Non-custodial tool for building decentralized computer applications
A mechanism for building decentralized computer applications that execute on a distributed computing system. The present technology works within a web browser, client application, or other software and provides access to decentralized computer applications through the browser. The present technology is non-custodial, wherein a public-private key pair, which represents user identity, is created on a client machine and then directly encrypted by a third-party platform without relying on one centralized computing system.
1. A system for setting up a wallet for a decentralized application by performing non-custodial authentication for a client, the system comprising:
processing circuitry; and
a memory operably coupled to the processing circuitry, having embodied thereon a program, the program being readable by processing circuitry and, when executed, causes the processing circuitry to:
receive over a network, a request for an access token for a user, at a first computing environment, from a second computing environment that authenticated the user;
send over the network, the access token for the user, from the first computing environment, to the second computing environment;
receive over the network, the access token, at the first computing environment, bypassing the second computing environment, from a third computing environment;
receive over the network, key information that is generated within a fourth computing environment at the third computing environment, the fourth computing environment is inaccessible to the decentralized application at the third computing environment, at the first computing environment, bypassing the second computing environment, from the third computing environment; and
send the key information from the first computing environment to a security resource to cause the security resource to encrypt the key information to generate encrypted key information.
2. The system of claim 1 , wherein the program, when executed, further causes the processing circuitry to:
send the key information from the first computing environment to the security resource to cause the security resource to encrypt the key information with a master key that is unexportable out of the security resource, to generate the encrypted key information.
3. The system of claim 1 , wherein the program, when executed, further causes the processing circuitry to:
send over the network, the encrypted key information, from the first computing environment, bypassing the second computing environment, to the third computing environment.
4. The system of claim 1 , wherein the program, when executed, further causes the processing circuitry to:
receive over the network, a credential that includes authentication information associated with the security resource, at the first computing environment, bypassing the second computing environment, from the third computing environment;
send the key information, from the first computing environment to the security resource, based at least on the first computing environment receiving over the network, the credential and the key information, from the third computing environment; and
receive the encrypted key information, by the first computing environment, from the security resource.
5. The system of claim 1 , wherein the fourth computing environment includes an iframe, and wherein the program, when executed, further causes the processing circuitry to:
link a user identity with the security resource, by the first computing environment, based at least on a new user request for the access token request.
6. The system of claim 1 , wherein the program, when executed, further causes the processing circuitry to:
send over the network, a credential that includes authentication information, from the first computing environment, bypassing the second computing environment, to the third computing environment, based at least on receiving over the network, the access token, at the first computing environment, from the third computing environment.
7. The system of claim 1 , wherein the program, when executed, further causes the processing circuitry to:
send over the network from the first computing environment to the third computing environment, a direction to access a site on the network at which to obtain a credential that includes authentication information, based at least on receiving over the network, the access token, at the first computing environment, from the third computing environment.
8. A non-transitory computer readable storage medium having embodied thereon a program, the program being readable by at least one processor and, when executed, causes the at least one processor to:
receive over a network, a new user request for an access token to setup a wallet for a decentralized application, from an authentication system that authenticates a new user;
send over the network, the access token that corresponds to the new user to the authentication system;
receive over the network, the access token, bypassing the authentication system, from a client device;
receive over the network, at least a portion of a private key, at a first computing environment, bypassing the authentication system, from an iframe that is used, at the client device, to generate the at least portion of the private key inaccessible to the decentralized application; and
send the at least portion of the private key to a remote security service to cause the remote security service to encrypt the at least portion of the private key to generate an encrypted version of the at least portion of the private key.
9. The non-transitory computer readable storage medium of claim 8 , wherein the program, when executed, further causes the at least one processor to:
send the at least portion of the private key to the remote security service to cause the remote security service to encrypt the at least portion of the private key with a master key that cannot be exported out by the remote security service, to generate the encrypted version of the at least portion of the private key.
10. The non-transitory computer readable storage medium of claim 8 , wherein the program, when executed, further causes the at least one processor to:
generate a master key by the first computing environment,
wherein the encrypted version of the at least portion of the private key includes the at least portion of the private key encrypted using the master key.
11. The non-transitory computer readable storage medium of claim 8 , wherein the program, when executed, further causes the at least one processor to:
link a user identity with the remote security service, by the first computing environment, based at least on the new user request for the access token.
12. The non-transitory computer readable storage medium of claim 8 , wherein the program, when executed, further causes the at least on processor to:
generate a master key by the first computing environment; and
provide the at least portion of the private key, by the first computing environment, to the remote security service to use the master key to encrypt the at least portion of the private key.
13. The non-transitory computer readable storage medium of claim 8 , wherein the program, when executed, further causes the at least one processor to:
provide the at least portion of the private key to the remote security service to use a master key to encrypt the at least portion of the private key; and
receive the encrypted at least portion of the private key from the remote security service.
14. The non-transitory computer readable storage medium of claim 8 , wherein the program, when executed, further causes the at least one processor to:
send over the network, to the client device, bypassing the authentication system, from the first computing environment, a credential that includes authentication information, based at least on receiving over the network, the access token, at the first computing environment, from the client device.
15. The non-transitory computer readable storage medium of claim 8 , wherein the program, when executed, further causes the at least one processor to:
send over the network, to the client device, from the first computing environment, a direction to access a site on the network at which to obtain a credential that includes authentication information, based at least on receiving over the network, the access token, at the first computing environment, from the client device.
16. A system for signing transaction data for a transaction in a decentralized application, the system comprising:
processing circuitry; and
a memory operably coupled to the processing circuitry, having embodied thereon a program, the program being readable by processing circuitry and when executed causes the processing circuitry to:
receive over a network, an access token that corresponds to a user, at a first computing environment, bypassing a second computing environment that authenticated the user, from a third computing environment;
based at least on the first computing environment receiving the access token, after receiving the access token, cause by the first computing environment, a security resource to decrypt encrypted key information with a master key that cannot be exported by the security resource, to generate decrypted key information; and
send over the network, the decrypted key information, from the first computing environment, bypassing the second computing environment, to a fourth computing environment at the third computing environment, the decrypted key information at the fourth computing environment inaccessible to the decentralized application at the third computing environment.
17. The system of claim 16 , wherein the program, when executed, further causes the processing circuitry to:
send over the network, the access token that corresponds to the user, from the first computing environment, to the second computing environment.
18. The system of claim 16 , wherein the program, when executed, further causes the processing circuitry to:
send over the network, a credential that includes authentication information for the user, from the first computing environment, bypassing the second computing environment, to the third computing environment, based at least on receiving over the network, the access token, at the first computing environment, from the third computing environment; and
receive over the network the credential that includes the authentication information for the user, at the security resource, bypassing the second computing environment, from the third computing environment.
19. The system of claim 16 , wherein the program, when executed, further causes the processing circuitry to:
send over the network from the first computing environment to the third computing environment, a direction to access a site on the network at which to obtain a credential that includes authentication information for the user, based at least on receiving over the network, the access token, at the first computing environment, from the third computing environment; and
receive over the network, the credential, at the security resource, bypassing the second computing environment, from the third computing environment.
20. The system of claim 16 , wherein the program, when executed, further causes the processing circuitry to:
receive over the network, a credential that includes authentication information for the user, at the security resource, bypassing the second computing environment, from the third computing environment; and
send over the network, the credential, from the first computing environment, bypassing the second computing environment, to the third computing environment, based at least on receiving over the network, the access token, at the first computing environment, from the third computing environment,
wherein the access token is a time bound access token,
wherein the credential is a scoped credential,
wherein the security resource includes a hardware security module, and
wherein sending the decrypted key information to the fourth computing environment includes sending the decrypted key information to an iframe at the third computing environment.