Generation of a multi-user contextual portfolio of private keys and use of such a portfolio
AssigneeCommissariat A L'energie Atomique Et Aux Energies Alternatives
InventorsChristine Hennebert, Florian Barrois
Life of this patent
Estimating the term…
Abstract
A method of generating a hierarchical deterministic keys portfolio, in particular to sign transactions sent to a blockchain. The generation method includes an initialization phase by an administrator and a phase of setting parameters for at least one user. Private key usage contexts are created from the administrator account, each context specifying conditions for use of the private key in said context. User accounts are also created, each user account being associated with a private key in the tree structure, the private key of said user being obtained from a master private key of the administrator, the usage context to which the user account is attached, and the user's identifier.
Claims18
A method of generating a hierarchical deterministic keys portfolio containing private keys according to a tree structure to sign transactions sent to a blockchain, said method comprising:
- creating, during an initialization phase, an administrator account;
- protecting, during the initialization phase, access to the administrator account by an administrator authentication element;
- generating, during the initialization phase, a master private key (km) by hashing a random seed, the master private key being stored in a secure memory area of a mobile device;
- creating, during a parameter setting phase, a plurality of usage context identifiers from the administrator account, each usage context identifier pointing to an address in the secure memory area in which conditions for use of a private key in said context are stored;
- creating, during the parameter setting phase, a plurality of user accounts from the administrator account, each user account being associated with a private key in the tree structure, each user account being identified by an identifier and access to each user account being protected by a user authentication element, the private key of a corresponding user being obtained from the master private key, the usage context identifier to which the user account is attached, and an identifier of the user;
- hashing the identifier and using the hashed identifier to deduce at least one index;
- and
- using the at least one index to generate the private key of the user.
A method of using a hierarchical deterministic keys portfolio generated by a generation method to sign a transaction addressed to a blockchain, said portfolio having been parameterized for at least one user and being hosted on a mobile device connected to a host device through a secure channel, the generation method comprising:
- creatin, during an initialization phase, an administrator account;
- protecting, during the initialization phase, access to the administrator account by an administrator authentication element;
- generating, during the initialization phase, a master private key (km) by hashing a random seed, the master private key being stored in a secure memory area of a mobile device;
- creatin, during a parameter setting phase, a plurality of usage context identifiers from the administrator account, each usage context identifier pointing to an address in the secure memory area in which conditions for use of a private key in said context are stored;
- and
- creatin, during the parameter setting phase, a plurality of user accounts from the administrator account, each user account being associated with a private key in a tree structure, each user account being identified by an identifier and access to each user account being protected by a user authentication element stored in the secure memory area of the mobile device, the private key of a corresponding user being obtained from the master private key, the usage context identifier to which the user account is attached, and an identifier of the user,
- the method of using the hierarchical deterministic keys portfolio further comprising:
- identifying the user using the corresponding user identifier and authenticates the user with the mobile device or the host device using an authentication element;
- filling in, by the user, a usage context identifier with the mobile device or the host device;
- hashing, by the mobile device, the identifier and using, by the mobile device, the hashed identifier to deduce at least one index;
- verifying, by the mobile device, that there is an existing user account in the portfolio associated with the usage context identifier and with the at least one index, then verifying that the user's authentication element is the same as that stored in the secure memory area of the mobile device, at an address specified by the user account;
- and
- when the verifying is successful,
- verifying when context data supplied by a sensor of the mobile device satisfy the usage conditions stored in the secure memory area at an address stored in the user account;
- and if these conditions are satisfied, and
- signing a transaction formed by the host device by the private key of the user, the signed transaction being returned to the host device to be transmitted to the blockchain.
A method of generating a hierarchical deterministic keys portfolio containing private keys according to a tree structure to sign transactions sent to a blockchain, said method comprising:
- creating, during an initialization phase, an administrator account;
- protecting, during the initialization phase, access to the administrator account by an administrator authentication element;
- generating, during the initialization phase, a master private key (km) by hashing a random seed, the master private key being stored in a secure memory area of a mobile device;
- creating, during a parameter setting phase, a plurality of usage context identifiers from the administrator account, each usage context identifier pointing to an address in the secure memory area in which conditions for use of a private key in said context are stored;
- creating, during the parameter setting phase, a plurality of user accounts from the administrator account, each user account being associated with a private key in the tree structure, each user account being identified by an identifier and access to each user account being protected by a user authentication element stored in the secure memory area of the mobile device, the private key of a corresponding user being obtained from the master private key, the usage context identifier to which the user account is attached, and an identifier of the user;
- hashing the identifier and using the hashed identifier to deduce at least one index;
- and
- verifying that there is an existing user account in the portfolio associated with the usage context identifier and with the at least one index, then verifying that the user's authentication element is the same as that stored in the secure memory area of the mobile device, at an address specified by the user account.
Dependencies are inferred from the claim text.