Cryptoasset custodial system with different rules governing access to logically separated cryptoassets
Methods, systems, and apparatus, including medium-encoded computer program products, for secure storage and retrieval of information, such as private keys, useable to control access to a blockchain, include, in at least one aspect, a method including: receiving a request to take an action with respect to a vault of multiple different vaults in a cryptoasset custodial system; authenticating, by an HSM, the policy map for the vault based on a cryptographic key controlled by the HSM; checking, by the HSM, the action against the policy map for the vault when the policy map for the vault is authenticated based on the cryptographic key controlled by the HSM; and effecting, by the HSM, the action when the action is confirmed to be in accordance with the policy map for the vault.
1. A method comprising:
signing, by a hardware security module, policy maps for respective different vaults in a cryptoasset custodial system using a private key of an asymmetric cryptographic key pair of a custodial account;
receiving, by the hardware security module, a request to take an action with respect to a vault of the different vaults in the cryptoasset custodial system, wherein the different vaults are logical groupings of cryptoassets associated with the custodial account of the cryptoasset custodial system, each of the different vaults has an associated policy map that defines vault control rules governing which actions are allowed for the vault under one or more specified conditions;
determining, by the hardware security module, a vault identifier of the vault based on the request;
authenticating, by the hardware security module, a policy map for the vault on which the action is requested by validating a digital signature of the policy map using a public key of the asymmetric cryptographic key pair controlled by the hardware security module based on determining the vault identifier of the vault, wherein the hardware security module comprises at least one secure storage device and at least one physical computing device coupled with the at least one secure storage device, the at least one physical computing device being configured to provide cryptographic processing to manage, for the custodial account, private keys of asymmetric cryptographic key pairs usable to control access to the cryptoassets in at least one blockchain;
checking, by the hardware security module, the action against the policy map for the vault when the policy map for the vault is authenticated using the asymmetric cryptographic key pair controlled by the hardware security module;
deriving, by the hardware security module, a private key for the vault of the custodial account by applying a key derivation function to the vault identifier of the vault of the custodial account, thereby enforcing the logical groupings of the different vaults of the custodial account;
effecting, by the hardware security module, the action using a derived private key for the vault when the action is confirmed to be in accordance with the policy map for the vault;
regenerating, by the hardware security module, the private key for the one of the cryptoassets by applying the key derivation function to one or more of a unique identifier for the vault, an asset identifier for the one of the cryptoassets, or a cryptographic key associated with the custodial account;
digitally signing, by the hardware security module, at least a portion of the request using the private key for the one of the cryptoassets; and
sending resulting digital signature data to the at least one blockchain.
2. The method of claim 1 , wherein the vault control rules of the policy map for the vault specify, for the action, individual users of the cryptoasset custodial system and a threshold number of the individual users to approve the action, and checking the action against the policy map for the vault comprises:
validating endorsement messages from at least a subset of the specified individual users of the cryptoasset custodial system; and
confirming the action is in accordance with the vault control rules of the policy map when the endorsement messages have been validated for the threshold number of the specified individual users.
3. The method of claim 2 , wherein validating the endorsement messages comprises checking cryptographic digital signatures using public keys corresponding to the subset of the specified individual users.
4. The method of claim 2 , wherein the action comprises changing the policy map for the vault, and effecting the action comprises:
processing an updated version of the policy map using the asymmetric cryptographic key pair controlled by the hardware security module; and
sending or saving results of the processing for future use by the hardware security module.
5. The method of claim 4 , wherein processing the updated version of the policy map comprises digitally signing, in the hardware security module, the updated version of the policy map using the private key of the asymmetric cryptographic key pair.
6. The method of claim 1 , further comprising: deleting, by the hardware security module, the private key for the one of the cryptoassets from memory in the hardware security module.
7. A non-transitory computer-readable medium encoding a computer program that, when executed by at least one physical computing device of a hardware security module, further comprising at least one secure storage device, causes the at least one physical computing device of the hardware security module to perform operations comprising:
signing policy maps for respective different vaults in a cryptoasset custodial system using a private key of an asymmetric cryptographic key pair of a custodial account;
receiving a request to take an action with respect to a vault of the different vaults in the cryptoasset custodial system, wherein the different vaults are logical groupings of cryptoassets associated with the custodial account of the cryptoasset custodial system, each of the different vaults has an associated policy map that defines vault control rules governing which actions are allowed for the vault under one or more specified conditions;
determining a vault identifier of the vault based on the request;
authenticating a policy map for the vault on which the action is requested by validating a digital signature of the policy map using a public key of the asymmetric cryptographic key pair controlled by the hardware security module based on determining the vault identifier of the vault, wherein the at least one physical computing device is further configured to provide cryptographic processing to manage, for the custodial account, private keys of asymmetric cryptographic key pairs usable to control access to the cryptoassets in at least one blockchain;
checking the action against the policy map for the vault when the policy map for the vault is authenticated using the asymmetric cryptographic key pair controlled by the hardware security module;
deriving a private key for the vault of the custodial account by applying a key derivation function to the vault identifier of the vault of the custodial account, thereby enforcing the logical groupings of the different vaults of the custodial account;
effecting the action using a derived private key for the vault when the action is confirmed to be in accordance with the policy map for the vault;
regenerating the derived private key for the one of the cryptoassets by applying the key derivation function to one or more of a unique identifier for the vault, an asset identifier for the one of the cryptoassets, or a cryptographic key associated with the custodial account;
digitally signing at least a portion of the request using the derived private key for the one of the cryptoassets; and
sending resulting digital signature data to the at least one blockchain.
8. The non-transitory computer-readable medium of claim 7 , wherein the vault control rules of the policy map for the vault specify, for the action, individual users of the cryptoasset custodial system and a threshold number of the individual users to approve the action, and checking the action against the policy map for the vault comprises:
validating endorsement messages from at least a subset of the specified individual users of the cryptoasset custodial system; and
confirming the action is in accordance with the vault control rules of the policy map when the endorsement messages have been validated for the threshold number of the specified individual users.
9. The non-transitory computer-readable medium of claim 7 , wherein the operations further comprise:
deleting the derived private key for the one of the cryptoassets from memory in the hardware security module.