Digital asset custodial system

A system for authorizing a transaction involving a cryptoasset, the system comprising:

• one or more processors;
• and
• one or more non-transitory computer readable media storing instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• receiving, at an online server, a transaction request for a requested transaction involving the cryptoasset from a requestor via a public computer network;
• transmitting one or more endorsement requests to one more mobile devices according to a stored policy in response to receipt of the requested transaction, the one or more mobile devices being associated with one or more users specified in the stored policy as one or more possible members of a quorum for approving the transaction;
• receiving, at the online server, one or more endorsement messages from the one or more mobile devices associated with the one or more users in response to transmitting the one or more endorsement requests;
• determining, by a hardware security module, that the one or more users have been authenticated according to the stored policy in connection with the one or more endorsement messages associated with the requested transaction;
• receiving, by the hardware security module, an indication of the one or more endorsement messages from the one or more mobile devices;
• determining, by the hardware security module, whether one or more valid endorsements have been received from the one or more users based on one or more public keys associated with the one or more users for which the one or more endorsement messages have been received;
• determining, by the hardware security module, whether a quorum specified by the stored policy has been met based on a comparison by the hardware security module of a number of the one or more valid endorsements that have been received and a number of authorizations that must be received according to the stored policy;
• based on the one or more valid endorsements having been received from the one or more users in satisfaction of the quorum, authorizing, by the hardware security module, the requested transaction by using a private key associated with the cryptoasset to sign an approval of the requested transaction, wherein the private key associated with the cryptoasset is generated by the hardware security module for a blockchain address associated with the cryptoasset, and wherein the private key associated with the cryptoasset is inaccessible by devices external to the hardware security module and different from one or more private keys associated with the one or more users;
• and
• in response to the transaction request, invoking a risk analysis of the requested transaction, wherein said authorizing the requested transaction is performed based on i) a result of the risk analysis indicating that a risk level associated with the requested transaction satisfies a risk criterion and ii) the one or more valid endorsements having been received from the one or more users in satisfaction of the quorum.

A digital asset custodial system comprising:

• an online server configured to:
• receive a requested transaction relating to a digital asset from a requestor via a public computer network;
• transmit one or more endorsement requests to one or more mobile devices according to a stored policy in response to receipt of the requested transaction, the one or more mobile devices being associated with one or more users specified in the policy as possible members of a quorum for approving the transaction;
• receive one or more endorsement messages from the one or more mobile devices in response to transmitting the one or more endorsement requests;
• and
• determine that the one or more users have been authenticated in connection with the one or more endorsement messages associated with the requested transaction;
• in response to the receiving the requested transaction, invoke a risk analysis of the requested transaction, wherein authorizing the requested transaction is performed based on i) a result of the risk analysis indicating that a risk level associated with the requested transaction satisfies a risk criterion and ii) one or more valid endorsements having been received from the one or more users in satisfaction of the quorum;
• and
• a hardware security module configured to:
• determine whether one or more valid endorsements have been received from the one or more users based on one or more public keys associated with the one or more users for which the one or more endorsement messages have been received;
• determine whether the quorum specified by the stored policy has been met based on a comparison of a number of the one or more valid endorsements that have been received and a number of authorizations that must be received according to the stored policy;
• and
• authorize the transaction by signing an approval of the requested transaction using a private key associated with the digital asset based on the one or more valid endorsements of the requested transaction having been received from the one or more users in satisfaction of the quorum, wherein the private key associated with the digital asset is generated by the hardware security module for a blockchain address associated with the digital asset, and wherein the private key associated with the digital asset is inaccessible by devices external to the hardware security module and different from one or more private keys associated with the one or more users.