# US 2019/0319792 A1 · Decentralized information protection for confidentiality and tamper-proofing on distributed database > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0319792 A1 - Document ID: US20190319792A1 - Status: Published application - Kind: A1 - Application number: 16/133,323 - Filed: 2018-09-17 - Published: 2019-10-17 - Earliest claimed: 2018-04-16 - Assignees: Xage Security, Inc. - Applicants: Xage Security, Inc. - Inventors: SUSANTO JUNAIDI IRWAN; ROMAN M. ARUTYUNOV; ALEXANDER MICHAEL VALDERRAMA - Web page: https://patentgrep.com/patent/US20190319792A1 ## CPC - H04L 9/3093: {involving Lattices or polynomial equations, e.g. NTRU scheme} - H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]} - H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/321: {involving a third party or a trusted authority} - H04L 9/3236: {using cryptographic hash functions} - H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)} - H04L 63/0464: {using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In an embodiment, a computer-implemented data security method comprises: using a first computing device, generating a plurality of encrypted shares from a plurality of shares of hidden security service data by using a separate public key from a plurality of public keys that correspond to a plurality of second computing devices; using a requesting second computing device, accessing and decrypting a first encrypted share of the plurality of encrypted shares using a first private key corresponding to the requesting second computing device to generate a first portion of the hidden security service data; using an available second computing device, decrypting a second encrypted share of the plurality of encrypted shares using a second private key corresponding to the available second computing device to generate a decrypted share; using the available second computing device, re-encrypting the decrypted share using a public key corresponding to the requesting second computing device to generate a re-encrypted share and sending the re-encrypted share to the requesting second computing device; and using the requesting second computing device, decrypting the re-encrypted share using the first private key to generate a second portion of the hidden security service data; using the first portion and second portion of the hidden security service data, forming and using a readable copy of the hidden security service data to perform authentications. ## Claims ### Claim 1 A computer-implemented data security method, comprising: using a first computing device, generating a plurality of encrypted shares from a plurality of shares of hidden security service data by using a separate public key from a plurality of public keys that correspond to a plurality of second computing devices; using a requesting second computing device, accessing and decrypting a first encrypted share of the plurality of encrypted shares using a first private key corresponding to the requesting second computing device to generate a first portion of the hidden security service data; using an available second computing device, decrypting a second encrypted share of the plurality of encrypted shares using a second private key corresponding to the available second computing device to generate a decrypted share; using the available second computing device, re-encrypting the decrypted share using a public key corresponding to the requesting second computing device to generate a re-encrypted share and sending the re-encrypted share to the requesting second computing device; using the requesting second computing device, decrypting the re-encrypted share using the first private key to generate a second portion of the hidden security service data; using the first portion and second portion of the hidden security service data, forming and using a readable copy of the hidden security service data to perform authentications. ### Claim 2 (depends on 1) The method of claim 1, further comprising: in response to generating the plurality of encrypted shares, storing the plurality of encrypted shares in a distributed blockchain data repository; wherein accessing and decrypting the first encrypted share comprises accessing the first encrypted share from the distributed blockchain data repository. ### Claim 3 (depends on 1) The method of claim 1, further comprising: forming the hidden security service data by using security service data to generate a stored digital representation of a polynomial function and calculating a plurality of x-y coordinate points from the polynomial function; wherein each share of the plurality of encrypted shares represents a point of the plurality of x-y coordinate points. ### Claim 4 (depends on 1) The method of claim 1, wherein forming the readable copy of the hidden security comprises calculating a polynomial function. ### Claim 5 (depends on 1) The method of claim 1, further comprising: using the plurality of second computing devices, conducting security checks on the requesting second computing device. ### Claim 6 (depends on 1) The method of claim 1, further comprising: in response to receiving an availability request, checking an availability of the plurality of second computing devices to determine the available second computing device. ### Claim 7 (depends on 1) The method of claim 1, wherein the readable copy of the hidden security service data comprises one or more usernames and passwords, keys, certificates, or audit logs. ### Claim 8 One or more non-transitory computer-readable storage media storing one or more sequences of program instructions which, when executed by one or more computing devices, cause: using a first computing device, generating a plurality of encrypted shares from a plurality of shares of hidden security service data by using a separate public key from a plurality of public keys that correspond to a plurality of second computing devices; using a requesting second computing device, accessing and decrypting a first encrypted share of the plurality of encrypted shares using a first private key corresponding to the requesting second computing device to generate a first portion of the hidden security service data; using an available second computing device, decrypting a second encrypted share of the plurality of encrypted shares using a second private key corresponding to the available second computing device to generate a decrypted share; using the available second computing device, re-encrypting the decrypted share using a public key corresponding to the requesting second computing device to generate a re-encrypted share and sending the re-encrypted share to the requesting second computing device; using the requesting second computing device, decrypting the re-encrypted share using the first private key to generate a second portion of the hidden security service data; using the first portion and second portion of the hidden security service data, forming and using a readable copy of the hidden security service data to perform authentications. ### Claim 9 (depends on 8) The one or more non-transitory machine-readable media of claim 8, further comprising instructions that, when executed by one or more computing devices, cause: in response to generating the plurality of encrypted shares, storing the plurality of encrypted shares in a distributed blockchain data repository; wherein accessing and decrypting the first encrypted share comprises accessing the first encrypted share from the distributed blockchain data repository. ### Claim 10 (depends on 8) The one or more non-transitory machine-readable media of claim 8, further comprising instructions that, when executed by one or more computing devices, cause: forming the hidden security service data by using security service data to generate a stored digital representation of a polynomial function and calculating a plurality of x-y coordinate points from the polynomial function; wherein each share of the plurality of encrypted shares represents a point of the plurality of x-y coordinate points. ### Claim 11 (depends on 8) The one or more non-transitory machine-readable media of claim 8, wherein forming the readable copy of the hidden security comprises calculating a polynomial function. ### Claim 12 (depends on 8) The one or more non-transitory machine-readable media of claim 8, further comprising instructions that, when executed by one or more computing devices, cause: using the plurality of second computing devices, conducting security checks on the requesting second computing device. ### Claim 13 (depends on 8) The one or more non-transitory machine-readable media of claim 8, further comprising instructions that, when executed by one or more computing devices, cause: in response to receiving an availability request, checking an availability of the plurality of second computing devices to determine the available second computing device. ### Claim 14 (depends on 8) The one or more non-transitory machine-readable media of claim 8, wherein the readable copy of the hidden security service data comprises one or more usernames and passwords, keys, certificates, or audit logs. ### Claim 15 A computer system providing an improvement in data security, the system comprising: a distributed blockchain data repository; a first computing device that is communicatively coupled to the distributed blockchain data repository and comprising a first non-transitory data storage medium storing instructions which, when executed by the first computing device, cause: generating a plurality of encrypted shares from a plurality of shares of hidden security service data by using a separate public key from a plurality of public keys that correspond to a plurality of second computing devices; at least two second computing devices of the plurality of second computing devices that are communicatively coupled to the distributed blockchain data repository and each comprising a second non-transitory data storage medium, storing instructions which, when executed by the plurality of second computing devices, cause: using a requesting second computing device, accessing and decrypting a first encrypted share of the plurality of encrypted shares using a first private key corresponding to the requesting second computing device to generate a first portion of the hidden security service data; using an available second computing device, decrypting a second encrypted share of the plurality of encrypted shares using a second private key corresponding to the available second computing device to generate a decrypted share; using the available second computing device, re-encrypting the decrypted share using a public key corresponding to the requesting second computing device to generate a re-encrypted share and sending the re-encrypted share to the requesting second computing device; using the requesting second computing device, decrypting the re-encrypted share using the first private key to generate a second portion of the hidden security service data; using the first portion and second portion of the hidden security service data, forming and using a readable copy of the hidden security service data to perform authentications. ### Claim 16 (depends on 15) The computer system of claim 15, comprising the second non-transitory data storage medium, storing additional instructions which, when executed by the plurality of second computing devices, cause: in response to generating the plurality of encrypted shares, storing the plurality of encrypted shares in a distributed blockchain data repository; wherein accessing and decrypting the first encrypted share comprises accessing the first encrypted share from the distributed blockchain data repository. ### Claim 17 (depends on 15) The computer system of claim 15, comprising the first non-transitory data storage medium, storing additional instructions which, when executed by the first computing device, cause: forming the hidden security service data by using security service data to generate a stored digital representation of a polynomial function and calculating a plurality of x-y coordinate points from the polynomial function; wherein each share of the plurality of encrypted shares represents a point of the plurality of x-y coordinate points. ### Claim 18 (depends on 15) The computer system of claim 15, wherein forming the readable copy of the hidden security comprises calculating a polynomial function. ### Claim 19 (depends on 15) The computer system of claim 15, comprising the second non-transitory data storage medium, storing additional instructions which, when executed by the plurality of second computing devices, cause: conducting security checks on the requesting second computing device. ### Claim 20 (depends on 15) The computer system of claim 15, wherein the readable copy of the hidden security service data comprises one or more usernames and passwords, keys, certificates, or audit logs.