Secure shared key establishment for peer to peer communications

A system comprising:

• one or more processors;
• and
• a non-transitory computer readable medium storing a plurality of instructions that, when executed, control the one or more processors to perform a method comprising:
• receiving, from a requesting device in a trusted network, a share request for a share of a data encryption key, the trusted network including the requesting device, a computing device, and one or more other computing devices;
• retrieving a first encrypted local share of the data encryption key from a memory, wherein the first encrypted local share of the data encryption key is encrypted using a local public key of the computing device;
• decrypting the first encrypted local share using a local private key of the computing device to obtain a local share, wherein the local private key is derived by a key generator using a plurality of derivation components including a network address of the computing device, a random number generated by the computing device, and an encrypted secret of the computing device, and wherein the local public key of the computing device is derived based on the local private key;
• re-encrypting the local share using a public key of the requesting device to obtain a second encrypted local share;
• and
• sending the second encrypted local share to the requesting device, wherein the requesting device (1) generates the data encryption key from (a) one or more shares including the second encrypted local share and one or more encrypted local shares received from the one or more other computing devices and (b) a local encrypted share stored in the requesting device and (2) uses the data encryption key to perform a cryptographic operation.

A non-transitory computer readable medium storing specific computer-executable instructions that, when executed by a processor, cause:

• receiving, from a requesting device in a trusted network, a share request for a share of a data encryption key, the trusted network including the requesting device, a computing device, and one or more other computing devices;
• retrieving a first encrypted local share of the data encryption key from a memory, wherein the first encrypted local share of the data encryption key is encrypted using a local public key of the computing device;
• decrypting the first encrypted local share using a local private key of the computing device to obtain a local share, wherein the local private key is derived by a key generator using a plurality of derivation components including a network address of the computing device, a random number generated by the computing device, and an encrypted secret of the computing device, and wherein the local public key of the computing device is derived based on the local private key;
• re-encrypting the local share using a public key of the requesting device to obtain a second encrypted local share;
• and
• sending the second encrypted local share to the requesting device, wherein the requesting device (1) generates the data encryption key from (a) one or more shares including the second encrypted local share and one or more encrypted local shares received from the one or more other computing devices and (b) a local encrypted share stored in the requesting device and (2) uses the data encryption key to perform a cryptographic operation.