System and Method of Virtual Private Keys

Abstract

A system for generating a virtual private key using personal credentials for establishing a trust relationship between two or more entities, wherein the credentials are stored on a remote secure repository and using information and data, comprising: personal knowledge and a suite of algorithms and methodologies integrated, without using third party information, in such a manner that the private key can be securely generated without exposing the credentials entity.

Claims

1. A system for generating a virtual private key to be used to establish a trust relationship between a user and one or more entities, the system comprising: a user device with a processor and a memory; a credential factory comprising a private key miner; a credential generator; wherein the credential factory generates a virtual private key at a user's request, the credential factory obtains user credentials through the credential generator, the virtual private key is used to generate a valid sequence of 24 words selected from a list of 2048 words and the factory generates a separate public key that is associated with the virtual private key.

2. The system for generating a virtual private key of claim 1, wherein anonymous user credentials are sent by the credential generator to a secure escrow server with a secure escrow database.

3. The system for generating a virtual private key of claim 1, wherein the user credentials comprise personal information of the user not known publicly.

4. The system for generating a virtual private key of claim 3, wherein the system employs the user credentials and a suite of algorithms and methodologies to securely generate the virtual private key without exposing the user credentials, and thus requiring no third party information to generate a key.

5. The system for generating a virtual private key of claim 4, wherein the virtual private key derives mnemonic words, further comprising a digital wallet on the user device for storing encrypted random information on a user device RAM, wherein the system uses the encrypted random information to derive and make available the virtual private key and the mnemonic words only when the user is actively using an algorithm running on the system to generate the virtual private key.

6. The system for generating a virtual private key of claim 1, wherein: the virtual private key is not stored in any database and is maintained only in a virtual state; whenever the virtual private key is needed it can be regenerated from personal knowledge of the user by first generating anonymous credentials and then passing these anonymous credentials to the private key miner; and all other components of the system that do not require secrecy can be stored as normal.

7. A system for generating the virtual private key of claim 1, comprising the steps of: 1. Downloading the credential factory to the memory of the user device; 2. Providing an interface with the user and the credential generator allowing the user to input personal credentials; 3. Requesting the credential factory to make the virtual private key; 4. Transferring the user credentials from the credential generator to the credential factory; 5. Generating the virtual private key with the credential factory using an anonymous credential; 6. Generating a public key associated with the virtual private key with the credential factory; and 7. Storing the public key on the memory of the user device.

8. The system of claim 1, wherein the virtual private key is stored by the user.

9. The system of claim 7, further including the following step: 8. Storing the anonymized personal credentials associated with the virtual private key to secure escrow server and secure escrow database.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0033] FIG. 1 is a schematic drawing evidencing an overview of one example of the system and method of virtual private keys disclosed herein.

[0034] FIG. 2 is a flow chart evidencing steps in the inventive method of using the system of FIG. 1.

[0035] FIG. 3 is a flow chart evidencing steps in the private key miner feature of the system of FIG. 1.

DETAILED DESCRIPTION OF THE INVENTION

[0036] The inventive generation of a virtual private key, in one example, is used to share data between two or more entities. At the same time, the virtual private key can be used in commercial endeavors such as Crypto Currency. The inventive private key is established from the personal credentials of an individual and could also be salted with other personal information.

[0037] This methodology makes provision for securely storing the credentials on a remote secure repository using the inventive methodologies contained herein. One example of the disclosed system uses information and data, comprising: personal user knowledge and a suite of algorithms and methodologies integrated in such a manner that a private key can be securely generated without exposing the credential entity, such as a username and a password chosen by the user. In one embodiment, no third-party information is required to generate the key. The user credentials are passed through non-reversible methodologies that render them anonymous. In the present system, hashing algorithms and randomizing algorithms are used in the virtual key generation and regeneration process.

[0038] One example of this embodiment would be the registration of a user into a system, wherein the user must provide an acceptable username and password. These user credentials would then be used to generate a pseudo random string, which string would then be used to generate the private key. The properties of the resulting private key are that it can be regenerated and that it can be virtual. Additionally, because it is user knowledge, the username and the password do not need to be stored on any system. In the present case to be compatible with existing systems, the private key is generated in such a manner that it can be used in commerce. More specifically, the private key can be used to generate a valid sequence of 24 words selected from a list of 2048 words that is valid for crypto wallets. While there are other methodologies for generating this list, the present inventive method begins with user credentials. The user credentials cannot be obtained by reversing the process.

[0039] The present invention makes use of the properties of Elliptic curves to generate appropriate private and public keys. While the use of these Elliptic curves is well known, the methodology described herein is unique and innovative. The methodology makes use of a “mining” process inside the CF to generate a 32 byte (8bits each) string that will produce a sequence of 24 words from a list of 2048 commonly known words. These 24 words are the basis for forming private keys in Crypto Currency, for example. For further clarification it should be noted that there are two mutually exclusive public keys that can be generated from this methodology, namely, the public key derived from the virtual private key and the public key derived from the key derived from the word sequence. One of these public keys is appropriate for Crypto currency and the other is appropriate for sharing data.

[0040] In a primary embodiment, the inventive system is not limited to sharing data with one other entity. Rather, there is a provision for multiple entities to securely share the information. This embodiment relates to the formation and use of the private key as the public key can be derived from this private key. The system as designed does NOT require the use of any current public key infrastructure. The system is unique and inventive in that the credentials of the owner are not available to any other party, the private key may never be stored or exposed to the underlying system and may be virtual in that it can easily be regenerated. For convenience, the private key could be stored encrypted with a strong encryption key.

[0041] One primary embodiment of the system and method is pictured in FIG. 1, detailed herein below. In this embodiment, the public key and private key cannot be tampered with or forged without discontinuing access to the data. If either key is tampered with or forged, the decryption of the information will fail because there will not be a one-to-one relationship between the keys. The system will know immediately if the keys have been tampered with, as the authentication of the user will fail immediately, before any access to any encrypted data can start to occur. In this system, inherently any data encrypted with the credentials is secured until the necessary authentication credentials can be entered and verified. The methodology makes use of the inventive step that authentication can be achieved by the success or failure of encryption and decryption rather than by comparing credentials.

[0042] One advantage of of this type of a system is that it is possible to provide an effective trust system without exposing the critical private key. If a user's device is lost or stolen, a new private key and associated data can be regenerated using the users' personal credentials. The credentials can be strong, but they should be in the realm of being memorable.

[0043] In another primary embodiment, a system for generating a virtual private key as described, wherein the system employs the user's personal information and a suite of algorithms and methodologies integrated in such a manner that a private key is securely generated without exposing the credentials entity, such that no third-party information is required to generate the key. An example of this mechanism in action would be a Cryptocurrency wallet where the data is required to be secured and not exposed to anyone. Once the registration is completed, the information stored in the wallet is mathematically calculated to create the private key, which is used to derive mnemonic words. While most wallets will store the private key, mnemonics and the password for authentication purposes on the device with some minimal form of protection, that data can be exposed if the device is lost or stolen. This mechanism will not store any of that information, nor will it store any credentials associated with the user on the device. The private key and mnemonics for the wallet are derived only when needed from the encrypted random information stored in the wallet and held in RAM for the duration of the session. This protects the sensitive information, since it is only available in RAM during and active session and only when required by the user. When the session ends, that sensitive information is removed from RAM and cannot be derived from the device if it is lost or stolen. This mechanism allows the wallet to be secure from intrusion whenever the session is inactive.

Detailed Drawing Description

[0044] FIG. 1 is an overview of one example of the system and method of virtual private keys disclosed herein and begins with a client/user using a user device 2 comprising a personal mobile device, a tablet or a personal computer to set up a secure transaction. In this illustration, the client has already installed a Credential Factory 3 (“CF”) to the client's local device. Each CF comprises a “miner” embodied as software operating according to the process of FIG. 3, described herein below. In the figures, system components are annotated with numbers and steps are annotated with letters.

[0045] In step A, the user sends a request to the locally installed CF 3 to establish a virtual key using the users' specific credentials. This may happen automatically as a part of the transaction setup interface. Step A first goes to the Credential Generator 4 (“CG”).

[0046] In step B, the CF 3 server obtains credentials from the user through the CG 4 by first soliciting user credentials from the user device 2 and then creating anonymous credentials from the user supplied credentials. The CG 4 is configured to select the appropriate credentials for this user. Credentials can consist of usernames, passwords, answers to questions and even reproducible biometrics or information retrieved from wearable devices and hardware tokens. The CF 3 ingests the anonymous credentials and generates a reproducible private key. As a note, the CG 4 is a component of the CF 3 although, in another embodiment one could have the CG 4 and the CF 3 as separate components and the CF 3 component could be local or remote or, alternatively the CG 4 and CF 3 could be in a client server relationship. The private key can be of any strength proportionate to the user credentials that are used for generation.

[0047] In step C, the CF 3 makes the generated private key available virtually, in device RAM or alternatively, it could be transmitted through the internet or otherwise for use by the user. This key in the present example does not need to be displayed or stored.

[0048] In step D, the CF 3 generates an associated public key and sends that public key with other data to a storage device 8, comprising a storage container/memory of the user device 2. This storage device 8 can be embodied as a local disk storage or an associated device like a hard drive or remotely in a cloud. The stored data does NOT need to be secure and is in fact intended for public use.

[0049] In step E, the secret anonymous credentials of the user can be sent to an associated secure escrow server 5 as a backup so that the user 2 can retrieve the credentials in the event that the user can no longer generate them. It is not possible to reverse the anonymous credentials into user credentials and the anonymous credential in escrow is worthless without associated personal information. The secure escrow server 5 may then save the anonymous credentials onto an associated secure escrow database 6 in an optional Step F.

[0050] FIG. 2 is a flow chart evidencing steps in the inventive method of using the virtual key system 1 shown in FIG. 1, comprising the following steps: [0051] 1. Downloading the credential factory to the memory of the user device; [0052] 2. Providing an interface with the user and the credential generator allowing user to input personal credentials; [0053] 3. Requesting the credential factory to make a virtual private key; [0054] 4. Transferring credentials from the credential generator 4 to the credential factory 5; [0055] 5. Generating the virtual private key with the credential factory 3 using the anonymous credentials; [0056] 6. Generating a public key associated with the virtual private key with the credential factory 3; [0057] 7. Storing the public key on a user device storage 8; and [0058] 8. Optionally, storing the anonymized personal credentials associated with the virtual private key to a secure escrow server 5 and secure escrow database 6.

[0059] FIG. 3 is a flow chart showing the private key miner 3A and related method to return a Virtual Private Key (“VPK”) to the user, derived from the anonymous credentials (“AC”) that the system received that are unique to the user. [0060] 1. Step A is to receive the AC from the registering device. [0061] a. Included in the AC is a 2-byte Enterprise Code (“EC”). [0062] i. The EC is used to distinguish the registering system. [0063] 2. Step B receives the AC and then passes them through a process to generate a Pseudo-Random String (“PBs”). [0064] a. The PBs is reproducible by giving the same AC and EC to the Generator. [0065] 3. Step C hashes the PBs and looks to match it against the EC. [0066] a. Step F, if the hash matches then go to 5. [0067] b. Step D, if the hash does not match then go to 4. [0068] 4. Increment the Random String. [0069] a. The PBs is increased by one and then returned to 3 to be checked again. [0070] b. This procedure occurs until the valid hash is matched. [0071] 5. Step F returns the VPK to the system.

INDEX OF PARTS

[0072] 1 virtual key system [0073] 2 User device [0074] 3 Credential factory (CF) [0075] 3A Private key miner [0076] 4 Credential generator server (CG) [0077] 5 Secure escrow server [0078] 6 Secure escrow database [0079] 7 Virtual key [0080] 8 User device storage

[0081] The references recited herein are incorporated herein in their entirety, particularly as they relate to teaching the level of ordinary skill in this art and for any disclosure necessary for the commoner understanding of the subject matter of the claimed invention. It will be clear to a person of ordinary skill in the art that the above embodiments may be altered or that insubstantial changes may be made without departing from the scope of the invention. Accordingly, the scope of the invention is determined by the scope of the following claims and their equitable equivalents.