# US 11,909,866 B2 · Systems and methods for configuring a networked system to perform threshold multi-party computation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,866 B2 - Document ID: US11909866B2 - Status: Granted - Kind: B2 - Application number: 17/459,076 - Filed: 2021-08-27 - Published: 2023-03-02 - Granted: 2024-02-20 - Earliest claimed: 2021-08-27 - Assignees: Paypal, Inc. - Applicants: Paypal, Inc. - Inventors: Hubert Andre Le Van Gong; Khai Hanh Tang; Shanshan Hua - Web page: https://patentgrep.com/patent/US11909866B2 ## CPC - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]} - H04L 9/0833: {involving conference or group key (network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065)} - H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 2209/46: Secure multiparty computation, e.g. millionaire problem - H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods and systems are presented for providing a multi-party computation (MPC) framework for dynamically configuring, deploying, and utilizing an MPC system for performing distributed computations. Based on device attributes and network attributes associated with computer nodes that are available to be part of the MPC system, a configuration for the MPC system is determined. The configuration may specify a total number of computer nodes within the MPC system, a minimum number of computer nodes required to participate in performing a computation process, a key distribution mechanism, and a computation processing mechanism. Encryption keys are generated and distributed among the computer nodes based on the key distribution mechanism. Upon receiving a request for performing the computation, updated network attributes are obtained. The configuration of the MPC system is dynamically modified based on the updated network attributes, and the MPC system performs the computations according to the modified configuration. ## Claims ### Claim 1 A system, comprising: a non-transitory memory; and one or more hardware processors coupled with the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising: receiving a configuration request to configure a threshold multi-party computation (MPC) system for performing a computation, wherein the configuration request indicates a security requirement and a resiliency requirement; determining network performance data for a set of networked computer nodes associated with the threshold MPC system; determining a configuration for the threshold MPC system based on the network performance data, the security requirement, and the resiliency requirement, wherein the configuration specifies a selection of a plurality of computer nodes within the set of networked computer nodes as part of the threshold MPC system, and a minimum number of computer nodes, among the plurality of computer nodes, required to perform the computation; selecting, between a centralized key distribution mechanism or a distributed key distribution mechanism, an encryption key distribution mechanism for distributing encryption keys among the plurality of computer nodes based on a difference between a total number of computer nodes in the plurality of computer nodes and the minimum number of computer nodes, wherein the selected encryption key distribution mechanism corresponds to the centralized key distribution mechanism when the difference exceeds a threshold, and wherein the configuration further specifies the selected encryption key distribution mechanism; and deploying the threshold MPC system based on the configuration. ### Claim 2 (depends on 1) The system of claim 1, wherein the deploying the threshold MPC system comprises: generating a set of encryption keys for use in the computation; and determining a distribution of the set of encryption keys among the plurality of computer nodes, wherein the distribution specifies assignments of different subsets of encryption keys to different computer nodes in the plurality of computer nodes. ### Claim 3 (depends on 1) The system of claim 1, wherein the deploying the threshold MPC system comprises: determining an order of performing the computation based on a distribution of a set of encryption keys among the plurality of computer nodes. ### Claim 4 (depends on 3) The system of claim 3, wherein the computation comprises data encryption for communication with a remote device, and wherein the operations further comprise: generating data for communicating to the remote device; encrypting the data using the threshold MPC system based on the order, wherein the encrypting comprises determining, among the plurality of computer nodes, a first computer node based on the order; and transmitting the data to the first computer node, wherein the first computer node is configured to (i) generate first intermediate data based on performing a first encryption routine on the data using a first encryption key distributed to the first computer node and (ii) transmit the first intermediate data to a second computer node of the plurality of computer nodes based on the order. ### Claim 5 (depends on 4) The system of claim 4, wherein the operations further comprise: receiving encrypted data from the threshold MPC system; and transmitting the encrypted data to the remote device. ### Claim 6 A method comprising: receiving, by one or more hardware processors, a configuration request to configure a multi-party computation (MPC) system for performing a computation, wherein the configuration request indicates a security requirement and a resiliency requirement; determining, by the one or more hardware processors, network performance data for a set of networked computer nodes associated with the MPC system; determining, by the one or more hardware processors, a configuration for the MPC system based on the network performance data, the security requirement, and the resilience requirement, wherein the configuration specifies a selection of a plurality of computer nodes within the set of networked computer nodes as part of the MPC system and a minimum number of computer nodes, among the plurality of computer nodes, required to perform the computation; selecting, between a centralized key distribution scheme or a distributed key distribution scheme, a key distribution scheme for distributing keys among the plurality of computer nodes based on a difference between a total number of computer nodes in the plurality of computer nodes and the minimum number of computer nodes, wherein the selected key distribution scheme corresponds to the centralized key distribution scheme when the difference exceeds a threshold, and wherein the configuration further specifies the selected key distribution scheme; and deploying, by the one or more hardware processors, the MPC system based on the configuration. ### Claim 7 (depends on 6) The method of claim 6, wherein the network performance data indicates (i) whether computer nodes within the plurality of computer nodes are connected via a local network or connected remotely via a plurality of networks and (ii) a latency rate and a failure rate associated with each computer node in the plurality of computer nodes. ### Claim 8 (depends on 6) The method of claim 6, further comprising: generating a plurality of keys for the MPC system; and distributing the plurality of keys among the plurality of computer nodes according to the key distribution scheme. ### Claim 9 (depends on 6) The method of claim 6, further comprising: receiving a request for performing the computation; subsequent to the receiving the request, determining updated network performance data associated with the plurality of computer nodes; modifying the configuration for the MPC system for processing the request; and causing the MPC system to perform the computation for the request based on the modified configuration. ### Claim 10 (depends on 9) The method of claim 9, wherein the modified configuration specifies a computation approach for performing the computation, and wherein the computation approach is one of a cascade approach or an XOR approach. ### Claim 11 (depends on 10) The method of claim 10, wherein the updated network performance data indicates a deteriorated network condition associated with at least one computer node in the plurality of computer node, and wherein the configuration is modified to use the XOR approach, instead of the cascade approach, for performing the computation. ### Claim 12 (depends on 9) The method of claim 9, wherein the modified configuration specifies a reduced minimum number of computer nodes required for participating in the computation. ### Claim 13 A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising: receiving a configuration request to configure a multi-party computation (MPC) system for performing a computation, wherein the configuration request indicates a security requirement and a resiliency requirement; determining network attributes associated with a set of networked computer nodes; determining a configuration for the MPC system based on the network attributes, the security requirement, and the resiliency requirement, wherein the configuration specifies a selection of a plurality of computer nodes within the set of networked computer nodes as part of the MPC system and a minimum number of computer nodes, among the plurality of computer nodes, required to perform the computation; selecting, between a centralized key distribution mechanism or a distributed key distribution mechanism, a key distribution mechanism for distributing keys among the plurality of computer nodes based on a difference between a total number of computer nodes in the plurality of computer nodes and the minimum number of computer nodes, wherein the selected key distribution mechanism corresponds to the centralized key distribution mechanism when the difference exceeds a threshold, and wherein the configuration further specifies the selected key distribution mechanism; and deploying the MPC system based on the configuration. ### Claim 14 (depends on 13) The non-transitory machine-readable medium of claim 13, wherein the selected key distribution mechanism corresponds to the centralized key distribution mechanism, and wherein the operations further comprise: generating a plurality of keys for the MPC system; and transmitting different subsets of the plurality of keys to different computer nodes in the plurality of computer nodes. ### Claim 15 (depends on 13) The non-transitory machine-readable medium of claim 13, wherein the selected key distribution mechanism corresponds to the decentralized key distribution mechanism, and wherein the operations further comprise: causing a first computer node in the plurality of computer nodes to generate a first plurality of keys corresponding to the first computer node; and causing the first computer node to transmit different subsets of the first plurality of keys to other computer nodes in the plurality of computer nodes. ### Claim 16 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the operations further comprise: causing a second computer node in the plurality of computer nodes to generate a second plurality of keys corresponding to the second computer node; and causing the second computer node to transmit different subsets of the second plurality of keys to other computer nodes, except the first computer node, in the plurality of computer nodes. ### Claim 17 (depends on 13) The non-transitory machine-readable medium of claim 13, wherein the operations further comprise: receiving a request for performing the computation; subsequent to the receiving the request, determining updated network attributes associated with the plurality of computer nodes; modifying the configuration for the MPC system for processing the request based on the updated network attributes; and causing the MPC system to perform the computation for the request based on the modified configuration. ### Claim 18 (depends on 1) The system of claim 1, wherein the operations further comprise: receiving a request for performing the computation; subsequent to the receiving the request, determining updated network performance data associated with the plurality of computer nodes; modifying the configuration for the threshold MPC system for processing the request; and causing the threshold MPC system to perform the computation for the request based on the modified configuration. ### Claim 19 (depends on 18) The system of claim 18, wherein the modified configuration specifies a computation approach for performing the computation, and wherein the computation approach is one of a cascade approach or an XOR approach. ### Claim 20 (depends on 19) The system of claim 19, wherein the updated network performance data indicates a deteriorated network condition associated with at least one computer node in the plurality of computer node, and wherein the configuration is modified to use the XOR approach, instead of the cascade approach, for performing the computation.