Application US20180262341

Secure Firmware Transaction Signing Platform Apparatuses, Methods and Systems
[+] Show Details

US20180262341

1. A transaction signing apparatus, comprising: (10) (5)

a memory;

a component collection in the memory, including:

a secure firmware transaction signing component implemented by a first hardware security module (HSM);

a processor disposed in communication with the memory, and configured to issue a plurality of processing instructions from the component collection stored in the memory, wherein the processor issues instructions from the secure firmware transaction signing component, stored in the memory, to: receive, via at least one processor, a transaction signing request message for a transaction;

obtain, via at least one processor, an encrypted master private key associated with the transaction from a second HSM;

retrieve, via at least one processor, from the first HSM's tamper-proof storage, a private key decryption key associated with the first HSM;

decrypt, via at least one processor, by the first HSM, the encrypted master private key using the retrieved private key decryption key;

determine, via at least one processor, a transaction hash and a keychain path associated with the transaction signing request message, wherein generation of the keychain path includes a hierarchal tree of private-public key pairs from the decrypted master private key;

determine, via at least one processor, by the first HSM, a signing private key from the generated hierarchical tree of private-public key pairs for the determined keychain path using the decrypted master private key;

sign, via at least one processor, by the first HSM, the determined transaction hash using the generated signing private key to generate a signature; and

return, via at least one processor, the generated signature;

wherein the first and second HSMs, the memory and the processor are electronically connected.

2. The apparatus of claim 1, wherein the first HSM is a Peripheral Component Interconnect Express (PCIe) appliance installed in a transaction signing server. (0)

3. The apparatus of claim 1, wherein the second HSM is a Universal Serial Bus (USB) appliance communicatively coupled to the first HSM via USB. (0)

4. The apparatus of claim 1, wherein the second HSM includes a pin entry device. (1) (0)

6. The apparatus of claim 1, wherein the second HSM also implements a secure firmware transaction signing component. (0)

7. The apparatus of claim 1, wherein the transaction signing request is an Application Program Interface (API) call to a method exposed by the secure firmware transaction signing component. (0)

8. The apparatus of claim 1, wherein the encrypted master private key is encrypted, by the second HSM, using a public key encryption key of the first HSM stored in the second HSM's tamper-proof storage. (0)

9. The apparatus of claim 1, wherein the signing private key is generated using a Bip32-based deterministic key derivation procedure. (0)

10. The apparatus of claim 1, further, comprising: (1) (1)

12. The apparatus of claim 1, wherein the transaction hash is signed in accordance with a hashing algorithm utilized by a Bitcoin protocol. (0)

13. The apparatus of claim 1, wherein the signature is returned in Distinguished Encoding Rules format. (0)

14. A processor-readable transaction signing non-transient physical medium storing processor-executable components, the components, comprising: (0) (1)

a component collection stored in the medium, including: a secure firmware transaction signing component implemented by a first hardware security module (HSM);

wherein the secure firmware transaction signing component, stored in the medium, includes processor-issuable instructions to: receive, via at least one processor, a transaction signing request message for a transaction;

obtain, via at least one processor, an encrypted master private key associated with the transaction from a second HSM;

retrieve, via at least one processor, from the first HSM's tamper-proof storage, a private key decryption key associated with the first HSM;

decrypt, via at least one processor, by the first HSM, the encrypted master private key using the retrieved private key decryption key;

determine, via at least one processor, a transaction hash and a keychain path associated with the transaction signing request message, wherein generation of the keychain path includes a hierarchical tree of private-public key pairs from the decrypted master private key;

sign, via at least one processor, by the first HSM, the determined transaction hash using the generated signing private key to generate a signature; and

return, via at least one processor, the generated signature;

wherein the first and second HSMs are electronically connected.

15. A processor-implemented transaction signing system, comprising: (0) (2)

secure firmware transaction signing component means implemented by a first hardware security module (HSM), to: receive, via at least one processor, a transaction signing request message for a transaction;

obtain, via at least one processor, an encrypted master private key associated with the transaction from a second HSM;

retrieve, via at least one processor, from the first HSM's tamper-proof storage, a private key decryption key associated with the first HSM;

decrypt, via at least one processor, by the first HSM, the encrypted master private key using the retrieved private key decryption key;

determine, via at least one processor, a transaction hash and a keychain path associated with the transaction signing request message, wherein generation of the keychain path includes a hierarchical tree of private-public key pairs from the decrypted master private key;

sign, via at least one processor, by the first HSM, the determined transaction hash using the generated signing private key to generate a signature; and

return, via at least one processor, the generated signature;

wherein the first and second HSMs, the memory and the secure firmware transaction signing component means are electronically connected.

16. A processor-implemented transaction signing method, comprising: (0) (2)

executing processor-implemented secure firmware transaction signing component instructions implemented by a first hardware security module (HSM), to: receive, via at least one processor, a transaction signing request message for a transaction;

obtain, via at least one processor, an encrypted master private key associated with the transaction from a second HSM;

retrieve, via at least one processor, from the first HSM's tamper-proof storage, a private key decryption key associated with the first HSM;

decrypt, via at least one processor, by the first HSM, the encrypted master private key using the retrieved private key decryption key;

determine, via at least one processor, a transaction hash and a keychain path associated with the transaction signing request message, wherein generation of the keychain path includes a hierarchical tree of private-public key pairs from the decrypted master private key;

sign, via at least one processor, by the first HSM, the determined transaction hash using the generated signing private key to generate a signature; and

return, via at least one processor, the generated signature;

wherein the first and second HSMs, the memory and the secure tamper-proof firmware transaction signing component means are electronically connected.

View Abstract and Specification Size

PDF with Images and Document Face >

Full Text Publication >

Application US20180262341

Secure Firmware Transaction Signing Platform Apparatuses, Methods and Systems

Patent Matrix® Search