Delegated Signing System for Blockchain Key Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The complexity of blockchains and key management hinders fast development and can lead to unintended errors, especially for non-experts in cryptography, and there is a need for improved signature management for blockchain applications and wallet services.
Innovation Solution
A system for delegated signing that involves an end user device, an application provider server, and a signing system, where the end user device initiates transactions without storing the private key, using a multi-party signing algorithm and authentication challenges to ensure security and authorization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the private key is stored on the end user device, then the device can independently sign transactions, but the security of the signing key is compromised due to vulnerabilities to viruses and malicious software
Solution Approach 1:
The private key is extracted from the end user device and stored externally on secure servers. The device retains only a public key and can initiate transactions, but the actual signing operation is performed externally, eliminating the security vulnerability of storing private keys on potentially compromised devices.
Solution Approach 2:
An intermediary signing system is introduced between the end user device and the blockchain network. This intermediary performs the signing operation using externally stored keys, allowing the device to maintain transaction initiation capability while removing the security risk of local private key storage.
2Reliability
If advanced cryptography such as Threshold Signature Scheme and Distributed Key Generation is implemented, then high security is achieved, but the system complexity increases and hinders fast development
Solution Approach 1:
The system provides self-service key management through automated key generation, storage, and signing operations performed by the intermediary system. Users simply need to create accounts and initiate transactions, while the complex cryptographic operations are automatically handled by the service infrastructure, making advanced cryptography accessible to non-experts.
Solution Approach 2:
An intermediary service layer abstracts the complex cryptographic operations from end users. The service handles Threshold Signature Scheme implementation, Distributed Key Generation, and multi-signature coordination, allowing developers to build applications without directly implementing complex cryptographic protocols.
3Reliability
If the signing key is not stored on the end user device, then security is improved, but the device loses the ability to control transaction signing independently
Solution Approach 1:
The system implements feedback mechanisms where the end user device sends transaction requests to the intermediary service, which then performs signing operations and returns signed transactions. This feedback loop maintains user control over transaction initiation and approval while the actual signing is performed securely externally.
Solution Approach 2:
An intermediary service acts as a trusted mediator that enables the device to control transaction signing without storing private keys locally. The intermediary responds to device requests with signed transactions, maintaining the device's control capability while ensuring security through external key management.
Data Source
AI summary
Some embodiments are directed to an improved system for delegated signing, comprising one or more end user devices, one or more application provider servers and a signing system. An end user device may initiate a transaction associated with the end user device. Before the transaction can be processed, a signature is needed on a message derived from the transaction data. The message may be signed by a plurality of signing devices using a multi-party signing algorithm. A signing system may instruct a plurality of signing devices to sign the message. Before the signing system may so instruct, the system may have an authentication challenge signed by the end user device. The signing system further may verify whether the end user device is authorized to perform the transaction.