# US 10,374,794 B1 · Secure transmission of tokens using private key fragments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,374,794 B1 - Document ID: US10374794B1 - Status: Granted - Kind: B1 - Application number: 15/638,920 - Filed: 2017-06-30 - Granted: 2019-08-06 - Earliest claimed: 2017-06-30 - Assignees: salesforce.com, inc. - Applicants: salesforce.com, inc. - Inventors: Prasad Peddada; Taher ElGamal - Web page: https://patentgrep.com/patent/US10374794B1 ## CPC - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/0822: {using key encryption key} - H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract System and methods for secure transmission are described and include receiving, by a first computing system, an encrypted token generated using a public key of an asymmetric key pair; receiving, by the first computing system, a first partially decrypted token generated by applying a first private key fragment of a private key of the asymmetric key pair to the encrypted token; applying, by the first computing system, a second private key fragment of the private key to the encrypted token to generate a second partially decrypted token; applying, by the first computing system, a third private key fragment of the private key to the encrypted token to generate a third partially decrypted token; and combining the first partially decrypted token, the second partially decrypted token and the third partially decrypted token to generate a decrypted token. ## Claims ### Claim 1 A method comprising: receiving, by a first computing system, an encrypted token generated using a public key of an asymmetric key pair; receiving, by the first computing system, a first partially decrypted token generated by applying a first private key fragment of a private key of the asymmetric key pair to the encrypted token; applying, by the first computing system, a second private key fragment of the private key to the encrypted token to generate a second partially decrypted token; applying, by the first computing system, a third private key fragment of the private key to the encrypted token to generate a third partially decrypted token; and combining the first partially decrypted token, the second partially decrypted token and the third partially decrypted token to generate a decrypted token. ### Claim 2 (depends on 1) The method of claim 1, wherein the second private key fragment is stored in a storage device associated with the first computing system. ### Claim 3 (depends on 2) The method of claim 2, wherein the third private key fragment is provided by a user of the first computing system. ### Claim 4 (depends on 3) The method of claim 3, wherein the encrypted token and the first partially decrypted token are received from a second computing system. ### Claim 5 (depends on 4) The method of claim 4, further comprising transmitting, by the first computing system, the public key and the first private key fragment to the second computing system. ### Claim 6 (depends on 5) The method of claim 5, further comprising fragmenting, by the first computing system, the private key into the first, second and third private key fragments. ### Claim 7 (depends on 6) The method of claim 6, wherein said fragmenting of the private key into the first, second and third private key fragments is applicable only to the first computing system receiving the encrypted token from the second computing system and not applicable to the first computing system receiving another encrypted token from a third computing system. ### Claim 8 A system comprising: one or more processors; and a non-transitory computer readable medium storing a plurality of instructions, which when executed, cause the one or more processors to: receive an encrypted token generated using a public key of an asymmetric key pair; receive a first partially decrypted token generated by applying a first private key fragment of a private key of the asymmetric key pair to the encrypted token; apply a second private key fragment of the private key to the encrypted token to generate a second partially decrypted token; apply a third private key fragment of the private key to the encrypted token to generate a third partially decrypted token; and combine the first partially decrypted token, the second partially decrypted token and the third partially decrypted token to generate a decrypted token. ### Claim 9 (depends on 8) The system of claim 8, wherein the second private key fragment is stored in a storage device associated with a first computing system. ### Claim 10 (depends on 9) The system of claim 9, wherein the third private key fragment is provided by a user of the first computing system. ### Claim 11 (depends on 10) The system of claim 10, wherein the encrypted token and the first partially decrypted token are received from a second computing system. ### Claim 12 (depends on 11) The system of claim 11, further comprising instructions to transmit the public key and the first private key fragment to the second computing system. ### Claim 13 (depends on 12) The system of claim 12, further comprising instructions to fragment the private key into the first, second and third private key fragments. ### Claim 14 (depends on 13) The system of claim 13, wherein the instructions to fragment the private key into the first, second and third private key fragments is applicable only to the first computing system receiving the encrypted token from the second computing system and not applicable to the first computing system receiving another encrypted token from a third computing system. ### Claim 15 A computer program product comprising computer-readable program code to be executed by one or more processors when retrieved from a non-transitory computer-readable medium, the program code including instructions to: receive an encrypted token generated using a public key of an asymmetric key pair; receive a first partially decrypted token generated by applying a first private key fragment of a private key of the asymmetric key pair to the encrypted token; apply a second private key fragment of the private key to the encrypted token to generate a second partially decrypted token; apply a third private key fragment of the private key to the encrypted token to generate a third partially decrypted token; and combine the first partially decrypted token, the second partially decrypted token and the third partially decrypted token to generate a decrypted token. ### Claim 16 (depends on 15) The computer program product of claim 15, wherein the second private key fragment is stored in a storage device of a first computing system. ### Claim 17 (depends on 16) The computer program product of claim 16, wherein the third private key fragment is provided by a user of the first computing system. ### Claim 18 (depends on 17) The computer program product of claim 17, wherein the encrypted token and the first partially decrypted token are received from a second computing system. ### Claim 19 (depends on 18) The computer program product of claim 18, further comprising instructions to transmit the public key and the first private key fragment to the second computing system. ### Claim 20 (depends on 19) The computer program product of claim 19, further comprising instructions to fragment the private key into the first, second and third private key fragments. ### Claim 21 (depends on 20) The computer program product of claim 20, wherein the instructions to fragment the private key into the first, second and third private key fragments is applicable only to the first computing system receiving the encrypted token from the second computing system and not applicable to the first computing system receiving another encrypted token from a third computing system.