Alness et al. (45 ) Date of Patent: Aug. 15 , 2017
(54 ) KEY CEREMONY OF A SECURITY SYSTEM (56 ) References Cited
FORMING PART OF A HOST COMPUTER
FOR CRYPTOGRAPHIC TRANSACTIONS U .S . PATENT DOCUMENTS
(71) Applicant: Coinbase, Inc., San Francisco , CA (US) 8 ,855 ,318 B1 * 10 /2014 Patnala H04L 9/0822
380 /277
9 ,071, 429 B1 * 6 / 2015 Roth .................. H04L 9 /3268
(72 ) Inventors : Andrew E . Alness , Santa Cruz , CA 2002 /0116611 Al * 8 /2002 Zhou ...... ................ H04L 9 /004
(US ); James Bradley Hudon , San 713 / 156
Francisco, CA (US) 2005/0138374 A1* 6 /2005 Zheng ................... HO4L 9 /0894
713 / 166
( 73 ) Assignee: Coinbase, Inc ., San Francisco , CA (US) 2007/0223706 A1* 9/2007 Gantman ......... GO6F 21/ 34
380 /286
( * ) Notice: Subject to any disclaimer, the term of this 2008 /0263363 A1* 10 /2008 Jueneman ............... G06F 21/32
713 / 184
patent is extended or adjusted under 35 2009 /0254750 A1* 10 /2009 Bono ................. HO4L 63/0428
U . S .C . 154 (b ) by 0 days . 713 / 170
2010 /0054458 A1* 3 /2010 Schneider ............... HO4L 9 /085
(21) Appl. No.: 14 /716 ,100 2010/0175061 A1 * 7 /2010 Maeda
380 /28
G06F 8/65
(22 ) Filed: May 19 , 2015 717 / 173
2010 /0235588 A1 * 9/2010 Maeda .............. H04L 9 /085
711/ 147
(65 ) Prior Publication Data
US 2016/0344543 A1 Nov. 24, 2016 (Continued )
Primary Examiner — Gary Gracia
(51) Int . Cl. (74 ) Attorney , Agent, or Firm — Stephen M . De Klerk
H04L 9 /32 (2006 .01 )
H04L 9 /08 ( 2006 .01) (57) ABSTRACT
G060 20 / 06 ( 2012 .01) A key ceremony application creates bundles for custodians
G060 20 / 38 ( 2012 .01) encrypted with their passphrases. Each bundle includes
G06F 21 /00 ( 2013 .01) master key share . The master key shares are combined to
U . S . CI. store an operationalmaster key . The operationalmaster key
CPC ......... H04L 9/ 0819 (2013.01); G06Q 20 /065 is used for private key encryption during a checkout process .
( 2013 .01) ; G06Q 20 /3823 ( 2013 .01 ) The operational private key is used for private key decryp
(58 ) Field of Classification Search tion for transaction signing in a payment process . The
CPC ............. HO4L 63 /0428 ; HO4L 2209/24 ; HO4L bundles further include TLS keys for authenticated requests
63 /061; H04L 63 /065 ; H04L 63/ 067; to create an API key for a web application to communicate
H04L 63 /068 ; H04L 63/0846 ; H04L with a service and to unfreeze the system after it has been
9 /0822 frozen by an administrator.
USPC ........ 713 /170 , 171, 175 , 168; 380 /227 , 282
See application file for complete search history . 5 Claims, 8 Drawing Sheets
Sequential Setup and Operation
Begin
OUUUU H H 10
Key Ceremony
12
Load Master Key
14
Create API key
16
Checkout Process (Permitted when Frozen )
18
Payment Process (Not Permitted when Frozen )
End
-- -
| Freeze ? 1
-
J
i 22
11
Unfreeze ?
US 9,735 ,958 B2
Page 2
(56) References Cited
U . S . PATENT DOCUMENTS
2011/0202755 A1 * 8 /2011 Orsini ................ H04L 63/029
713 / 151
2013/0010966 A1 * 1/2013 Li ............... H04L 9 / 0888
380 /278
2013/0191632 A1 * 7/2013 Spector ........... HO4L 9 / 083
713/ 155
2013/0339738 A1 * 12/2013 Shaw .............. HO4L 9 /085
713 / 171
* cited by examiner
atent Aug. 15 , 2017 Sheet 1 of 8 US 9 ,735 , 958 B2
|- - - - - - - - - - - -
Freeze
?| -
ie ze
?
Unfr|
22
1
- - -
SOeapqeureatntuiodapnl Fig
1
Begin keyate
CreAPI PCFwehreohmc()ikzteosuenstd PFearyomc(Not)whenizsed
10
CKeremoyn MasKeyLoadter 14 16 18 End
atent Aug. 15 , 2017 Sheet 2 of 8 US 9,735,958 B2
38 CreTLSate authoCA()rity 40 creCAate ServTLSice Key
certificate
36 CreNate custoTLSdian keys 42 CreNate Bundles 44 ceEkbuwnsecatrinoycdptilahesnd pctkaushntpe(o)onlyhdriwasrne Lcalpetaorpssecrets(,MKTLS)keys
46
3
Fig
CereKeymon
PromptMasofter Cereform nyMofvalues CMraesater memory
N
and in
Key 34 into
Split shaNres
MK
01 - 0 -00
EBnucrny28dptled CustTLSkey-odianSer-TLSkeyvice
-
MK
share Custodian 000
Custodian Custodian Custodian
Fig
2
Lap24top Key CeremonyAplication 26
atent Aug. 15 , 2017 Sheet 3 of 8 US 9,735,958 B2
Database 52
Serv50ice
Ser50vice
Serv50ice
Key
API Gener56ator Payment Mod60ule Mas1ter Key64|
Ser50vice Hash
00 Checkout
MasKeyterLoa54der Mod58ule FLroegizce62 Freeze flag220 Version
LMoasKeydtienrg 74
- 0 -00 Custodian Custodian Custodian
Web 48 Aplication 4
Fig
atent Aug. 15 , 2017 Sheet 4 of 8 US 9 ,735 , 958 B2
Database 52
Serv50ice
Ser50vice Payment Master
APIKey Gener56ator Mod60ule 64Key
Serv50ice
Ser50vice Encrypted Key 88
API
Checkout
MasKeyterLoa54der Mod58ule FLroegizce62 Fre zeflag220
CreAPIkeyate
<
Custodian .
M
L
Custodian Custodiany
184
Aplication
Web 48 APIKey 86
5
Fig
U . S . Patent Aug. 15 , 2017 Sheet 5 of 8 US 9 ,735 , 958 B2
104
Database 52
Ser50vice
Serv50ice
Serv50ice
APIKey Gener56ator Payment Mod60ule Master 64
Key
Serv50ice
EAPKndrcirevypatsyed 7TzYFp
103
)
Key
Mast e r Checkout
Loa54der Mod58ule FLroegizce 62 Fre ze 220flag
102 105
BLaloancedr 98
CPhreockeosut 1024
Aplication
Web 48APIKey86
6
Fig
CSuoysmtpoumtemr 92Page BAEFidmtpecrotlisydn
90 94
94
1067
atent Aug. 15 , 2017 Sheet 6 of 8 US 9 ,735 , 958 B2
Database 52
Ser50vice
Serv50ice
Serv50ice |
API
Key
Gene56rator Payment Mod60ule Master Key64
Serv50ice
EAPnKdrciryevpatseysd 7TzYFp
115
(
Checkout
MasKeyter Loa54der Mod58ule FLroegizce62 Fre ze220flag
113
- 116
Paryomcenst BLaloancedr 98
110
8
Request11ation agupensleifrom
Webcrgatnieodsn
112
A
B
.
to
tx —
1134
ap liA
“cweb
Send
to
.
"
BTC
1
to
Ask
sign
Service
.
113
pdLreoico114keyand.vrkautpe
tx
115
Sign
.
116
.
signed
Return
tx
Bbnsrieotag.txtod117cwnaeirsdnkt
Out
:
In
:-B
A-
-
to
BTC
1 BTC
8
to
Web Aplication 48 Key
API 86
For
more o
d
7
Fig
to
Send
?
BTC
1
A Send 111
Wal108et
10e s BTC
AdhasrB
atent Aug. 15 , 2017 Sheet 7 of 8 US 9 ,735 , 958 B2
Database 52
Custodian TLS
-
keys
Ser50vice
Ser50vice
Ser50vice
APIKey Gener56ator PaymentMod60ule Master Key
64
Serv50ice(
224
)
228
TLS
key
230
K
Checkout
MasKeyter Loa54der Mod58ule FLroegizce 62 Fre ze220flag
Frleazge
222
222
AB
to
2
-
BTC toTC
7
-
)
225
* ???
Out
:
Aplication
Web 48APIKey 86
8
Fig
221
APdamgien118OffOn
atent Aug. 15 , 2017 Sheet 8 of 8 US 9 ,735 , 958 B2
900
930 938
PROCESSOR
VIDEO DISPLAY
INSTRUCTIONS
940
MAIN MEMORY
ALPHA -NUMERIC
INSTRUCTIONS INPUT DEVICE
934 936 942
STATIC MEMORY CURSOR CONTROL
DEVICE
948 944
DRIVE UNIT
NETWORK
BUS 950
INTERFACE DEVICE MACHINE
READABLE
MEDIUM
| | 952
INSTRUCTIONS
954
946
NETWORK SIGNAL
GENERATION
FIG . 9 DEVICE
US 9 , 735, 958 B2
KEY CEREMONY OF A SECURITY SYSTEM when executed by a processor of a computer carries out a
FORMING PART OF A HOST COMPUTER method of distributing security data to custodians including
FOR CRYPTOGRAPHIC TRANSACTIONS creating, by a key ceremony application , a for - distribution
master key, storing, by the key ceremony application , the
BACKGROUND OF THE INVENTION 5 for -distribution master key in the memory , splitting , by the
key ceremony application , the for-distribution master key
1 ). Field of the Invention into N shares, distributing, by the key ceremony application ,
This invention relates to a computer system and method the N shares among N custodians and clearing, by the key
for storing and transacting bitcoin . ceremony application , the for- distribution master key from
2 ). Discussion of Related Art 10 the memory .
The Bitcoin network is a peer -to -peer payment system API Key Generation
having a plurality ofnodes that are connected to one another. The invention also provides a host computer system
Bitcoin exchange computer systems allow for users to including an application programmable interface (API) key
exchange local currency into or out of bitcoin . Users send generator forming part of a service and configured to receive
payments by broadcasting digitally signed messages to the 15 a plurality of requests to create an API key, generate , upon
Bitcoin network . Users may , for example , send and receive a determination by the API key generator , that the plurality
payments using mobile applications on mobile devices, of requests to create an API key is at least equal to a
client software or a web browser . minimum number (M ) requests, an API key, store the API
Transactions do not explicitly identify the payor and key and provide an output of the API key , and a web
payee by name or wallet. Instead , a bitcoin transaction 20 application configured to receive the API key , store the API
transfers ownership to a new address , referred to as a key , receive a request, and communicate with the service in
“ Bitcoin address” . The Bitcoin address is derived from the response to receiving the request, including providing the
public portion of one or more cryptographic key pairs . The API key stored by the web application to the service, the
private portion of a key pair is not disclosed to the public service adapted to receive the API key from the web
To send bitcoin sent to an address , a user broadcasts a 25 application , and execute a procedure only if the API key
payment message that is digitally signed with the associated received from the web server matches the API key stored by
private key . the service .
Participants known as “ miners ” at miner computer sys - The invention further provides a method of transacting
tems verify and timestamp transactions into a shared public bitcoin including receiving, by a service , a plurality of
database called a “ block chain " . The miners are rewarded 30 requests to create an application programmable interface
with transaction fees and newly minted bitcoin for their (API) key , generating, by the service , upon a determination
effort. The miner computer systems are specialized comput- by the service that the plurality of requests to create an API
ers that append blocks of transactions to the block chain . key is at least equal to a minimum number (M ) requests, an
Solving a cryptographic puzzle required to append a block API key, storing, by the service , the API key, providing , by
carries a reward plus fees included in transactions in the 35 the service , an output of the API key, receiving, by a web
block . application, the API key, storing,by the web application , the
Host computer systems reside at various nodes and may API key, receiving, by the web application , a request,
host accounts or " wallets” that allow users to make and communicating , by the web application , with the service in
accept payments using bitcoin . The wallet stores the public response to receiving the request, including providing the
key of the Bitcoin address and its associated private key . 40 API key stored by the web application to the service ,
It may be a security concern for users that the private keys receiving , by the service , the API key from the web appli
of their Bitcoin addresses may be stolen from their wallets. cation and executing, by the service , a procedure only if the
Existing systems do not provide a solution for maintaining API key received from the web server matches the APIkey
security over private keys while still allowing the users to stored by the service .
checkout on a merchant page and making payments using 45 The invention also provides a computer -readable medium
their wallets . having stored thereon a set of instructions that, when
executed by a processor of a computer carries out a method
SUMMARY OF THE INVENTION of transacting bitcoin including receiving, by a service , a
plurality of requests to create an application programmable
Key Ceremony 50 interface (API) key , generating, by the service , upon a
The invention provides a host computer system including determination by the service that the plurality of requests to
a key ceremony application configured to create a for - create an API key is at least equal to a minimum number (M )
distribution master key , store the for -distribution master key requests , an API key , storing, by the service , the APIkey ,
in the memory, split the for- distribution master key into N providing, by the service, an output of the API key , receiv
shares , distribute the N shares among N custodians, clear the 55 ing, by a web application , the API key, storing , by the web
for -distribution master key from the memory . application , the API key , receiving, by the web application ,
The invention also provides a method of distributing a request, communicating , by the web application , with the
security data to custodians including creating, by a key service in response to receiving the request, including pro
ceremony application , a for - distribution master key , storing, viding the API key stored by the web application to the
by the key ceremony application , the for- distribution master 60 service , receiving , by the service , the API key from the web
key in the memory, splitting, by the key ceremony applica application and executing, by the service , a procedure only
tion , the for- distribution master key into N shares, distrib if the API key received from the web server matches the API
uting , by the key ceremony application , the N shares among key stored by the service .
N custodians and clearing , by the key ceremony application , Checkout and Payment
the for - distribution master key from the memory . 65 The invention further provides a host computer system
The invention further provides a computer- readable including a web application configured to receive, prior to
medium having stored thereon a set of instructions that, receiving a request for payment, a request for address, and
US 9 ,735 ,958 B2
requests an address from the service, a checkout module address , the request for payment including an amount of
configured to receive the request for address , generate the bitcoin to be paid , generating, by the web application , an
address and the private key in response to the request for unsigned transaction in response to receiving the request for
address, store the address and the encrypted private key in payment, the unsigned transaction including the amount of
association with one another , and provide the address to the 5 bitcoin to be paid in the request for payment , requesting, by
web application , the web application configured to receive the web application , a signing of the unsigned transaction to
the address from the service , transmit the address to the create a signed transaction , receiving, by the service , the
customer computer system , receive a request for payment to request for signing the transaction , determining, by the
a bitcoin address , the request for payment including an service , the address corresponding to the bitcoin address in
amount of bitcoin to be paid , generate an unsigned transac - 10 the unsigned transaction , determining , by the service, the
tion in response to receiving the request for payment, the private key stored in association with the address , signing,
unsigned transaction including the amount of bitcoin to be by the service , the transaction with the private key to create
paid in the request for payment, requesting a signing of the the signed transaction , providing , by the service, the signed
unsigned transaction to create a signed transaction and a transaction to the web service , receiving , by the web appli
payment module configured to receive the request for sign - 15 cation , the signed transaction and broadcasting , by the web
ing the transaction , determine the address corresponding to application, the signed transaction over the bitcoin network .
the bitcoin address in the unsigned transaction , determine Private Key Decryption
the private key stored in association with the address , sign The invention also provides a host computer system
the transaction with the private key to create the signed including a service , a master key loader configured to store
transaction , and provide the signed transaction to the web 20 an operational master key in memory of the service , a
service , the web service receiving the signed transaction , database having an address and an encrypted private key
and broadcasting the signed transaction over the bitcoin stored in association with one another, a web application
network . configured to receive a request for payment to a bitcoin
The invention also provides a method of transacting address , the request for payment including an amount of
bitcoin including receiving by a web application prior to 25 bitcoin to be paid , generate an unsigned transaction in
receiving a request for payment, a request for address, response to receiving the request for payment, the unsigned
requesting , by the web application , an address from a transaction including the amount of bitcoin to be paid in the
service , receiving , by the service , the request for address , request from payment, and request a signing of the unsigned
generating, by the service, an address and a private key in transaction to create a signed transaction and a payment
response to the request for address , storing, by the service, 30 module configured to receive the request for signing the
the address and the private key in association with one transaction , determine the address corresponding to the
another , providing, by the service , the address to the web bitcoin address in the unsigned transaction , determine the
application , receiving, by the web application , the address encrypted private key stored in association with the address ,
from the service, transmitting, by the web application , the decrypt the encrypted private key with the operational
address to the customer computer system , receiving , by a 35 master key to generate a decrypted private key, and sign the
web application , a request for payment to a bitcoin address, transaction with the decrypted private key to create the
the request for payment including an amount of bitcoin to be signed transaction , the web application configured to receive
paid , generating, by the web application , an unsigned trans- the signed transaction , and broadcast the signed transaction
action in response to receiving the request for payment, the over the bitcoin network .
unsigned transaction including the amount of bitcoin to be 40 The invention further provides a method of transacting
paid in the request for payment, requesting, by the web bitcoin including storing , by a service, an operationalmaster
application , a signing of the unsigned transaction to create a key in memory of a service and storing, by the service, the
signed transaction , receiving, by the service , the request for address and the encrypted private key in association with
signing the transaction , determining , by the service , the one another, receiving , by a web application , a request for
address corresponding to the bitcoin address in the unsigned 45 payment to a bitcoin address , the request for payment
transaction , determining, by the service, the private key including an amount of bitcoin to be paid , generating, by the
stored in association with the address , signing, by the web application , an unsigned transaction in response to
service , the transaction with the private key to create the receiving the request for payment, the unsigned transaction
signed transaction , providing, by the service , the signed including the amount of bitcoin to be paid in the request
transaction to the web service , receiving , by the web appli - 50 from payment, requesting, by the web application , a signing
cation , the signed transaction and broadcasting , by the web of the unsigned transaction to create a signed transaction ,
application , the signed transaction over the bitcoin network . receiving , by the service, the request for signing the trans
The invention further provides a computer - readable action , determining , by the service , the address correspond
medium having stored thereon a set of instructions that, ing to the bitcoin address in the unsigned transaction ,
when executed by a processor of a computer carries out a 55 determining , by the service , the encrypted private key stored
method of transacting bitcoin including receiving by a web in association with the address , decrypting, by the service ,
application prior to receiving a request for payment, a the encrypted private key with the operational master key to
request for address , requesting, by the web application , an generate a decrypted private key, signing, by the service, the
address from a service , receiving, by the service , the request transaction with the decrypted private key to create the
for address, generating, by the service , an address and a 60 signed transaction , receiving, by the web application , the
private key in response to the request for address , storing, by signed transaction and broadcasting, by the web application ,
the service , the address and the private key in association the signed transaction over the bitcoin network .
with one another, providing, by the service , the address to The invention also provides a computer- readable medium
the web application , receiving, by the web application , the having stored thereon a set of instructions that, when
address from the service , transmitting, by the web applica - 65 executed by a processor of a computer carries out a method
tion , the address to the customer computer system , receiv - of transacting bitcoin including storing, by a service , an
ing , by a web application , a request for payment to a bitcoin operational master key in memory of a service and storing,
US 9 ,735 ,958 B2
by the service , the address and the encrypted private key in when executed by a processor of a computer carries out a
association with one another , receiving , by a web applica method of transacting bitcoin including storing, by a service ,
tion , a request for payment to a bitcoin address, the request the address and the encrypted private key in association with
for payment including an amount of bitcoin to be paid , one another , receiving, by a web application , a request for
generating, by the web application , an unsigned transaction 5 payment to a bitcoin address, the request for payment
in response to receiving the request for payment, the including an amount of bitcoin to be paid , generating ,by the
unsigned transaction including the amount of bitcoin to be web application, an unsigned transaction in response to
paid in the request from payment, requesting, by the web receiving the request for payment, the unsigned transaction
application, a signing of the unsigned transaction to create a including the amount of bitcoin to be paid in the request
signed transaction, receiving , by the service , the request for 10 from payment, requesting, by the web application , a signing
signing the transaction , determining, by the service , the of the unsigned transaction to create a signed transaction,
address corresponding to the bitcoin address in the unsigned
transaction , determining, by the service, the encrypted pri receiving , by the service, the request for signing the trans
vate key stored in association with the address , decrypting, action , determining, by the service , the address correspond
by the service , the encrypted private key with the operational 15 ing to the bitcoin address in the unsigned transaction ,
master key to generate a decrypted private key, signing, by determining, by the service, the private key stored in asso
the service , the transaction with the decrypted private key to ciation with the address, detecting, by the service , a freeze
create the signed transaction, receiving, by the web appli- flag on -state , disallowing, by the service, signing of the
cation , the signed transaction and broadcasting , by the web transaction in response to detecting the freeze flag on - state ,
application , the signed transaction over the bitcoin network . 20 detecting, by the service, a freeze flag off - state, allowing ,by
Freeze Logic the service, signing of the transaction in response to detect
The invention further provides a host computer system ing the freeze flag off- state , receiving, by the web applica
including a database having an address and a private key tion , the signed transaction and broadcasting , by the web
stored in association with one another, a web application application , the signed transaction over the bitcoin network .
receiving a request for payment to a bitcoin address, the 25
request for payment including an amount of bitcoin to be BRIEF DESCRIPTION OF THE DRAWINGS
paid , generating an unsigned transaction in response to
receiving the request for payment, the unsigned transaction The invention is further described by way of example
including the amount of bitcoin to be paid in the request with reference to the accompanying drawings , wherein :
from payment, and requesting a signing of the unsigned 30 FIG . 1 is a flow chart illustration sequential setup and
transaction to create a signed transaction and a payment operation of a host computer system according to an
module configured to receive the request for signing the embodiment of the invention ;
transaction , determine the address corresponding to the FIG . 2 is a block diagram illustrating a laptop of a master
bitcoin address in the unsigned transaction , determining the of ceremony and custodian computers for purposes of cre
private key stored in association with the address , detect a 35 ating encrypted bundles having master key shares , custodian
freeze flag on -state , disallow signing of the transaction in transport layer security ( TLS) keys and a service TLS key ;
response to detecting the freeze flag on -state , detect a freeze FIG . 3 is a flow chart illustrating a key ceremony that is
flag off -state, and allow signing of the transaction with the executed by the computers of FIG . 2 ;
private key in response to detecting the freeze flag off-state , FIG . 4 is a block diagram illustrating how a master key is
the web application receiving the signed transaction , and 40 loaded within a service by custodians;
broadcasting the signed transaction over the bitcoin net- FIG . 5 is a block diagram illustrating how an application
work . programmable interface (API) key is created by the custo
The invention also provides a method of transacting
bitcoin including storing, by a service , the address and the FIG . 6 is a block diagram illustrating a checkout process
encrypted private key in association with one another , 45 that is carried out by the host computer system communi
receiving, by a web application , a request for payment to a cating with a customer computer system ;
bitcoin address, the request for payment including an FIG . 7 is a block diagram illustrating a payment process
amount of bitcoin to be paid , generating, by the web that is carried out by the host computer system communi
application , an unsigned transaction in response to receiving cating with a wallet on a device of a customer ;
the request for payment, the unsigned transaction including 50 FIG . 8 is block diagram illustrating how a freeze flag is set
the amount of bitcoin to be paid in the request from payment, by an administratorof the host computer system and how the
requesting, by the web application , a signing ofthe unsigned freeze flag is reset by the custodians ; and
transaction to create a signed transaction , receiving, by the FIG . 9 is a block diagram of a machine in the form of a
service , the request for signing the transaction , determining computer system forming part of the host computer system .
by the service, the address corresponding to the bitcoin 55
address in the unsigned transaction, determining , by the DETAILED DESCRIPTION OF THE
service , the private key stored in association with the INVENTION
address , detecting , by the service , a freeze flag on -state ,
disallowing, by the service , signing of the transaction in FIG . 1 of the accompanying drawings illustrates the
response to detecting the freeze flag on - state , detecting , by 60 sequential setup and operation , at a high level, according to
the service , a freeze flag off -state , allowing , by the service, an embodiment of the invention . A key ceremony is first
signing of the transaction in response to detecting the freeze carried out (Step 10 ). Following the key ceremony, a master
flag off-state , receiving , by the web application , the signed key is loaded ( Step 12 ) and an application programmable
transaction and broadcasting, by the web application , the interface ( API) key is created (Step 14 ) . Following the
signed transaction over the bitcoin network . 65 creation of the API key, a checkout process can be carried
The invention further provides a computer- readable out (Step 16 ). A payment process ( Step 18 ) is usually carried
medium having stored thereon a set of instructions that, out after the checkout process.
US 9,735 ,958 B2
At any point in time after the master key is loaded , the TLS is an open protocol for securing communications.
system can be frozen (Step 20 ). The system can be unfrozen TLS is used to communicate with the services 50 . The client
after it has been frozen (Step 22 ) using keys from the key and the service 50 have public /private key pairs to encrypt
ceremony ( Step 10 ) . The checkout process (Step 16 ) can be messages. The certificate of the service 50 is used to
carried out when the system is frozen and when the system 5 communicate the specific key that it owns the client' s
is unfrozen . The payment process (Step 18 ) can only be certificate communicates the key that it owns. The certifi
carried out when the system is unfrozen and not when the cates are issued by the CA . Client and server keys can be
system is frozen . created right away , as well as the CA ,but the client needs the
FIG . 2 illustrates components that are in communication CA and the client key , and the server certificate needs the CA
with one another in order to distribute master key (MK ) 10 and the server key .
shares, custodian transport layer security ( TLS ) keys and FIG . 4 specifically illustrates loading of an operational
service TLS keys. The system includes a laptop 24 that has master key 64 into the service 50 by the master key loader
a key ceremony application 26 . The laptop 24 is in the form 54 . At 71, a service instance is initialized. At 72 , M custo
of a distinct machine, but forms part of a larger security dians are assembled by themaster key loader 54 , wherein M
system of a host computer system . Custodians 1 to N 15 is more than one , but less than N . At 73 , each custodian , 1
represent respective custodian computer systems that are to M , decrypts their respective bundle with their respective
connected to the laptop 24 over a network such as the passphrase . Each custodian then sends the decrypted master
Internet. Custodians 1 to N are assembled . Only custodians key share to the service 50 . The request by the respective
1 to M may be required for various security purposes, custodian is authenticated by the custodian and service TLS
wherein M , is less than or equal to N . Each custodian 1 to 20 keys by the service 50 as is commonly understood by one
N is provided an encrypted bundle 28 having a respective skilled in the art. After the service 50 receives the M shares,
master key share , client TLS key, client TLS certificate , the service 50 , at 75 , derives the operational master key 64
service TLS key , service TLS certificate , and certificate from the M shares . All versions of the operational master
authority (CA ). The master key shares and the custodian key are hashed within the database 52 . At 76 , if the master
TLS keys are different from one bundle to the next and the 25 key hash exists in the database , the service 50 ensures that
service TLS keys are the same for all the bundles . the master key hash is the same. If the master key hash is the
FIG . 3 illustrates a key ceremony between the systems same, the service 50 can store the respective operational
shown in FIG . 2 . At 30 , the key ceremony application 26 master key 64 within the service 50 for later use. Alterna
prompts a master of ceremony for values of M and N . The tively , at 77, if the master key hash does not exist, then the
master of ceremony then enters the respective values of M 30 service 50 stores a new version and hash of the operational
and N into the key ceremony application 26 . At 32 , the key maser key within the database 52 . At 78 , the service 50 then
ceremony application 26 creates a for - distribution master stores the new version of the operational master key as the
key in memory of the laptop 24 . At 34 , the key ceremony master key 64 within the service for later use .
application 26 splits the for- distribution master key into N After the master key 64 has been created by the service
shares . 35 50, the custodians 1 to M disconnect from the service 50. At
At 36 , the key ceremony application 26 creates N custo - no point was the operational master key 64 shared with any
dian TLS keys . The custodian TLS keys are all different one of the custodians 1 to M .
from one another. FIG . 5 illustrates the procedure for creating an API key
At 38 , the key ceremony application 26 creates a TLS that allows the web application 48 to communicate with the
certificate authority (CA ). At 40 , the certificate authority 40 service 50 . The API key is created by an API key generator
creates a service TLS key. 56 of the service 50 . At 81 , the API key generator 56
At 42 , the key ceremony application 26 creates N bundles. assembles M custodians, wherein M is 1 < M < = N . At 82,
Each bundle includes a respective share of the for- distribu each custodian , 1 to M , sends a request to the service 50 to
tion master key , a respective custodian TLS key, and the create an API key . The request by the respective custodian
service TLS key. Through an interactive script process 45 is authenticated by the custodian and service TLS keys by
between each custodian , 1 to N , and the key ceremony the service 50 . The APIkey generator 56 requires at least M
application 26 , a respective custodian provides a respective requests to create an API key . At 83, after M requests, the
passphrase to the key ceremony application 26 . The key API key generator 56 generates and returns a unique APIkey
ceremony application 26 then encrypts the respective bundle to custodian M . At 84, custodian M shares the APIkey with
for the respective custodian with their respective passphrase . 50 the web application 48 . The web application 48 then stores
The key ceremony application 26 then sends the respective the API key as API key 86 .
encrypted bundles 28 to the respective custodians 1 to N . At The service 50 then encrypts the API key with the master
44 , each custodian receives and keeps a bundle encrypted key 64 and stores the API in an encrypted form as an
with their passphrase . The respective passphrase is only encrypted API key 88 in the database 52 . The web applica
known to the respective custodian . At 46 , the laptop 24 55 tion 48 can communicate with the service 50 . Any commu
clears all secrets, including the for -distribution master key , nication or request from the web application 48 with or to
the custodian TLS keys and the service TLS key . The the service 50 includes the API key 86 . When the service 50
for -distribution master key ( in the form of master key receives the API key 86 from the web application 48 , the
shares ), custodian TLS keys and service TLS key are now service first decrypts the encrypted API key 88 with the
only present in the encrypted bundles 28 held by the 60 master key 64 and determines whether the decrypted API
respective custodians 1 to N , for security purposes. key 88 is the same as the API key 86 received from the web
FIG . 4 illustrates components of a host computer system application 48 . If the API keys do not match , the service 50
for storing and transacting bitcoin , including a web appli does not execute any actions by the checkout module 58 ,
cation 48, multiple instances of a service 50 , and a database payment module 60 or freeze logic 62 . Only if the API keys
52 . Each one of the services 50 further includes a master key 65 match does the service 50 execute procedures by the check
loader 54 , an API key generator 56 , a checkout module 58 , out module 58 , paymentmodule 60 or freeze logic 62 as
a paymentmodule 60 and freeze logic 62. requested by the web application 48 .
US 9,735 ,958 B2
10
FIG . 6 illustrates a checkout process that is initiated by a 110 . Further details of bitcoin transactions are described in
customer computer system 90 . The customer computer U .S . patent application Ser. No. 14 /660,296 , filed on Mar.
system 90 has a page 92 within browser with an empty 17 , 2015 , which is incorporated herein in its entirety .
bitcoin address field 94 . The page 92may for example be a FIG . 8 illustrates a freeze flag process that is executed by
page of a merchant on which the user lands . At 101, the 5 the freeze logic 62 . At 221 , a host computer administrator
customer computer system 90 automatically requests an filips a freeze switch from “ off ” to “ on ” on an admin page 118
address over the Internet from the web application 48 . At of the web application 48 . When the web application 48 , at
102, the web application 48 requests the address from one of 221, detects the switching of the freeze switch on the admin
the services 50 . A load balancer 98 determines which one of
the respective services 50 the request is routed to based on 10 page 118 , the web application 48 , at 222 , sends a request to
the service 50 to freeze. At 223 , the freeze logic 62 of the
the respective loads on the respective services 50 . The service 50 sets a freeze flag 220 to a freeze flag on -state . The
checkout module 58 then executes the checkout process freeze flag in the preceding figures is shown as being in a
within the service 50 . At 103, the checkout module 58 freeze flag off -state represented as an empty circle. In FIG .
creates a private key . At 104 , the checkout module 58
15
encrypts the private key with the operationalmaster key 64 15 oth 8 , the freeze flag 220 is shown as a solid circle representing
and stores the encrypted private key in the database 52 . The a freeze flag on - state . At 224 , the checkoutmodule 58 of the
checkout module 58 further generates an address and, at service 50 can continue to generate keys as described with
104 , stores the address “ B ” in association with the encrypted reference to FIG . 6 ,but the paymentmodule 60 is prevented
private key within the database 52. by the freeze flag 220 from signing any transaction as
At 105 , the checkout module 58 provides the address 20 described with reference to FIG . 7 . At 225 , any transaction
(“ B ” ) through the load balancer 98 to the web application that requires signing is queued and tried again later auto
48 . When the web application 48 receives the address, the matically , for example on a 5 minute interval or repeatedly
web application 48 , at 106 , sends the address to the customer on exponentially increasing intervals .
computer system 90 . The address then shows up within the At 226 , N custodians are assembled for purposes of
previously empty bitcoin address field 94 . 25 unfreezing the service 50 . The custodians may for example
The private key is encrypted and stored within the data be assembled using a web interface that is provided by the
base 52 without any human intervention and the private key freeze logic 62 and displayed within browsers of the respec
is never shared with the web application 48 . The checkout tive custodians. At 227 , each custodian sends an authenti
module 58 only executes the checkout process as described cated request to unfreeze the service to the service 50. Each
with reference to reference numerals 103, 104 and 105 if the 30 request includes a respective custodian TLS key and the TLS
web application 48 provides the API key 86 to the service 50 key of the service 50 for purposes of encrypted authentica
and the API key 86 received from the web application 48 tion . Reference numeral 230 represents one TLS key that is
matches the API key that was previously stored by the received from one of the custodians. The service 50 then
service 50 in the database 52 in encrypted form with authenticates the request using the respective TLS key 230 .
reference to FIG . 5 . 35 At 228 , after the freeze logic 62 has received M requests
FIG . 7 illustrates a payment process that is initiated by a to unfreeze the service , wherein M is 1 < M < = N , the freeze
wallet 108 , for example on a mobile device or on a personal logic 62 of the service 50 resets the freeze flag 220 to the
computer. It is assumed that the address “ B ” has 10 bitcoin freeze flag off- state . When the freeze flag is set to freeze flag
(BTC ) stored therein . When a user selects a “ Send ” button , off - state , the payment module 60 can again sign transac
the user, at 111, sends a request from the wallet 108 to the 40 tions. When the transaction that was queued at 225 is
web application 48 to send 1 BTC to A . When the web submitted by the web application 48 to the service 50 for
application 48 receives the request transmitted at 111 , the signature, the payment module 60 proceeds to sign and
web application 48 , at 112 , generates an unsigned transac - return the transaction as described with reference to FIG . 7 .
tion ( Tx ). The transaction includes an “ In ” designating It can thus be seen that payment can only be reactivated
address “ B ” . The transaction includes a “ OUT” reference of 45 when M custodians request activation of payment, for pur
1 BTC to address “ A ” and 8 BTC to address “ B ” . A further poses of security.
1 BTC (not shown ) represents a miner 's fee . FIG . 9 shows a diagrammatic representation of a machine
At 103 , the web application 48 sends the transaction in the exemplary form of a computer system 900 within
through the load balancer 98 to one of the services 50 . The which a set of instructions , for causing the machine to
web application 48 asks the service 50 to sign the transac - 50 perform any one or more of the methodologies discussed
tion . The request from the web application 48 to the service herein , may be executed . In alternative embodiments, the
50 includes the APIkey 86 . The service 50 authenticates the machine operates as a standalone device or may be con
API key 86 and , only if authenticated , executes a payment nected ( e .g ., networked ) to other machines. In a network
process by the payment module 60 . deployment, the machine may operate in the capacity of a
At 114 , the payment module 60 looks up the respective 55 server or a client machine in a server -client network envi
private key . The payment module 60 compares the address ronment, or as a peer machine in a peer -to -peer (or distrib
“ B ” in the transaction with the addresses in the database 52. uted ) network environment. The machine may be a personal
When a match is found , the paymentmodule 60 extracts the computer (PC ), a tablet PC , a set- top box (STB ), a Personal
respective encrypted private key from the address “ B ” found Digital Assistant ( PDA ), a cellular telephone, a web appli
in the database 52 . The paymentmodule 60 then decrypts the 60 ance , a network router, switch or bridge, or any machine
private key with the operational master key 64 . At 115 , the capable of executing a set of instructions (sequential or
payment module 60 signs the transaction with the decrypted otherwise ) that specify actions to be taken by thatmachine .
private key to create a signed transaction. At 106 , the service Further, while only a single machine is illustrated , the term
50 returns the signed transaction to the web application 48 " machine" shall also be taken to include any collection of
via the load balancer 98 . When the web application 48 65 machines that individually or jointly execute a set (or
receives the signed transaction , the web application 48 , at multiple sets ) of instructions to perform any one or more of
107 , broadcasts the signed transaction to the bitcoin network the methodologies discussed herein .
US 9 ,735 ,958 B2
11 12
The exemplary computer system 900 includes a processor communicates over the communication network with a
930 (e.g ., a central processing unit (CPU ) , a graphics customer computer system to execute a checkout pro
processing unit (GPU ), or both ), a main memory 932 ( e . g ., cess only after the operational master key is stored in
read -only memory (ROM ), flash memory, dynamic random thememory connected to the service over the commu
access memory (DRAM ) such as synchronous DRAM 5 nication network .
(SDRAM ) or Rambus DRAM (RDRAM ), etc .), and a static 2 . The host computer system of claim 1 , wherein the key
memory 934 ( e. g., flash memory , static random access ceremony application is configured to receive a passphrase
memory (SRAM , etc .), which communicate with each other from each custodian , and encrypt each bundle with a respec
via a bus 936 . tive passphrase of a respective custodian .
The computer system 900 may further include a video 10 3. A method of distributing security data to custodians
display 938 (e. g., a liquid crystal displays (LCD ) or a comprising :
cathode ray tube ( CRT)). The computer system 900 also creating, by a key ceremony application associated with a
includes an alpha -numeric input device 940 ( e.g ., a key computing device comprising a memory, a for-distri
board ), a cursor control device 942 ( e. g., a mouse ), a disk bution master key ;
drive unit 944 , a signal generation device 946 (e .g ., a 15 storing, by the key ceremony application, the for -distri
speaker ), and a network interface device 948. bution master key in memory connected to the key
The disk drive unit 944 includes a machine - readable ceremony application ;
medium 950 on which is stored one or more sets of instruc splitting, by the key ceremony application , the for -distri
tions 952 ( e. g., software ) embodying any one or more of the bution master key into N shares;
methodologies or functions described herein . The software 20 creating, by the key ceremony application , a plurality of
may also reside , completely or at least partially, within the custodian transport layer security ( TLS) keys that are
main memory 932 and /or within the processor 930 during different from one another;
execution thereof by the computer system 900 , thememory creating , by the key ceremony application , a certificate
932 and the processor 930 also constituting machine read authority that creates a service TLS key ;
able media . The software may further be transmitted or 25 creating , by the key ceremony application , N bundles ,
received over a network 954 via the network interface each bundle including a respective one of the N shares ,
device 948. a respective one of the different custodian TLS keys
While certain exemplary embodiments have been and the service TLS key ;
described and shown in the accompanying drawings, it is to distributing ,by the key ceremony application , the respec
be understood that such embodiments are merely illustrative 30 t ive shares among N custodians, each custodian being
and not restrictive of the current invention , and that this associated with a respective computing device;
invention is not restricted to the specific constructions and clearing , by the key ceremony application , the for- distri
arrangements shown and described since modifications may bution master key, custodian TLS keys and the service
occur to those ordinarily skilled in the art . TLS key from the memory of the computing device
What is claimed : 35 associated with the key ceremony application ;
1 . A host computer system comprising: communicating, by a master key loader of a service
a key ceremony application associated with a computing associated with a different computing device compris
device comprising a memory ing a different memory separate from the key ceremony
creates a for-distribution master key, application, over a communication network with
store the for -distribution master key in the memory con - 40 respective computing devices of M of N custodians to
nected to the key ceremony application , receive at least M of the N shares , where M is equal to
split the for - distribution master key into N shares, or less than N ; and
create a plurality of custodian transport layer security deriving , by the master key loader, the operational master
( TLS ) keys that are different from one another, key from the M shares before storing the operational
create a certificate authority that creates a service TLS 45 master key in the memory
key , storing, by the master key loader, the operational master
create N bundles, each bundle including a respective one key in memory connected to the service ; and
of the N shares , a respective one of the different communicating, using a web application configured asso
custodian TLS keys and the service TLS key ; ciated with a computing device, over the communica
distribute the respective shares among N custodians , each 50 tion network with a customer computer system , to
custodian being associated with a respective computing execute a checkout process only after the operational
device , and master key is stored in the memory connected to the
clear the for-distribution master key, custodian TLS keys service over the communication network .
and the service TLS key from the memory of the
of the 4 . The method of claim 3, further comprising :
computing device associated with the key ceremony 55 receiving a passphrase from each custodian ; and
application ; encrypting each bundle with a respective passphrase of a
a service associated with a different computing device respective custodian .
comprising a different memory separate from the key 5 . A non -transitory computer -readable medium having
ceremony application performs operations to : stored thereon a set of instructions that, when executed by a
communicate over a communication network with respec - 60 processor of a computer carries out a method of distributing
tive computing devices of M of the N custodians to security data to custodians comprising:
receive at least M of the N shares , where M is equal to creating , by a key ceremony application associated with a
or less than N , computing device comprising a memory , a for -distri
derive an operational master key from the M shares, and bution master key ;
store the operational master key in memory connected to 65 storing, by the key ceremony application , the for -distri
the service ; and bution master key in memory connected to the key
a web application associated with a computing device ceremony application ;
US 9 ,735 ,958 B2
13 14
splitting, by the key ceremony application , the for-distri communicating, by a master key loader of a service
bution master key into N shares ; associated with a different computing device compris
creating, by the key ceremony application , a plurality of ing a differentmemory separate from the key ceremony
custodian transport layer security ( TLS ) keys that are application , over a communication network with
different from one another ; 5 respective computing devices of M of N custodians to
creating, by the key ceremony application , a certificate receive at least M of the N shares , where M is equal to
or less than N ; and
authority that creates a service TLS key ; deriving, by the master key loader , the operationalmaster
creating , by the key ceremony application , N bundles, key from the M shares before storing the operational
each bundle including a respective one of the N shares , master key in the memory
a respective one of the different custodian TLS keys storing, by the master key loader, the operational master
and the service TLS key ; key in memory connected to the service ; and
distributing , by the key ceremony application , the respec communicating, using a web application associated with
a computing device , over the communication network
tive shares among N custodians, each custodian being
associated with a respective computing device ; 15 with a customer computer system , to execute a check
clearing, by the key ceremony application , the for-distri out process only after the operational master key is
bution master key, custodian TLS keys and the service stored in the memory connected to the service over the
TLS key from the memory of the computing device communication network .
associated with the key ceremony application ; * * * * *