Secret splitting and metadata storage

Abstract

To provide a computing device and a method for secret splitting and metadata storage.SOLUTION: A method causes a processor of a computing device to determine a secret to be protected and dividing the secret into a number of secret shares. At least a subset of the number of secret shares is required to reconstruct the secret. The processor of the computing device also transfers each secret share to a respective portable storage device or a medium for distribution to a respective shareholder, generates metadata using at least a hash of each secret share, and stores the metadata using the secret share separately from the portable storage device or medium.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application claims the benefit of U.S. Provisional Patent Application No. 62 / 981,663, entitled "SECRET SPLITTING AND METADATA STORAGE," filed on February 26, 2020 (Attorney Docket No. 270.034 USPR), the entire contents of which are incorporated herein by reference. [Background technology]

[0002]

[0002] Cryptography can be used to securely store and transmit data. Keys can be used to encrypt and decrypt data, or to sign transactions. Summary of the Invention [Means for solving the problem]

[0003]

[0003] The computing device includes at least one processor and at least one memory communicatively coupled to the at least one processor. The at least one processor is configured to determine a secret to be protected. The at least one processor is also configured to divide the secret into a plurality of secret shares, where at least a subset of the secret shares are required to reconstruct the secret. The at least one processor is also configured to transfer each secret share to a respective portable storage device or medium for distribution to a respective shareholder. The at least one processor is also configured to generate metadata with at least a hash of each secret share, where the metadata is stored separately from the portable storage device or medium with the secret share.

[0004]

[0004] The computing device includes at least one processor and at least one memory communicatively coupled to the at least one processor. The at least one processor is configured to determine a secret share retrieved from each of at least two secret share storage devices or media retrieved from a shareholder. The at least one processor is also configured to determine metadata having a list of at least hashes of a plurality of secret shares generated before the secret shares were distributed to the plurality of shareholder. The at least one processor is also configured to attempt to reconstruct a secret using the secret shares retrieved from the at least two secret share storage devices or media. The at least one processor is also configured to identify at least one of the retrieved secret shares as incorrect based on the metadata if the secret cannot be reconstructed from the retrieved secret share.

[0005]

[0005] Exemplary embodiments will be described with more specificity and detail using the accompanying drawings, with the understanding that the drawings illustrate only exemplary embodiments and therefore should not be considered limiting of the scope. [Brief description of the drawings]

[0006] [Figure 1]

[0006] FIG. 1 is a block diagram illustrating an example system for secret splitting and metadata storage. [Diagram 2]

[0007] FIG. 2 is a block diagram illustrating an example computing device used in the system for secret splitting and metadata storage. [Diagram 3]

[0008] FIG. 2 is a block diagram illustrating an example secret generator. [Figure 4]

[0009] FIG. 1 is a block diagram illustrating an example system for secret splitting and metadata storage. [Diagram 5]

[0010] FIG. 1 is a flow diagram illustrating an example method for splitting secrets and storing metadata. [Figure 6]

[0011] FIG. 1 is a flow diagram illustrating an example method for reconstructing a secret from at least two of a plurality of secret shares. [Figure 7]

[0012] FIG. 1 illustrates an example of a computer system in which some embodiments of the present disclosure may be utilized. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0007]

[0013] According to common practice, the various features illustrated are not drawn to scale but are drawn to emphasize particular features relevant to the exemplary embodiments.

[0014] In the following detailed description, reference is made to the accompanying drawings, which form a part hereof, and which show, by way of example, specific exemplary embodiments. It is to be understood, however, that other embodiments may be utilized and that logical, mechanical, and electrical changes may be made. Furthermore, the methods illustrated in the drawings and specification should not be construed as limiting the order in which individual steps may be performed. Thus, the following detailed description is not to be construed in a limiting sense.

[0008]

[0015] Strings of characters can be used to encrypt and decrypt data, and to sign cryptographic transactions, such as, for example, cryptocurrency transactions. It is desirable to keep certain strings of characters secure and accessible only to a limited number of people. These strings are referred to herein as "secrets." One type of secret includes private keys, public keys, encryption keys, decryption keys, signing keys, as well as passwords, secret phrases, account numbers, or mnemonic phrases or seeds that can be used to reconstruct a key (however, these may not all be known). A secret may be a cryptographic key (without limitation). For example, a secret may be a private key (or a mnemonic or seed derived from a private key) of an address in a distributed ledger that holds a pool of cryptocurrency. Such secrets may be of high value and require care to ensure security. Furthermore, a secret may be any digital data that can be represented as a string of characters, such as, for example, the raw data of a digital image arranged as a string of characters, the raw data of a digital video file arranged as a string of characters, the raw data of a digital audio file arranged as a string of characters, or any other type of digital file arranged as a string of characters.

[0009]

[0016] As used herein, the term "distributed ledger" refers to an electronic ledger that is distributed across multiple interconnected nodes, where multiple nodes store copies of the ledger. In some examples, a distributed ledger may implement one or more blockchains to validate data stored within the distributed ledger. A blockchain is a verifiable permanent ledger that is built one block at a time, with a proof-of-work seal (e.g., a hash) attached to each block that validates that block. In a blockchain, the hash of the previous block is included in the current block, so by recursion, the current hash also validates all previous blocks back to the original genesis block. When a hash is inserted into the blockchain, it is permanently recorded and acts as a notary to verify the time-stamped proof of existence of the hashed data at the moment the block is added to the chain. Future blocks provide additional certainty that no changes can be made to previous blocks in the chain, as they add a layer of protection against manipulation of data stored in the chain, or reorganization of the chain. A blockchain is an implementation of a distributed ledger. Exemplary blockchains include, but are not limited to, the Bitcoin blockchain, the Ethereum blockchain, the Ravencoin blockchain, BigchainDB, Billon, Chain, Corda, Credits, Elements, Monax, Fabric, HydraChain, Hyperledger, Multichain, Openchain, Quorum, Sawtooth, and Stellar.

[0010]

[0017] In symmetric encryption and decryption, the same key may be used to encrypt and decrypt, e.g., one or more private keys of different blockchain addresses, accounts, and / or wallets. For example, an Advanced Encryption Standard (AES) key may be used to symmetrically encrypt and / or decrypt data. In some configurations, the secret may be an AES key (or a mnemonic or seed derived from the AES key). Without limitation, the symmetric key may operate according to any of the following encryptions: Twofish, Serpent, Advanced Encryption Standard (AES), Blowfish, CAST5, Kuznyechik, RC4, Data Encryption Standard (DES), Triple DES (3DES), Skipjack, Safer+ / ++ (Bluetooth), IDEA, and / or other Cipher Block Coding (CBC) variations.

[0011]

[0018] In some configurations, the secret may be an asymmetric key (or a mnemonic or seed derived from the asymmetric key). A "public / private key pair" that includes a private key and a corresponding public key may be used in asymmetric encryption. The private key and public key may be referred to as the decryption private key and the encryption public key, respectively. The public key may be used to encrypt data that can only be decrypted using the private key that corresponds to the public key used for encryption. In an example, the public key may be used to generate a transaction address in a distributed ledger, and only the corresponding private key can sign a transaction that spends funds from the transaction address. This may be referred to as "asymmetric" encryption / decryption, since the same key is not used to encrypt and decrypt (or sign a transaction). In some configurations, the private key and public key may instead be referred to as the signing key and the signature verification key, respectively. In general, it is desirable to keep the private key (and sometimes the public key) safe. Without limitation, the asymmetric keys may operate according to any of the following encryptions: Rivest-Shamir-Adleman (RSA) and Elliptic Curve Cryptography (ECC) (e.g., Curve25519), Edwards Curve Digital Signature Algorithm (EdDSA) (e.g., Ed25519), etc.

[0012]

[0019] There is often a trade-off between keeping a key safe and having access to it when needed. In some cases, it is undesirable to limit access to a secret to a single user. Additionally, it may be desirable for multiple people to need to use the secret. In an example, this is useful when multiple directors, officers, partners, and / or employees of an organization need to participate in using a key. A secret can be split into multiple shares, and a subset of the shares can be used to reconstruct the secret. In an example, a secret is split into a set of secret shares using Shamir secret shares and / or polynomial interpolation. The terms "portion," "share," and "component" (and variations thereof) are used interchangeably herein to refer to one of multiple portions of a split secret (e.g., a cryptographic key). In an example, a particular amount of secret shares may be required to reconstruct a particular secret. For example, a particular secret may be split into N secret shares such that M of the N secret shares are required to reconstruct a particular secret. In an example, N secret shares may be distributed to various shareholder. In an example, each secret share is distributed to a different individual or group of people (shareholder) that does not overlap with another individual or group of people receiving a different secret share. However, in some configurations, multiple secret shares may be provided to the same individual or group of people.

[0013]

[0020] In examples, secret shares may be stored on a portable storage device or medium for distribution to shareholder(s), such as, for example, a USB key / memory stick (or other solid state drive), or an optical or magnetic disk. In examples, secret shares may be physically distributed by being displayed on a screen, written down, or otherwise printed (such as on a Quick Response (QR) code, barcode, etc.). In examples, secret shares (e.g., keys) may be electronically distributed to user devices using at least one of email, Short Message Service (SMS), Multimedia Messaging Service (MMS), instant messaging, push notifications (such as push verification notifications), polling (or pulling) notifications, or Bluetooth, Wi-Fi, or Near Field Communication (NFC) transmissions.

[0014]

[0021] Splitting the secret and distributing it to different people (or groups of people) adds a layer of security, since it means that collusion by different shareholders is required to maliciously reconstruct the key and the encryption keys. If the secret needs to be reconstructed, at least M of the N secret shares must be collected. If the reconstruction fails, it may be difficult to identify the point of failure, either because the secret shares do not reconstruct the correct secret or because an error occurred during the reconstruction. In other words, it becomes difficult to identify which secret share caused the failure. In the worst case scenario, if too many secret shares are lost, stolen, or corrupted, the secret may become unrecoverable.

[0015]

[0022] Thus, the present system and method improves upon systems that require multiple shareholders to hold shares of a secret when multiple shares are required to perform an action. Specifically, the present system and method generates metadata that can be used to troubleshoot the cause of a problem if there is one during reconstitution of a secret. This metadata can map (1) a particular secret share distribution vehicle (e.g., evidence bag) to a particular secret share and / or (2) a particular secret share distribution vehicle (e.g., evidence bag) to a particular secret / wallet number.

[0016]

[0023] The present system and method can improve upon conventional systems for distribution and storage of secrets in other ways. First, in addition to numbering a distribution means (e.g., an evidence bag) for a particular secret share, the metadata includes a hash of the secret share. Thus, in some configurations, the hash of a obtained secret share can be verified before an attempt is made to reconstruct the secret. For example, a person or script tasked with reconstructing the secret (e.g., before attempting to reconstruct the secret) can compare (1) a hash generated from the secret share before the secret share was distributed to the shareholder with (2) a hash generated from the secret share obtained just before or just after the secret share was used to reconstruct the secret. This ensures that only the correct secret share (the secret share claimed by the shareholder) is used to reconstruct the secret.

[0017]

[0024] Second, the use of an M-of-N system as described herein (where, in some examples, N>M>1) would eliminate a single point of failure. Specifically, to make the key unrecoverable, M shares must be lost or stolen (i.e., M of the shareholders must collude) before the secret can be negligently reconstructed. A single lost / stolen secret share (or a single malicious shareholder) would not allow the secret to be reconstructed.

[0018]

[0025] Third, the metadata used in the systems and methods described herein provides benefits (as discussed above) while mitigating any risks that may result from loss or theft of the metadata: if one or more copies of the metadata are lost or stolen, a fraudulent holder will simply know how many outstanding secret shares there are (and hashes of those secret shares), but will never possess the actual secret shares.

[0019]

[0026] As used herein, the term "encryption" or variations thereof refers to converting data into a code to prevent unauthorized access. Encryption can be performed in a variety of ways, including symmetric encryption, in which a single encryption key is used to both encrypt and decrypt data, and asymmetric encryption, in which a public key is used to encrypt data and a corresponding private key is used to decrypt the data.

[0020]

[0027] As used herein, the term "signing" or variations thereof refers to adding or modifying data associated with a desired transaction, for example, using a secret.

[0021]

[0028] As used herein, unless otherwise specified, the term “user” refers to a person (or automated instructions, such as, for example, a script) that accesses a customer device 102 to initiate any of the functions described herein.

[0022]

[0029] As used herein, the term "wallet" refers to a set of instructions, digital files, and / or memory used to store and / or manage digital assets, such as cryptocurrencies. Although the description herein may refer to cryptocurrencies at times, other types of digital assets may be held and managed in a wallet. In some examples, a wallet may be defined by one or more private keys, one or more public keys derived from the one or more private keys, and / or one or more transaction addresses derived from the one or more private keys and / or one or more public keys. In some examples, a wallet may be defined by one or more private account keys (and, optionally, corresponding public account keys), each of which may have one or more child and / or grandchild transaction keys.

[0023]

[0030] 1 is a block diagram illustrating an exemplary system 100 for secret splitting and metadata storage. System 100 includes a computing device 102 and a plurality of optional computing devices 104 (e.g., optional computing device 104-1 through optional computing device 104-A). Each of computing device 102 and computing device 104 may be implemented as either a mobile computing device, such as a mobile phone, tablet computer, mobile media device, mobile gaming device, laptop computer, vehicle-based computer, or a non-mobile device, such as a dedicated terminal, public terminal, kiosk, server, or desktop computer. Each computing device 104 is connected to at least one network 106 (network In some configurations, the computing device 102 is communicatively coupled to the computing device 104 using a network (e.g., network 106-1 through network 106-A). In an example, the at least one network 106 includes at least one wire network and / or at least one wireless network. In an example, any combination of wire and wireless networks is used to couple the computing device 104 to the computing device 102. In an example, the at least one network 106 includes at least one of at least one local area network (LAN), at least one wide area network (WAN), or the Internet. In an example, any combination of a local area network, a wide area network, or the Internet is used as the at least one network 106 to couple the computing device 104 to the computing device 102. In some configurations, the computing device 102 may be coupled to one or more other computing devices 104 when it is “air-gapped” (not connected to any wireless or wired network) during other times. In an example, computing device 102 and computing device 104 each include at least one memory, at least one processor, at least one optional network interface, at least one optional display device, at least one optional input device, and at least one power source.

[0024]

[0031] 2 is a block diagram illustrating an exemplary computing device 102 used in system 100 for secret splitting and metadata storage. Computing device 102 includes at least one memory 202, at least one processor 204, optionally at least one network interface 206, an optional secret generator 208, an optional Shamir secret share module 210, an optional hash function 212, an optional display device 214, an optional input device 216, an optional power source 218, an optional secret reconstruction module 220, an optional verification module 222, and an optional metadata module 224.

[0025]

[0032] In an example, the at least one memory 202 is any device, mechanism, or populated data structure used to store information. In an example, the at least one memory 202 can be or include any type of volatile, non-volatile, and / or dynamic memory. For example, the at least one memory 202 can be a random access memory, a memory storage device, an optical memory device, a magnetic medium, a floppy disk, a magnetic tape, a hard drive, an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), an optical medium (compact disk, DVD, Blu-ray disk, M-DISC, etc.), etc. According to some embodiments, the at least one memory 202 can include one or more disk drives, a flash drive, one or more databases, one or more tables, one or more files, a local cache memory, a processor cache memory, a relational database, a flat database, etc. In addition, one skilled in the art will recognize many additional devices and techniques for storing information that can be used as the at least one memory 202. The at least one memory 202 may be used to store instructions for executing one or more applications or modules on the at least one processor 204. For example, the at least one memory 202 may store instructions needed to perform the functions of the optional secret generator 208, the optional Shamir secret share module 210, the optional hash function 212, the optional secret reconstruction module 220, the optional verification module 222, and / or the optional metadata module 224, in one or more examples. It can be used to store all or some of the

[0026]

[0033] The at least one processor 204 may be any known processor, such as a general purpose processor (GPP), or a special purpose or any programmable logic device (such as a field programmable gate array (FPGA), application specific integrated circuit (ASIC), or other integrated circuit or circuit configuration). In an example, any of the optional secret generator 208, optional Shamir secret share module 210, optional hash function 212, optional secret reconstruction module 220, optional verification module 222, and / or optional metadata module 224 are implemented by the at least one processor 204 and at least one memory 202.

[0027]

[0034] In an example, the at least one optional network interface 206 includes or is coupled to at least one optional antenna for communicating with a network (such as one of the at least one network 106 of the system 100). In an example, the at least one optional network interface 206 includes at least one of an Ethernet interface, a cellular radio access technology (RAT) radio, a Wi-Fi radio, a Bluetooth radio, or a near field communication (NFC) radio. In an example, the at least one optional network interface 206 includes a cellular radio access technology radio configured to establish cellular data communication (mobile internet) at sufficient speeds with a remote server using a local area network (LAN) or a wide area network (WAN). In an example, the cellular radio access technology includes at least one of Personal Communication Services (PCS), Special Mobile Radio (SMR) service, Enhanced Special Mobile Radio (ESMR) service, Advanced Wireless Services (AWS), Code Division Multiple Access (CDMA), Global System for Mobile Communications (GSM) service, Wideband Code Division Multiple Access (W-CDMA), Universal Mobile Telecommunications System (UMTS), Worldwide Interoperability for Microwave Access (WiMAX), Third Generation Partnership Project (3GPP®), Long Term Evolution (LTE), High Speed ​​Packet Access (HSPA), Third Generation (3G), Fourth Generation (4G), Fifth Generation (5G), etc., or other suitable communication services, or combinations thereof. In an example, the at least one optional network interface 206 and / or the at least one optional network interface 206 includes a Wi-Fi (IEEE 802.11) radio configured to communicate with a wireless local area network, which communicates with a remote server rather than a wide area network.In an example, the at least one optional network interface 206 and / or the at least one optional network interface 206 includes a near field communication device limited to close proximity communications, such as a passive near field communication (NFC) tag, an active near field communication (NFC) tag, a passive radio frequency identification (RFID) tag, an active radio frequency identification (RFID) tag, a proximity card, or other personal area network device. In an example, the same at least one optional network interface 206 and / or the at least one optional network interface 206 are also used to communicate with an external gateway device to the network (such as an NFC payment terminal).

[0028]

[0035] In an example, the optional at least one display device 214 includes at least one of a light emitting diode (LED), a liquid crystal display (LCD), a light emitting diode (LED) display, an organic light emitting diode (OLED) display, an electronic ink display, a field emission display (FED), a surface conduction electron emission display (SED), or a plasma display. In an example, the optional at least one input device 216 includes at least one of a touch screen (including capacitive and resistive touch screens), including touch pads, capacitive buttons, mechanical buttons, switches, dials, keyboards, mice, cameras, biometric sensors / scanners, etc. In an example, optional at least one display device 214 and optional at least one input device 216 are combined into a human machine interface (HMI) for user interaction with the computing device 102. In an example, at least one optional power supply 218 is used to provide power to various components of the network node 102.

[0029]

[0036] At least one processor 204 of the computing device 102 is configured to securely generate at least one secret. In an example, this is implemented in an optional secret generator 208. At least one processor 204 of the computing device 102 may be configured to securely generate at least one secret.

[0030]

[0037] 3 is a block diagram illustrating an example of a secret generator 208. In the example, the secret generator 208 generates different data simultaneously or near simultaneously. In the example, the secret generator 208 generates (1) a private key 326, (2) an optional mnemonic / seed 328 derived from the private key 326, (3) an optional public key 330, and / or (4) at least one optional address 332 in a distributed ledger (e.g., holding cryptocurrency). In the example, each of the private key 326, the optional mnemonic / seed 328, the optional public key 330, and the at least one optional address 332 are represented as strings of different characters.

[0031]

[0038] The private key 326 or mnemonic / seed 328 may be a secret (that is later split and distributed to shareholders). In an example, the optional public key 330 corresponds to and is derived from the private key 326. In an example, the private key 326 and the public key 330 (and optionally the address) are generated using a single function. However, the private key 326 is generally not derived from the public key 330. In an example, the private key 326 can be used to spend funds from the optional address 332, while the optional public key 330 can be used to monitor transactions to and from the address 332 or to send cryptocurrency to the address 332. In an example, a private / public key pair is generated, and a hash of the public key 330 is an address in the distributed ledger (that can be used to make transactions to the wallet). Alternatively, the public key 330 can be used to encrypt data, while the private key 326 can be used to decrypt data. The private key 326 is generally kept secure (relatively few people have access to it) while the public key 330 is more freely shared (more people have access to it).

[0032]

[0039] If the private key 326 is lost, the mnemonic code or seed 328 can be used to recover the private key 326. In an example, the mnemonic code or seed 328 is a set of words (e.g., 12 or 15 words) from which the private key 326 can be derived. In an example, the mnemonic code or seed 328 is first derived from the private key 326. In an example, the address 332 may be a hash of the public key 330. Thus, the address is derived from the public key 330, but the public key 330 may not be derived from the address 332.

[0033]

[0040] Optionally, the at least one processor 204 of the computing device 102 is configured to generate the private key 326 by generating a sequence having random or pseudo-random properties. Optionally, the private key 326 is generated according to the Bitcoin Improvement Proposal 39 (BIP39) available at https: / / githob.com / bitcoin / bips / blob / master / bip-0039.mediawiki, incorporated herein by reference. In an example, the corresponding public key 330 is generated from the private key 326 by using elliptic curve multiplication (a type of cryptographic function). Then, as previously mentioned, the address 332 may be a hash of the public key 330.

[0034]

[0041] Referring back to FIG. 2 again, the at least one processor 204 is further configured to split the secret into a set of secret shares, where at least a subset of the secret shares can be used to reconstruct the secret. In an example, this is implemented in a Shamir secret share module 210. In an example, the splitting is configurable and a particular amount of secret shares may be required to reconstruct the secret. For example, a particular secret may be split into N secret shares, such that M of the N secret shares are required to reconstruct the particular secret. In an example, each secret share is distributed to a different shareholder. In an example, the secret shares may optionally be verified (as described in more detail below) before being distributed to the various shareholder. In an example, the secret is split into N secret shares via at least one of Shamir secret shares and polynomial interpolation. Optionally, the secret shares may be encrypted (e.g., using a symmetric or asymmetric key) before being distributed to the shareholder. As used herein, a "shareholder" is an individual or organization entrusted with securely storing at least one secret share. In other words, secret shares are distributed to shareholders for safekeeping after the secret is generated and divided.

[0035]

[0042] In an example, each secret share can be transferred to a separate storage device or medium. In an example, each secret share is written to an archival grade optical disc, for example, a MILLENNIAL DISC (M-DISC) that retains data for hundreds or thousands of years. Optionally, each individual secret share is also placed in a security envelope or package that is tamper-proof (making it difficult to tamper with the contents) and / or tamper-proof (providing a mechanism to indicate whether the contents of the security envelope or package have been tampered with). Regardless of whether a security envelope or package is used, each secret share is distributed to its respective shareholder once placed in its respective storage medium. Typically, each secret share is given to a different shareholder, although configurations are possible in which a shareholder receives multiple generated secret shares.

[0036]

[0043] Alternatively or additionally, the secret share may be distributed electronically to devices belonging to a shareholder (or group of shareholder) using at least one network interface 206, such as by at least one of email, short message service (SMS), multimedia messaging service (MMS), instant messaging, push notification, or push verification notification. In an example, the secret share is displayed, printed, or otherwise fixed on a medium provided to the shareholder (e.g., as a Quick Response (QR) code), and the shareholder enters the secret share into a corresponding computing device 104, transcribes it in his or her own handwriting, and / or securely stores the printout itself.

[0037]

[0044] At least one processor 204 of the computing device 102 is further configured to generate a hash of the secret and / or individual secret shares. In an example, this is performed in a cryptographic hash function 212. In an example, a hash of the secret or secret shares is generated before the secret shares are distributed and stored for verification purposes. In an example, the hash function 212 receives an input (a character string such as a secret or secret share) and generates a hash (a set of distinct keys). The hash function 212 returns a hash of a particular value (a string of characters). The input to the hash function 212 uniquely determines the output (hash). In other words, a particular hash function 212 will only generate a hash of a particular value from one particular input, and any change to the input will generate a hash of a different value. As discussed below, comparing the hashes of the secret shares serves as a proxy for verifying the secret shares themselves. Examples of hash functions 212 that can be used include, but are not limited to, the Secure Hash Algorithm (SHA)-1, SHA-2 functions (e.g., SHA-256 or SHA-512 (sometimes called SHA2-512)), or any of MD4, MD5, RIPEMD160, etc.

[0038]

[0045] In an example, the at least one processor 204 of the computing device 102 is further configured to reconstruct a secret from the set of secret shares, where at least a subset of the secret shares can be used to reconstruct the secret, e.g., such that M of N secret shares are needed to reconstruct the secret. In an example, this is implemented in the secret reconstruction module 220. In an example, the at least one processor 204 is configured to obtain a subset (e.g., M of N) of the secret shares from a subset of the shareholders. In an example, if the secret shares were distributed on a portable storage device or medium (e.g., optical disk), obtaining includes reading the subset of the secret shares from a portable storage device or medium physically brought to the computing device 102. Alternatively, if the secret shares were distributed on a printed material (e.g., a bar code or QR code), obtaining includes scanning the subset of the secret shares (physically brought by the shareholders) using an imaging device such as a camera or scanner. Alternatively, if the secret shares were distributed electronically via at least one network 106, obtaining may include receiving a subset of the secret shares from the shareholder's electronic device 104 via the at least one network 106.

[0039]

[0046] Once the subset of secret shares is obtained (e.g., in the air-gapped computing device 102), the secret reconstruction module 220 is configured to securely reconstruct the secret. In examples, the Shamir secret share (e.g., performed by the Shamir secret share module 210) includes using the secret 434-1 to define a polynomial of order (M-1), where each of the N secret shares 436-1 is pointed to by the defined polynomial. In these examples, the secret 434-2 is reconstructed (e.g., in the secret reconstruction module 220) by determining the original polynomial from at least M of the N obtained secret shares 436-2.

[0040]

[0047] However, if the secret shares were encrypted before distribution, they may be decrypted before the secret is reconstructed. In instances where the secret shares are encrypted with a symmetric key before distribution, the same symmetric key can be used to decrypt the secret shares and then the secret can be reconstructed. Alternatively, if the secret shares are encrypted with their respective asymmetric keys (e.g., public keys) before distribution, a decryption key corresponding to each asymmetric key (e.g., a private key corresponding to a public key) can be used to decrypt the secret shares and then the secret can be reconstructed. If the secret shares were not encrypted before distribution to the shareholders, they do not need to be decrypted before the secret can be reconstructed.

[0041]

[0048] In the example, at least one processor 204 of the computing device 102 may receive (1) at least one secret share and / or (2) a reconfigured The at least one processor 204 may further be configured to verify the secret itself obtained. In an example, this is performed in the verification module 222. In an example, the at least one processor 204 may be configured to compare hashes obtained at two different times. In an example, the at least one processor 204 may compare (1) a hash generated from the secret share before the secret share is distributed to the shareholder with (2) a hash generated from the secret share distributed immediately before or after the secret share is used to reconstruct the secret. If the two hashes match, it is verified that the secret share (for which the hash was generated) is the same. For example, the secret share obtained from the shareholder is the same as the secret share originally given to the shareholder.

[0042]

[0049] Alternatively or additionally, at least one processor 204 may compare (1) a hash generated from the secret before it was split with (2) a hash generated from the secret after it was reconstructed. If the two hashes match, the secret from which the hash was generated is verified to be the same. For example, the reconstructed secret is the same as the original secret. It should be noted that the various verifications discussed herein are optional.

[0043]

[0050] In an example, the at least one processor 204 of the computing device 102 is further configured to collect and store metadata about the secrets and / or secret shares generated at the computing device 102. In an example, this is performed in a metadata module 224. Among other things, the metadata can be used to verify the secret shares before and / or after reconstructing the secret. Additionally, the metadata can be used to identify which secret shares obtained from the shareholders were responsible for the failure if an error occurs during the reconstructing of the secret (or if an incorrect secret is reconstructed using the obtained secret shares).

[0044]

[0051] In an example, the metadata includes (1) a list of hashes of the secret shares, (2) addresses generated with (and corresponding to) the secret, (3) a mapping of the distribution means (e.g., evidence bag identifier) ​​of each secret share to a particular secret / wallet number, (4) a copy of the hash function 212 code (e.g., a set of executable instructions to hash the secret shares), and / or (5) a copy of the code used to split the secret (e.g., a set of executable instructions to perform a Shamir split). In an example, each copy of the metadata is stored on a separate portable storage device or medium, such as, for example, an M-DISC. Alternatively or additionally, the metadata can be stored in the password manager software, printed as a QR code for safekeeping, or transmitted electronically to cloud-based storage.

[0045]

[0052] 4 is a block diagram illustrating an exemplary system 100 for secret 434-1 division and metadata 440 storage. Specifically, FIG. 4 illustrates various stages in which (1) secret 434-1 is generated and divided into secret shares 436-1, (2) metadata 440 is generated, (3) secret shares 436-1 are distributed to shareholders 442-1 through 442-N, (4) secret shares 436-2 are obtained, and (5) secret 434-2 is reconstructed from obtained secret shares 436-2. In some configurations, some of the five stages may be performed while computing device 102 is coupled (e.g., via at least one network 106) to other computing devices 104, while computing device 102 may be air-gapped (not connected to any wired network). In one embodiment, the computing device 102 is coupled to at least one other computing device 104. In another ...

[0046]

[0053] With reference to the secret share 436-2 or the portable storage device or medium, the term "obtained" is used to indicate that something has been distributed to a shareholder 442 and returned to the computing device 102. In an example, the obtained secret share 436-2 may or may not be a secret share of one of the original secret shares 436-1 generated prior to distribution, depending on whether the portable storage device or medium storing the obtained secret share 436-2 has been tampered with (or the shareholder 442 accidentally brought the wrong portable storage device or medium).

[0047]

[0054] 4, the computing device 102 that generates the distributed secret share 436-1 may or may not be the same computing device 102 as the computing device that reconstructs the secret 434-2. In other words, the generation portion 403 and the reconstruction portion 405 may be on the same or different computing devices 102.

[0048]

[0055] Optionally, the computing device 102 may be securely erased / formatted before the secret 434-1 is generated and split. This may include using any suitable technique for erasing / formatting a storage device (e.g., a hard disk drive). In an example, this includes encrypting the contents of a storage device (e.g., a hard disk drive) in the computing device 102 and restoring the operating system (e.g., from a cloud-based server). A decryption key may be generated or derived during the encryption process.

[0049]

[0056] Secret 434-1 can be any string of characters, such as a cryptographic private key 326 (e.g., for an address 332 in a distributed ledger holding pooled cryptocurrency), a password, a mnemonic phrase or seed 328 that can be used to reconstruct the private key 326, a public key 330, an address 332, a secret phrase, an account number, the raw data of a digital image arranged as a string of characters, the raw data of a digital video file arranged as a string of characters, the raw data of a digital audio file arranged as a string of characters, or any other type of digital file arranged as a string of characters.

[0050]

[0057] In an example, the secret generator 208 generates a secret 434-1. In an example where the secret 434-1 is a private key 326, or a mnemonic / seed 328 for recovering the private key 326, the secret generator 208 generates an optional public key 330 and / or at least one optional address 332 (holding cryptocurrency) in the distributed ledger. In an example where the secret 434-1 is a private key 326, the secret generator 208 generates the private key 326 by generating a sequence having pseudorandom properties. Once the at least one optional address 332 has been generated with the secret 434-1, it may be optionally verified by (1) sending a small amount of cryptocurrency to the address 332 and (2) verifying the small amount by viewing a transaction for the address 332 in the distributed ledger itself. Alternatively, secret 434-1 may be identified and / or received at computing device 102 (e.g., via user input or from memory) rather than being generated at computing device 102. For example, an existing account number, password, or other string of characters may be entered or transmitted to computing device 102 rather than being generated at computing device 102.

[0051]

[0058] In an example, the Shamir secret share module 210 splits the secret 434-1 into at least two secret shares 436-1. In an example, the secret 434-1 is split into N secret shares 436-1, where M of the N secret shares 436-2 are required to reconstruct the secret 434-2. In an example, the secret 434-1 is split into the secret shares 436-1 using Shamir secret shares and / or polynomial interpolation. In an example, input (e.g., user input) is received at the Shamir secret share module 210 to specify the M and N values ​​for the split. In general, without limitation, one <M≦Nである。

[0052]

[0059] In an example, a hash function 212 (e.g., SHA-512) generates a share hash 437 for each secret share 436-1. Each secret share 436-1 determines exactly one hash value for a given current hash function 212, such as SHA-512. The share hash 437 may be stored by the metadata module 224 in at least one copy of the metadata 440 (e.g., stored on an archival grade optical medium such as an M-DISC). In addition to the list of share hashes 437, each copy of metadata 440 may also include: (1) a list of addresses 332 generated with (and corresponding to) secret 434-1, (2) a mapping of the distribution means (e.g., evidence bag identifier) ​​of each secret share 436-1 to a particular secret 434-1 / wallet number, (3) a copy of the hash function 212 code (e.g., a set of instructions executable to hash secret share 436-1), and / or (4) a copy of the code used to split secret 434-1 (e.g., a set of instructions executable to perform a Shamir split). In an example, metadata 440 may be stored in password manager software, printed as a QR code for safekeeping, or sent electronically to cloud-based storage instead of (or in addition to) being transferred to an optical disk.

[0053]

[0060] In the example, the share hash 437 is stored in the metadata 440 for later verification of the obtained secret share 436-2 at or near the time the secret 434-2 is reconstructed.

[0054]

[0061] Optionally, secret shares 436-1 may be verified by verification module 222 prior to distribution. In an example, all secret shares 436-1 are used to reconstruct secret 434-2 at least once. For example, secret 434-2 must be reconstructed at least N / M (rounded up to an integer) times, e.g., if M=3 and N=5, secret 434-2 is reconstructed 5 / 3 (rounded up to an integer)=2 times, so all secret shares 436-1 are used at least once during reconstruction of secret 434-2.

[0055]

[0062] In the example, secret 434-1 is compared to reconstructed secret 434-2. If secret 434-1 matches reconstructed secret 434-2, then secret share 434 (used to reconstruct secret 434-2) is Secret share 436-1 is verified and distributed to shareholders 442. If secret 434-1 does not match reconstructed secret 434-2, then secret share 436-1 (used to reconstruct secret 434-2) is not verified and is not distributed to shareholders 442 until the cause of the problem is identified and corrected.

[0056]

[0063] Alternatively, the hash of secret 434-1 can be compared to the hash of reconstructed secret 434-2. If the hash of secret 434-1 matches the hash of reconstructed secret 434-2, then secret share 436-1 (used to reconstruct secret 434-2) is verified and distributed to shareholders 442. If the hash of secret 434-1 does not match the hash of reconstructed secret 434-2, then secret share 436-1 (used to reconstruct secret 434-2) is not verified and is not distributed to shareholders 442 until the cause of the problem is identified and corrected.

[0057]

[0064] Optionally, the secret 434-1, the share hash 436-1, and / or the reconstructed secret 434-2 are deleted from the computing device 102 once the secret share 436-1 is verified (by using all secret shares 436-1 at least once to reconstruct the secret 434-2).

[0058]

[0065] Once the secret 434-1 has been divided into secret shares 436-1 (and the secret shares 436-1 have optionally been verified), each secret share 436-1 may be transferred to a respective secret share storage device or medium 438-1 through 438-N. In an example, the secret share storage device or medium 438 is an archival grade optical medium, such as an M-DISC. However, other types of portable storage devices or media may be used instead of or in addition to optical media. Alternatively, the secret share 436-1 may be distributed in physical printout (e.g., a barcode or QR code), distributed electronically over at least one network 106, and displayed electronically so that the shareholder 442 can transcribe it, such as in his or her own handwriting. Optionally, the secret share 436-1 may be encrypted before being transferred on the secret share storage device or medium 438. Optionally, the secret share 436-1 is deleted from the computing device 102 after being transferred to a portable storage device or medium for distribution.

[0059]

[0066] Optionally, computing device 102 may be securely erased / formatted again after the distribution of secret share 436-1. This may include using any suitable technique for erasing / formatting a storage device (e.g., a hard disk drive). In an example where the storage device (e.g., a hard disk drive) of computing device 102 was encrypted prior to the generation of secret 434-1, the corresponding decryption key (generated or derived when the storage device was encrypted) can be discarded, e.g., securely deleted.

[0060]

[0067] If secret 434-2 is to be reconstructed, at least some secret share storage devices or media 438 (which store secret shares 436-2) are obtained from share holders 442. The number of secret share storage devices or media 438 obtained depends on the values of M and N determined during the splitting of secret 434-1. If M < N, the number of secret share storage devices or media 438 obtained is less than the number of secret shares 436-1 distributed. If M = N, all of the secret share storage devices or media 438 distributed are obtained for the reconstruction of secret 434-2. For the reconstruction of secret 434-2.

[0061]

[0068] If the secret share storage devices or media 438 were physically distributed (e.g., on the secret share storage devices or media 438 or in a physical printout), at least a subset will typically be physically returned to the computing device 102. In this case, at least a subset of the shareholders 442 may be asked to physically bring their respective secret share storage devices or media 438 to the meeting at a designated date and time. Once the secret share storage devices or media 438 are physically obtained, they may need to be processed prior to verification and / or reconstruction of the secret, such as by reading the secret share 436-2 on the secret share storage devices or media 438 or scanning a QR code on a printout.

[0062]

[0069] When secret shares 436-1 are distributed electronically (e.g., via at least one network 106), at least a subset is typically obtained electronically from shareholders 442 (e.g., via at least one network 106). This may involve an electronic request being sent to devices of at least a subset of shareholders 442, which are then approved and the secret shares are sent to computing devices 102. In some configurations, the computing devices 102 that generate and split secret 434-1 for distribution may be different from the computing devices 102 that reconstruct secret 434-2.

[0063]

[0070] If the secret share 436-1 was encrypted before distribution, it is decrypted after acquisition before it is verified or before the secret 434-2 is reconstructed. If the secret share 436-1 was symmetrically encrypted before distribution, it is decrypted symmetrically after acquisition. If the secret share 436-1 was asymmetrically encrypted before distribution, it is decrypted asymmetrically after acquisition. If the secret share 436-1 was not encrypted before distribution to the shareholders 442, it does not need to be decrypted before the secret share 434-2 is reconstructed.

[0064]

[0071] Prior to reconstructing secret 434-2, obtained secret share 436-2 may optionally be verified. In an example, at least one hash of obtained secret share 436-2 (generated at or near the time of reconstruction of secret 434-2) is compared to a list of share hashes 437 (in metadata 440 generated before secret share 436-1 was distributed). If the hash of obtained secret share 436-2 matches a hash in the list of share hashes 437 (in metadata 440), it means that the obtained secret share 436-2 can be used to reconstruct the desired secret 434-2 (because it matches the secret share 436-1 originally distributed to shareholder 442-1). If the hash of the obtained secret share 436-2 does not match any hash in the list of share hashes 437 (in metadata 440), it means that the obtained secret share 436-2 cannot be used to reconstruct the desired secret 434-2 (because it is not one of the secret shares 436-1 originally distributed to shareholders 442).

[0065]

[0072] Once the secret share 436-2 is obtained (and optionally verified), the secret 434-2 can be reconstructed in the secret reconstruction module 220. In some configurations, the secret reconstruction module 220 and the Shamir secret share module 210 can be implemented together. In an example, the secret reconstruction modules 220, 220 perform a Shamir join (Shamir join) corresponding to the Shamir split performed by the Shamir secret share module 210. ) to use the

[0066]

[0073] If the secret 434-2 cannot be reconstructed from the secret share 436-2 (because an error occurred during the reconstruction of the secret 434-2 or because the reconstructed secret 434-2 does not match the original secret 434-1), the verification module 222 may identify at least one secret share 436-2 as incorrect based on the metadata 440. In an example, this involves comparing at least one hash of the obtained secret share 436-2 to the list of share hashes 437 in the metadata 440. If the hash of the obtained secret share 436-2 matches a hash in the list of share hashes 437 (in the metadata 440), then it is the “correct” obtained secret share 436-2 (because it matches the secret share 436-1 originally distributed to the shareholder 442-1). If the hash of the obtained secret share 436-2 does not match any hash in the list of share hashes 437 (in metadata 440), then it is identified as an "incorrect" obtained secret share 436-2 (because it is not one of the secret shares 436-1 originally distributed to the shareholder 442). This post-reconstruction verification / identification can narrow down the problem to the secret share storage device or medium 438 of the particular shareholder 442.

[0067]

[0074] 5 is a flow diagram illustrating an example method 500 for splitting a secret 434-1 and storing metadata 440. The method 500 may be performed by a computing device 102 in the system for secret splitting and metadata storage 100. In an example, at least some of the steps in the method 500 are performed by at least one processor in the computing device 102.

[0068]

[0075] Method 500 begins with optional step 502, where at least one processor erases the contents of at least one storage device (e.g., a hard disk drive) in computing device 102. In an example, this includes encrypting the contents of the at least one storage device and restoring the operating system (e.g., from a cloud-based server). A decryption key may be generated or derived that can decrypt the contents of the storage device. Alternatively, any suitable technique for erasing the contents of the storage device may be used.

[0069]

[0076] The method 500 proceeds to step 504, where the at least one processor determines a secret 434-1 to be protected. In an example, the secret 434-1 is a string of any characters, such as, for example, a cryptographic private key 326 or a mnemonic phrase or seed 328 that can be used to reconstruct the private key 326. In an example where the secret 434-1 is a private key 326 or a mnemonic / seed 328, the determining may include the at least one processor generating the secret 434-1. Alternatively or additionally, the determining may include the at least one processor identifying and / or receiving an existing secret 434-1 rather than generating it.

[0070]

[0077] If the secret 434-1 is a private key 326, or a mnemonic / seed 328 for recovering the private key 326, the at least one processor may generate an optional public key 330 and / or at least one address 332 (holding the cryptocurrency) in the distributed ledger. Once the at least one optional address 332 has been generated using the secret 434-1, (1) a small amount of the cryptocurrency may be written to the address; The address can be optionally verified by (1) sending the amount to address 332 and (2) verifying a small amount by viewing transactions for address 332 in the distributed ledger itself. This helps to ensure that the address is a valid address in the desired distributed ledger.

[0071]

[0078] Method 500 proceeds to step 506, where at least one processor divides secret 434-1 into multiple secret shares 436-1, where at least a subset of multiple secret shares 436-1 are required to reconstruct secret 434-2. Secret 434-1 may be divided using Shamir secret shares and / or polynomial interpolation. In an example, a user of computing device 102 is prompted to provide user input specifying (1) how many secret shares 436-1 secret 434-1 should be divided into and / or (2) how many secret shares 436-1 are required to reconstruct secret 434-1. In an example, a user may select any number for N (e.g., N=1 to 100) and M (e.g., M<=N). In an example, a user may adjust the configuration of M and N based on the security of secret 434-1, the accessibility of secret 434-1, and / or any other concerns.

[0072]

[0079] Method 500 proceeds to optional step 508, where at least one processor verifies secret shares 436-1 by using each secret share 436-1 at least once to reconstruct secret 434-1. For example, secret 434-2 must be reconstructed at least N / M (rounded up to an integer) times, e.g., if M=3 and N=5, secret 434-2 is reconstructed 5 / 3 (rounded up to an integer)=2 times, so that all secret shares 436-1 are used at least once during the reconstruction of the secret. Secret share 436-1 may be verified by (1) comparing secret 434-1 to reconstructed secret 434-2 (where secret share 436-1 is verified only if secret 434-1 matches reconstructed secret 434-2) or (2) comparing a hash of secret 434-1 to a hash of reconstructed secret 434-2 (where secret share 436-1 is verified only if the hash of secret 434-1 matches the hash of reconstructed secret 434-2). In an example, if not all of secret share 436-1 is verified in optional step 508, e.g., if (1) secret 434-1 does not match reconstructed secret 434-2 or (2) the hash of secret 434-1 does not match the hash of reconstructed secret 434-2, method 500 ends or returns to any of the previous steps.

[0073]

[0080] The method 500 proceeds to step 510, where the at least one processor transfers each secret share 436-1 to a respective portable storage device or medium for distribution to the respective shareholders 442. In an example, the secret shares 436-1 are transferred to an archival grade optical medium, such as an M-DISC. However, other types of portable storage devices or media may be used instead of or in addition to optical media. Optionally, the secret shares 436-1 may be encrypted before being transferred to the portable storage device or medium.

[0074]

[0081] Distribution shall consist of physically placing each portable storage device or medium in a tamper-proof and / or tamper-evident security envelope or package. This can include disposing of and then forwarding a different security envelope or package to each shareholder 442, where each security envelope has a unique identifier.

[0075]

[0082] Method 500 proceeds to step 512, where at least one processor generates metadata 440 using at least a hash 437 of each secret share 436-1. Each share hash 437 may be a string of characters whose length is determined by the hash function 212 used to generate the share hash 437, such that, for example, a share hash 437 generated using SHA-512 is 512 bits long. Each secret share 436-1 may determine a single hash value when a given modern hash function 212, such as SHA-512, is used (however, older hash functions, such as some of the SHA-1 functions, may result in hash collisions).

[0076]

[0083] In addition to the list of share hashes 437 (step 510), each copy of metadata 440 may also include (1) a list of addresses 332 generated with (and corresponding to) secret 434-1; (2) a mapping of identifiers for each security envelope or package used to distribute secret shares 436-1 to a particular secret 434-1 / wallet number; (3) a copy of the hash function 212 code used to generate the share hashes 437 in metadata 440 (optional step 508); and / or (4) a copy of the code used to split secret 434-1 into secret shares 436-1 (step 506).

[0077]

[0084] Method 500 proceeds to optional step 514, where the at least one processor deletes locally stored copies of secret 434-1, secret share 436-1, and optional share hash 437 (and any reconstructed secret 434-2 generated in optional step 508). Optional step 518 may further include again erasing the contents of the entire at least one storage device (e.g., hard disk drive) in computing device 102 (e.g., by securely deleting the decryption key created in optional step 502).

[0078]

[0085] Method 500 proceeds to optional step 516, where at least one processor uses secret share 436-1 to store metadata 440 separately from a portable storage device or medium. Each copy of metadata 440 can be (1) stored on a portable storage device or medium (e.g., archival grade optical media such as M-DISC), (2) stored in an electronic repository (e.g., restricting access to people with proper credentials), and / or (3) printed as a QR code for archival. Alternatively, any other suitable storage method can be used for metadata 440. In an example, deleting the locally stored copies of secret 434-1 and secret share 436-1 (at optional step 514) before writing metadata 440 (at optional step 516) prevents secret 434-1 and secret share 436-1 from being written to the metadata 440 medium.

[0079]

[0086] In an example, method 500 is performed without revealing secret 434-1 or even secret portion 436-1 to the user, even though share hash 437 is displayed. For added security, in some configurations, method 500 is performed with at least one (e.g., two) witnesses in addition to the user executing process 500. This will ensure that secret 434-1 and secret share 436-1 are not distributed without authorization.

[0080]

[0087] FIG. 6 is a flowchart showing an exemplary method 600 for reconstructing a secret 434-2 from at least two acquired secret shares 436-2. The method 600 can be executed by a computing device 102. In an example, the method 600 in FIG. 6 is sequentially executed to the method 500 in FIG. 5. In this case, the computing device 102 implementing the method 600 in FIG. 6 may or may not be the same as the computing device 102 implementing the method 500 in FIG. 5. In an example, at least some of the steps in the method 600 are implemented by at least one processor in the computing device 102.

[0081]

[0088] The method 600 begins with an optional step 602, where at least two of a plurality of secret share storage devices or media 438 are acquired by the computing device 102, and each secret share storage device or media 438 stores at least one acquired secret share 436-2 of the secret 434-1. The number of secret share storage devices or media 438 to be acquired depends on the values of M and N determined during the splitting of the secret 434-1. If M < N, the number of secret share storage devices or media 438 to be acquired is less than the number of distributed secret shares 436-1. If M = N, all of the distributed secret share storage devices or media 438 are acquired for the reconstruction of the secret 434-2. In an example, at least a subset of the secret share storage devices or media 438 are physically brought into the computing device 102. In an example, at least a subset of the share holders 442 may be required to bring their respective secret share storage devices or media 438 to a meeting at a specified date and time.

[0082]

[0089] The method 600 proceeds to step 604, where the secret share 436-1 is determined from the secret share storage device or medium 438, and, for example, the obtained secret share 436-2 is read from the secret share storage device or medium 438 and, optionally, stored in the computing device 102. If a storage device (e.g., a USB drive) is used, it may be connected to the computing device, for example, via a USB port or the like. If an optical medium (e.g., an M-DISC) is used, the optical medium may be placed in a disc drive in order to read the obtained secret shares 436-2 and, optionally, store them in the computing device 102.

[0083]

[0090] If the secret share 436-1 was encrypted before distribution, step 604 may include decrypting the secret share 436-1. If the secret share 436-1 was symmetrically encrypted (using a symmetric key) before distribution, it is symmetrically decrypted (using the same symmetric key) after retrieval. If the secret share 436-1 was asymmetrically encrypted (using a public key) before distribution, it is asymmetrically decrypted (using a private key that corresponds to the public key) after retrieval. If the secret share 436-1 was not encrypted before distribution to the shareholders 442, it does not need to be decrypted in step 604.

[0084]

[0091] Method 600 proceeds to step 606, where at least one processor determines metadata 440 (for secret 434-1), the metadata 440 having at least a list of hashes 437 of secret shares 436-1 that were generated before secret shares 436-1 were distributed to shareholders 442. In the example, metadata 440 is (1) generated using secret 434-1 (and The metadata 440 may also include (1) a list of addresses 332 (corresponding to each of the addresses 332 corresponding to the secret shares 434-1), (2) a mapping of an identifier for each security envelope or package used to distribute the secret shares 436-1 to a particular secret 434-1 / wallet number, (3) a copy of the hash function 212 code used to generate the share hash 437 in the metadata 440, and / or (4) a copy of the code used to split the secret 434-1 into secret shares 436-1 prior to distribution.

[0085]

[0092] Method 600 proceeds to optional step 608, where at least one processor verifies the obtained secret share 436-2. In an example, a hash of at least one of the obtained secret shares 436-2 is compared to a list of share hashes 437 in metadata 440. If the hash of the obtained secret share 436-2 matches a hash in the list of share hashes 437 (in metadata 440), it means that the obtained secret share 436-2 can be used to reconstruct the desired secret 434-2 (because it matches the secret share 436-1 originally distributed to shareholders 442-1). If the hash of the obtained secret share 436-2 does not match any hash in the list of share hashes 437 (in metadata 440), it means that the obtained secret share 436-2 cannot be used to reconstruct the desired secret 434-2 (because it is not one of the secret shares 436-1 originally distributed to shareholders 442). In the example, subsequent steps of the method 600 are performed only if all obtained secret shares 436-2 are verified in optional step 608.

[0086]

[0093] Method 600 proceeds to step 610, where at least one processor attempts to reconstruct secret 434-2 using the obtained secret share 436-2. In the example, step 610 uses a Shamir join that corresponds to what was the Shamir secret share (a division of secret 434-1) performed prior to distribution of secret share 436-1.

[0087]

[0094] Method 600 proceeds to optional step 612, where if the secret 434-2 cannot be reconstructed from the obtained secret shares 436-2, the at least one processor identifies at least one secret share 436-2 as incorrect based on the metadata 440. For example, optional step 612 may be performed in response to (1) an error occurring during the reconstruction of the secret 434-2, or (2) if the secret 434-2 does not match the original secret 434-1 that was reconstructed, split and distributed in step 610. This scenario (where reconstructed secret 434-2 does not match original secret 434-1) can be determined by (1) comparing the hash of the secret and reconstructed secret 434-1, (2) determining whether the account balance of the address associated with reconstructed secret 434-2 is correct (however, if the address has not received any transactions, the address may have no balance and / or may not appear in a blockchain explorer), or (3) comparing the address (in metadata 440) with the address derived from reconstructed secret 434-2.

[0088]

[0095] Optional step 612 may be performed similarly to optional step 608, e.g., a hash of at least one of the obtained secret shares 436-2 is compared to a list of share hashes 437 in metadata 440. If the hash of the obtained secret share 436-2 matches a hash in the list of share hashes 437 (in metadata 440), then This is the "correct" retrieved secret share 436-2 (because it matches the secret share 436-1 originally distributed to shareholders 442-1). If the hash of the retrieved secret share 436-2 does not match any hash in the list of share hashes 437 (in metadata 440), then it is identified as the "incorrect" retrieved secret share 436-2 (because it is not one of the secret shares 436-1 originally distributed to shareholders 442).

[0089]

[0096] Thus, if one of the shareholders 442 brings in (intentionally or unintentionally) the incorrect secret share storage device or medium 438, the method 600 can help narrow down the problem to the particular shareholder 442's secret share storage device or medium 438 (which holds the obtained incorrect secret share 436-2). By narrowing down the source of the problem to the particular shareholder 442, the problem can be appropriately addressed.

[0090]

[0097] In instances where the secret share storage device or medium 438 is distributed in a tamper-proof and / or tamper-evident security envelope or package, the security envelope or package may list the secret 434-1 identifier (e.g., “Wallet 1”) so that a shareholder 442 can easily identify which of multiple security envelopes or packages in his or her possession he or she needs to bring to reconstruct a particular secret 434-1.

[0091]

[0098] Additionally, by separating metadata 440 from secret share storage devices or media 438, a fraudulent owner of metadata 440 or secret share storage devices or media 438 would likely not have enough information to steal the remaining secret share storage devices or media 438 to reconstruct secret 434-2. In fact, a fraudulent owner of one of secret share storage devices or media 438 may not know what type of data is represented by secret share 436-1, or whether or how much it is valuable. However, metadata 440 may still be useful even without secret share storage devices or media 438, for example, allowing someone to monitor transactions associated with addresses listed in metadata 440 and / or send cryptocurrency to addresses in metadata 440.

[0092]

[0099] Furthermore, the mapping of which individuals are shareholders 442 may not be readily available from the metadata 440 or secret share storage device or medium 438. Such a mapping may itself pose a threat to the security of the shareholders 442. By not including this mapping in the metadata 440, it becomes more difficult to know which individuals are shareholders 442. However, in some configurations, there may be another mapping (of individuals to security envelope or package numbers) that is accessible to a very small number of people.

[0093]

[0100] Method 600 proceeds to optional step 614, where once secret 434-2 has been reconstructed from the obtained secret shares 436-2, at least one processor performs an action requiring the reconstructed secret 434-2. Examples of such actions include (1) encrypting or decrypting data using the reconstructed secret 434-2, (2) generating a transaction address in a distributed ledger based on the reconstructed secret 434-2, and / or (3) sending cryptocurrency from the address using the reconstructed secret 434-2. This may include signing the transaction.

[0094]

[0101] In examples, method 600 is performed without displaying reconstructed secret 434-1 or even reconstructed secret portion 436-1 to the user. For added security, in some configurations, method 600 is performed with at least one (e.g., two) witnesses in addition to the user performing process 600 to ensure that secret 434-1 and secret share 436-1 are not distributed without authorization.

[0095]

[0102] The techniques introduced herein can be embodied as dedicated hardware (such as circuitry), as programmable circuitry suitably programmed with software and / or firmware, or as a combination of dedicated and programmable circuitry. Thus, the embodiments can include a machine-readable medium having stored thereon instructions that can be used to program a computer (or other electronic device) to execute a process. The machine-readable medium can include, for example, a floppy disk, an optical disk, a compact disk read-only memory (CD-ROM), a magneto-optical disk, a read-only memory (ROM), a random access memory (RAM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic or optical card, a flash memory, or any other type of medium / machine-readable medium suitable for storing electronic instructions.

[0096]

[0103] Computer System Overview

[0104] The embodiments of the present disclosure include various steps and operations described above. These various steps and operations may be performed by hardware components or may be embodied in machine-executable instructions used to cause a general-purpose or special-purpose processor programmed with the instructions to perform the steps. Alternatively, the steps may be performed by a combination of hardware, software, and / or firmware. Thus, FIG. 7 is an example of a computer system 700 that may utilize embodiments of the present disclosure. According to this example, the computer system 700 includes an interconnect 702, at least one processor 704, at least one communication port 706, at least one main memory 708, at least one removable storage medium 710, at least one read-only memory 712, and at least one mass storage device 714.

[0097]

[0105] The at least one processor 704 may be any known processor. The at least one communication port 706 may be or include, for example, an RS-232 port for use with a modem-based dial-up connection, a 10 / 100 Ethernet port, or a gigabit port using copper or fiber. The nature of the at least one communication port 706 may be selected depending on the network, such as a local area network (LAN), a wide area network (WAN), or any network to which the computer system 700 connects. The at least one main memory 708 may be a random access memory (RAM) or any other dynamic storage device generally known in the art. The at least one read-only memory 712 may be any static storage device, such as a programmable read-only memory (PROM) chip for storing static information, such as instructions for the at least one processor 704.

[0098]

[0106] At least one mass storage device 714 may be used to store information and instructions, such as a hard disk (such as a magnetic disk drive or solid state drive using a serial / parallel ATA or SCSI interface), an optical disk, a redundant array of independent disks (RADs), or a combination of both. .AID), or other mass storage devices. The interconnect 702 may be or include one or more buses, bridges, controllers, adapters, and / or point-to-point connections. The interconnect 702 communicatively couples the at least one processor 704 with other memory, storage, and communication blocks. The interconnect 702 may be a PCI / PCI-X or SCSI-based system bus, depending on the storage device used. The at least one removable storage medium 710 may be any type of external hard drive, floppy drive, compact disk read only memory (CD-ROM), compact disk re-writable (CD-RW), digital video disk read only memory (DVD-ROM), Blu-Ray disk read only memory (BD-ROM), Blu-Ray disk recordable (BD-R), Blu-Ray disk recordable erasable (BD-RE), MILLENNIAL DISC (M-DISC), etc.

[0099]

[0107] The above components are intended to illustrate some types of possibilities. The foregoing examples are merely exemplary embodiments and should not limit the present disclosure in any way. The embodiments, structures, methods, etc. described herein, including those described below and above, can be combined together in various ways.

[0100]

[0108] term

[0109] Below are brief definitions of terms, abbreviations, and phrases used throughout this application.

[0101]

[0110] The terms "connected," "coupled," and "communicatively coupled" and related terms are used in an operational sense and are not necessarily limited to a direct physical connection or coupling. Thus, for example, two devices may be directly coupled or coupled through one or more intermediate media or devices. As another example, devices may be coupled such that information can be passed between the devices without sharing a physical connection with each other. Based on the disclosure provided herein, one of ordinary skill in the art will recognize various ways in which a connection or coupling exists in accordance with the foregoing definition.

[0102]

[0111] The phrase "based on" does not mean "based only on," unless expressly specified otherwise. In other words, the phrase "based on" refers to both "based only on" and "based at least on." In addition, the term "and / or" means "and" or "or." For example, "A and / or B" can mean "A," "B," or "A and B." In addition, "A, B, and / or C" can mean "A only," "B only," "C only," "A and B," "A and C," "B and C," or "A, B, and C."

[0103]

[0112] Phrases such as "in an exemplary embodiment," "in an illustrative embodiment," "in some embodiments," "according to some embodiments," "in an illustrated embodiment," "in another embodiment," "embodiment," "in an example," "example," "in some examples," "some examples," and the like generally mean that the particular feature, structure, or characteristic that follows the phrase is included in at least one embodiment of the present disclosure, and may be included in more than one embodiment of the present disclosure. Additionally, such phrases do not necessarily refer to the same or different embodiments.

[0104]

[0113] If the specification states that an element or feature "may," "can," "could," or "could" include, or that an element or feature "may," "can," "could," or "could" have a characteristic, When a description states that something "may" be included or have, that particular component or feature does not have to be included or have that characteristic.

[0105]

[0114] The term "react" includes fully or partially reacting.

[0115] The term "module" broadly refers to a component of software, hardware, or firmware (or any combination thereof). A module is typically a functional component that can use specified inputs to produce useful data or other output. A module may or may not be self-contained. An application program (also called an "application") may contain one or more modules, or a module may contain one or more application programs.

[0106]

[0116] The term "network" generally refers to a group of interconnected devices that can exchange information. A network may be as small as a few personal computers on a local area network (LAN) or as large as the Internet, a worldwide computer network. As used herein, "network" is intended to encompass any network that can transmit information from one entity to another. In some cases, a network may consist of multiple networks or even multiple heterogeneous networks, such as one or more border networks, voice networks, broadband networks, financial networks, service provider networks, Internet service provider (ISP) networks, and / or public switched telephone networks (PSTN), interconnected via gateways operable to facilitate communication between the various networks.

[0107]

[0117] Also, for purposes of illustration, various embodiments of the present disclosure have been described in the context of computer programs, physical components, and logical interactions within a modern computer network. Importantly, while these embodiments describe various embodiments of the present disclosure in relation to modern computer networks and programs, the methods and apparatus described herein are equally applicable to other systems, devices, and networks, as will be understood by those skilled in the art. Thus, the illustrated applications of the embodiments of the present disclosure are intended to be examples, not limitations. Other systems, devices, and networks to which the embodiments of the present disclosure are applicable include, for example, other types of communication and computer devices and systems. More specifically, the embodiments are applicable to communication systems, services, and devices, such as cell phone networks and compatible devices. In addition, the embodiments are applicable to all levels of computing, from personal computers to large network mainframes and servers.

[0108]

[0118] In conclusion, the present disclosure provides novel systems, methods, and configurations for secret splitting and metadata storage. Although a detailed description of one or more embodiments of the present disclosure has been given above, various alternatives, modifications, and equivalents will be apparent to those skilled in the art without departing from the spirit of the present disclosure. For example, while the above embodiments refer to certain features, the scope of the present disclosure also includes embodiments having different combinations of features and embodiments that do not include all of the described features. Thus, the scope of the present disclosure is intended to encompass all alternatives, modifications, and variations that fall within the scope of the claims, and all equivalents thereof. Thus, the above description should not be construed as limiting. example

[0119] Example 1 includes at least one processor and at least one memory communicatively coupled to the at least one processor, the at least one processor determining a secret to be protected, dividing the secret into a number of secret shares, and The method includes a computing device configured to: transfer each secret share, where at least a subset of the plurality of secret shares is required to reconstruct the secret, to a respective portable storage device or medium for distribution to a respective shareholder; generate metadata using at least a hash of each secret share; and store the metadata using the secret shares separately from the portable storage device or medium.

[0109]

[0120] Example 2 includes the computing device of example 1, wherein each of the secret, the secret share, and the hash of the secret share are strings of different characters.

[0110]

[0121] Example 3 includes the computing device of any of examples 1-2, wherein the secret is a cryptographic private key or a mnemonic phrase or seed that can be used to reconstruct the private key.

[0111]

[0122] Example 4 includes the computing device of any of Examples 1-3, wherein the at least one processor is configured to split the secret into multiple secret shares using Shamir secret shares or polynomial interpolation.

[0112]

[0123] Example 5 includes the computing device of any of Examples 1-4, wherein the at least one processor is configured to verify the secret shares by using each secret share at least once to reconstruct the secret, and the secret shares are simply transferred to a respective portable storage device or medium after the secret share is successfully verified.

[0113]

[0124] Example 6 includes the computing device of any of Examples 1-5, wherein the at least one processor is configured to, prior to determining the secret, erase contents of the at least one storage device in the computing device, perform a clean install of the operating system, and delete copies of the secret and secret shares stored locally on the computing device after transferring each secret share to a respective portable storage device or medium.

[0114]

[0125] Example 7 includes the computing device of any of Examples 1-6, wherein the secret is a cryptographic private key or a mnemonic phrase or seed that can be used to recover the cryptographic private key, and the at least one processor is configured to determine the secret by generating the cryptographic private key or the mnemonic phrase or seed.

[0115]

[0126] Example 8 includes the computing device of example 7, wherein the at least one processor also generates the following information in the metadata: a public key corresponding to the cryptographic private key; and at least one address in the distributed ledger.

[0116]

[0127] Example 9 includes the computing device of any of Examples 1-8, wherein the at least one processor is configured to determine secret shares obtained from at least two secret share storage devices or media obtained from the shareholders, and to attempt to reconstruct the secret using the secret shares obtained from the at least two secret share storage devices or media.

[0117]

[0128] Example 10 includes the computing device of example 9, wherein the at least one processor is configured to: The method is configured to identify at least one of the obtained secret shares as incorrect based on the data.

[0118]

[0129] Example 11 includes a method for secret splitting and metadata storage including determining a secret to be protected, splitting the secret into a number of secret shares, where at least a subset of the number of secret shares are required to reconstruct the secret, transferring each secret share to a respective portable storage device or medium for distribution to a respective shareholder, generating metadata using at least a hash of each secret share, and storing the metadata using the secret shares separately from the portable storage device or medium.

[0119]

[0130] Example 12 includes the method of example 11, wherein the secret, the secret share, and the hash of the secret share are each a string of different characters.

[0131] Example 13 includes the method of any of examples 11-12, wherein the secret is a cryptographic private key or a mnemonic phrase or seed that can be used to reconstruct the private key.

[0120]

[0132] Example 14 includes the method of any of examples 11-13, wherein the splitting includes splitting the secret into multiple secret shares using Shamir secret shares or polynomial interpolation.

[0121]

[0133] Example 15 includes the method of any of Examples 11-14, further including verifying the secret shares by using each secret share at least once to reconstruct the secret, and the secret shares are simply transferred to the respective portable storage device or medium after the secret shares are successfully verified.

[0122]

[0134] Example 16 includes the method of any of Examples 11-15, and further includes, prior to determining the secret, erasing the contents of at least one storage device and performing a clean install of the operating system on the computing device, and after transferring each secret share to a respective portable storage device or medium, deleting copies of the secret and secret shares stored locally on the computing device.

[0123]

[0135] Example 17 includes the method of any of Examples 11-16, wherein the secret is a cryptographic private key or a mnemonic phrase or seed that can be used to recover the cryptographic private key, and the secret is determined by generating the cryptographic private key or the mnemonic phrase or seed.

[0124]

[0136] Example 18 includes the method of example 17, further including generating the following information in the metadata: a public key corresponding to the cryptographic private key, and at least one address in the distributed ledger.

[0125]

[0137] Example 19 includes the method of any of Examples 11-18, further including determining a secret share obtained from each of the at least two secret share storage devices or media obtained from the shareholder, and attempting to reconstruct the secret using the secret shares obtained from the at least two secret share storage devices or media.

[0126]

[0138] Example 20 includes the method of example 19, further comprising: If the secret share cannot be reconstructed, the method further includes identifying at least one of the obtained secret shares as incorrect based on the metadata.

[0127]

[0139] Example 21 includes a computing device comprising at least one processor and at least one memory communicatively coupled to the at least one processor, the at least one processor configured to determine a secret share retrieved from each of at least two secret share storage devices or media retrieved from at least two of a plurality of shareholder(s), determine metadata having a list of at least hashes of the plurality of secret shares generated before the secret shares were distributed to the plurality of shareholder(s), attempt to reconstruct a secret using the secret shares retrieved from the at least two secret share storage devices or media, and if the secret cannot be reconstructed from the retrieved secret share, identify at least one of the retrieved secret shares as incorrect based on the metadata.

[0128]

[0140] Example 22 includes the computing device of example 21, wherein each of the secret, the obtained secret share, and the hash of the multiple secret shares are strings of different characters.

[0129]

[0141] Example 23 includes the computing device of any of Examples 21-22, wherein the secret is a cryptographic private key or a mnemonic phrase or seed that can be used to reconstruct the private key.

[0130]

[0142] Example 24 includes the computing device of any of Examples 21-23, wherein the at least one processor is configured to attempt to reconstruct the secret using a Shamir combine.

[0131]

[0143] Example 25 includes the computing device of any of Examples 21 to 24, wherein the at least one processor is configured to verify each of the obtained secret shares by comparing each of the obtained secret shares with a list of hashes in the metadata, and if each of the obtained secret shares matches a hash in the list of hashes in the metadata, then each of the obtained secret shares is successfully verified.

[0132]

[0144] Example 26 includes the computing device of example 25, wherein the at least one processor is configured to attempt to reconstruct the secret only after the secret share is successfully verified.

[0133]

[0145] Example 27 includes the computing device of any of Examples 21-26, wherein the at least one processor is configured to perform at least one of the following actions requiring the reconstructed secret when the secret is reconstructed from the obtained secret share: encrypting or decrypting data using the reconstructed secret, generating a transaction address in the distributed ledger based on the reconstructed secret, or signing a transaction using the reconstructed secret, where the transaction sends or signs cryptocurrency from an address in the distributed ledger.

[0134]

[0146] Example 28 includes the computing device of any of Examples 21 to 27, wherein the at least one processor performs a seek before the secret shares to be obtained are determined. The method is configured to divide the secret into a plurality of secret shares, at least a subset of the plurality of secret shares being required to reconstruct the secret, and to transfer each secret share to a respective portable storage device or medium, each portable storage device or medium being distributed to a plurality of shareholder.

[0135]

[0147] Example 29 includes a method including determining a secret share obtained from each of at least two secret share storage devices or media obtained from at least two of a plurality of shareholder, determining metadata having a list of at least hashes of the plurality of secret shares generated before the secret shares were distributed to the plurality of shareholder, attempting to reconstruct a secret using the secret shares obtained from the at least two secret share storage devices or media, and if the secret cannot be reconstructed from the obtained secret share, identifying at least one of the obtained secret shares as incorrect based on the metadata.

[0136]

[0148] Example 30 includes the method of example 29, wherein each of the secret, the obtained secret share, and the hash of the multiple secret shares are strings of different characters.

[0137]

[0149] Example 31 includes the method of any of examples 29-30, wherein the secret is a cryptographic private key or a mnemonic phrase or seed that can be used to reconstruct the private key.

[0138]

[0150] Example 32 includes the method of any of examples 29-31, further including attempting to reconstruct the secret using a Shamir combine.

[0151] Example 33 includes the method of any of Examples 29 to 32, further including verifying each obtained secret share by comparing each obtained secret share to the list of hashes in the metadata, where if each obtained secret share matches a hash in the list of hashes in the metadata, each obtained secret share is successfully verified.

[0139]

[0152] Example 34 includes the method of example 33, wherein the attempting includes attempting to reconstruct the secret only after the secret share is successfully verified.

[0153] Example 35 includes the method of any of Examples 29-34, further including, when the secret is reconstructed from the obtained secret share, performing at least one of the following actions requiring the reconstructed secret: encrypting or decrypting data using the reconstructed secret, generating a transaction address in the distributed ledger based on the reconstructed secret, or signing a transaction using the reconstructed secret, where the transaction sends or signs cryptocurrency from an address in the distributed ledger.

[0140]

[0154] Example 36 includes the method of any of Examples 29-35, further including splitting the secret into a plurality of secret shares before the secret shares to be obtained are determined, where at least a subset of the plurality of secret shares are required to reconstruct the secret, and transferring each secret share to a respective portable storage device or medium, where each portable storage device or medium is distributed to a plurality of shareholder.

Claims

1. 1. A computing device comprising: At least one processor; at least one memory communicatively coupled to the at least one processor; The at least one processor Determine which secrets should be protected, splitting the secret into a number of secret shares, at least a subset of the number of secret shares being required to reconstruct the secret; transferring each secret share to a respective portable storage device or medium for distribution to each shareholder; generating metadata using at least a hash of each secret share; A computing device configured to use the secret share to store the metadata separately from the portable storage device or medium.

2. The computing device of claim 1 , wherein the secret, the secret share, and the hash of the secret share are each a string of different characters.

3. The computing device of claim 1 , wherein the secret is a cryptographic private key or a mnemonic phrase or seed that can be used to reconstruct a private key.

4. 2. The computing device of claim 1, wherein the at least one processor is configured to divide the secret into the multiple secret shares using Shamir secret shares or polynomial interpolation.

5. the at least one processor is configured to verify the secret shares by using each secret share at least once to reconstruct the secret; 10. The computing device of claim 1, wherein the secret shares are simply transferred to a respective portable storage device or medium after the secret shares have been successfully verified.

6. The at least one processor prior to determining the secret, erasing the contents of at least one storage device and performing a clean install of an operating system on the computing device; 10. The computing device of claim 1, configured to delete copies of the secret and the secret shares stored locally on the computing device after transferring each secret share to a respective portable storage device or medium.

7. the secret is a cryptographic private key or a mnemonic phrase or seed that can be used to recover the cryptographic private key; The computing device of claim 1 , wherein the at least one processor is configured to determine the secret by generating the cryptographic private key or mnemonic phrase or seed.

8. The at least one processor also includes in the metadata the following information: Wow, a public key corresponding to said cryptographic private key; and at least one address in the distributed ledger.

9. The at least one processor determining secret shares to be obtained from at least two secret share storage devices or media obtained from said shareholder; The computing device of claim 1 , configured to attempt to reconstruct the secret using the secret shares obtained from the at least two secret share storage devices or media.

10. 10. The computing device of claim 9, wherein the at least one processor is configured to identify at least one of the obtained secret shares as incorrect based on the metadata if the secret cannot be reconstructed from the obtained secret shares.

11. 1. A method for secret splitting and metadata storage, comprising: determining a secret to be protected; splitting the secret into a number of secret shares, where at least a subset of the number of secret shares is required to reconstruct the secret; transferring each secret share to a respective portable storage device or medium for distribution to a respective shareholder; generating metadata using at least a hash of each secret share; and storing said metadata separately from said portable storage device or medium using said secret share.

12. 12. The method of claim 11, wherein the secret, the secret share, and the hash of the secret share are each strings of different characters.

13. The method of claim 11 , wherein the secret is a cryptographic private key or a mnemonic phrase or seed that can be used to reconstruct a private key.

14. 12. The method of claim 11, wherein the step of dividing comprises dividing the secret into the multiple secret shares using Shamir secret shares or polynomial interpolation.

15. verifying the secret shares by using each secret share at least once to reconstruct the secret; The method of claim 11, wherein the secret shares are simply transferred to the respective portable storage device or medium after the secret shares have been successfully verified.

16. prior to the step of determining the secret, erasing the contents of at least one storage device and performing a clean install of the operating system on the computing device; and after the step of transferring each secret share to a respective portable storage device or medium, deleting copies of the secret and the secret shares stored locally on the computing device. The method described.

17. the secret is a cryptographic private key or a mnemonic phrase or seed that can be used to recover the cryptographic private key; The method of claim 11 , wherein the secret is determined by generating the cryptographic private key or mnemonic phrase or seed.

18. In said metadata, the following information is included: a public key corresponding to said cryptographic private key; At least one address in a distributed ledger; The method of claim 17 further comprising the step of generating:

19. determining a secret share to be obtained from each of at least two secret share storage devices or media obtained from said shareholder; and attempting to reconstruct the secret using the secret shares obtained from the at least two secret share storage devices or media.

20. 20. The method of claim 19, further comprising identifying at least one of the obtained secret shares as incorrect based on the metadata if the secret cannot be reconstructed from the obtained secret shares.

21. 1. A computing device comprising: At least one processor; at least one memory communicatively coupled to the at least one processor; The at least one processor determining a secret share obtained from each of at least two secret share storage devices or media obtained from at least two of the plurality of shareholder; determining metadata comprising a list of at least hashes of a plurality of secret shares generated before the secret shares were distributed to the plurality of shareholder; attempting to reconstruct the secret using the secret shares obtained from the at least two secret share storage devices or media; a computing device configured to identify at least one secret share of the obtained secret shares as incorrect based on the metadata if the secret cannot be reconstructed from the obtained secret shares.

22. 22. The computing device of claim 21, wherein the secret, the obtained secret share, and the hash of the multiple secret shares are each a string of different characters.

23. 22. The computing device of claim 21, wherein the secret is a cryptographic private key or a mnemonic phrase or seed that can be used to reconstruct a private key.

24. 22. The computing device of claim 21, wherein the at least one processor is configured to attempt to reconstruct the secret using a Shamir combine.

25. the at least one processor is configured to verify each of the obtained secret shares by comparing the respective obtained secret share to the list of hashes in the metadata; 22. The computing device of claim 21, wherein each obtained secret share is successfully verified if the each obtained secret share matches a hash in the list of hashes in the metadata.

26. 26. The computing device of claim 25, wherein the at least one processor is configured to attempt to reconstruct the secret only after the secret share is successfully verified.

27. The at least one processor, when the secret is reconstructed from the obtained secret share, performs one of the following actions requiring the reconstructed secret: encrypting or decrypting data using the reconstructed secret; generating a transaction address in a distributed ledger based on the reconstructed secret; or 22. The computing device of claim 21, further configured to: sign a transaction using the reconstructed secret, the transaction performing at least one of: sending cryptocurrency from an address in the distributed ledger; and signing.

28. The at least one processor, before the obtained secret share is determined, splitting the secret into the plurality of secret shares, where at least a subset of the plurality of secret shares is required to reconstruct the secret; and transferring each secret share to a respective portable storage device or medium; 22. The computing device of claim 21, wherein each portable storage device or medium is distributed to the multiple shareholders.

29. 1. A method comprising: determining a secret share obtained from each of at least two secret share storage devices or media obtained from at least two of the plurality of shareholder; determining metadata comprising a list of at least hashes of a plurality of secret shares generated before the secret shares were distributed to the plurality of shareholder; attempting to reconstruct the secret using the secret shares obtained from the at least two secret share storage devices or media; and identifying at least one of the obtained secret shares as incorrect based on the metadata if the secret cannot be reconstructed from the obtained secret shares.

30. 30. The method of claim 29, wherein the secret, the obtained secret share, and the hash of the multiple secret shares are each a string of different characters.

31. 30. The method of claim 29, wherein the secret is a cryptographic private key or a mnemonic phrase or seed that can be used to reconstruct a private key.

32. 30. The method of claim 29, further comprising attempting to reconstruct the secret using a Shamir combine.

33. verifying each of the obtained secret shares by comparing the respective secret shares to the list of hashes in the metadata; 30. The method of claim 29, wherein each obtained secret share is successfully verified if the each obtained secret share matches a hash in the list of hashes in the metadata.

34. 34. The method of claim 33, wherein the attempting step includes attempting to reconstruct the secret only after the secret share is successfully verified.

35. When the secret has been reconstructed from the obtained secret share, the following actions require the reconstructed secret: encrypting or decrypting data using the reconstructed secret; generating a transaction address in a distributed ledger based on the reconstructed secret; or 30. The method of claim 29, further comprising performing at least one of the following steps: signing a transaction using the reconstructed secret, the transaction transferring cryptocurrency from an address in the distributed ledger.

36. Before the secret shares to be acquired are determined, splitting the secret into the plurality of secret shares, where at least a subset of the plurality of secret shares is required to reconstruct the secret; and transferring each secret share to a respective portable storage device or medium; 30. The method of claim 29, wherein each portable storage device or medium is distributed to the multiple shareholders.

Images