US 11,711,213 B2
Master key escrow process
Arun Velagapalli, San Francisco, CA (US); Nitin Mahendru, San Jose, CA (US); Arthur Britto, San Francisco, CA (US); David Schwartz, Tiburon, CA (US); and Kimon Papahadjopoulos, Milpitas, CA (US)
Assigned to POLYSIGN, INC., Oakland, CA (US)
Filed by Polysign, Inc., Oakland, CA (US)
Filed on Mar. 31, 2021, as Appl. No. 17/219,473.
Claims priority of provisional application 63/055,760, filed on Jul. 23, 2020.
Prior Publication US 2022/0029801 A1, Jan. 27, 2022
Int. Cl. H04L 9/08 (2006.01); H04L 9/40 (2022.01); H04L 9/32 (2006.01)
CPC H04L 9/0894 (2013.01) [H04L 9/0877 (2013.01); H04L 9/3247 (2013.01); H04L 9/3268 (2013.01); H04L 63/0823 (2013.01)] 15 Claims
OG exemplary drawing
 
1. A computer-implemented method for escrow of master keys, the method comprising:
initializing each of three third-party hardware security modules (HSMs) as master escrow recovery devices, wherein:
each third-party HSM corresponds to a different third party;
the different third parties are different from a single first party; and
the different third parties and the single first party all peer review the master escrow recovery device initialization;
performing a bootstrap operation on an authoritative blockchain to generate three master keys;
generating a first set of master key shard ciphertexts using a first one of the three master escrow recovery devices, a second set of master key shard ciphertexts using a second one of the three master escrow recovery devices, and a third set of master key shard ciphertexts using a third one of the three master escrow recovery devices;
storing the first set of master key shard ciphertexts, the second set of master key shard ciphertexts, and the third set of master key shard ciphertexts as opaque objects in each of two first-party HSMs, the two first-party HSMs corresponding to the single first party; and
initializing each of three additional third-party HSMs as redundant master escrow recovery devices, each redundant master escrow recovery device corresponding to one master escrow recovery device.