US10659223B2 — Secure multiparty loss resistant storage and transfer of cryptographic keys for blockchain based systems in conjunction with a wallet management system
Document text
Research, not advice. Part of the Bitcoin research archive (October 2026). Claims labelled unverified, contested or fringe are reported, not endorsed; statuses of bills and rules are as of the date checked. Government, court and patent records are public domain; the research notes are CC BY 4.0.
US010659223B2
(12) United States Patent (10 ) Patent No.: US 10,659,223 B2
Wright et al. (45 ) Date of Patent: May 19 , 2020
( 54 ) SECURE MULTIPARTY LOSS RESISTANT (56 ) References Cited
STORAGE AND TRANSFER OF
CRYPTOGRAPHIC KEYS FOR U.S. PATENT DOCUMENTS
BLOCKCHAIN BASED SYSTEMS IN 5,600,725 A 2/1997 Rueppel et al.
CONJUNCTION WITH A WALLET 5,761,305 A 6/1998 Vanstone et al.
MANAGEMENT SYSTEM (Continued )
(71) Applicant: nChain Holdings Limited , St. John's
(AG ) FOREIGN PATENT DOCUMENTS
(72 ) Inventors : Craig Steven Wright, London (GB ); AU 2016100059 A4 3/2016
Stephane Savanah , London (GB ) CN 103440209 A 12/2013
(73 ) Assignee: nChain Holdings Limited , St. Johns (Continued )
(AG )
OTHER PUBLICATIONS
( * ) Notice : Subject to any disclaimer, the term of this
patent is extended or adjusted under 35 Allison , “ Symbiont's Adam Krellenstein : There's really only two
U.S.C. 154(b ) by 0 days . smart contract systems Ethereum's and ours,” International Busi
(21) Appl. No.: 16 / 111,022 ness Times, https://www.ibtimes.co.uk/symbionts-adam-krellenstein
theres-really -only -two -smart- contract -systems-ethereums- ours
(22 ) Filed : Aug. 23 , 2018 1530490 , Nov. 25 , 2015 [ retrieved Dec. 12 , 2018 ], 4 pages .
(65 ) Prior Publication Data (Continued )
US 2018/0367298 A1 Dec. 20 , 2018 Primary Examiner — Aravind K Moorthy
Related U.S. Application Data ( 74 ) Attorney , Agent, or Firm - Davis Wright Tremaine
(63) Continuation of application No. PCT/IB2017 / LLP
050829, filed on Feb. 14 , 2017.
Foreign Application Priority Data (57 ) ABSTRACT
(30 )
A solution for controlling access to a resource such as a
Feb. 23 , 2016 (GB ) 1603117.1 digital wallet implemented using a blockchain. Use of the
Mar. 24 , 2016 (GB ) 1605026.2 invention during set up of the wallet can enable subsequent
Nov. 15 , 2016 (GB ) 1619301.3 operations to be handled in a secure manner over an insecure
channel. An example method comprises splitting a verifica
(51) Int. Ci. tion element into multiple shares; determining a common
H04L 9/32 ( 2006.01 ) secret atmultiple nodes in a network ; and using the common
G06F 7/04 ( 2006.01) secret to transmit a share of the verification element between
(Continued ) nodes. The shares can be split such that no share is sufficient
(52) U.S. Cl. to determine the verification element and can be stored at
CPC H04L 9/085 (2013.01 ); G06Q 20/3678 separate locations. Upon share unavailability, the share can
(2013.01); G06Q 20/3829 ( 2013.01) ; be retrieved a location accessibility . For safe transmission of
(Continued ) the share (s ), the common secret is generated at two different
(58 ) Field of Classification Search
nodes independently and used to generate an encryption key
CPC HO4L 9/085 ; H04L 63/0442 ; H04L 9/0825 ; for encrypting at least one share of the verification element
to be transmitted securely .
HO4L 9/3247; H04L 9/0861;
(Continued ) 22 Claims, 5 Drawing Sheets
P. 19
Third node
3
5 27
Network
23 Second node
First node
P
Police
15 11 H
13
Cavesdropper
US 10,659,223 B2
Page 2
(51) Int. Ci. 2012/0100833 Al
2012/0290830 A1
4/2012 Gao
11/2012 Resch et al.
H04L 9/08 ( 2006.01 ) 2012/0331287 Al 12/2012 Bowman et al.
G06Q 20/36 ( 2012.01 ) 2013/0051552 A1 2/2013 Handschuh et al.
G06Q 20/38 ( 2012.01 ) 2013/0061049 Al 3/2013 Irvine
2013/0177157 A1 * 7/2013 Li HO4L 9/083
H04L 9/30 ( 2006.01)
H04L 29/06 ( 2006.01) 380/277
2013/0191632 A1 * 7/2013 Spector H04L 9/083
(52) U.S. CI. 713/155
CPC H04L 9/0825 (2013.01) ; H04L 9/0861 2014/0082358 Al 3/2014 Nakhjiri et al.
(2013.01) ; H04L 9/0894 (2013.01); H04L 2014/0129844 A1 * 5/2014 Johnson G06F 21/78
713/189
9/3066 (2013.01 ); H04L 9/3247 ( 2013.01) ; 2015/0066748 A1 3/2015 Winslow et al.
H04L 63/0442 (2013.01); G06Q 2220/00 2015/0086020 A1 3/2015 Harjula et al.
( 2013.01); H04L 9/3252 (2013.01) ; H04L 2015/0188700 A1 7/2015 Ben Saied et al .
2209/56 (2013.01) 2015/0205929 A1
2015/0206106 A1
7/2015 Brama
7/2015 Yago
( 58 ) Field of Classification Search 2015/0213433 Al 7/2015 Khan
CPC . H04L 9/0894; H04L 9/3252 ; H04L 2209/56 ; 2015/0302401 A1 10/2015 Metral
G06Q 20/3678 ; G06Q 20/3829 ; G06Q 2015/0304302 A1 * 10/2015 Zhang GO6F 21/46
20/389; G06Q 2220/00 713/171
USPC 713/171, 168; 726/6 , 30 2015/0324764 Al 11/2015 Van Rooyen et al.
See application file for complete search history. 2015/0332224 Al 11/2015 Melika et al .
2015/0350171 Al 12/2015 Brumley
References Cited 2015/0356523 Al 12/2015 Madden
( 56 ) 2015/0363770 A1 12/2015 Ronca et al.
2016/0085955 Al 3/2016 Lerner
U.S. PATENT DOCUMENTS 2016/0086175 A1 3/2016 Finlow -Bates et al.
2016/0092988 A1 3/2016 Letourneau
5,889,865 A 3/1999 Vanstone et al. 2016/0140335 A1 * 5/2016 Proulx G06F 21/45
5,896,455 A 4/1999 Vanstone et al. 726/6
5,933,504 A 8/1999 Vanstone et al. 2016/0149878 A1 * 5/2016 Pogorelik H04L 63/062
6,061,449 A 5/2000 Candelore et al. 380/283
6,078,667 A 6/2000 Johnson 2016/0234026 A1 8/2016 Wilkins et al .
6,122,736 A 9/2000 Vanstone et al. 2016/0261408 A1 * 9/2016 Peddada HO4L 9/0861
6,141,420 A 10/2000 Vanstone et al. 2016/0261565 A1 9/2016 Lorenz et al.
6,618,483 B1 9/2003 Vanstone et al. 2016/0269182 A1 9/2016 Sriram et al .
6,704,870 B2 3/2004 Vanstone et al. 2016/0283941 Al 9/2016 Andrade
6,785,813 B1 8/2004 Vanstone et al . 2016/0335924 A1 * 11/2016 Ikarashi G06F 21/60
6,792,530 B1 9/2004 Qu et al. 2016/0352518 Al 12/2016 Ford et al.
7,006,633 B1 2/2006 Reece 2016/0379208 A1 * 12/2016 Deliwala G06Q 20/363
7,095,851 B1 * 8/2006 Scheidt HO4L 9/0841 705/67
380/28
8,522,011 B2 8/2013 Spalka et al. 2017/0103385 Al 4/2017 Wilson , Jr. et al.
9,209,980 B2 12/2015 Bowman et al. 2017/0132621 Al 5/2017 Miller et al .
9,258,130 B2 2/2016 Hwang et al. 2017/0154331 A1 6/2017 Voorhees
10,050,779 B2 8/2018 Alness et al. 2017/0243193 A1 8/2017 Manian et al .
10,068,228 B1 * 9/2018 Winklevoss G06Q 20/3829 2017/0250801 A1 * 8/2017 Chen HO4L 9/085
2001/0050990 A1 12/2001 Sudia 2018/0109377 A1 * 4/2018 Fu H04L 63/061
2003/0046202 Al 3/2003 Knapp 2018/0367298 A1 * 12/2018 Wright HO4L 9/0861
2004/0049687 A1 3/2004 Orsini et al. 2019/0149337 A1 * 5/2019 Savanah H04L 9/3239
2004/0193890 A1 9/2004 Girault 713/168
2006/0023887 A1 2/2006 Agrawal et al. 2019/0158470 A1 * 5/2019 Wright HO4W 4/70
2006/0153368 A1 7/2006 Beeson 2019/0220859 Al* 7/2019 Weight HO4L 9/3231
2006/0156013 A1 7/2006 Beeson 2019/0229911 A1 * 7/2019 Allen G06Q 20/0658
2006/0179319 A1 8/2006 Krawczyk 2019/0238334 Al 8/2019 Nakamura
2007/0055880 A1 3/2007 Lauter et al .
2007/0192842 A1 * 8/2007 Beaulieu HO4L 9/0844 FOREIGN PATENT DOCUMENTS
726/9
2008/0082817 A1 * 4/2008 Takahashi G06F 21/31 CN 103927656 A 7/2014
713/155 DE 102010002241 B4 3/2012
2008/0144836 Al 6/2008 Sanders et al. EP 1477882 A2 11/2004
2008/0288773 Al 11/2008 Nguyen et al. EP 2538606 A1 12/2012
2009/0161876 A1 6/2009 Sherkin EP 2975570 A1 1/2016
2010/0023771 A1 1/2010 Struik FR 3018370 A1 9/2015
2010/0131755 A1 * 5/2010 Zhu H04L 63/0815 FR 3018377 A1 9/2015
713/155 FR 3018378 A1 9/2015
2010/0150341 A1 * 6/2010 Dodgson G06F 21/805 FR 3018379 A1 9/2015
380/29 JP H11289324 A 10/1999
2010/0172501 A1 7/2010 Tian et al. JP 2000502553 A 2/2000
2010/0199095 A1 8/2010 Ho JP 2007242221 A 9/2007
2010/0228973 A1 * 9/2010 Dancer HO4L 63/0442 JP 2009526411 A 7/2009
713/168 JP 2011082662 A 4/2011
2011/0022854 Al 1/2011 Macchetti et al. WO 2005107141 A1 11/2005
2011/0202773 A1 8/2011 Ghouti et al . WO 2013053058 A1 4/2013
2011/0307698 A1 12/2011 Vanstone WO 2015127789 A1 9/2015
2011/0311051 Al 12/2011 Resch et al . WO 2015171580 A1 11/2015
2012/0011362 Al 1/2012 Lambert WO 2015175854 A2 11/2015
2012/0039474 Al 2/2012 Ho WO 2016161073 Al 10/2016
US 10,659,223 B2
Page 3
( 56 ) References Cited Krawczyk , “ HMQV : A High - Performance Secure Diffie -Hellman
Protocol,” Annual International Cryptology Conference 2005 , Aug.
FOREIGN PATENT DOCUMENTS 14 , 2005 , first disclosed online Jul. 5 , 2005, 66 pages.
OTHER PUBLICATIONS
Krellenstein , “ The Counterparty Protocol,” GitHub , https://github .
com /jsimnz/Counterparty /blob /master/README.md, Jan. 8, 2014
Antonopoulos, “Mastering Bitcoin Unlocking Digital Cryptocur [Dec. 12 , 2018 ], pages .
rencies,” O'Reilly Media , Inc., Dec. 20 , 2014 , 282 pages.
Maxwell et al., “ Deterministic wallets,” Bitcoin Forum , https: //
bitcointalk.org/index.php?topic=19137.0;all, Jun . 18 , 2011 [ retrieved
bitcoininvestor.com ,“ All -Star Panel: Ed Moy, Joseph VaughnPerling, Dec. 10 , 2018 ], 104 pages.
Trace Mayer, Nick Szabo, Dr. Craig Wright," YouTube, https: // OpenSSL Wiki, “ Elliptic Curve Diffie Hellman ,” OpenSSL , https: //
youtu.be/LdvQTwjVmrE , Bitcoin Investor Conference, Oct. 29 , wiki.openssl.org/index.php/Elliptic_Curve_Diffie_Hellman ,Mar. 10 ,
2015 [retrieved Dec. 12, 2018 ], 1 page . 2014 [retrieved Dec. 10 , 2018 ], 5 pages.
BitFury Group , “ Smart Contracts on Bitcoin Blockchain , BitFury OpenSSL Wiki, “ EVP Key Agreement,” OpenSSL , https: //wiki.
Group Limited , Aug. 13 , 2015 ( updated Sep. 4 , 2015), http :// bitfury . openssl.org/index.php/EVP_Key_Agreement,Apr. 28, 2017 [ retrieved
com /content/5-white-papers- research/contracts - 1.1.1.pdf, 20 pages. Dec. 10 , 2018 ], 2 pages .
Brown et al., " Standards for Efficient Cryptography 1: Elliptic Poon et al., “ The Bitcoin Lightning Network : Scalable Off -Chain
Curve Cryptography Version 2.0," Certicom Research , May 21, Instant Payments,” https://www.bitcoinlightning.com/wp-content/
2009, 144 pages. uploads/2018/03 /lightning -network -paper.pdf, Jan. 14 , 2016 [ retrieved
Brown et al., “ Standards for Efficient Cryptography 2: Recom Dec. 10 , 2018 ], 59 pages .
mended Elliptic Curve Domain Parameters Version 2.0 ," Certicom Pornin , “ Deterministic Usage of the Digital Signature Algorithm
Research , Jan. 27 , 2010 , 37 pages . (DSA ) and Elliptic Curve Digital Signature Algorithm (ECDSA ),”
Campagna et al., “ Standards for Efficient Cryptography 4 : Elliptic Request for Comments : 6979 , Independent Submission , Aug. 2013 ,
Curve Qu - Vanstone Implicit Certificate Scheme (ECQV ) Version 79 pages.
1.0 ," Certicom Research , Jan. 24 , 2013 , 32 pages . Scott , “ Counterparty to Create First Peer-to -Peer Digital Asset
Coinprism , “ 80 bytes OP_RETURN explained,” Coinprism Blog, Exchange Platform ,” Cointelegraph , https://cointelegraph.com/news/
http://blog.coinprism.com/2015/02/11/80-bytes-op-return/, Feb. 11 , counterparty_to_create_first_peer_to_peer_digital_asset_exchange_
2015 [retrieved Dec. 21, 2018 ], 8 pages. platform , Apr. 10 , 2014 [retrieved Dec. 12, 2018 ], 2 pages .
Corallo , “ [Bitcoin - development ] Relative Tasca et al., “ Digital Currencies: Principles, Trends, Opportunities,
CHECKLOCKTIMEVERIFY (was CLTV proposal),” Linux Foun and Risks,” ECUREX Research Working Paper, Sep. 7, 2015 (Oct.
dation , https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2015 2015 version), 110 pages .
May /007858.html, May 4 , 2015 (retrieved Dec. 12 , 2018 ], 3 pages. TIMEISNOW77724 et al.,“ Help understanding counterparty,thanks
Decker, “ [ BIP ] Normalized transaction IDs,” Bitcoin -Dev , https:// in advance!,” Reddit r/counterparty_xcp , https://www.reddit.com/r/
bitcoin-development.narkive.com/DjOYjEig/bip-normalized counter party_xcp /comments /2qntze /help_understanding_counterparty_
transaction -ids, Oct. 19 , 2015 (retrieved Dec. 12 , 2018 ], 16 pages. thanks_in_advance/, Dec. 28 , 2014 [retrieved Dec. 11, 2018 ], 4
pages .
Orcode,“ New Kid on the Blockchain ,” Hacker News, https ://news. UK Commercial Search Report dated Jun . 27 , 2016 , Patent Appli
ycombinator.com/item?id=11372455 ,Mar. 28 , 2016 [Dec. 12 , 2018 ], cation No. GB1603123.9 , filed Feb. 23 , 2016 , 11 pages.
32 pages. UK Commercial Search Report dated Jun . 27 , 2016 , Patent Appli
Eragmus et al., " Time to lobby Bitcoin's core devs : " SF Bitcoin cation No. GB1603125.4 , filed Feb. 23 , 2016 , 11 pages .
Devs Seminar - Scalability to billions of transactions per day, UK Commercial Search Report dated Jun . 28, 2016 , Patent Appli
satoshi- level Micropayments, near-zero risk of custodial theft , & cation No. GB1603122.1, filed Feb. 23 , 2016 , 12 pages .
Instant transactions” ... but only w / a malleability-fixing soft fork," UK Commercial Search Report dated Jun . 9 , 2016 , Patent Appli
Reddit r/bitcoin , https://www.reddit.com/r/Bitcoin/comments/222191/ cation No. GB1603117.1 , filed Feb. 23 , 2016 , 12 pages .
time_to_lobby_bitcoins_core_devs_sf_bitcoin_devs/,Mar. 14 , 2015 UK Commercial Search Report dated May 24 , 2016 , Patent Appli
[Dec. 12 , 2018 ], 21 pages. cation No. GB1605571.7 , filed Apr. 1 , 2016 , 3 pages .
Familiar et al.,“ Transcript for # bitcoin -dev 2015/03/27 ," BitcoinStats , UK Commercial Search Report dated May 9, 2016 , Patent Appli
http://bitcoinstats.com/irc/bitcoin-dev/logs/2015/03/27 ,Mar. 27, 2015 cation No. GB1603114.8 , filed Feb. 23 , 2016 , 2 pages.
[archived version Jun . 27 , 2016 ], 11 pages. UK IPO Search Report dated Jul. 26 , 2016 , Patent Application No.
Flood et al., “ Contract as Automaton : The Computational Repre GB1603114.8 , filed Feb. 23 , 2016 , 5 pages.
sentation of Financial Agreements,” Office of Financial Research UK IPO Search Report dated Jul. 4 , 2016 , Patent Application No.
Working Paper No. 15-04 , Mar. 26 , 2015 , 25 pages. GB1603125.4 , filed Feb. 23, 2016 , 6 pages.
Friedenbach et al., “ Freimarkets: extending bitcoin protocol with UK IPO Search Report dated Jul. 5, 2016 , Patent Application No.
user- specified bearer instruments , peer- to -peer exchange , off -chain GB1603123.9 , filed Feb. 23 , 2016 , 5 pages .
accounting , auctions, derivatives and transitive transactions,” Ver UK IPO Search Report dated Oct. 17 , 2016 , Patent Application No.
sion v0.01 , http://freico.in/docs/freimarkets-v0.0.1.pdf, Aug. 24 , GB1603117.1, filed Feb. 23 , 2016 , 5 pages.
2013 [retrieved Dec. 12 , 2018 ], 25 pages . UK IPO Search Report dated Oct 26 , 2016 , Patent Application No.
Goldfeder et al., “ Securing Bitcoin Wallets via a New DSA /ECDSA GB1603122.1 , filed Feb. 23 , 2016 , 4 pages .
threshold signature scheme," manuscript, https: //www.cs.princeton . UK IPO Search Report dated Sep. 9, 2016 , Patent Application No.
edu /~ stevenag/ threshold_sigs.pdf, 2015 [retrieved Jun . 21 , 2018 ], GB1605571.7 , filed Apr. 1, 2016 , 5 pages .
26 pages. Whitequark , “ # bitcoin -wizards on Jul. 30 , 2015_irc logs at whitequark .
International Search Report and Written Opinion dated Apr. 26 , org," whitequark.org, https://irclog.whitequark.org/bitcoin-wizards/
2017 , International Patent Application No. PCT/IB2017 /050865 , 2015-07-30 , Jul. 30 , 2015 (retrieved Dec. 12 , 2018 ], 8 pages.
filed Feb. 16 , 2017, 9 pages . Wood , “ Ethereum : A Secure Decentralised Generalised Transaction
International Search Report and Written Opinion dated May 29 , Ledger: Final Draft - Under Review ," Etereum Project Yellow
2017, International Patent Application No. PCT/IB2017/050815 , Paper, http://tech.lab.carl.pro/kb/ethereum/yellowpaper, Apr. 2014 ,
filed Feb. 14 , 2017, 10 pages . 32 pages.
Killerstorm et al., “ Transcript for # bitcoin -dev Sep. 3, 2012,” Wright ,“ Registry and Automated Management Method for Blockchain
BitcoinStats, http://www.bitcoinstats.com/irc/bitcoin-dev/logs/2012/ Enforced Smart Contracts,” U.S. Appl. No. 15 /138,717 , filed Apr.
09/03 , Sep. 3 , 2012 [retrieved Dec. 21, 2018 ], 14 pages . 26 , 2016 .
Koblitz et al.,“ Cryptocash , Cryptocurrencies, and Cryptocontracts ,” Buterin , " Secret Sharing DAOs: The Other Crypto 2.0 ," Ethereum
Designs, Codes and Cryptography 78 (1):87-102 , publication avail Blog , Dec. 26 , 2014 [ retrieved Nov. 21 , 2019 ], https:// ethereum .
able online Oct. 1 , 2015 , print publication Jan. 2016 . github.io/blog/2014/12/26/secret-sharing-daos-crypto-2-07, 10 pages .
US 10,659,223 B2
Page 4
( 56 ) References Cited Fimkrypto, “ FIMK 0.6.4 Released,” Github.com , Feb. 11, 2016
[ retrieved Jan. 30 , 2017 ], https://github.com/fimkrypto/fimk/
OTHER PUBLICATIONS releases, 17 pages .
Gutoski et al., “ Hierarchical deterministic Bitcoin wallets that
European Communication pursuant to Article 94 (3 ) EPC dated Jul. tolerate key leakage ( Short paper)," Financial Cryptography and
1 , 2019 , Application No. 17707121.4-1218 , filed Feb. 14 , 2017 , 6 Data Security : 19th International Conference , FC 2015 , Revised
pages . Selected Papers, Jan. 26 , 2015 , 9 pages.
Gennaro et al., “ Threshold -Optimal DSA / ECDSA Signatures and an International Search Report and Written Opinion dated May 31 ,
Application to Bitcoin Wallet Security,” International Conference 2017, Patent Application No. PCT/ IB2017/050856 , filed Feb. 16 ,
on Applied Cryptography and Network Security , Jun . 9 , 2016 , 42 2017 , 11 pages.
pages. Japanese Office Action dated Jan. 22 , 2019, Patent Application No.
Hao , “ On Robust Key Agreement Based on Public Key Authenti 2018-516682 , filed Feb. 16 , 2017 , 14 pages .
cation ,” International Conference on Financial Cryptography and Kravchenko, “ Distributed multi -ledger model for financial indus
Data Security , Jan. 25 , 2010 , 12 pages . try,” Github.com , Oct. 21, 2015 ( retrieved Jan. 30 , 2017 ], https: //
Harayama et al., “ Key escrow method of personal decryptographic github.com/WebOfTrustInfo/rebooting-the-web-of-trust/blob/master/
key by using elliptic curve calculation ,” Institute of Electronics, topics - andadvance -readings /DistributedMulti
Information and Communication Engineers (IEICE ) Technical Report ledgerModelForFinancialIndustry.md, 2 pages.
109 ( 85 ): 91-96 , Jun . 11, 2009. Mainelli , “ Blockchain : why smart contracts need shrewder people,"
Wikipedia, “ Shamir's Secret Sharing,” Wikipedia the Free Ency Banking Technology, Apr. 4, 2016 [retrieved Jan. 30 , 2017 ], http: //
clopedia , Jan. 20 , 2017 version (retrieved on Jan. 9 , 2019 ], https: // www.bankingtech.com/461572/blockchain-why-smart-contracts
en.wikipedia.org/w/index.php?title=Shamir’s_Secret_Sharing&oldid= need -shrewderpeople/, 3 pages.
761082071, 6 pages. McCorry et al., “ Authenticated Key Exchange over Bitcoin ,” Inter
Wikipedia, “ Shamir's Secret Sharing,” Wikipedia the Free Ency national Conference on Research in Security Standardisation 2015 ,
clopedia ,Mar. 6 , 2016 version ( retrieved on Jun . 24 , 2019 ], https: // Dec. 15 , 2015 , 18 pages,
en.wikipedia.org/w/index.php?title=Shamir’s_Secret_Sharing&oldid= Ryepdx et al., “ Answer to What is theGlobal Registrar ?”,” Ethereum
708636892 , 6 pages . Stack Exchange, Feb. 26 , 2016 [ retrieved Jan. 30 , 2017 ], http : //
Zyskind et al., “ Decentralizing Privacy: Using a Blockchain to ethereum.stackexchange.com/questions/1610/what-is-the-global
Protect Personal Data," 2015 IEEE CS Security and Privacy Work registrar, 3 pages .
shops, May 21, 2015 , pages . Sevareid et al., “ Use Case Asset Depository,” Github.com , Jan. 11 ,
Gitbook , “ Ethereum Frontier Guide,” Gitbook (Legacy ), Feb. 4 , 2016 version ( last edited May 5 , 2016 ) [retrieved Jan. 30 , 2017 ],
https://github.com/hyperledger/hyperledger/wiki/Use-Case-Asset
2016 , 293 pages.
Herbert et al., " A Novel Method for Decentralised Peer -to -Peer Depository, 4 pages .
Software License Validation Using Cryptocurrency Blockchain Swanson , “ Great Chain of Numbers: Chapter 3 : Next Generation
Technology,” Proceedings of the 38th Australasian Computer Sci Platforms," Great Wall ofNumbers,Mar. 4 , 2014 (retrieved Jan. 30 ,
2017 ], http://www.ofnumbers.com/2014/03/04/chapter-3-next
ence Conference, Jan. 27 , 2015 , 9 pages.
International Search Report and Written Opinion dated Apr. 3 , 2017 , generation -plafforms/, 25 pages .
Patent Application No. PCT/IB2017 /050824 , filed Feb. 14 , 2017 , 13 Tuesta et al., " Smart contracts : the ultimate automation of trust ?,"
pages . BBVA Research Financial Inclusion Unit , Oct. 2015 , 5 pages.
Reiner et al., “ Bitcoin Wallet Identity Verification Specification ," UK Commercial Search Report dated Apr. 25 , 2016 , Patent Appli
diyhpluswiki, http://diyhpl.us/-bryan/papers2/bitcoin/armory-verisign cation No. 11603117.1, filed Feb. 23 , 2016 , 11 pages .
bitcoin -wallet- identityspecification.pdf, Feb. 27 , 2015 ( retrieved UK Commercial Search Report dated Sep. 30, 2016 , Patent Appli
Jan. 27 , 2016 ), 24 pages . cation No. 1606630.0 , filed Apr. 15 , 2016 , 7 pages .
Third -Party Submission Under 37 CFR 1.290 dated Jun . 12 , 2019 , UK IPO Search Report dated Dec. 12 , 2016 , Patent Application No.
U.S. Appl. No. 16 /078,605 , filed Aug. 21, 2018 , 31 pages. GB1606630.0 , filed Apr. 15 , 2016 , 4 pages.
Third - Party Submission Under 37 CFR 1.290 dated Jun . 12, 2019 , Vayngrib , “ Future , operating business on chain ,” Github.com ,May
U.S. Appl. No. 16 /079,089 , filed Aug. 22 , 2018 , 19 pages. 4 , 2015 [retrieved Jan. 30 , 2017 ], https://github.com/tradle/about/
Wuille, “ Hierarchical Deterministic Wallets,” Github , https: // github . wiki/ Future,-operating -business-on-chain , 9 pages .
com /bitcoin /bips/blob /ab90b5289f0356282397fa968aa47d2238a7b380 / Vietnamese Office Action dated Sep. 27 , 2018 , Patent Application
bip -0032.mediawiki, Feb. 12 , 2016 (retrieved Mar. 23, 2017), 9 No. 1-2018-03358 , filed Feb. 16 , 2017 , 2 pages.
pages. Walport et al., “ Distributed Ledger Technology : beyond block
“ Bitcoin Developer Guide,” Bitcoin Project, https://web.archive . chain - A report by the UK Government Chief Scientific Adviser,"
org /web /20160515171209/https://bitcoin.org/en/developer-guide,May United Kingdom Government Office for Science , Dec. 2015, 88
15 , 2016 [retrieved Mar. 13 , 2019 ], 55 pages. pages.
Charlon et al., “Open -Assests- Protocol,” Github.com , Nov. 17 , Weller at al., “ CounterpartyXCP/Documentation : Protocol Specifi
2015 ( retrieved Jan. 30 , 2017], https://github.com/Open Assets/open cation ,” Github.com , Jan. 25, 2015 (last edited Jun. 17, 2019 )
assets - protocol/blob /master /specification.mediawiki, 5 pages . [retrieved Jan. 13 , 2020 ], 10 pages .
Counterparty, “ Home Page,” Counterparty, copyright 2018 [retrieved Wikipedia , “ Counterpart (platform ),” last edited Dec. 6 , 2019
Jan. 13 , 2020 ], counterparty.io, 3 pages . [retrieved Jan. 13, 2020 ], 2 pages.
Dorier, “ Colored Coins and Ricardian Contracts,” Coinprism Blog, Zhang et al., “ AntShare Trading Platform ,” Github.com , Jun . 3 ,
Dec. 10, 2014 [retrieved Jan. 30 , 2017 ], http://blog.coinprism.com/ 2016 (last edited Aug. 21, 2016 ) [ retrieved Jan. 30 , 2017 ], https: //
2014 / 12 / 10 / colored -coins -and -ricardian - contracts/, 9 pages . github.com/AntShares/AntShares/wiki/Whitepaper-1.1 , 9 pages.
European Communication pursuant to Article 94 ( 3 ) EPC dated Jan. Zyskind et al., “ Enigma: Decentralized Computation Platform with
2 , 2020 , Patent Application No. 18166910.2-1218 , filed Feb. 16 , Guaranteed Privacy,” arXiv preprint arXiv : 1506 , Jun . 10 , 2015 , 14
2017, 4 pages . pages.
Extended European Search Report dated Jul. 18 , 2018 , Patent
Application No. 18166910.2-1218 , filed Feb. 16 , 2017, 8 pages. * cited by examiner
U.S. Patent May 19 , 2020 Sheet 1 of 5 US 10,659,223 B2
gen
P
Third node
27
Network
First node
23 Second node
X
Pic
Eavesdropper
U.S. Patent May 19 , 2020 Sheet 2 of 5 US 10,659,223 B2
Network
Second mode
Share message (M ) between the first and second nodes
Determine a first node second private Determine a first node second public
key (V2c ) based on the first node key (Pd) based on the first node master
master private key ( Vic and public key (Pac )
the Generator Value (GV ) and the Generator Value (GV )
Generate a first signed message (SM1)
based on themessage (M ) and the first
node second private key (Vic).
Send the first signed message (SMI) 360
to the second node .
Keceive the first signed message (SM1)
from the Erst node
Validate signature on the first signed
message (SM1) with the determined
firstnode second public key (P )
Authenticate the first node
based on the result of validating
first signed message (SMI)
Determine a second node second pubic 470 Determine a second node second
key ( as ) based on the private key ( V s) based on the
second node master public key (Ps) and second node master private key (Vis
the Generator Value (GV) and the Generator Value (GV )
Determine common secret ( CS ) based on Determine common secret (CS ) based
first node second private key ( Vac) and on second noda second private key (Vas )
second node second public key (P ) and first node second public key (Pac)
Fig . 2
U.S. Patent May 19 , 2020 Sheet 3 of 5 US 10,659,223 B2
Network
First node Second node
Settle on ECC system using a Settle on ECC system using a
base value base value (G )
Generate first asymmetric
cryptography pair including: a first
node master private key (Vid ; and
a first nodemaster public key (Pic)
based on the first node
private master key (Vic ) and G
Send client master public key (Pac 130
to the second node
Receive first node
master public key (Pic )
Store first node
master public key (Pic )
Generate second asymmetric
Cryptography pair including : a
second node master private key
(Vis ); and a second node master
public key (Pus) based on the
second node master private key
(Vis) and base value (G )
Send second node master public
y
key (Pish to first node
Receive second node
master public key ( Pa )
Store second node
master public key (Past
U.S. Patent May 19 , 2020 Sheet 4 of 5 US 10,659,223 B2
7
First node
Generate a message (M )
Send themessage (M Receive the message (M )
to the second node from the first node
Determine a Generator Value (GV ) Determine a Generator Value (GV)
based on themessage (M ) 420 based on themessage (M )
Determine a first node second private Determine a first node second public
key (Vzp ) based on the first node key (Pac ) based on the first node master
master private key (Vp ) and public key (Pic ), Generator Value (GV ),
the Generator Value (GV ) and base value (G )
Generate a first signed message (SMI)
based on the message (M ) and the first
node second private key (V2C ). 440
Send first signed message (SM1) Receive first signed message (SMI)
to the second node from first node
S Validate signature on the first signed
message (SMI) with the determined
first node second public key (Pze)
Authenticate the first node
based on the result of validating the
first signed message (SM1)
Determine a second node second public Determine a second node second private
key (Pzs) based on the second node master key (Vis) based on the second
public key (Pis ), Generator Value node master private key (Vis ) and the
Generator Value (GV
(GV ), and base point (G )
Determine common secret ( CS) based on Determine common secret ( CS ) based
first node second private key (V2c ) and on second node second private key ( Vas)
second node second public key (PS) and first node second public key (Pxc)
U.S. Patent May 19 , 2020 Sheet 5 of 5 US 10,659,223 B2
Network
First node
Determine a symmetric -key based on the Determine a symmetric -key based on the
shared common secret (CS ) shared common secret (CS )
Encrypting a first communication
message , with the symmetric -key , to an
encrypted first communicationmessage
Sending the encrypted first
communication message , over
the communications network ,
to the second node
Receiving the encrypted first
communication message
Decrypting the encrypted first
communication message , with the
symmetric -key, to the first
communication message
Encrypting a second communication
message , with the symmetric -key ,
to an encrypted second
communication message
Sending the encrypted second
communication message ,
over the communications network ,
to the firstnode
Receiving the encrypted second
communication message
Decrypting the second communication
message, with the symmetric -key, to the 550
second communication message
Fig . 5
US 10,659,223 B2
2
SECURE MULTIPARTY LOSS RESISTANT munications network . However, physical delivery in not
STORAGE AND TRANSFER OF always a practical option . Therefore, a problem in such
CRYPTOGRAPHIC KEYS FOR cryptographic systems is the establishment of the symmet
BLOCKCHAIN BASED SYSTEMS IN ric -key (which may be based on a common secret ) between
CONJUNCTION WITH A WALLET 5 the nodes across an unsecure electronic network such as the
MANAGEMENT SYSTEM internet. Thus this step of providing a symmetricalkey (the
common secret) is a potentially catastrophic vulnerability .
This application is a continuation of PCT Application No. As the symmetric -key algorithms and protocols are simple
PCT/IB2017 /050829 , filed Feb. 14 , 2017 , entitled
“ SECURE MULTIPARTY LOSS RESISTANT STORAGE 10 and widely used , there is a need for two nodes to determine
a common secret based symmetrical key securely across an
AND TRANSFER OF CRYPTOGRAPHIC KEYS FOR unsecure network .
BLOCK CHAIN BASED SYSTEMS IN CONJUNCTION
WITH A WALLET MANAGEMENT SYSTEM ,” which The use of asymmetric -keys, also known as public -key
claims priority to United Kingdom Application No. cryptography, alleviates this issue to some extent. While the
1603117.1, filed Feb. 23, 2016 , entitled “ DETERMINING A 15 private key is kept secret its corresponding public key may
COMMON SECRET FOR TWO BLOCKCHAIN NODES be made publicly available. Its interception on a network is
FOR THE SECURE EXCHANGE OF INFORMATION ,” not catastrophic. Existing protocols include the Diffie-Hell
United Kingdom Application No. 1605026.2 , filed Mar. 24 , man Key Exchange and the Three Pass Protocol.
2016 , entitled “ SECURE MULTIPARTY LOSS RESIS However , storage of the private key gives rise to signifi
TANT STORAGE AND TRANSFER OF CRYPTO- 20 cant security concerns. Consider , for example, a digital
GRAPHIC KEYS FOR BLOCKCHAIN BASED SYS wallet such as a Bitcoin wallet. Digital wallets comprise
TEMS IN CONJUNCTION WITH A WALLET software which enables a user to connect with other nodes
MANAGEMENT SYSTEM ,” and United Kingdom Appli so as to perform transactions with their electronic assets e.g.
cation No. 1619301.3 , filed Nov. 15 , 2016 , entitled using bitcoin funds to purchase goods and services. Public
“ DETERMINING A COMMON SECRET FOR TWO 25 key cryptography is often used to protect the vital informa
BLOCKCHAIN NODES FOR THE SECURE tion which is needed for such connections and transactions .
EXCHANGE OF INFORMATION .” The previously noted The private key is stored either by the wallet installed on the
applications are hereby incorporated by reference in their user's device (“client side') or by a wallet service provider
entirety . (“server side'). However, if the private key is stored only at
This invention relates generally to computer and data 30 the client side, the private key can be lost through theft , loss
security, and more particularly to secure handling of highly or damage caused to the user's hardware e.g. computer,
sensitive data items such as cryptographic keys. The inven mobile phone etc. Similarly , if the user dies or becomes
tion provides an access controlmechanism . The invention is incapacitated , knowledge of or access to the private key can
particularly suited for, but not limited to , use with digital be lost and thus the funds associated with the wallet become
( software ) wallets . This may include, for example, wallets 35 inaccessible . While server-side storage of the private key
used in relation to cryptocurrencies such as Bitcoin . The can overcome these problems, the user must be prepared to
invention provides an advantageous access controlmecha trust the service provider to keep their private key secure .
nism . Security breaches at the server side are a real and significant
Cryptography involves techniques for secure storage of risk .
sensitive data as well as its communication between two or 40 Thus, it is desirable to provide a solution which enables
more nodes in a network . A node may include a mobile the safe handling of a secret. This secret may be a crypto
communication device , a tablet computer, a laptop com graphic key and /or something which may provide access to
puter, desktop , other forms of computing devices and com the key . Such an improved solution has now been devised .
munication devices, a server device in a network , a client In accordance with the present invention there is provided an
device in a network , one or more nodes in a distributed 45 improved solution as defined in the appended claims.
network , etc. The nodes may be associated with , for The invention may provide a computer - implemented
example, a natural person , a group of people such as method . It may enable the control of access to a resource . It
employees of a company, a system such as a banking system , may be called a verification or authentication method . Itmay
or a distributed , peer -to-peer ledger ( i.e. blockchain ). be referred to as a cryptographic key management solution .
Two or more nodes may be linked by a communications 50 The resource may be any type of physical or electronic
network that is unsecure and vulnerable to eavesdropping or resource . In one embodiment, the resource is a digital wallet
interception by unauthorised third parties. Therefore , mes or some other resource relating to a form of currency . It may
sages sent between nodes are often sent in encrypted form . be a Bitcoin wallet or other wallet for the management of
Upon receipt, the intended recipient decrypts the messages cryptocurrency resources. The invention may provide a
with corresponding decryption key (s) or other decryption 55 method of controlling access to a digital wallet (and corre
methods. Thus the security of such communication may be sponding system )
dependent on preventing the third party from determining The invention may be used during the set-up , registration
the corresponding decryption key. or creation of a digital wallet via an unsecure communica
One known cryptographic method includes using sym tion channel (such as the internet), to enable subsequent
metric-key algorithms. The keys are symmetric in the sense 60 wallet-related operations such as transactions to be handled ,
that the same symmetric -key is used for both encryption of communicated and /or created in a secure fashion .
a plain text message and decryption of the cipher text One or more embodiments of the invention may comprise
message . However, the symmetric -key must be transmitted the step of deriving the cryptographic key from an existing
to both nodes in a secure way to prevent unauthorised access cryptographic key pair. This may comprise the steps of:
to it . This may include , for example, physically delivering 65 determining a first entity second private key based on at
the symmetric-key to the (authorised ) nodes so that the least a first entity master private key and a generator
symmetric -key is never transmitted over an unsecure com value ;
US 10,659,223 B2
3 4
determining a second entity second private key based on parties may be nodes on the network . In one embodiment,
at least a second entity master private key and the the method may comprise the step of storing at least three
generator value; shares of the verification element at different locations
determining a common secret (CS ) at the first entity based relative to each other.
on the first entity second private key and the second 5 At least one of the shares may be stored in or on a back -up
entity second public key, and determining the common or “ safe- storage ” facility . This may be separate , independent
secret (CS ) at the second entity based on the second and /or distinct from any other location which stores a share .
entity second private key and first entity second public This provides an important advantage, because it enables
key; and restoration of the verification element in the event that one
wherein : 10 of the other shares becomes unavailable . In such a situation ,
the first entity second public key and the second entity the share may be retrieved from the safe-storage facility.
second public key are respectively based on at least A verification process may be performed prior to resto
the first/second entity master key and the generator ration of the verification element using the shares. The
value. verification process may comprise verification of the identity
Additionally or alternatively , the invention may comprise 15 of a pre -determined or designated individual, and /or a com
a method of controlling access to a digitalwallet, the method puting resource .
comprising the steps : Another aspect of the invention may relate to the secure
determining a first entity second private key based on at distribution of one or more of the shares . The method may
least a first entity master private key and a generator comprise the step of using the common secret to generate an
value; 20 encryption key, wherein the encryption key is used to
determining a second entity second private key based on encrypt at least one share of the verification element or a
at least a second entity master private key and the message comprising said at least one share .
generator value; The common secret may be determined at the at least two
determining a common secret ( CS ) at the first entity based nodes independently of each other . Thus, each node may
on the first entity second private key and the second 25 determine or generate the secret for themselves, without
entity second public key, and determining the common input from or communication with the other node or another
secret (CS ) at the second entity based on the second party. This means that the common secret may not require
entity second private key and first entity second public transmission over a communications channel. This provides
key ; and enhanced security because it cannotbe intercepted by unau
wherein : 30 thorised parties. The common secret may be common to ( i.e.
the first entity second public key and the second entity shared by ) only the at least two nodes . The common secret
second public key are respectively based on at least may then be used to generate an encryption key, and that
the first/second entity m ter key and the generator encryption key may be used for the safe transmission of the
value. share (s ). Other data may also be transmitted using the
Additionally or alternatively , the method may comprise 35 encryption key.
the steps: The method may comprise the step of determining, at a
splitting a verification element into a plurality of shares; first node (C ), a common secret (CS ) that is common with
determining a common secret at or on two or more nodes the first node (C ) and a second node (S ), wherein the first
in a network ; node (C ) is associated with a first asymmetric cryptography
using the common secret to transmit at least one share of 40 pair having a first node master private key (Vic ) and a first
the verification element from one node in the network node master public key (Pic), and the second node (S ) is
to at least one other node . associated with a second asymmetric cryptography pair
The verification element may be a cryptographic key. It having a second node master private key (Vis) and a second
may be a private key in an asymmetric cryptography pair. node master public key (Pls ), wherein the method com
Additionally or alternatively , it may be a representation of a 45 prises:
cryptographic key , or some item which may be used to determining a first node second private key (V2c ) based
access, calculate, derive or retrieve a cryptographic key. It on at least the first node master private key (Vic ) and
may be some secret or value which can be used in a a Generator Value (GV ) ;
verification process such as, for example, a mnemonic or a determining a second node second public key (P2s) based
seed . 50 on at least the second node master public key (Pis) and
Thus, one aspect of the invention may relate to splitting the Generator Value GV ( ) ; and
a secret such as a private key into (unique ) shares. The determining the common secret (CS ) based on the first
verification elementmay be split into a plurality of shares node second private key (V2c ) and the second node
such that the verification element can be restored or regen second public key (P2s ),
erated from two or more of the shares . Shamir's Secret 55 wherein the second node ( S ) has the same common
Sharing Scheme may be used to split the verification ele secret (S ) based on a first node second public key (P2c )
ment into shares . and a second node second private key (V2s), wherein :
The shares may be split such that any share on its own is the first node second public key (P2c ) is based on at
of no value, meaning that it cannot be used to arrive at the least the first node master public key (Pic) and the
(original, un -split ) verification element. The split may be 60 Generator Value (GV ); and the second node second
performed such that the verification element can only be private key (V2s) is based on at least the second node
restored upon combination of a predetermined number of master private key (Vis ) and the Generator Value (GV ).
shares. In one embodiment, any two shares may be sufficient The Generator Value (GV ) may be based on a message
for restoration of the verification element. (M ). The method may further comprise: generating a first
Another aspect of the invention may relate to safe han- 65 signed message (SM1) based on the message (M ) and the
dling or storage of the respective shares. The shares may be first node second private key (V2c ); and sending, over the
sent to , and stored by , different parties. Some or all of these communications network , the first signed message (SM1) to
US 10,659,223 B2
5 6
the second node ( S ),wherein the first signed message (SM1) The Generator Value (GV ) may be based on determining
can be validated with a first node second public key (P2c ) to a hash of a previous Generator Value (GV) .
authenticate the first node (C ). The first asymmetric cryptography pair and the second
The method may also comprise : receiving , over the com asymmetric cryptography pairmay be based on a function of
munications network, a second signed message ( SM2) from 5 respective previous first asymmetric cryptography pair and
the second node (S ); validating the second signed message previous second asymmetric cryptography pair.
(SM2) with the second node second public key (P2S ) ; and In an alternative wording, the invention may provide a
authenticating the second node (S ) based on the result of method comprising the steps: splitting a verification element
validating the second signed message (SM2), wherein the
second signed message (SM2) was generated based on the 10 intogenerating
a plurality of shares;
, at a first node, a derived (or second ) private
message (M ), or a second message (M2), and the second cryptographic key based on a first master asymmetric
node second private key (V2s ). key pair ;
The method may further comprise generating a message using the derived private key for the encryption and /or
(M ); and sending , over a communications network , the secure transmission of least one share of the verifica
message (M ) to the second node (S ). Alternatively , the 15 tion element .
method may comprise receiving the message (M ), over the The method may also comprise the step of generating , at
communications network , from the second node (S ). In yet
another alternative, the method may comprise receiving the a second node , the same derived private key, this being
message (M ), over the communications network , from generated independently of the first node and based on a
another node. In yet another alternative, the method may 20 second master asymmetric key pair.
comprise receiving the message (M ) from a data store , The derived private key may be part of an asymmetric key
and / or an input interface associated with the first node (C ).
pair comprising the private key and a public key . The first
The first node master public key (Pic), second node and /or second nodes may se Elliptic Curve Cryptography
master public key (Pis )may be based on elliptic curve point ( ECC ) to generate the private key (and its corresponding
multiplication of respective first node master private key 25 public key ).
(Vic ) and second node master private key (Vis) and a The method may comprise the steps :
generator (G ). Agreeing on , between the first and second nodes , a
The method may further comprise the steps of: receiving , standard ECC system using a base point (G ); and /or
over the communications network , the second node master generating , at the first and /or second node, a public /
public key (Pls); and storing, at a data store associated with 30 private key pair using the agreed standard ECC system
the first node (C ), the second node master public key (Pis). and publishing the public key ; this may mean making
The method may further comprise the steps of: generat it publicly available ; and/or
ing , at a first node (C ), the first node master private key registering the first node’s master public key (Pac ) at the
(Vic ) and the first node master public key (Pic ); sending , second node or another location , and /or registering the
over the communications network , the first node master 35
public key (Pic) to the second node (S ) and /or other node ; second node's master public key (Pac) at the first node
and storing , in a first data store associated with the first node or another location ; and /or
( C ), the first node master private key (Vic ). sending a message ( M ) from the first node to the second
The method may also comprise: sending, over the com node and /or vice versa , and creating a hash of the
munications network , to the second node, a notice indicative 40 message ; the message may be signed using the derived
of using a common elliptic curve cryptography (ECC ) private key ; this step may represent the only transmis
system with a base point (G ) for the method of determining sion required to 1) establish a shared secret between the
a common secret (CS). The step of generating the first node nodes and 2 ) initiate a secured communication session
master private key (Vic) and the first node master public key between them . The first or second node may use the
(Pic)may comprise: generating the first nodemaster private 45 received message M to generate its own derived (sec
key (Vic ) based on a random integer in an allowable range ondary ) public /private key pair. This may allow the
specified in the common ECC system ; and determining the node to calculate the other node's derived public key ;
first node master public key (Pic ) based on elliptic curve and/or
point multiplication of the first node master private key receiving the message and independently calculating the
(Vic) and the base point (G ) according to the following 50 hash of the message M ( e.g. SHA - 256 (M )) ; and /or
formula : calculating a public key (P2c ) which is derivable from the
Pic = VicXG master key (Pmc); and /or
validating the signature (Sig -V2c ) against the calculated
The method may further comprise: determining the Gen ???
erator Value (GV) based on determining a hash of the 55 The derived private key may be deterministically derived
message (M ), wherein the step of determining a first node from the first or second node's master public key .
second private key (V2C ) is based on a scalar addition of the The invention may also comprise a computer-imple
first node master private key (Vic ) and the Generator Valuemented system arranged and configured to implement any
(GV) according to the following formula : embodiment of the method (s) described above . The system
V2c = VictGV 60 may compriseoror alternatively
Additionally utilise a blockchain
, it maynetwork
compriseor platform
a digital.
The step of determining a second node second public key wallet provider or management system .
(P2S) may be based on the second node master public key Any feature described above in relation to one aspect or
(Pis) with elliptic curve point addition to the elliptic curve
embodiment of the invention may also be used in relation to
point multiplication of the Generator Value (GV ) and the 65 any other aspect or embodiment. For example , and feature
base point (G ) according to the following formula : described in relation to the method may apply to the system
P2s = P1s + GVxG . and vice versa .
US 10,659,223 B2
7 8
These and other aspects of the present invention will be is a human - friendly code or group of words which can be
apparent from and elucidated with reference to , the embodi turned into a binary seed for the generation of a wallet or
ment described herein . data .
An embodiment of the present invention will now be Herein , there following termsmay be used .
described, by way ofexample only , and with reference to the 5 “ Secret” (S ) is a secret ( e.g. a number or value) thatneeds
accompany drawings, in which : to be shared securely between parties .
FIG . 1 is a schematic diagram of an example system to " Share" is a piece of the secret. The secret is divided into
determine a common secret for a first node and second node , pieces and each piece is called a share. It is computed
asmay be used in accordance with the present invention for 10 from the given secret. In order to recover the secret,one
secure transmission of highly sensitive information, such as must obtain a certain numbers of shares .
a share of a private key; “ Threshold ” (k ) is the minimum number of shares that
FIG . 2 is a flow chart of computer-implemented methods one needs to regenerate or recover the secret. The secret
for determining a common secret as may be used in accor can be regenerated only when you have > = k shares .
dance with the present invention for secure transmission of 15 From a” broad
“ Prime (p ) is a random prime number.
perspective, an illustrative embodiment
highly sensitive information , such as a share of a private may comprise a method as follows. In this example, we use
key ; a “ 2 - of- 3 ' scheme ( i.e. k = 2 ):
FIG . 3 is a flow chart of computer- implemented methods A user registers with a wallet provider to generate and set
to register the first and second nodes ; up a new wallet associated with that user. In this
FIG . 4 is another flow chart of computer- implemented 20 example , the wallet is a Bitcoin wallet, which utilises
methods for determining a common secret as may be used in the Blockchain
accordance with the present invention for secure transmis A public -private key pair is generated and associated with
sion of highly sensitive information , such as a share of a the user's wallet;
private key; The private key is split into shares, using 4S
FIG . 5 is a flow chart of computer- implemented methods 25 One share of the private key is sent via a secure trans
of secure communication between the first node and second mission to the user
node . Another share of the private key is retained by the service
As explained above, a need exists for enhanced storage provider and stored on a server
and/ or exchange of a secret such as a cryptographic key, or Another share is sent via a secure transmission to a remote
a secret which can be used to generate a key. The secret may 30 location for safe storage . The term “remote ' does not
be a seed for a wallet mnemonic, or other security -related imply any particular geographical distance or location .
item . The invention provides such a solution . An embodi Instead , it is used herein to mean that the share is held
ment is described below for the purposes of illustration , and in , at or on a secure storage facility or resource which
uses the context of a digital wallet implemented on a is independent in some sense from the wallet provider
blockchain . However, the invention is not limited to such 35 or the user , preferably both .“ Independent” may include
implementations and could be implemented in respect of any physical , logical, financial , political and/or organisa
computer-implemented network or system . tionally independent. For example , the safe storage
As above, public -key cryptography is often used in rela may be contracted out to a commercial entity which
tion to digital wallets . If the end user (which we may refer provides the safe storage service for a fee; or it may be
to as a “ client” or simply “ user ” ) is responsible for storing 40 held by the user's attorney, or some other elected (and
their private key, problems may arise when the user or their trusted ) party who accepts responsibility for storing the
hardware become unavailable as this renders the private key , share and supplying it upon request if needed ;
and thus the wallet’s funds, inaccessible . However, storage The wallet provider can destroy any or all copies of the
of the key at the wallet provider's end (which we may refer complete private key , because it is no longer needed .
to as “ server side” ) requires a degree of trust in that provider 45 When the private key is needed for subsequent authori
and their security mechanisms. So there is a need to store the sation of the user (e.g. because the user now wishes to
private key in such a way that it cannot be obtained by an make a transaction ) the key can be reconstructed from
unauthorised party , but can also be reproduced when nec the user's share, which the user provides to the wallet
essary . The term “ user” may be a human user or a computer provider as and when needed , and the wallet provider's
implemented resource . 50 share .
One known cryptographic algorithm , known as " Shamir's An advantage of this is that even if the wallet provider's
secret sharing scheme” (4S ), teaches splitting the secret up security is breached , the unauthorised party cannot gain
into unique parts or shares which are then distributed to access to the user's private key because it is not stored
different parties . The shares can be used to reconstruct the anywhere on the wallet provider's system and the wallet
secret thereafter. Each individual share is of no value or use 55 provider's system alone does not contain enough shares to
on its own until it is combined with one or more other shares . allow reconstruction of the private key. This same advantage
The number of shares required to reconstruct the secret can applies in situations where the client's security is breached .
vary according to the needs of the situation. In some cases, Another advantage is that by storing a share at a safe
all shares may be required , while in other cases only a storage location, the private key can be reconstructed by
sufficient number are required . This is known as the thresh- 60 retrieving that share from safe storage and combining it with
old scheme, where any k of the shares are sufficient to the wallet provider's share . Thus, if the user dies orbecomes
reconstruct the original secret. incapacitated , or if the user's hardware (and thus share ) is
In this illustrative embodiment, 4S is used to split a secret lost, damaged or stolen , the funds in the wallet can still be
such as a private key or mnemonic seed into a number of accessed . In such a situation , the user's identity would be
parts. It is then also used to regenerate the key ormnemonic 65 verified . In some cases, the identity of a proven , trusted party
seed from a certain number of parts. The use of mnemonics such as executor of an estate or attorney would be verified .
is known in conjunction with digital wallets . The mnemonic This may be achieved , by example , upon production of
US 10,659,223 B2
9 10
evidence such as death certificate , passport, a legal docu iii. Select a Random Prime Number
ment or other form of identification. Upon verification of Chose a random prime number (p ) such that:
authorised identity , the share of the secret would be retrieved
from safe storage. Therefore, the safe storage serves as a p > max( S,n )
type of back -up facility which can be used in exceptional or 5
pre - determined circumstances. Let p = 1613
Thus, the invention provides an advantageous combina iv. Final polynomial
tion of enhanced system /data security plus convenience . It
provides a simple , effective and secure solution for access y = f(x )mod p
control. 10
It should be noted that in the above example , the private
key is generated by the wallet service provider and respec y = ( 1234 + 166x + 94 x )mod 1613
tive parts are sent to the user and safe storage resource . Creating the Shares
However, this may not be the case in other embodiments. It To divide the secret into n shares , we need to construct n
is also important to note that transmission of parts between 15 points (shares ) using the polynomial:
parties, which may be referred to as “nodes ', must be
performed in a secure manner because any unauthorised y = (1234 + 166x + 94 x ?)mod 1613
interception of multiple shares could enable the interceptor
to reconstruct the secret ( e.g. mnemonic or key ). This secure Since n = 6 for this example , we will have 6 points . Note
exchange problem is also addressed by the invention , as 20 that we start with x = 1 and NOT X = 0 .
described below . For x = 1 to 6 , the 6 points are as follows:
More detailed aspects of the invention are now described ( 1 , 1494 ); ( 2,329 ); ( 3,965); (4,176 ); (5 , 1188 ); (6,775 )
for the purpose of illustration . It should be noted that Out of these n (6 ) points, any k (3 ) points can be used to
mir’s Secret Sharing Scheme is a technique which is regenerate the secret key .
known in the art , and the skilled person would be aware of, Reconstructing the Secret from a Given Number of Shares
understand and be able to use it . Therefore, the following is 25 i. Get the secret integer
provided for the purpose of completeness only . To reconstruct the secret, we need following information :
Splitting the Secret into Shares n = 6 , k = 3 , p = 1613 ,
Given a secret S , a number of participants n , a threshold k shares :
number k , and some prime number p , we construct a ( x0 , yo )= ( 1, 1494 ); (x1 , y1) = (2,329) ; (x2 , y2 )= ( 3,965)
polynomial: 30
Once we have the above information , we can use a
y = f(x ) of degree k - 1 (modulo our prime p ) technique such as Lagrange Interpolation which is known in
with constant term S. the art and readily appreciated by the skilled person . Using
Next, we choose n unique random integers between 1 and coefficientsthis technique we can rebuild the entire polynomial. The
p - 1 , inclusive, and evaluate the polynomial at those n can be calculated according to formula below :
points. Each of the n participants is given a ( x , y ) pair. This 35
can be achieved by the following steps.
1. Convert into Integer k -1
For the 4S algorithm , the secret needs to be an integer.
Hence if the secret is in some other format (ex . String , hex 40
etc.) it must be converted into an integer first. If the secret
is already an integer, this step can be omitted . For this
a ; (x ) =
? 0 < = j < = k - 1 , j?i
i= 0
(x – x ;) / (x ; – x ;) modp
but since S = do , we only need to find do = a0 (0 )
example , let S = 1234 . k-1
-X ; modp
2. Decide Number of Shares (n ) and Threshold (k ) do =
Note that k parts will be required to regenerate the secret. i= 0Osi< k - 1 X ; – x ;
Hence , choose S and k such that k parts can always be 45
obtained while recovering the secret. For this example, let where x ; – X ; 0
n = 6 , k = 3.
3. Create the Polynomial
p
We need to create a polynomial of the form : y = f(x ) mod The skilled person will understand that in the above , the
50 exponent -1 signifies taking themultiplicative inverse . Most
i. Determine constant term and degree of polynomial programming languages comprise inbuilt packages to per
f(x)= ao+ ajx +azx_ + azxº + ... +Qz_1 *k-1 form mathematical operations such as multiplicative
inverse .
The constant term a = S ii. Convert integer to desired format
degree of polynomial= k - 1 If Step 1 was performed to convert a specific format to an
55
Hence for k = 3 and S = 1234 , we need to build a polynomial integer , we follow the reverse procedure to convert the
with degree 2 and ac = 1234 integer back to the desired format.
f(x) = 1234 +Q1x +azt? Secure Transmission of the Shares
ii. Determine Coefficients As mentioned above, it is important that the shares of the
Chose k - 1 random numbers (use a Random (or pseudo mannerareso transmitted
60 secret
as to
to the respective recipients in a secure
prevent unauthorised parties from being able
random ) Number Generator) such that: to reconstruct the secret. In a preferred embodiment, the
O <a S secure transmission can be achieved as described below .
A common secret (CS ) can be established between two
Let a1= 166 ; 42 = 94 65 parties and then used to generate a secure encryption key for
transmission of one or more of the shares. This common
Hence, f(x ) = 1234 + 166x + 94x2 secret (CS) is not to be confused with the secret (S ) referred
US 10,659,223 B2
11 12
to above. The Common Secret (CS) is generated and used to 400 includes determining 430 a first node second public key
enable secure exchange of the Secret ( S ) e.g. key or share (P2c ) based on the firstnodemaster public key (Pic) and the
thereof. Generator Value (GV) . The method 400 further include
The two parties could be any two of the wallet service determining 470 a second node second private key (V2s )
provider, the user, the safe storage resource or some other 5 based on the second node master private key (Vis) and the
legitimate party . Hereafter, for the sake of convenience , they Generator Value (GV). The method 400 includes determin
will be referred to as a first node ( C ) a second node ( S ). The
ing 480 the common secret (CS) based on the second node
aim is to generate a common (CS ) secret which both nodes second private key (V2s) and the first node second public
know butwithout that common secret having been sent via key (Pc).
a communication channel, thus eliminating the possibility of 10 The communications network 5 may include a local area
its unauthorised discovery. The secret splitting plus safe network , a wide area network , cellular networks, radio
storage technique , in combination with a secure transmis communication network , the internet , etc. These networks,
sion technique such as described below , provides a secure where data may be transmitted via communicationsmedium
key -management solution. such as electrical wire , fibre optic, or wirelessly may be
The secure transmission technique of the present inven- 15 susceptible to eavesdropping, such as by an eavesdropper
tion involves the CS being generated at each end of the 11. The method 300 , 400 may allow the first node 3 and
transmission in an independent manner, so that while both second node 7 to both independently determine a common
nodes know the CS it has not had to travel over potentially secret without transmitting the common secret over the
unsecure communication channels. Once that CS has been communications network 5 .
established at both ends, it can be used to generate a secure 20 Thus one advantage is that the common secret (CS ) may
encryption key that both nodes can use for communication be determined securely and independently by each node
thereafter. This is of particular benefit during the wallet without having to transmit a private key over a potentially
registration process, for transmission of the split private key unsecure communications network 5. In turn , the common
from one party to another. secret may be used as a secretkey (or as the basis of a secret
FIG . 1 illustrates a system 1 that includes a first node 3 25 key ) for encrypted communication between the first and
which is in communication with a second node 7 over a second nodes 3 , 7 over the communications network 5 .
communications network 5. The first node 3 has an associ The methods 300 , 400 may include additional steps. The
ated first processing device 23 and the second node 5 has an method 300 may include , at the first node 3, generating a
associated second processing device 27. The first and second signed message (SM1) based on the message (M ) and the
nodes 3, 7 may include an electronic device, such as a 30 first node second private key (V2c ). The method 300 further
computer, phone, tablet computer, mobile communication includes sending 360 the first signed message (SMI), over
device, computer server etc. In one example , the first node the communications network , to the second node 7. In turn ,
3 may be a client (user) device and the second node 7 may the second node 7 may perform the steps of receiving 440
be a server. The server may be a digital wallet provider's the first signed message (SM1). The method 400 also
server. 35 includes the step of validating 450 the first signed message
The first node 3 is associated with a first asymmetric ( SM2) with the first node second public key (P2c ) and
cryptography pair having a first node master private key authenticating 460 the first node 3 based on the result of
(Vic ) and a first node master public key (Pic). The second validating the first signed message (SMI). Advantageously,
node (7 ) is associated with a second asymmetric cryptogra this allows the second node 7 to authenticate that the
phy pair having a second nodemaster private key (Vis) and 40 purported first node (where the first signed message was
a second node master public key (Pis). In other words, the generated ) is the first node 3. This is based on the assump
first and second nodes are each in possession of respective tion that only the first node 3 has access to the first node
public -private key pairs. master private key (Vic ) and therefore only the first node 3
The first and second asymmetric cryptography pairs for can determine the first node second private key (V2c ) for
the respective first and second nodes 3, 7 may be generated 45 generating the first signed message (SM1). It is to be
during a registration process , such as registration for a appreciated that similarly, a second signed message (SM2)
wallet. The public key for each node may be shared publicly , can be generated at the second node 7 and sent to the first
such as over communications network 5 . node 3 such that the first node 3 can authenticate the second
To determine the common secret (CS) at both the first node 7 , such as in a peer-to -peer scenario .
node 3 and second node 7 , the nodes 3, 7 perform steps of 50 Sharing the message (M ) between the first and second
respective methods 300, 400 without communicating private nodes may be achieved in a variety of ways. In one example ,
keys over the communications network 5 . the message may be generated at the first node 3 which is
The method 300 performed by the first node 3 includes then sent, over the communications network 5 , the second
determining 330 a first node second private key (V2c )based node 7. Alternatively , the message may be generated at the
on at least the first node master private key (Vic ) and a 55 second node 7 and then sent, over the communications
Generator Value (GV ). The Generator Value may be based network 5 , to the second node 7. In yet another example , the
on a message ( M ) that is a shared between the first and message may be generated at a third node 9 and themessage
second nodes, which may include sharing the message over sent to both the first and second nodes 3 , 7. In yet another
the communications network 5 as described in further detail alternative , a user may enter the message through a user
below . The method 300 also includes determining 370 a 60 interface 15 to be received by the first and second nodes 3 ,
second node second public key (P2s) based on at least the 7. In yet another example , the message (M ) may be retrieved
second node master public key (P1s) and the Generator from a data store 19 and sent to the first and second nodes
Value (GV). The method 300 includes determining 380 the 3 , 7. In some examples , the message (M )may be public and
common secret ( CS ) based on the first node second private therefore may be transmitted over an unsecure network 5 .
key (V2c ) and the second node second public key (P2s). 65 In further examples, one or more messages (M ) may be
Importantly, the same common secret ( CS ) can also be stored in a data store 13 , 17, 19 , where the message may be
determined at the second node 7 by method 400. The method associated with some entity such as digital wallet, or a
US 10,659,223 B2
13 14
communication session established between the first node 3 Pic: The first node master public key that is made publicly
and the second node 7. Thus the messages (M ) may be known .
retrieved and used to recreate, at the respective first and The first node 3 may store the first node master private
second nodes 3 , 7 , the common secret (CS) associated with key (Vic ) and the firstnode master public key (Pic ) in a first
that wallet or session. 5 data store 13 associated with the first node 3. For security ,
Advantageously, a record to allow recreation of the com the first node master private key (Vic) may be stored in a
secure portion of the first data store 13 to ensure the key
mon secret (CS ) may be kept without the record by itself remains
having to be stored privately or transmitted securely. This private .
may be advantageous if numerous transactions are per The method 100 further includes sending 130 the first
formed at the first and second nodes 3 , 7 and it would be 10 node master public key (Pic ), over the communications
impractical to store all the messages (M ) at the nodes network 5 , to the second node 7. The second node 7 may, on
themselves. receiving 220 the first node master public key (Pic ), store
Method of Registration 100, 200 230 the first node master public key (Pic ) in a second data
An example of a method of registration 100, 200 will be store 17 associated with the second node 7 .
described with reference to FIG . 3 , where method 100 is 15 Similar to the first node 3 , the method 200 of the second
performed by the first node 3 and method 200 is performed 7 includes generating 240 a second asymmetric cryptogra
by the second node 7. This includes establishing the first and phy pair that includes the second node master private key
second asymmetric cryptography pairs for the respective (Vis ) and the second node master public key (Pis). The
first and second nodes 3 , 7 . second node master private key (Vis) is also a random
The asymmetric cryptography pairs include associated 20 integer within the allowable range . In turn , the second node
private and public keys, such as those used in public-key master public key (Pis) is determined by the following
encryption . In this example , the asymmetric cryptography formula :
pairs are generated using Elliptic Curve Cryptography
(ECC ) and properties of elliptic curve operations. Pus = V1sxG ( Equation 2 )
Standards for ECC may include known standards such as 25 Thus the second asymmetric cryptography pair includes:
those described by the Standards for Efficient Cryptography Vis: The second node master private key that is kept
Group (www.sceg.org ). Elliptic curve cryptography is also secret by the second node .
described in U.S. Pat. Nos. 5,600,725,5,761,305,5,889,865, Pis: The second node master public key that is made
5,896,455 , 5,933,504 , 6,122,736 , 6,141,420 , 6,618,483, publicly known.
6,704,870 , 6,785,813 , 6,078,667, 6,792,530 .
In the method 100 , 200 , this includes the first and second 30 The second node 7 may store the second asymmetric
nodes agreeing 110 , 210 on a common ECC system and cryptography pair in the second data store 17. The method
using a base point (G ). (Note : the base point could be 200 further includes sending 250 the second node master
referred as a Common Generator, but the term 'base point public key (P1s) to the first node 3. In turn , the first node 3
is used to avoid confusion with the Generator Value GV ). In may receive 140 and stores 150 the second node master
one example , the common ECC system may be based on 35 public key (Pls ).
secp256K1 which is an ECC system used by Bitcoin . The It is to be appreciated that in some alternatives, the
base point (G ) may be selected , randomly generated , or respective public master keys may be received and stored at
assigned . a third data store 19 associated with the third node 9 (such
Turning now to the first node 3, the method 100 includes as a trusted third party ). This may include a third party that
settling 110 on the common ECC system and base
This may include receiving the common ECC system and point ( G ) , 40 acts as a public directory, such as a certification authority.
base point from the second node 7, or a third node 9 . (Pic) may Thus in some examples , the first node master public key
Alternatively, a user interface 15 may be associated with the requested and received by the second node 7 only
first node 3, whereby a user may selectively provide the when determining the common secret (CS) is required (and
common ECC system and/or base point (G ). In yet another 45 viceTheversa ).
registration steps may only need to occur once as an
alternative one or both of the common ECC system and/or
base point (G ) may be randomly selected by the first node 3 . initial setup of, for example , the digital wallet .
The first node 3 may send, over the communications net Session Initiation and Determining the Common Secret
work 5 , a notice indicative of using the common ECC by the First Node 3
system with a base point (G ) to the second node 7. In turn , An example of determining a common secret (CS) will
the second node 7 may settle 210 by sending a notice 50 now be described with reference to FIG . 4. The common
indicative of an acknowledgment to using the common ECC secret (CS) may be used for a particular session , time,
system and base point (G ). transaction , or other purpose between the first node 3 and the
The method 100 also includes the first node 3 generating second node 7 and it may not be desirable , or secure , to use
120 a first asymmetric cryptography pair that includes the the same common secret (CS). Thus the common secret (CS )
firstnode master private key (Vic ) and the first nodemaster 55 may be changed between different sessions, time, transac
public key (Pic). This includes generating the first master tions , etc.
private key (Vic ) based , at least in part , on a random integer The following is provided for illustration of the secure
in an allowable range specified in the common ECC system . transmission technique which has been described above .
This also includes determining the first node master public
key (Pic) based on elliptic curve pointmultiplication of the 60 Generating a Message ( M ) 310
In this example
first node master private key (Pic ) and the base point (G ) node 3 includes generating , the method 300 performed by the first
according to the formula: 310 a message (M ). Themessage
(M ) may be random , pseudo random , or user defined . In one
Pic = VicxG ( Equation 1) example , themessage (M ) is based on Unix time and a nonce
(and arbitrary value). For example , the message (M ) may be
Thus the first asymmetric cryptography pair includes : 65 provided as:
Vic : The first node master private key that is kept secret
by the first node. Message ( M =UnixTime+ nonce ( Equation 3)
US 10,659,223 B2
15 16
In some examples, the message (M ) is arbitrary . However a signed message includes applying a digital signature
it is to be appreciated that the message (M ) may have algorithm to digitally sign themessage (M ). In one example ,
selective values (such as Unix Time, etc ) thatmay be useful this includes applying the first node second private key
in some applications . (V2c) to the message in an Elliptic Curve Digital Signature
The method 300 includes sending 315 the message (M ), 5 Algorithm (ECDSA ) to obtain the first signed message
over the communications network 3 , to the second node 7 . (SMI).
The message (M )may be sent over an unsecure network as Examples of ECDSA include those based on ECC sys
themessage (M ) does not include information on the private tems with secp256k1, secp256r1, secp384r1, se3cp521r1.
keys . The first signed message (SM1) can be verified with the
Determining a Generator Value (GV ) 320 10 corresponding first node second public key (P2c) at the
Themethod 300 further includes the step of determining
320 a Generator Value (GV ) based on the message (M ). In second node 7. This verification of the first signed message
this example , this includes determining a cryptographic hash first node 3be, which
( SM1 ) may used by the second node 7 to authenticate the
will be discussed in the method 400
of the message. An example of a cryptographic hash algo below .
rithm includes SHA - 256 to create a 256 -bit Generator Value 15 Determine a Second Node Second Public Key 370
(GV). That is :
GV = SHA- 256 (M ) (Equation 4 ) The first node 3 may then determine 370 a second node
second public key (P2s ). As discussed above, the second
It is to be appreciated that other hash algorithmsmay be node second public key (P2s) may be based at least on the
used . This may include other has algorithms in the Secure second node master public key (Pls) and the Generator
Hash Algorithm (SHA ) family. Some particular examples 20 Value (GV). In this example , since the public key is deter
include instances in the SHA -3 subset, including SHA3-224 , mined 370 ' as the private key with elliptic curve point
SHA3-256 , SHA3-384 , SHA3-512 , SHAKE128 , multiplication with the base point (G ), the second node
SHAKE256 . Other hash algorithmsmay include those in the second public key (P2s) can be expressed , in a fashion
RACE Integrity Primitives Evaluation Message Digest similar to Equation 6 , as:
(RIPEMD ) family . A particular example may include RIP 25
EMD - 160 . Other hash functions may include families based P2s = V2sXG ( Equation 10.1)
on Zémor- Tillich hash function and knapsack -based hash
functions . P2s = P 18 +GVXG (Equation 10.2 )
Determining a First Node Second Private Key 330 The mathematical proof for Equation 10.2 is the same as
The method 300 then includes the step 330 of determining
330 the first node second private key (V2c) based on the 30 described above for deriving Equation 9.1 for the first node
second node master private key (Vic ) and the Generator second public key (P2c ). It is to be appreciated that the first
Value (GV). This can be based on a scalar addition of the node 3 can determine 370 the second node second public key
first node master private key (Vic ) and the Generator Value independently of the second node 7 .
(GV )according to the following formula : Determine the Common Secret 380 at the First Node 3
V2c = Vic +GV ( Equation 5 ) 35 The first node 3 may then determine 380 the common
secret (CS) based on the determined first node second
Thus the first node second private key (V2c ) is not a private key (V2c ) and the determined second node second
random value but is instead deterministically derived from public key (P2s). The common secret (CS) may be deter
the first node master private key. The corresponding public mined by the first node 3 by the following formula:
key in the cryptographic pair, namely the first node second 40
public key (P2c ), has the following relationship : S = V2cXP 25 (Equation 11)
P2cV2cXG (Equation 6 ) Method 400 Performed at the Second Node 7
Substitution of V2c from Equation 5 into Equation 6 The corresponding method 400 performed at the second
provides : 45
node 7 will now be described . It is to be appreciated that
P2c = (VICGV)xG (Equation 7) some of these steps are similar to those discussed above that
were performed by the first node 3 .
where the ‘ + ' operator refers to elliptic curve point addition . The method 400 includes receiving 410 the message (M ),
Noting that elliptic curve cryptography algebra is distribu over the communications network 5 , from the first node 3 .
tive, Equation 7 may be expressed as : This may include the message (M ) sent by the first node 3
P2c = VicXG +GVxG (Equation 8 ) 50 at step 315. The second node 7 then determines 420 a
Finally, Equation 1 may be substituted into Equation 7 to Generator Value (GV ) based on the message (M ). The step
provide: of determining 420 the Generator Value (GV ) by the second
node 7 is similar to the step 320 performed by the first node
P2c = Pic +GVxG (Equation 9.1) described above . In this example , the second node 7 per
P2CP1SHA-256 (M )xG (Equation 9.2 )
55 forms
3.
this determining step 420 independent of the first node
Thus the corresponding firstnode second public key (P2c ) The next step includes determining 430 a first node
can be derivable given knowledge of the first node master second public key (P2c ) based on the first node master
public key (Pic ) and the message (M ). The second node 7 public key (Pic ) and the Generator Value (GV ). In this
may have such knowledge to independently determine the 60 example , since the public key is determined 430' as the
first node second public key (P2c ) as will be discussed in private key with elliptic curve point multiplication with the
further detail below with respect to the method 400 . base point (G ), the first node second public key (P2c ) can be
Generate a First Signed Message (SM1) Based on the expressed, in a fashion similar to Equation 9, as :
Message and the First Node Second Private Key 350 (Equation 12.1 )
The method 300 further includes generating 350 a first 65 P2c = V2cxG
signed message (SM1) based on the message (M ) and the
determined first node second private key (V2c ). Generating P2c = P1c +GVXG ( Equation 12.2 )
US 10,659,223 B2
17 18
The mathematicalproof for Equations 12.1 and 12.2 is the S = V2cXP2s (Equation 11)
same as those discussed above for Equations 10.1 and 10.2 .
The Second Node 7 Authenticating the First Node 3 S = V2cx (V2sXG )
The method 400 may include steps performed by the (Equation 15 )
second node 7 to authenticate that the alleged first node 3, 5 S = ( V2cxV2s)xG
is the first node 3. As discussed previously, this includes Turning to the common secret (CS ) determined by the
receiving 440 the first signed message (SM1) from the first second node 7 , Equation 12.1 can be substituted into Equa
node 3. The second node 7 may then validate 450 the tion 14 as follows:
signature on the first signed message (SM1) with the first ( Equation 14 )
node second public key (P2c ) that was determined at step 10 S = V25* P2c
430 .
Verifying the digital signature may be done in accordance S = V25* ( V2cxG )
with an Elliptic Curve Digital Signature Algorithm (Equation 16 )
( ECDSA ) as discussed above. Importantly , the first signed S = ( V2sXV2c)xG
message (SM1) that was signed with the first node second 15 Since ECC algebra is commutative , Equation 15 and
private key (V2c) should only be correctly verified with the Equation 16 are equivalent, since :
corresponding first node second public key (P2c ), since V20 S = ( V2cxV2s)~ G = (V25 * V2c)xG (Equation 17 )
and P2c form a cryptographic pair. Since these keys are
deterministic on the first node master private key (Vic) and The Common Secret (CS) and Secret Key
the first node master public key (Pic ) that were generated at 20 The common secret (CS ) may now be used as a secret key,
registration of the first node 3 , verifying first signed message or as the basis of a secret key in a symmetric -key algorithm
(SM1) can be used as a basis of authenticating that an for secure communication between the first node 3 and
alleged first node sending the first signed essage (SM1) is second node 7. This communication may be used to convey
the same first node 3 during registration . Thus the second part of a private key , a representation of or identifier for a
node 7 may further perform the step of authenticating ( 460) 25 private key , or mnemonic for a private key . Therefore , once
the first node 3 based on the result of validating (450 ) the the invention has been used during set- up of, for example , a
first signed message . digital wallet or other controlled resource, secure commu
The above authentication may be suitable for scenarios nication between the parties can be performed thereafter.
where one of the two nodes is a trusted node and only one The common secret (CS ) may be in the form of an elliptic
of the nodes need to be authenticated . For example, the first 30 curve point (xs, ys). This may be converted into a standard
node 3 may be a client and the second node 7 may be a key format using standard publicly known operations agreed
server trusted by the client such as a wallet provider. Thus by the nodes 3, 7. For example, the xsvalue may be a 256 - bit
the server ( second node 7 ) may need to authenticate the integer that could be used as a key for AES 256 encryption . It
credentials of the client ( first node 3) in order to allow the could also be converted into a 160 -bit integer using RIP
client access to the server system . It may not be necessary 35 EMD160 for any applications requiring this length key.
for the server to be authenticate the credentials of the server The common secret (CS) may be determined as required .
to the client. However in some scenarios, it may be desirable Importantly, the first node 3 does not need to store the
for both nodes to be authenticated to each other, such as in common secret (CS ) as this can be re -determined based on
a peer -to -peer scenario . the message (M ). In some examples, the message (s) (M )
The Second Node 7 Determining the Common Secret 40 used may be stored in data store 13, 17 , 19 ( or other data
The method 400 may further include the second node 7 store ) without the same level of security as required for the
determining 470 a second node second private key (V2s) master private keys. In some examples, the message (M )
based on the second node master private key (Vis) and the may be publicly available.
Generator Value (GV). Similar to step 330 performed by the However depending on some application , the common
first node 3, the second node second private key (V2s) can 45 secret (CS) could be stored in the first data store (X )
be based on a scalar addition of the second node master associated with the first node provided the common secret
private key (Vis) and the Generator Value (GV)according to ( CS ) is kept as secure as the first node master private key
the following formulas: (Vic ).
V2s = Vis+ GV (Equation 13.1) It should be noted that the above-mentioned embodiments
50 illustrate rather than limit the invention , and that those
V2s = V1 SHA -256 (M ) (Equation 13.2 ) skilled in the art will be capable of designing many alter
The second node 7may then , independent of the first node native embodiments without departing from the scope of the
invention as defined by the appended claims. In the claims,
3, determine 480 the common secret (CS) based on the any reference signs placed in parentheses shall not be
second node second private key (V2s) and the first node 55 construed as limiting the claims. The word " comprising ” and
second public key (P2c ) based on the following formula : " comprises” , and the like , does not exclude the presence of
S = V25XP 2c (Equation 14 )
elements or steps other than those listed in any claim or the
Proof of the Common Secret (CS) Determined by the First specification as a whole . In the present specification , " com
Node 3 and Second Node 7 prises” means “ includes or consists of” and “ comprising”
The common secret (CS ) determined by the first node 3 is 60 means “ including or consisting of” . The singular reference
the same as the common secret (CS) determined at the of an element does not exclude the plural reference of such
second node 7. Mathematical proof that Equation 11 and elements and vice - versa . The invention may be implemented
Equation 14 provide the same common secret (CS) will now by means of hardware comprising several distinct elements,
be described . and by means of a suitably programmed computer. In a
Turning to the common secret ( CS ) determined by the first 65 device claim enumerating several means, several of these
node 3 , Equation 10.1 can be substituted into Equation 11 as means may be embodied by one and the same item of
follows: hardware. The mere fact that certain measures are recited in
US 10,659,223 B2
19 20
mutually different dependent claims does not indicate that a 7. A method according to claim 1, wherein the common
combination of these measures cannotbe used to advantage . secret is:
i) determined at the two or more nodes independently of
The invention claimed is : each other, such that the common secret does not
1. A computer- implemented method of controlling access 5 require transmission over a communications channel
to a resource , the method comprising: between the nodes; and/ or
splitting a verification element into a plurality of shares ; ii) shared only by the two or more nodes .
determining a common secret at two or more nodes in a 8. A method according to claim 1 comprising the step of
network ; and setting up , creating or registering a digital wallet, wherein
using the common secret to transmit at least one share of 10 the verification element is associated with the digitalwallet.
the verification element between the two or more
nodes, wherein : 9. A method according to claim 1, wherein the Generator
the common secret is determined by first (C ) and Value (GV) is based on a message (M ).
second (S ) nodes in the network , wherein the first 10. A method according to claim 9 and further comprising
node ( C ) is associated with a first asymmetric cryp- 15 thegenerating
steps of:
a first signed message (SMI) based on the
tography pair having a first node master private key
(Vic ) and a first node master public key (Pic), and message (M ) and the first node second private key
the second node ( S ) is associated with a second (V2c); and
asymmetric cryptography pair having a second node sending, over a communications network , the first signed
master private key (Vis) and a second node master 20 message (SMI) to the second node (S ),
public key (P1s); and wherein wherein the first signed message (SMI) can be validated
the method further comprises: with a firstnode second public key (P2c ) to authenticate
determining a first node second private key (V2c) the first node (C ).
based on at least the first node master private key 11. A method according to claim 9 and further comprising:
(Vic ) and a Generator Value (GV ); 25 receiving, over a communications network , a second
determining a second node second public key (P2 ) signed message (SM2) from the second node (S );
based on at least the second node master public validating the second signed message (SM2) with the
key ( P1s) and the Generator Value (GV) ; and second node second public key (P2S ); and
determining the common secret ( CS ) based on the authenticating the second node (S ) based on a result of
firstnode second private key (V2c) and the second 30 validating the second signed message (SM2),
node second public key (P2s), wherein the second signed message (SM2) was generated
wherein the second node (S ) has the same common based on the message (M ), or a second message (M2),
secret (S ) based on a first node second public key and the second node second private key (V2s ).
(P2s) and a second node second private key (Vas), 12. A method according to claim 9 further comprising :
wherein : 35 receiving the message (M ), over a communications net
the first node second public key (P2c) is based on work , from the second node ( S ).
at least the first node master public key (Pic ) 13. A method according to claim 9 further comprising :
and the Generator Value (GV ); and receiving the message (M ), over a communications net
the second node second private key (V2s) is based work , from another node.
on at least the second node master private key 40 14. A method according to claim 1 and further compris
(Vis) and the Generator Value (GV ) . ing:
2. A method according to claim 1 wherein the verification generating a message (M ); and
element is a cryptographic key, a representation of a cryp sending , over a communications network , the message
tographic key, or some element which may be used to (M ) to the second node (S ).
access , calculate or retrieve the cryptographic key. 45 15. A method according to claim 1 , wherein the firstnode
3. A method according to claim 1 and further comprising master public key (Pic ), second node master public key
the step of using the common secret to generate an encryp (Ps) are based on elliptic curve point multiplication of
tion key, wherein the encryption key is used to encrypt the respective first node master private key (Vic ) and second
at least one share of the verification element or a message node master private key (Vis) and a base point (G ).
comprising or relating to said at least one share . 50 16. A method according to claim 1 further comprising the
4. A method according to claim 1 and further comprising steps of:
the step of: receiving, over a communications network , the second
storing at least three shares of the verification element at node master public key (P1s); and
different locations relative to each other ; and storing, at a data store associated with the first node (C ),
wherein at least one of the at least three shares is stored 55 the second node master public key (P1s ).
in or on a back -up or safe- storage facility which is 17. A method according to claim 1 further comprising the
separate , independent and /or distinct from at least two steps of:
other locations of the different locations . generating, at a firstnode (C ), the first node master private
5. A method according to claim 1, wherein the resource is key (Vic ) and the first node master public key (Pic );
a digital wallet or other resource relating to some form of 60 sending, over a communications network , the first node
currency . master public key (Pic ) to the second node (S ) and /or
6. A method according to claim 1 , wherein the verification another node; and
element is split into a plurality of shares such that the storing , in a first data store associated with the first node
verification element can be restored or regenerated from two (C ), the first node master private key (Vic).
or more of the shares ; and wherein the verification element 65 18. A method according to claim 1, wherein the Generator
is split into a plurality of shares using Shamir’s Secret Value (GV) is based on determining a hash of a previous
Sharing Scheme. Generator Value (GV) .
US 10,659,223 B2
21 22
19. A method according to claim 1, wherein the first
asymmetric cryptography pair and the second asymmetric
cryptography pair are based on a function of respective
previous first asymmetric cryptography pair and previous
second asymmetric cryptography pair. 5
20. A computer-based system arranged to perform the
steps of claim 1 .
21. A system according to claim 20 , wherein :
the resource is a digital wallet or other resource relating
to some form of currency . 10
22. A system according to claim 20, wherein the system
comprises software arranged to enable the setup , creation or
registration of a digital wallet, wherein the verification
element is associated with the digital wallet . ui