Systems and methods for threshold cryptography for cloud-based software-implemented hardware security modules

An encryption system comprising:

• at least one hardware processor;
• and
• one or more non-transitory computer readable storage media containing instructions that, when executed by the at least one hardware processor, cause the at least one hardware processor to perform operations comprising:
• collecting at least a decryption-threshold number of private-key shares from a secure store, the private-key shares corresponding to a public key generated in a first secure enclave as part of a secret key set, the secret key set further comprising a first plural quantity of the private-key shares;
• obtaining an ephemeral-hardware-security-module-(eHSM)-encryption key by decrypting the collected private-key shares;
• and
• initializing, in a second secure enclave, a second instance of a first soft eHSM, the initialized second instance of the first soft eHSM being encrypted with the obtained eHSM-encryption key.

One or more non-transitory computer readable storage media containing instructions that, when executed by at least one hardware processor, cause the at least one hardware processor to perform operations comprising:

• collecting at least a decryption-threshold number of private-key shares from a secure store, the private-key shares corresponding to a public key generated in a first secure enclave as part of a secret key set, the secret key set further comprising a first plural quantity of the private-key shares;
• obtaining an ephemeral-hardware-security-module-(eHSM)-encryption key by decrypting the collected private-key shares;
• and
• initializing, in a second secure enclave, a second instance of a first soft eHSM, the initialized second instance of the first soft eHSM being encrypted with the obtained eHSM-encryption key.