# US 12,113,893 B2 · Non-custodial tool for data encryption and decryption with decentralized data storage and recovery

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,113,893 B2
- Document ID: US12113893B2
- Status: Granted
- Kind: B2
- Application number: 18/444,480
- Filed: 2024-02-16
- Published: 2024-08-22
- Granted: 2024-10-08
- Earliest claimed: 2023-02-17
- Assignees: Magic Labs, Inc.
- Applicants: Magic Labs, Inc.
- Inventors: Fei-Yang Jen; Yi Wei Chen; Dheeban Srinivasan Govindarajan; Jaemin Jin; Shang Li
- Web page: https://patentgrep.com/patent/US12113893B2

## CPC

- H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]}
- H04L 9/0822: {using key encryption key}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes}
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- H04L 9/3247: {involving digital signatures}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

This disclosure relates to techniques for performing encryption and decryption operations and that provide fully non-custodial data management, i.e., where end-users have control over their data—rather than a third party. Specifically, the techniques disclosed herein are configured to allow end-users to have the ability to recover and/or maintain access to data stored on third-party systems—even if one or more third-party entities storing the data are no longer in compliance with a predetermined set of operational criteria. In other implementations, novel split private key generation techniques are disclosed, wherein a newly-generated private key may be split into at least three shards, e.g., an authentication service provider shard, a shard for another entity, and a “recovery” shard. In still other implementations, an iFrame may decrypt separate shards of a private key using a delegated key management system (DKMS) and then use the reconstructed private key to sign a digital transaction.

## Claims

### Claim 1

A method of decentralized key management, comprising: causing a Client to initiate, via a browser, digitally signing of a transaction for submission to a blockchain using a private key associated with a user account of a decentralized application (dApp);
causing the client to retrieve a browser encrypted entity shard of the private key;
causing the client to decrypt the browser encrypted entity shard of the private key that verifies the identity of the browser and generates a key management system (KMS) encrypted entity shard;
causing the client to receive a KMS encrypted authentication system shard of the private key from an authentication system;
causing the client to send, bypassing the authentication system, the KMS encrypted entity shard of the private key and the KMS encrypted authentication system shard of the private key for decryption at a third-party KMS;
causing the client to receive a decrypted entity shard of the private key and a decrypted authentication system shard of the private key from the third-party KMS; and
causing the client to reconstruct the private key for signing the transaction from the decrypted entity shard of the private key and the decrypted authentication system shard of the private key.

### Claim 2 (depends on 1)

The method of claim 1, wherein the client reconstructs the private key within the iFrame of the browser.

### Claim 3 (depends on 1)

The method of claim 1, wherein the browser encrypted entity shard of the private key is retrieved from storage local to the browser.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
causing the client to determine whether the browser encrypted entity shard of the private key is stored on the client;
causing the client to request for an entity encrypted entity shard based on a determination that the browser encrypted entity shard of the private key is not stored on the client;
causing the client to receive the entity encrypted entity shard from the authentication system; and
causing the client to send the entity encrypted entity shard to an entity system for decryption, wherein the entity system is separate from the authentication system.

### Claim 5 (depends on 1)

The method of claim 1, wherein the browser's encryption of the entity shard of the private key is decrypted in the browser using a Web Crypto API.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
causing the client to send the decrypted entity shard of the private key to the KMS after reconstructing the private key;
causing the client to receive the KMS encrypted entity shard of the private key from the KMS;
causing the client to encrypt the KMS encrypted entity shard with a browser identifying encryption operation to generate the browser encrypted entity shard; and causing the client to store the browser encrypted entity shard in local memory.

### Claim 7

One or more non-transitory computer-readable media having stored thereon computer-executable instructions for causing one or more processors, when programmed thereby, to be able to perform operations comprising:
causing a Client to initiate, digitally signing of a transaction for submission to a decentralized network using a private key associated with a user account of a decentralized application (dApp);
causing the client to retrieve a browser encrypted entity shard of the private key;
causing the client to decrypt the browser encrypted entity shard of the private key to generate a KMS encrypted entity shard;
causing the client to receive a KMS encrypted authentication system shard of the private key from an authentication system;
causing the client to send, bypassing the authentication system, the KMS encrypted entity shard of the private key and the KMS encrypted authentication system shard of the private key for decryption at a KMS;
causing the client to receive a decrypted entity shard of the private key and a decrypted authentication system shard of the private key from the KMS; and
causing the client to reconstruct the private key for signing the transaction from the decrypted entity shard of the private key and the decrypted authentication system shard of the private key.

### Claim 8 (depends on 7)

The one or more non-transitory computer-readable media of claim 7,
wherein the client reconstructs the private key within a secure execution environment of the browser.

### Claim 9 (depends on 7)

The one or more non-transitory computer-readable media of claim 7, wherein the instructions, when executed, further cause the one or more processors to:
cause the client to send the decrypted entity shard of the private key to the KMS after reconstructing the private key;
cause the client the receive the KMS encrypted entity shard of the private key from the KMS;
cause the client to encrypt the KMS encrypted entity shard with a browser identifying encryption operation to generate the browser encrypted entity shard; and
cause the client to store the browser encrypted entity shard in local memory.

### Claim 10 (depends on 7)

The one or more non-transitory computer-readable media of claim 7, wherein the instructions, when executed, further cause the one or more processors to:
causing the client to determine whether the browser encrypted entity shard of the private key is stored on the client;
causing the client to request for an entity encrypted entity shard based on a determination that the browser encrypted entity shard of the private key is not stored on the client; and
causing the client to receive the entity encrypted entity shard from the authentication system; and
causing the client to send the entity encrypted entity shard to an entity system for decryption, wherein the entity system is separate from the authentication system.

### Claim 11 (depends on 7)

The one or more non-transitory computer-readable media of claim 7, wherein the browser encrypted entity shard of the private key is decrypted in a browser of the client using a Web Crypto API.

### Claim 12 (depends on 7)

The one or more non-transitory computer-readable media of claim 7, wherein the browser encrypted entity shard of the private key is decrypted in a browser of the client using a Web Crypto API.

### Claim 13 (depends on 7)

The one or more non-transitory computer-readable media of claim 7, wherein the iFrame of a browser of the client sends the KMS encrypted entity shard of the private key and the KMS encrypted authentication system shard of the private key to the KMS for decryption.

### Claim 14 (depends on 7)

The one or more non-transitory computer-readable media of claim 7, wherein the iFrame of a browser of the client receives the decrypted entity shard of the private key and the decrypted authentication system shard of the private key from the KMS.

### Claim 15

One or more non-transitory computer-readable media having stored thereon computer-executable instructions for causing one or more processors, when programmed thereby, to be able to perform operations comprising:
receiving a request from a user account associated with decentralized application (dApp) to digitally sign a transaction for submission to a decentralized network using a private key;
retrieving an entity shard of the private key from an entity service and bypassing an authentication service, wherein the entity shard of the private key has been decrypted by the entity service;
retrieving an encrypted authentication system's shard of the private key from an authentication service;
decrypting the encrypted authentication system's shard of the private key using a third-party key management system (KMS);
sending, bypassing the authentication service, the encrypted authentication system's shard of the private key to the third-party KMS;
reconstructing the private key from the decrypted entity shard of the private key and the decrypted authentication system shard of the private key; and
signing the transaction with the reconstructed private key.

### Claim 16 (depends on 15)

The one or more non-transitory computer-readable media of claim 15, wherein the instructions, when executed, further cause the one or more processors to:
encrypt the decrypted entity shard with the third-party KMS in response to decrypting the private key to generate a KMS-encrypted entity shard.

### Claim 17 (depends on 16)

The one or more non-transitory computer-readable media of claim 16, wherein the instructions, when executed, further cause the one or more processors to:
encrypt the KMS-encrypted entity shard in a browser using a Web Crypto API to generate a browser-encrypted and KMS-encrypted entity share.

### Claim 18 (depends on 17)

The one or more non-transitory computer-readable media of claim 17, wherein the instructions, when executed, further cause the one or more processors to:
save the browser-encrypted and KMS-encrypted entity shard in storage local to the browser.

### Claim 19 (depends on 18)

The one or more non-transitory computer-readable media of claim 18, wherein the instructions, when executed, further cause the one or more processors to:
determine whether the browser-encrypted and KMS-encrypted entity shard is stored local to the browser; and
decrypt the browser-encrypted and KMS-encrypted entity shard to verify the identity of the browser and generate the KMS-encrypted entity shard.