# US 12,217,252 B2 · Hybrid identity as a service for decentralized browser based wallets

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,217,252 B2
- Document ID: US12217252B2
- Status: Granted
- Kind: B2
- Application number: 18/530,519
- Filed: 2023-12-06
- Published: 2024-03-28
- Granted: 2025-02-04
- Earliest claimed: 2019-01-03
- Assignees: American Express Travel Related Services Company, Inc.
- Applicants: American Express Travel Related Services Company, Inc.
- Inventors: Jitendra Singh Dikhit; Alaric M. Eby; Andras L. Ferenczi; Ashish Kumar; Upendra Mardikar
- Web page: https://patentgrep.com/patent/US12217252B2

## CPC

- G06Q 20/3829: {involving key management}
- G06Q 20/36: using electronic wallets or electronic money safes
- G06Q 20/3674: {involving authentication}
- G06Q 20/3827: {Use of message hashing}
- G06Q 20/4012: {Verifying personal identification numbers [PIN]}
- G06Q 20/4014: {Identity check for transactions}
- H04L 9/0822: {using key encryption key}
- H04L 9/0863: {involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067)}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- H04L 9/3247: {involving digital signatures}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- G06Q 2220/00: Business processing using cryptography
- H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash
- H04L 2463/062: applying encryption of the keys
- H04L 2463/102: applying security measure for e-commerce
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Disclosed are various embodiments for a service for decentralized browser based wallets. Various embodiments of the present disclosure can receive a first passcode and a second passcode from a security provider device. Various embodiments can use a cryptowallet to decrypt a first encrypted private key using the first passcode to generate a decrypted private key. Various embodiments can use a cryptowallet to sign a transaction request with the decrypted private key. Various embodiments can use a cryptowallet to generate a second encrypted private key by encrypting the decrypted private key using the second passcode.

## Claims

### Claim 1

A method, comprising:
hashing, by a security provider, account creation information associated with a stored password hash to create hashed account creation information;
decrypting an encrypted first passcode stored in association with the account creation information to generate a first passcode, wherein a cryptowallet on a user device uses the first passcode to perform cryptographic processes on one or more keys stored by the cryptowallet on the user device, wherein an encrypted private key is at least one of the one or more keys;
generating, by the security provider, a second passcode in response to decrypting the encrypted first passcode, wherein the first passcode is different from the second passcode, wherein the cryptowallet on the user device uses the second passcode to perform cryptographic processes on the one or more keys stored by the cryptowallet on the user device;
encrypting, by the security provider, the second passcode using the hashed account creation information as an encryption key to create an encrypted passcode;
returning, by the security provider, the first passcode and the second passcode to the cryptowallet on the user device;
decrypting, by the user device via the cryptowallet, the encrypted private key using the returned first passcode to generate a decrypted private key;
signing, by the user device via the cryptowallet, a transaction request with the decrypted private key; and
in response to signing the transaction request, re-encrypting, by the user device via the cryptowallet, the decrypted private key using the returned second passcode.

### Claim 2 (depends on 1)

The method of claim 1, further comprising storing, by the security provider, the encrypted passcode in association with the account creation information.

### Claim 3 (depends on 1)

The method of claim 1, further comprising receiving, by the security provider, a user identifier and a password from the user device, wherein the user identifier and password are received from a browser executing on the user device and the first passcode and the second passcode are returned to the browser via an encrypted channel.

### Claim 4 (depends on 1)

The method of claim 1, wherein generating the second passcode further comprises generating a random string of numbers and characters of arbitrary length according to at least one pre-established rule.

### Claim 5 (depends on 1)

The method of claim 1, further comprising receiving, by the security provider, the account creation information comprising at least one of a username, a user address, a phone number, or an email address.

### Claim 6 (depends on 3)

The method of claim 3, further comprising hashing, by the security provider, the user identifier and the password to produce a password hash; and comparing, by the security provider, the password hash to a stored password hash to determine that the password hash matches the stored password hash, wherein the stored password hash is stored in a repository of the security provider.

### Claim 7 (depends on 1)

The method of claim 1, wherein generating the second passcode further comprises generating a random string of special characters and mixed case characters according to at least one pre-established rule.

### Claim 8 (depends on 1)

The method of claim 1, further comprising prompting, by the security provider, the user device to create the cryptowallet.

### Claim 9 (depends on 8)

The method of claim 8, wherein the security provider prompts the user device to create the cryptowallet in response to receiving a user identifier and a password from the user device.

### Claim 10 (depends on 3)

The method of claim 3, further comprising removing variables referencing the first passcode and the second passcode.

### Claim 11

A system, comprising:
a user device comprising a first processor, a first memory, first machine-readable instructions stored in the first memory, and a cryptowallet stored in the first memory;
a computing device comprising a second processor, a second memory, and second machine-readable instructions stored in the second memory, the second machine-readable instructions, when executed by the second processor, cause the computing device to at least:
hash account creation information associated with a stored password hash to create hashed account creation information;
decrypt an encrypted first passcode stored in association with the account creation information to generate a first passcode;
generate a second passcode in response to decrypting the encrypted first passcode, wherein the first passcode is different from the second passcode;
encrypt the second passcode using the hashed account creation information as an encryption key to create an encrypted passcode; and
return the first passcode and the second passcode to the cryptowallet on the user device; and
wherein the cryptowallet uses the first passcode to perform cryptographic processes on one or more keys stored by the cryptowallet, an encrypted private key is at least one of the one or more keys, the cryptowallet uses the second passcode to perform cryptographic processes on the one or more keys stored by the cryptowallet, and the first machine-readable instructions, when executed by the first processor, cause the first processor to at least:
decrypt, via the cryptowallet, the encrypted private key using the returned first passcode to generate a decrypted private key;
sign, via the cryptowallet, a transaction request with the decrypted private key; and
in response to signing the transaction request, re-encrypt, via the cryptowallet, the decrypted private key using the returned second passcode.

### Claim 12 (depends on 11)

The system of claim 11, wherein the second machine-readable instructions, when executed by the second processor, further cause the computing device to at least store the encrypted passcode in association with the account creation information.

### Claim 13 (depends on 11)

The system of claim 11, wherein the second machine-readable instructions, when executed by the second processor, further cause the computing device to at least receive a user identifier and a password from a browser executing on the user device and the first passcode and the second passcode are returned to the browser via an encrypted channel.

### Claim 14 (depends on 11)

The system of claim 11, wherein the second machine-readable instructions that, when executed by the second processor, cause the computing device to generate the second passcode further cause the computing device to generate a random string of numbers and characters of arbitrary length according to at least one pre-established rule.

### Claim 15 (depends on 11)

The system of claim 11, wherein the second machine-readable instructions, when executed by the second processor, further cause the computing device to at least receive the account creation information comprising at least one of a username, a user address, a phone number, or an email address.

### Claim 16 (depends on 13)

The system of claim 13, wherein the second machine-readable instructions, when executed by the second processor, further cause the computing device to at least hash the user identifier and the password to produce a password hash; and compare the password hash to a stored password hash to determine that the password hash matches the stored password hash, wherein the stored password hash is stored in a repository of the computing device.

### Claim 17 (depends on 11)

The system of claim 11, wherein the second machine-readable instructions that, when executed by the second processor, cause the computing device to generate the second passcode further cause the computing device to at least generate a random string of special characters and mixed case characters according to at least one pre-established rule.

### Claim 18 (depends on 11)

The system of claim 11, wherein the second machine-readable instructions that, when executed by the second processor, further cause the computing device to at least prompt the user device to create the cryptowallet.

### Claim 19 (depends on 18)

The system of claim 18, wherein the second machine-readable instructions that cause the computing device to at least prompt the user device to create the cryptowallet are executed in response to receiving a user identifier and a password from the user device.

### Claim 20 (depends on 13)

The system of claim 13, wherein the browser removes variables referencing the first passcode and the second passcode.