Systems and methods for key sharing for cryptocurrency transactions
A system for managing and using digital financial assets, such as cryptocurrency uses multiple independent devices that mutually cooperate to control cryptocurrency assets in a secure manner. Each of these devices may store a unique private key associated with the cryptocurrency assets, which may be configured such that a certain minimum number of these private keys are required to transfer the cryptocurrency assets. The use of multiple private keys spread across multiple distinct devices may reduce the likelihood of loss stemming from a hardware failure or reduce the likelihood of an attacker successfully gaining access to the cryptocurrency assets. In addition, selection of the devices to be used for storing these private keys, as well as how many private keys are required to authorize a transaction, may be tailored to balance a user's preferences for reliability of access versus security and for third-party custody versus self-custody.
1 . A cryptocurrency management system providing distributed authority over a cryptocurrency address to improve security for authentication, comprising:
a cryptocurrency management device (CMD) under custody of a user, the CMD configured to generate a first authenticating signature for use in authenticating transactions involving a cryptocurrency address of a cryptocurrency network, wherein the first authenticating signature is generated using a stored first authenticating key share from a pool of authenticating key shares associated with the cryptocurrency address;
a cryptocurrency management server (CMS) under custody of a third-party, the CMS configured to generate a second authenticating signature for use in authenticating transactions involving the cryptocurrency address, wherein the second authenticating signature is generated using a stored second authenticating key share from the pool of authenticating key shares associated with the cryptocurrency address, and wherein the CMS monitors an amount of time that has elapsed since a most recent transaction to prevent loss of access to the cryptocurrency address; and
a mobile communication device (MCD) operated by the user via a display device configured to communicate information to the user and receive input from the user, the MCD configured to generate a third authenticating signature for use in authenticating transactions involving the cryptocurrency address, wherein:
the third authenticating signature is generated using a stored third authenticating key share from the pool of authenticating key shares associated with the cryptocurrency address; and
the MCD has at least one processor configured to:
receive a request via the display device to initiate a transaction;
automatically initiate the transaction, the transaction involving one or more cryptocurrency tokens associated with the cryptocurrency address;
automatically communicate with the CMD via a short-range communication protocol to obtain the first authenticating signature, wherein the CMD authenticates a first communication from the MCD associated with the transaction with a first round of authentication, wherein the first round of authentication includes a first confirmation of an identity of the MCD using a first key pair;
automatically communicate with the CMS via a network to obtain the second authenticating signature, wherein the CMS authenticates a second communication from the MCD associated with the transaction with a second round of authentication, wherein the second round of authentication includes a second confirmation of the identity of the MCD using a second key pair;
receive a communication from the CMS that includes a minimum-threshold number of authenticating signatures sufficient to form a quorum that maintains access to the cryptocurrency address and maintains security of the cryptocurrency address, wherein the CMS determines the minimum-threshold number of authenticating signatures to form the quorum based on a duration of time since the request to initiate the transaction occurred;
obtain at least the minimum-threshold number of authenticating signatures sufficient to form the quorum of authenticating signatures by communicating with at least one of the CMD or the CMS, wherein the quorum of authenticating signatures includes the third authenticating signature and either the first authenticating signature or the second authenticating signature;
automatically authenticate the transaction based on the quorum of authenticating signatures to generate an authenticated transaction;
submit the authenticated transaction to the cryptocurrency network; and
display a notification via the display device indicating that the authenticated transaction is complete.
2 . The cryptocurrency management system of claim 1 , wherein: the minimum-threshold number of authenticating signatures sufficient to form the quorum of authenticating signatures is set to decrease after a predetermined amount of time from a most recent transaction involving one or more cryptocurrency tokens associated with the cryptocurrency address;
the CMS is further configured to:
based on the monitored amount of time elapsed since the most recent transaction, initiate a new financial transaction involving the one or more cryptocurrency tokens associated with the cryptocurrency address, thereby delaying a decrease in the minimum-threshold number of authenticating signatures sufficient to form the quorum.
3 . The cryptocurrency management system of claim 1 , wherein:
the pool of authenticating key shares further comprises a fourth authenticating key share that is inactive and usable to generate a fourth authenticating signature, wherein:
the fourth authenticating signature, when inactive, does not contribute to obtaining the minimum-threshold number of authenticating signatures; and
the fourth authenticating key share is set to activate after a predetermined amount of time from a most recent transaction involving one or more cryptocurrency tokens associated with the cryptocurrency address; and
the CMS is further configured to:
based on the monitored amount of time elapsed since the most recent transaction, initiate a new financial transaction involving the one or more cryptocurrency tokens associated with the cryptocurrency address, thereby delaying activation of the fourth authenticating key share.
4 . The cryptocurrency management system of claim 1 , wherein to obtain the second authenticating signature the at least one processor is configured to:
transmit a signature request comprising authenticating information and transaction information to the CMS, wherein the transmitted authenticating information is sufficient to authenticate the MCD to the CMS and the transaction information comprises information detailing the initiated transaction; and
receive a signature reply comprising the first authenticating signature, wherein the signature reply was generated by the CMS using the transaction information and the CMS required the initiated transaction to conform to a transaction policy associated with the cryptocurrency address before the CMS generated the second authenticating signature.
5 . The cryptocurrency management system of claim 1 , wherein to obtain the first authenticating signature the at least one processor is configured to:
transmit a signature request comprising authenticating information and transaction information to the CMD, wherein the transmitted authenticating information is sufficient to authenticate the MCD to the CMD and the transaction information comprises information detailing the initiated transaction; and
receive a signature reply comprising the first authenticating signature, wherein the signature reply was generated by the CMD using the transaction information and the CMD required a user to provide biometric information directly to the CMD before the CMD generated the first authenticating signature.
6 . The cryptocurrency management system of claim 5 , wherein the at least one processor is configured to transmit the signature request to the CMD via a short-range peer-to-peer communication channel.
7 . A method for managing cryptocurrency to provide distributed authority over a cryptocurrency address to improve security for authentication, comprising:
storing, in a mobile communication device (MCD) operated by a user via a display device configured to communicate information to the user and receive input from the user, a first authenticating key share from a pool of authenticating key shares associated with a cryptocurrency address of a cryptocurrency network;
receive, at the MCD via the display device, a request to initiate a transaction;
automatically initiating, by the MCD, the transaction, the transaction involving one or more cryptocurrency tokens associated with the cryptocurrency address;
obtaining, by the MCD, at least a minimum-threshold number of authenticating signatures sufficient to form a quorum of authenticating signatures by automatically communicating with at least one of a cryptocurrency management device (CMD) under custody of the user or a cryptocurrency management server (CMS) under custody of a third-party, wherein:
the quorum of authenticating signatures includes a first authenticating signature and either a second authenticating signature or a third authenticating signature;
the first authenticating signature is generated using the first authenticating key share;
the second authenticating signature is obtained from the CMD by communication via a short-range communication protocol and the second authenticating signature is generated by the CMD using a second authenticating key share from the pool of authenticating key shares, wherein the second authenticating key share is stored on the CMD, wherein the CMD authenticates a first communication from the MCD associated with the transaction with a first round of authentication, wherein the first round of authentication includes a first confirmation of an identity of the MCD using a first key pair; and
the third authenticating signature is obtained from the CMS by communication via a network and the third authenticating signature is generated by the CMS using a third authenticating key share from the pool of authenticating key shares, wherein the third authenticating key share is stored on the CMS, wherein the CMS authenticates a second communication from the MCD associated with the transaction with a second round of authentication, wherein the second round of authentication includes a second confirmation of the identity of the MCD using a second key pair, and wherein the CMS monitors an amount of time that has elapsed since a most recent transaction to prevent loss of access to the cryptocurrency address;
receiving a communication from the CMS that includes the minimum-threshold number of authenticating signatures sufficient to form the quorum that maintains access to the cryptocurrency address and maintains security of the cryptocurrency address, wherein the CMS determines the minimum-threshold number of authenticating signatures to form the quorum based on a duration of time since the request to initiate the transaction occurred;
automatically authenticating, by the MCD, the transaction based on the quorum of authenticating signatures to generate an authenticated transaction;
submitting, by the MCD, the authenticated transaction to the cryptocurrency network; and
displaying a notification via the display device indicating that the authenticated transaction is complete.
8 . The method of claim 7 , wherein, based on the monitored amount of time elapsed since the most recent transaction:
the minimum-threshold number of authenticating signatures sufficient to form the quorum of authenticating signatures is set to decrease after a predetermined amount of time from the most recent transaction involving one or more cryptocurrency tokens associated with the cryptocurrency address; and
the method further comprises transmitting the first authenticating signature to the CMS, wherein the first authenticating signature is transmitted in response to a request from the CMS for an authorizing signature for a new financial transaction.
9 . The method of claim 7 , wherein, based on the monitored amount of time elapsed since the most recent transaction:
the pool of authenticating key shares further comprises a fourth authenticating key share that is inactive and usable to generate a fourth authenticating signature, wherein:
the fourth authenticating signature, when inactive, does not contribute to obtaining the minimum-threshold number of authenticating signatures; and
the fourth authenticating key share is set to activate after a predetermined amount of time from the most recent transaction involving one or more cryptocurrency tokens associated with the cryptocurrency address; and
the method further comprises transmitting the first authenticating signature to the CMS, wherein the first authenticating signature is transmitted in response to a request from the CMS for an authorizing signature for a new financial transaction.
10 . The method of claim 7 , wherein the obtaining comprises:
transmitting a signature request comprising authenticating information and transaction information from the MCD to the CMS, wherein the transmitted authenticating information is sufficient to authenticate the MCD to the CMS and the transaction information comprises information detailing the initiated transaction; and
receiving, at the MCD from the CMS, a signature reply comprising the third authenticating signature, wherein the signature reply was generated by the CMS using the transaction information and the CMS required the initiated transaction to conform to a transaction policy associated with the cryptocurrency address before the CMS generated the third authenticating signature.
11 . The method of claim 10 , wherein the transaction policy required the initiated transaction to be less than a certain amount of value.
12 . The method of claim 7 , wherein the obtaining comprises:
transmitting a signature request comprising authenticating information and transaction information from the MCD to the CMD, wherein the transmitted authenticating information is sufficient to authenticate the MCD to the CMD and the transaction information comprises information detailing the initiated transaction; and
receiving, at the MCD from the CMD, a signature reply comprising the second authenticating signature, wherein the signature reply was generated by the CMD using the transaction information and the CMD required a user to provide biometric information directly to the CMD before the CMD generated the second authenticating signature.
13 . The method of claim 12 , wherein the transmitting the signature request to the CMD is via a short-range peer-to-peer communication channel.
14 . A mobile communication device (MCD) operated by a user, comprising:
memory configured to store a first authenticating key share from a pool of authenticating key shares associated with a cryptocurrency address of a cryptocurrency network;
a display device configured to communicate information to the user and receive input from the user;
a communication interface configured to communicate with a cryptocurrency management device (CMD) under custody of the user, a cryptocurrency management server (CMS) under custody of a third-party, and the cryptocurrency network; and
at least one processor configured to:
receive a request via the display device to initiate a transaction;
automatically initiate the transaction, the transaction involving one or more cryptocurrency tokens associated with the cryptocurrency address;
obtain at least a minimum-threshold number of authenticating signatures sufficient to form a quorum of authenticating signatures by automatically communicating with at least one of the CMD or the CMS via the communication interface, wherein:
the quorum of authenticating signatures includes a first authenticating signature and either a second authenticating signature or a third authenticating signature;
the first authenticating signature is generated using the first authenticating key share;
the second authenticating signature is obtained from the CMD by communication via a short-range communication protocol and the second authenticating signature is generated by the CMD using a second authenticating key share from the pool of authenticating key shares, wherein the second authenticating key share is stored on the CMD, wherein the CMD authenticates a first communication from the MCD associated with the transaction with a first round of authentication, wherein the first round of authentication includes a first confirmation of an identity of the MCD using a first key pair; and
the third authenticating signature is obtained from the CMS by communication via a network and the third authenticating signature is generated by the CMS using a third authenticating key share from the pool of authenticating key shares, wherein the third authenticating key share is stored on the CMS, wherein the CMD, the CMS and the MCD are configured to provide distributed authority over the cryptocurrency address, wherein the CMS authenticates a second communication from the MCD associated with the transaction with a second round of authentication, wherein the second round of authentication includes a second confirmation of the identity of the MCD using a second key pair, and wherein the CMS monitors an amount of time that has elapsed since a most recent transaction to prevent loss of access to the cryptocurrency address;
receiving a communication from the CMS that includes the minimum-threshold number of authenticating signatures sufficient to form the quorum that maintains access to the cryptocurrency address and maintains security of the cryptocurrency address, wherein the CMS determines the minimum-threshold number of authenticating signatures to form the quorum based on a duration of time since the request to initiate the transaction occurred;
automatically authenticate the transaction based on the quorum of authenticating signatures to generate an authenticated transaction;
submit, via the communication interface, the authenticated transaction to the cryptocurrency network; and
display a notification via the display device indicating that the authenticated transaction is complete.
15 . The mobile communication device of claim 14 , wherein, based on a monitored amount of time elapsed since the most recent transaction:
the minimum-threshold number of authenticating signatures sufficient to form the quorum of authenticating signatures is set to decrease after a predetermined amount of time from a most recent transaction involving one or more cryptocurrency tokens associated with the cryptocurrency address; and
the at least one processor is further configured to transmit the first authenticating signature to the CMS, wherein the first authenticating signature is transmitted in response to a request from the CMS for an authorizing signature for a new financial transaction.
16 . The mobile communication device of claim 14 , wherein, based on a monitored amount of time elapsed since the most recent transaction:
the pool of authenticating key shares further comprises a fourth authenticating key share that is inactive and usable to generate a fourth authenticating signature, wherein:
the fourth authenticating signature, when inactive, does not contribute to obtaining the minimum-threshold number of authenticating signatures; and
the fourth authenticating key share is set to activate after a predetermined amount of time from a most recent transaction involving one or more cryptocurrency tokens associated with the cryptocurrency address; and
the at least one processor is further configured to transmit the first authenticating signature to the CMS, wherein the first authenticating signature is transmitted in response to a request from the CMS for an authorizing signature for a new financial transaction.
17 . The mobile communication device of claim 14 , wherein to obtain the second authenticating signature the at least one processor is configured to:
transmit a signature request comprising authenticating information and transaction information to the CMD, wherein the transmitted authenticating information is sufficient to authenticate the MCD to the CMD and the transaction information comprises information detailing the initiated transaction; and
receive a signature reply comprising the second authenticating signature, wherein the signature reply was generated by the CMD using the transaction information and the CMD required a user to provide biometric information directly to the CMD before the CMD generated the second authenticating signature.
18 . The mobile communication device of claim 17 , wherein the at least one processor is configured to transmit the signature request to the CMD via a short-range peer-to-peer communication channel.
19 . The mobile communication device of claim 14 , wherein to obtain the third authenticating signature the at least one processor is configured to:
transmit a signature request comprising authenticating information and transaction information to the CMS, wherein the transmitted authenticating information is sufficient to authenticate the MCD to the CMS the transaction information comprises information detailing the initiated transaction; and
receive a signature reply comprising the third authenticating signature, wherein the signature reply was generated by the CMS using the transaction information and the CMS required the initiated transaction to conform to a transaction policy associated with the cryptocurrency address before the CMS generated the third authenticating signature.
20 . The mobile communication device of claim 19 , wherein the transaction policy required the initiated transaction to be less than a certain amount of value.