Granted Patent B1

US 12,425,191 · App. 18/482,650 · Granted Sep 23, 2025

Inventors: James Pecoraro (New York, NY); Scott Ryan James (New York, NY); Jakub Guzikowski (Wroclaw, PL); Cezary Siewierski (Dublin, IE); Jason Niggel (New York, NY)

Assignee: THE BANK OF NEW YORK MELLON

H04L9/0822H04L9/0877H04L9/0891H04L9/14

Abstract

Claims (59)

1. A method for providing multiple key encryption, comprising:

generating, a private key encryption key (KEK) and a corresponding public KEK in a trusted execution environment (TEE);

providing the public KEK to a key generator;

generating, by the key generator, a data encryption key (DEK) and encrypting the DEK with the public KEK;

obtaining, by a key processor, an ephemeral public key and the encrypted DEK, and sending the ephemeral public key and the encrypted DEK to the TEE;

decrypting, by the TEE, the encrypted DEK using the private KEK, and re-encrypting the decrypted DEK with the ephemeral public key;

obtaining, by the key processor, the re-encrypted DEK from the TEE and passing the re-encrypted DEK to a signing service;

decrypting, by the signing service the re-encrypted DEK using a corresponding ephemeral private key; and

encrypting, by the signing service, data using the DEK.

2. The method of claim 1 , wherein the TEE, is a hardware security module (HSM).

3. The method of claim 1 , wherein the encrypted DEK is stored in a secret management system (SMS).

4. The method of claim 3 , wherein the ephemeral public key is obtained from the signing service, and the encrypted DEK is obtained from the SMS.

5. The method of claim 1 , wherein the signing service resides in a secure enclave.

6. The method of claim 1 , further comprising:

obtaining the encrypted data; and

decrypting the encrypted data using the DEK.

7. The method of claim 1 , further comprising:

sharding, by the key processor, the DEK, into multiple shards, and

distributing, the DEK shards to multiple actors.

8. The method of claim 7 , wherein the multiple actors comprise at least two actors, each having different credentials.

9. The method of claim 1 , wherein the data is a transaction request; and

wherein, the transaction request is broadcast to a blockchain network.

10. A system for providing multiple key encryption, comprising:

one or more processors; and

at least one memory storing one or more code sets in the at least one memory and executed by the one or more processors, which, when executed, configure the one or more processors to:

generate a private key encryption key (KEK) and a corresponding public KEK in a trusted execution environment (TEE);

provide the public KEK to a key generator;

generate, by the key generator, a data encryption key (DEK) and encrypt the DEK with the public KEK;

obtain, by a key processor, an ephemeral public key and the encrypted DEK, and send the ephemeral public key and the encrypted DEK to the TEE;

decrypt, by the TEE, the encrypted DEK using the private KEK, and re-encrypt the decrypted DEK with the ephemeral public key;

obtain, by the key processor, the re-encrypted DEK from the TEE and pass the re-encrypted DEK to a signing service;

decrypt, by the signing service the re-encrypted DEK using a corresponding ephemeral private key; and

encrypt, by the signing service, data using the DEK.

11. The system of claim 10 , wherein the TEE, is a hardware security module (HSM).

12. The system of claim 10 , wherein the encrypted DEK is stored in a secret management system (SMS).

13. The system of claim 12 , wherein the ephemeral public key is obtained from the signing service, and the encrypted DEK is obtained from the SMS.

14. The system of claim 10 , wherein the signing service resides in a secure enclave.

15. The system of claim 10 , further configured to:

obtain the encrypted data; and

decrypt the encrypted data using the DEK.

16. The system of claim 10 , further configured to:

shard, by the key processor, the DEK, into multiple shards, and

distribute, the DEK shards to multiple actors.

17. The system of claim 16 , wherein the multiple actors comprise at least two actors, each having different credentials.

18. The system of claim 10 , wherein the data is a transaction request; and

wherein, the transaction request is broadcast to a blockchain network.

19. A non-transitory computer-readable medium storing computer-program instructions that, when executed by one or more processors, cause the one or more processors to effectuate operations comprising:

generating, a private key encryption key (KEK) and a corresponding public KEK in a trusted execution environment (TEE);

providing the public KEK to a key generator;

generating, by the key generator, a data encryption key (DEK) and encrypting the DEK with the public KEK;

obtaining, by a key processor, an ephemeral public key and the encrypted DEK, and sending the ephemeral public key and the encrypted DEK to the TEE;

decrypting, by the TEE, the encrypted DEK using the private KEK, and re-encrypting the decrypted DEK with the ephemeral public key;

obtaining, by the key processor, the re-encrypted DEK from the TEE and passing the re-encrypted DEK to a signing service;

decrypting, by the signing service the re-encrypted DEK using a corresponding ephemeral private key; and

encrypting, by the signing service, data using the DEK.

20. The non-transitory computer-readable medium of claim 19 , further comprising:

sharding, by the key processor, the DEK, into multiple shards, and

distributing, the DEK shards to multiple actors;

wherein the multiple actors comprise at least two actors, each having different credentials.

Assignments (1)

References Cited (27)

Cited By (1)

US 12,609,927