Systems and methods to replicate private key shares from multi-party computation (MPC) nodes in a primary subsystem to MPC nodes a backup subsystem

A method, comprising:

• in a computing system that includes one or more hardware processors and one or more memories that implement a primary asset custody subsystem in a first cloud computing data center and a backup asset custody subsystem in a second cloud computing data center different from the first cloud computing data center, the primary asset custody subsystem including a plurality of primary multi-party computation (MPC) clusters, where each primary MPC cluster is allocated to an asset owner and includes a primary MPC client and a plurality of primary MPC nodes, the backup asset custody subsystem including a plurality of backup MPC clusters corresponding to the plurality of primary MPC clusters, where each backup MPC cluster is allocated to the asset owner of its corresponding primary MPC cluster and includes a backup MPC client and a plurality of backup MPC nodes, wherein the one or more memories are configured to store instructions, which when executed by the one or more hardware processors cause the one or more hardware processors to perform operations comprising:
• operating each primary MPC node in the primary MPC cluster in a different computing signing party environment and generating a private key share for a partial signature for a blockchain transaction;
• operating each backup MPC node in the backup MPC cluster operate in a different computing signing party environment;
• the backup MPC client sending an export public key from each backup MPC node in the backup MPC cluster to the primary MPC client, where each export public key is part of a corresponding export public key-export private key pair;
• the primary MPC client:
• sending each export public key to a corresponding primary MPC node in the primary MPC cluster, and in response, receiving from each primary MPC node in the primary MPC cluster a corresponding encrypted private key share encrypted with a corresponding export public key;
• and
• sending the encrypted private key shares to the backup MPC client;
• the backup MPC client transmitting the encrypted private key shares to corresponding backup MPC nodes in the backup MPC cluster;
• and
• each backup MPC node in the backup MPC cluster decrypting a corresponding encrypted private key share using the export private key from the corresponding export public key-export private key pair to obtain a corresponding backup private key share, and to store the decrypted corresponding backup private key share.

A non-transitory, computer-readable storage medium for a computing system that includes one or more hardware processors and one or more memories that implement a primary asset custody subsystem in a first cloud computing data center and a backup asset custody subsystem in a second cloud computing data center different from the first cloud computing data center, the primary asset custody subsystem including a plurality of primary multi-party computation (MPC) clusters, where each primary MPC cluster is allocated to an asset owner and includes a primary MPC client and a plurality of primary MPC nodes, the backup asset custody subsystem including a plurality of backup MPC clusters corresponding to the plurality of primary MPC clusters, where each backup MPC cluster is allocated to the asset owner of its corresponding primary MPC cluster and includes a backup MPC client and a plurality of backup MPC nodes, wherein the one or more memories are configured to store instructions, which when executed by the one or more hardware processors cause the one or more hardware processors to perform operations comprising:

• operating each primary MPC node in the primary MPC cluster in a different computing signing party environment to generate a private key share for a partial signature for a blockchain transaction;
• wherein the one or more memories are configured to store instructions for the backup asset custody subsystem which includes a plurality of backup MPC clusters corresponding to the plurality of primary MPC clusters, where each backup MPC cluster is allocated to the asset owner of its corresponding primary MPC cluster and includes a backup MPC client and a plurality of backup MPC nodes,
• operating each backup MPC node in the backup MPC cluster operate in a different computing signing party environment;
• the backup MPC client sending an export public key from each backup MPC node in the backup MPC cluster to the primary MPC client, where each export public key is part of a corresponding export public key-export private key pair;
• the primary MPC client:
• sending each export public key to a corresponding primary MPC node in the primary MPC cluster, and in response, receiving from each primary MPC node in the primary MPC cluster a corresponding encrypted private key share encrypted with a corresponding export public key;
• and
• sending the encrypted private key shares to the backup MPC client;
• the backup MPC client transmitting the encrypted private key shares to corresponding backup MPC nodes in the backup MPC cluster;
• and
• each backup MPC node in the backup MPC cluster decrypting a corresponding encrypted private key share using the export private key from the corresponding export public key-export private key pair to obtain a corresponding backup private key share, and to store the decrypted corresponding backup private key share.