Apparatus and methods for remote controlled cold storage of digital assets using near field communication tags

1. A method of performing a transaction over a blockchain network, the method comprising:

receiving instructions for executing a blockchain transaction;

ensuring that the instructions are authorized;

on the basis of the received instruction, generating a command to collect signatures for the blockchain transaction;

transmitting the command using a secure air-gapped process to multiple Data Center Hardware Security Modules (DC HSMs), wherein each DC HSM contains a corresponding private key for signing the blockchain transaction;

validating an authenticity of the received command at each of the multiple DC HSMs;

securely signing the blockchain transaction inside each of the multiple DC HSMs using a signing technique and transferring signatures back using the secured air-gapped process;

building a multi-signed transaction from collected DC HSM signatures; and

transmitting the multi-signed transaction to a destination,

wherein the secure air-gapped process uses near field communication (NFC) interfaces and NFC Radio Frequency Identification (RFID) tags, and

wherein the NFC interfaces are physically shielded.

2. The method of claim 1 , wherein the destination comprises a blockchain network.

3. The method of claim 1 , wherein the NFC interfaces are physically shielded to resist side channel attacks.

4. The method of claim 2 , further comprising ensuring that at least M of N DC HSMs sign the blockchain transaction before transmitting the multi-signed transactions to the blockchain network, where N=a total number of DC HSMs, and M≤N, for integers N and M.

5. The method of claim 4 , wherein the signing technique comprises Elliptic Curve Digital Signature Algorithm (ECDSA), Edwards-Curve Digital Signature Algorithm (EdDSA), RSA, or any combination thereof.

6. A cold storage system for storing digital assets comprising:

a. an integration server, including a processor and a memory, coupled to an external network;

b. a central control center comprising a request handler and a command handling Hardware Security Module (HSM); and

c. multiple distributed data centers each comprising:

i. an associated Data Center (DC) HSM for managing cryptographic keys;

ii. a processor coupled to the associated DC HSM;

iii. a dedicated remote controlled server coupled to the integration server; and

iv. a physically shielded near field communication (NFC) adapter pair having a Radio Frequency Identification (RFID) tag forming an air-gapped communication channel between the remote controlled server and the processor coupled to the associated DC HSM.

7. The cold storage system of claim 6 , wherein each of the NFC adapter pairs comprises NFC devices and tags physically shielded to avoid side channel attacks, data skimming, or both.

8. The cold storage system of claim 7 , wherein each of the NFC adapter pairs comprises NFC devices having both read/write capabilities comprising NFC tags between the NFC devices.

9. The cold storage system of claim 6 , wherein the external network comprises the Internet or a virtual private network.

10. The cold storage system of claim 6 , wherein the request handler is configured to receive raw instructions to execute blockchain transactions from the integration server and to send the raw instructions to the command handling HSM over the air-gapped channel.

11. The cold storage system of claim 10 , wherein the raw instruction is authorized by the command handling HSM through a multiple factor authentication protocol.

12. The cold storage system of claim 6 , wherein each of the multiple processors of the distributed data centers is configured to send and receive commands only from its associated NFC adapter pair.

13. The cold storage system of claim 6 , wherein each of the multiple associated DC HSMs is configured to verify an authenticity of received commands using digital signatures and pre-installed certificates of the command handling HSM.

14. The cold storage system of claim 6 , wherein each of the associated DC HSMs is configured for determining whether an associated one or more command execution constraints are met.

15. The cold storage system of claim 14 , wherein the command execution constraints comprise velocity of requests, time bound expiry, or both.