KEY GENERATION IN TRUSTED EXECUTION ENVIRONMENTS
A key management system uses a trusted execution environment (TEE) to generate a private key for a user. The key management system is used to provide network users with a non-custodial wallet, or self-custody wallet, in a safe and secure manner. The key management system provides services to network users including creation of a user's digital wallet, processing of transactions conducted by the user's digital wallet, and recovery process steps to recover the user's digital wallet. Secure applications are provided by the key management system within the TEE. The TEE may be accessible via cloud services as a separate virtual machine being an isolated partition and/or execution environment. All services provided by the key management system are performed within the TEE to ensure data privacy and security. The TEE uses sharding algorithms on private keys generated by users and distributes shards of the private keys on the key management system.
1 . A method for generating a key within a trusted execution environment (TEE), the method comprising:
generating, within the TEE, a private key for a user in response to receiving a request to create a digital wallet from the user;
creating a first shard, a second shard, and a third shard based on the private key using a sharding algorithm;
encrypting the first shard; and
transmitting the second shard to a developer associated with the digital wallet.
2 . The method of claim 1 , further comprising:
creating a fourth shard and a fifth shard based on the third shard using the sharding algorithm;
encrypting the fourth shard; and
transmitting the fifth shard to the developer associated with the digital wallet.
3 . The method of claim 2 , further comprising:
digitally signing a transaction request within the TEE.
4 . The method of claim 3 , wherein digitally signing the transaction request further comprises:
receiving the transaction request;
decrypting the fourth shard;
forming the third shard using the sharding algorithm with the decrypted fourth shard and the fifth shard;
decrypting the first shard;
forming the private key in unencrypted form using the sharding algorithm with the decrypted first shard and the third shard; and
signing a payload of the transaction request using the unencrypted private key.
5 . The method of claim 1 , further comprising:
recovering the digital wallet within the TEE.
6 . The method of claim 5 , wherein recovering the digital wallet further comprises:
receiving a digital wallet recovery request;
decrypting the first shard; and
combining the decrypted first shard with the second shard using the sharding algorithm to create a raw private key.
7 . The method of claim 6 , wherein recovering the digital wallet further comprises:
creating a sixth shard, a seventh shard, and an eighth shard based on the raw private key using the sharding algorithm;
encrypting the sixth shard;
transmitting the seventh shard to the developer associated with the digital wallet;
creating a ninth shard and a tenth shard based on the eighth shard using the sharding algorithm;
encrypting the ninth shard; and
transmitting the tenth shard to the developer associated with the digital wallet.
8 . A device, comprising:
a memory; and
one or more processors comprising a trusted execution environment (TEE), wherein the one or more processors are configured to cause performance of operations, comprising:
generating, within the TEE, a private key for a user in response to receiving a request to create a digital wallet from the user;
creating a first shard, a second shard, and a third shard based on the private key using a sharding algorithm;
encrypting the first shard; and
transmitting the second shard to a developer associated with the digital wallet.
9 . The device of claim 8 , wherein the operations further comprise:
creating a fourth shard and a fifth shard based on the third shard using the sharding algorithm;
encrypting the fourth shard; and
transmitting the fifth shard to the developer associated with the digital wallet.
10 . The device of claim 9 , wherein the operations further comprise:
digitally signing a transaction request within the TEE.
11 . The device of claim 10 , wherein digitally signing the transaction request further comprises:
receiving the transaction request;
decrypting the fourth shard;
forming the third shard using the sharding algorithm with the decrypted fourth shard and the fifth shard;
decrypting the first shard;
forming the private key in unencrypted form using the sharding algorithm with the decrypted first shard and the third shard; and
signing a payload of the transaction request using the unencrypted private key.
12 . The device of claim 8 , wherein the operations further comprise:
recovering the digital wallet within the TEE.
13 . The device of claim 12 , wherein recovering the digital wallet further comprises:
receiving a digital wallet recovery request;
decrypting the first shard; and
combining the decrypted first shard with the second shard using the sharding algorithm to create a raw private key.
14 . The device of claim 13 , wherein recovering the digital wallet further comprises:
creating a sixth shard, a seventh shard, and an eighth shard based on the raw private key using the sharding algorithm;
encrypting the sixth shard;
transmitting the seventh shard to the developer associated with the digital wallet;
creating a ninth shard and a tenth shard based on the eighth shard using the sharding algorithm;
encrypting the ninth shard; and
transmitting the tenth shard to the developer associated with the digital wallet.
15 . A non-volatile computer-readable medium that stores instructions that, when executed, cause performance of operations, comprising:
generating, within a trusted execution environment (TEE) of a processor, a private key for a user in response to receiving a request to create a digital wallet from the user;
creating a first shard, a second shard, and a third shard based on the private key using a sharding algorithm;
encrypting the first shard; and
transmitting the second shard to a developer associated with the digital wallet.
16 . The non-volatile computer-readable medium of claim 15 , wherein the operations further comprise:
creating a fourth shard and a fifth shard based on the third shard using the sharding algorithm;
encrypting the fourth shard; and
transmitting the fifth shard to the developer associated with the digital wallet.
17 . The non-volatile computer-readable medium of claim 16 , wherein the operations further comprise:
digitally signing a transaction request within the TEE.
18 . The non-volatile computer-readable medium of claim 17 , wherein digitally signing the transaction request further comprises:
receiving the transaction request;
decrypting the fourth shard;
forming the third shard using the sharding algorithm with the decrypted fourth shard and the fifth shard;
decrypting the first shard;
forming the private key in unencrypted form using the sharding algorithm with the decrypted first shard and the third shard; and
signing a payload of the transaction request using the unencrypted private key.
19 . The non-volatile computer-readable medium of claim 15 , wherein the operations further comprise:
recovering the digital wallet within the TEE.
20 . The non-volatile computer-readable medium of claim 19 , wherein recovering the digital wallet further comprises:
receiving a digital wallet recovery request;
decrypting the first shard;
combining the decrypted first shard with the second shard using the sharding algorithm to create a raw private key;
creating a sixth shard, a seventh shard, and an eighth shard based on the raw private key using the sharding algorithm;
encrypting the sixth shard;
transmitting the seventh shard to the developer associated with the digital wallet;
creating a ninth shard and a tenth shard based on the eighth shard using the sharding algorithm;
encrypting the ninth shard; and
transmitting the tenth shard to the developer associated with the digital wallet.