Secure dynamic threshold signature scheme employing trusted hardware

1. A computer-implemented security method comprising the step of:

generating an elliptic curve digital signature algorithm signature comprising a first signature component, r, and a second signature component, w, the generation step comprising:

forming, by a node, a signing group with other nodes;

obtaining, by the node, based on a secure random number: a) a multiplicative inverse of the secure random number; and b) the first signature component, r, wherein the first signature component is determined based on the secure random number and an elliptic curve generator point;

determining, by the node, a partial signature based on a private secret share, the multiplicative inverse of the secure random number and the first signature component, wherein the partial signature is determined within an enclave associated with a trusted execution environment of the node;

receiving, by the node, partial signatures from other nodes of the signing group; and

generating, by the node, the second signature component, w, based on determined and received partial signatures.

2. The computer-implemented method of claim 1 , wherein obtaining comprises generating the multiplicative inverse and the first signature component and wherein the computer-implemented method further comprises sending the multiplicative inverse to the other nodes.

3. The computer-implemented method of claim 2 , wherein obtaining comprises provisioning an enclave associated with a trusted execution environment of the node to generate the secure random number.

4. A computer-implemented method according to claim 1 , wherein obtaining comprises receiving the multiplicative inverse and the first signature component from one of the other nodes.

5. A computer-implemented method according to claim 1 , further comprising, prior to forming the signing group, signalling an intention to participate in distributed signature generation.

6. A computer-implemented method according to claim 1 , wherein the partial signature is determined by performing Lagrangian interpolation.

7. A computer-implemented method according to claim 1 , wherein the second signature component is generated within an enclave associated with a trusted execution environment and wherein the method further includes, after generating the second signature component, sending the elliptic curve digital signature algorithm from the enclave to a host portion of the node.

8. A computer-implemented method according to claim 1 , further comprising adding the signature to a transaction and broadcasting the transaction to a blockchain network.

9. A computer-implemented method according to claim 1 , further comprising, prior to forming the signing group, obtaining the secret share by based on secret share data received from a plurality of existing members of the signing group.

10. The computer-implemented method of claim 9 , wherein the secret share is determined within an enclave associated with a trusted execution environment of the node.

11. A computer-implemented method according to claim 1 , wherein the partial signature, v i , is determined as:

v i =k −1 rb i s i mod p,

where b i is a Lagrangian interpolation coefficient, k −1 is the multiplicative inverse of the secure random number, s i is the secret share, r is the first signature component, and p is an order.

12. A non-transitory computer readable storage medium configured to store computer-executable instructions on a node which configure a processor to:

form a signing group with other nodes;

obtain, based on a secure random number: a) a multiplicative inverse of the secure random number; and b) a first signature component, r, wherein the first signature component is determined based on the secure random number and an elliptic curve generator point;

determine a partial signature based on a private secret share, the multiplicative inverse of the secure random number and the first signature component, wherein the partial signature is determined within an enclave associated with a trusted execution environment of the node;

receive partial signatures from the other nodes of the signing group; and

generate the second signature component, w, based on determined and received partial signatures; and

generate an elliptic curve digital signature algorithm signature comprising the first signature component, r, and the second signature component, w.

13. A system comprising:

an interface device of an electronic device;

a processor coupled to the interface device; and

a memory coupled to the processor, the memory having stored thereon computer executable instructions which cause the processor to:

form a signing group with other electronic devices;

obtain based on a secure random number: a) a multiplicative inverse of the secure random number; and b) a first signature component, r, wherein the first signature component is determined based on the secure random number and an elliptic curve generator point;

determine a partial signature based on a private secret share, the multiplicative inverse of the secure random number and the first signature component, wherein the partial signature is determined within an enclave associated with a trusted execution environment of the electronic device;

receive partial signatures from the signing group;

generate the second signature component, w, based on determined and received partial signatures; and

generate an elliptic curve digital signature algorithm signature comprising the first signature component, r, and the second signature component, w.

14. The system of claim 13 , wherein the processor includes the trusted execution environment and wherein the computer executable instructions are executed within the trusted execution environment.