Hardware Wallet MPC Backup Using Distributed Key Shares
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing electronic devices and communication networks are vulnerable to hacking and illicit access, particularly due to structural weaknesses in secure elements and single-key security architectures, which can lead to loss or compromise of security keys and undermine the theoretical security of stored data.
Innovation Solution
A secure electronic device integrates a secure element with a high-capacity processing device and storage memory on a single monolithic chip, incorporating a secure bus structure and embedded hardware logic to protect against hacking, and implements a multi-party computation (MPC) framework for decentralized secret data generation and backup, allowing recovery of lost or compromised security data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single-key security architecture is used, then the device structure is simple, but the security key can be lost or compromised
Solution Approach 1:
The security key is divided into multiple segments and distributed across different devices. Each device holds only a portion of the key, and the complete key can be reconstructed only when all segments are combined through the recovery system, preventing any single device from having full key access.
Solution Approach 2:
A recovery server acts as an intermediary that coordinates the distribution and reconstruction of key segments. The server manages the secure storage of segments and facilitates the key reconstruction process without any single device holding the complete key, adding a layer of security mediation.
2Ease of operation
If security data is stored in a single device, then access is convenient, but the data is vulnerable to hacking and loss
Solution Approach 1:
Security data is segmented and distributed across multiple devices including mobile devices, hardware wallets, and cloud storage. This segmentation ensures that no single device contains the complete security data, making it resistant to hacking attempts on individual devices while maintaining accessible recovery paths.
Solution Approach 2:
The system changes the storage parameter from centralized to distributed across multiple locations and device types. This parameter change transforms the security model from vulnerable single-point storage to resilient multi-point distribution, reducing hacking vulnerability while preserving access through the recovery mechanism.
3Productivity
If cryptographic keys are stored in memory, then the algorithm execution is efficient, but the memory structure can be exploited by hackers
Solution Approach 1:
The complete cryptographic key is extracted from any single memory location and distributed across multiple devices. Only key segments are stored in individual device memories, which reduces the value of memory exploitation since hackers cannot obtain the complete key from a single memory breach. The full key functionality is restored only through coordinated reconstruction.
4Reliability
If a decentralized backup system is implemented, then security is improved, but the system complexity increases
Solution Approach 1:
A recovery server serves as a centralized intermediary that manages the decentralized backup system. The server coordinates segment distribution, handles reconstruction requests, and maintains system state without requiring complex peer-to-peer communication between all devices. This intermediary approach achieves decentralized security with manageable system complexity.
Solution Approach 2:
The recovery server performs multiple functions including segment distribution, key reconstruction coordination, device authentication, and backup management. This multi-functionality consolidates complex operations into a single versatile component, reducing overall system complexity while maintaining decentralized backup reliability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Backup and recovery of multi-party computation (MPC) security data utilized to secure digital assets and transactions thereof can enhance user confidence and user experience in digital asset transactions. Example MPC security data can include cryptographic keys and key shares utilized with a N x M MPC signature and validation framework. A computing device participating in generation of MPC secure data can retain a segment of the MPC secure data and can encrypt and store an encrypted segment at a second device. A recovery service or recovery application at the second device can facilitate recovery of the MPC secure data segment at the computing device, or at an additional device not involved in generation of the MPC secure data. The recovery service or application can facilitate recovery of the MPC secure data segment even in the event the computing device is lost.