ZERO-TRUST SOFTWARE-BASED SECURITY MODEL

1 . A processor-implemented method of attestation, the processor-implemented method comprising:

generating, in a software enclave on a native application or browser and from a host device, a key generation request to a secure key client to generate a key pair;

performing a multi-party key generation operation between the secure key client on the native application or browser and a secure key server; and

storing a first private key share and public key on the secure key client, wherein a second private key share and a public key are stored on the secure key server and wherein the public key is sent from the secure key server to a host server for storage.

2 . The method of claim 1 , wherein the software enclave utilizes a trusted execution environment (TEE) or a Web Crypto API (WCA) for generating the key pair.

3 . The method of claim 1 , further comprising using a device-binding key to sign every message throughout the protocol, the device-binding key binding all interactions to the current device.

4 . The method of claim 1 , wherein the multi-party key generation operation uses threshold cryptography, such as ECDSA or RSA.

5 . The method of claim 1 , further comprising associating the key shares with a unique identifying set including a DeviceID, UserID, ApplicationID, and EnvironmentID.

6 . The method of claim 1 , wherein the secure key server transmits the public key to a host server for storage and verification.

7 . The method of claim 1 , further comprising performing a key refresh procedure to update the MPC Key Share after each use, ensuring the Key Share becomes outdated if an adversary clones the device without gaining persistent access.

8 . The method of claim 1 , further comprising using the stored public key on the host server to verify signatures generated by the secure key client and secure key server.

9 . The method of claim 1 , further comprising transmitting a challenge request from the host device to the host server, receiving a challenge, and using multi-party computation to generate a signed challenge for verification with the stored public key.

10 . The method of claim 1 , comprising:

receiving, at the host device, a challenge from the host server;

transmitting the challenge from the host device to the secure key client in the software enclave;

transmitting the challenge from the secure key client in the software enclave to the secure key server;

performing a multi-party key generation operation between the secure key client on the native application or browser and the secure key server to generate a signed challenge; and

transmitting the signed challenge to the host server to verify a signature with a stored public key on the host server.

11 . A processor-implemented method of assertion, the processor-implemented method comprising:

transmitting, from a software enclave on a native application or browser and from a host device, a challenge request to a host server;

receiving, at the host device, a challenge from the host server;

transmitting the challenge from the host device to a secure key client in the software enclave;

transmitting the challenge from the secure key client in the software enclave to a secure key server;

performing a multi-party key generation operation between the secure key client on the native application or browser and the secure key server to generate a signed challenge;

transmitting the signed challenge to the host server to verify a signature with a stored public key on the host server.

12 . The method of claim 11 , wherein the software enclave utilizes a trusted execution environment (TEE) or a Web Crypto API (WCA) for generating the key pair.

13 . The method of claim 11 , further comprising using a device-binding key to sign every message throughout the protocol, the device-binding key binding all interactions to the current device.

14 . The method of claim 11 , wherein the multi-party key generation operation uses threshold cryptography, such as ECDSA or RSA.

15 . The method of claim 11 , further comprising associating the key shares with a unique identifying set including a DeviceID, UserID, ApplicationID, and EnvironmentID.

16 . The method of claim 11 , wherein the secure key server transmits the public key to a host server for storage and verification.

17 . The method of claim 11 , further comprising performing a key refresh procedure to update the MPC Key Share after each use, ensuring the Key Share becomes outdated if an adversary clones the device without gaining persistent access.

18 . A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processors to be configured to:

transmit, from a software enclave on a native application or browser and from a host device, a challenge request to a host server;

receive, at the host device, a challenge from the host server;

transmit the challenge from the host device to a secure key client in the software enclave;

transmit the challenge from the secure key client in the software enclave to a secure key server;

perform a multi-party key generation operation between the secure key client on the native application or browser and the secure key server to generate a signed challenge;

transmit the signed challenge to the host server to verify a signature with a stored public key on the host server.

19 . An apparatus for performing an assertion, the apparatus including one or more:

means for transmitting, from a software enclave on a native application or browser and from a host device, a challenge request to a host server;

means for receiving, at the host device, a challenge from the host server;

means for transmit the challenge from the host device to a secure key client in the software enclave;

means for transmitting the challenge from the secure key client in the software enclave to a secure key server;

means for performing a multi-party key generation operation between the secure key client on the native application or browser and the secure key server to generate a signed challenge;

means for transmitting the signed challenge to the host server to verify a signature with a stored public key on the host server.

20 . The apparatus of claim 19 , comprising a means for checking the assertion using internet connectivity rather than cell phone telephony by calling a service without user action to avoid phishing.