Cold storage cryptographic authentication apparatus and system

A secure cryptographic cold storage apparatus and system. Embodiments of the present disclosure provide for a cold storage apparatus configured to generate a private key, compute an associated PK/PKY and display the latter on a visual display screen. An associated interface apparatus is configured to retrieve the PK/PKH optically and store it in memory. The interface apparatus is configured to produce an associated message and render it at a visual display. The cold storage apparatus may retrieve the message optically, and cryptographically sign the message utilizing one or more public key cryptography methods. The cold storage apparatus produces a graphical output comprising the signed message and renders it at the visual display. The interface apparatus retrieves the signed message and verifies that the cold storage apparatus signed the message, utilizing the public key cryptography methods.

FIELD

The present disclosure relates to the field of cryptographic security systems; in particular, a system and method for secure authentication utilizing a cold cryptographic storage signature apparatus and system.

BACKGROUND

As use of blockchain technologies becomes more prevalent, greater attention is brought to computer security issues when dealing with transactions involving blockchain assets. Blockchain assets may include any one or more of cryptocurrencies (e.g., Bitcoin), stocks of a company or shares, ownership interests in, or access rights to, any other type of assets, financial products (e.g., bonds, debt securities, options, futures and other derivatives), stored data of various types (e.g., a document, records, logs, etc.), proof of identity, travel or government documents, licenses, and an interest in a smart contractual agreement. These assets are characterized as being transacted using blockchain technologies. Blockchain technologies include a distributed ledger performed by various computers independently checking the integrity of transactions in a decentralized way.

Blockchain assets typically require the use of cryptographic keypairs in order to transact. These keypairs consist of a private key, which is kept secret, and a mathematically-derived public key (and associated address), that can be revealed to the public. Maintaining the secrecy of private keys, or the seed or other information from which private keys are derived, is critical to securing a holder's interest in a blockchain asset from theft or confiscation by third parties. Certain methods for managing blockchain wallets and assets include use a “hot” wallet, which stores a user's private keys or seed information on an internet-accessible device. These wallets can range from desktop applications to mobile applications to web-based portals. While hot wallets provide convenience in terms of ease of use, hot wallets possess security issues due to the risk of hacking or theft and the inherent vulnerability of internet communication protocols. Security is greatly enhanced by storing all private information, including cryptographic private keys and seed information from which those keys are detived, on a “cold storage” device (i.e., a device without internet connectivity. By storing offline, the user protects itself from potential compromise of hot storage systems. However, cold storage solutions can be difficult to implement and require considerable effort to set up and execute a trade of a blockchain asset.

Through applied effort, ingenuity, and innovation, Applicant has identified a number of deficiencies and problems with cold storage devices and systems. Applicant has developed a solution that is embodied by the present invention, which is described in detail below.

SUMMARY

Certain aspects of the present disclosure provide for a cold digital storage apparatus comprising a computing module comprising at least one processor and a non-transitory computer readable medium communicably engaged with the at least one processor; an output device communicably engaged with the computing module, the output device comprising a visual display; an input device communicably engaged with the computing module, the input device comprising a touchscreen or a keypad; and a camera communicably engaged with the computing module, wherein the camera is configured to capture a digital image; wherein the non-transitory computer readable medium comprises instructions stored thereon that, when executed, cause the at least one processor to perform one or more operations, the one or more operations comprising: generating a cryptographic public-private keypair; displaying, via the output device, a public key or a public key hash associated with the public-private keypair; receiving, via the camera, a cryptographic message from an interface device comprising the public key or the public key hash; verifying the cryptographic message data according to the cryptographic public-private keypair; signing the cryptographic message in response to successfully verifying the cryptographic message data according to the cryptographic public-private keypair; generating a signed cryptographic message according to the cryptographic public-private keypair; concatenating a hash of one or more user identity data with the signed cryptographic message; and generating a machine-readable optical code comprising concatenated data comprising the signed cryptographic message and the one or more user identity data.

In accordance with certain embodiments, the one or more operations may further comprise generating a machine-readable optical code comprising the public key or the public key hash. In certain embodiments, the cryptographic message from the interface device may comprise a machine-readable optical code comprising the public key or the public key hash. In certain embodiments, the one or more operations may further comprise verifying a user identity according to one or more user identity data. In certain embodiments, the one or more operations may further comprise concatenating a hash of one or more verified user identity data with the signed cryptographic message. In accordance with certain embodiments, the input device comprises at least one biometric sensor. In certain embodiments, the one or more operations may further comprise processing at least one biometric input from the at least one biometric sensor or the camera. In certain embodiments, the one or more operations further comprise verifying the identity of at least one user in response to processing the at least one biometric input from the at least one biometric sensor or the camera. In certain embodiments, the one or more operations further comprise associating the identity of the at least one user with the public key or the public key hash.

Further aspects of the present disclosure provide for a cold storage system comprising a cold storage apparatus comprising a first computing module, a first non-transitory memory device, a first input/output interface and a first camera; and an interface apparatus comprising a second computing module, a second non-transitory memory device, a second input/output interface and a second camera, wherein the cold storage apparatus is operably configured to generate a cryptographic public-private keypair and display a public key or a public key hash associated with the public-private keypair, wherein the interface apparatus is operably configured to receive the public key or the public key hash, store the public key or the public key hash in the second non-transitory memory device and process the public key or the public key hash via the second computing module to operably pair the interface apparatus with the cold storage apparatus, wherein operably pairing the interface apparatus with the cold storage apparatus comprises receiving and verifying one or more user identity data with the cold storage apparatus, and concatenating a hash of a verified user identity with the cold storage apparatus.

In accordance with certain embodiments, the interface apparatus is operably configured to generate a cryptographic message comprising the public key or the public key hash and generate a visual display of the cryptographic message at the second input/output interface. In certain embodiments, the cold storage apparatus is operably configured to scan the cryptographic message with the first camera. In certain embodiments, the cold storage apparatus is operably configured to process the cryptographic message with the first computing module and cryptographically sign the cryptographic message. In certain embodiments, the cold storage apparatus is operably configured to display a cryptographically signed message at the first input/output interface. In certain embodiments, the interface apparatus is operably configured to scan the cryptographically signed message with the second camera and process the cryptographically signed message with the second computing module to authenticate the cryptographically signed message.

Still further aspects of the present disclosure provide for a cold storage system comprising a cold storage apparatus comprising a first computing module, a first non-transitory memory device, a first input/output interface, a first optical sensor and at least one biometric sensor; and an interface apparatus comprising a second computing module, a second non-transitory memory device, a second input/output interface and a second optical sensor, wherein the cold storage apparatus is operably configured to generate a cryptographic public-private keypair and display a public key or a public key hash associated with the public-private keypair, wherein the interface apparatus is operably configured to receive the public key or the public key hash, store the public key or the public key hash in the second non-transitory memory device and process the public key or the public key hash via the second computing module to operably pair the interface apparatus with the cold storage apparatus, wherein the cold storage apparatus is operably configured to receive at least one biometric data input from the at least one biometric sensor and verify the identity of at least one user according to the at least one biometric data input, wherein operably pairing the interface apparatus with the cold storage apparatus comprises concatenating a hash of a verified biometric data input with the cold storage apparatus.

In accordance with certain embodiments, the interface apparatus is operably configured to generate a cryptographic message comprising the public key or the public key hash and output the cryptographic message at the second input/output interface. In certain embodiments, the cold storage apparatus is operably configured to receive the cryptographic message at the first computing module and cryptographically sign the cryptographic message. In certain embodiments, the interface apparatus is operably configured to receive the cryptographically signed message at the second optical sensor and process the cryptographically signed message with the second computing module to authenticate the cryptographically signed message. In certain embodiments, the cold storage apparatus is operably configured to concatenate a signed hash comprising the biometric data input and the public key or the public key hash.

DETAILED DESCRIPTION

It should be appreciated that all combinations of the concepts discussed in greater detail below (provided such concepts are not mutually inconsistent) are contemplated as being part of the inventive subject matter disclosed herein. It also should be appreciated that terminology explicitly employed herein that also may appear in any disclosure incorporated by reference should be accorded a meaning most consistent with the particular concepts disclosed herein.

It should be appreciated that various concepts introduced above and discussed in greater detail below may be implemented in any of numerous ways, as the disclosed concepts are not limited to any particular manner of implementation. Examples of specific implementations and applications are provided primarily for illustrative purposes. The present disclosure should in no way be limited to the exemplary implementation and techniques illustrated in the drawings and described below.

As used herein, “exemplary” means serving as an example or illustration and does not necessarily denote ideal or best.

As used herein, the term “includes” means includes but is not limited to, the term “including” means including but not limited to. The term “based on” means based at least in part on.

As used herein, the term “interface” refers to any shared boundary across which two or more separate components of a computer system may exchange information. The exchange can be between software, computer hardware, peripheral devices, humans, and combinations thereof.

Following below are more detailed descriptions of various concepts related to, and embodiments of, inventive methods, apparatuses and systems for secure authentication utilizing a cold cryptographic storage signature system. An exemplary system, method, and apparatus according to the principles herein may include a cold storage apparatus comprising a computing module, a storage drive, an output mechanism such as a screen, input mechanisms such as a touchscreen or keyboard/keypad, and a camera. The computing module of the cold storage apparatus may be configured to execute one or more cryptography algorithm or framework to generate a globally unique alpha-numeric identifier comprising a cryptographically secure “private key” and store the private key in a memory device of the computing module. The computing module of the cold storage apparatus may be further configured to execute the one or more cryptography algorithm or framework to generate one or more “public keys” or hash of the public key (together, the “PK/PKH”) that are mathematically associated with the private key, such that possession of the private key and its relationship to the public key can be established and verified without disclosing the private key. These public and private keys may also comprise one or more master keys, such that a tree of child keypairs may be derived from them. The cold storage apparatus can regenerate any number of private/public keypairs, as needed. In accordance with certain aspects of the present disclosure, the cold storage apparatus has no physical or electromagnetic connection to any other device and is completely isolated from sharing any data through any means other than optically; for example, via a visual display screen or a free-space optical communication pathway. In accordance with certain aspects of the present disclosure, the cold storage apparatus can include a means to verify a user identity and pair the user identity with the public key of the cold storage apparatus via biometric identification data (e.g., fingerprint, retinal scanning technology, and the like) by taking a cryptographic hash of the biometric identification data and associating it with the PK/PKH through a cryptographic signature. In accordance with certain aspects of the present disclosure, the cold storage apparatus may be operably engaged with an interface apparatus comprising a means to generate and visually display a message (which may comprise any data known to the interface apparatus that the interface apparatus wishes to authenticate via the cold storage apparatus) and a means to receive data optically (e.g., via an integrated camera or optical sensor).

In accordance with certain exemplary embodiments of the present disclosure, a cold storage apparatus generates a private key, computes an associated PK/PKY and displays the latter on a visual display screen. The interface apparatus retrieves the PK/PKH visually and stores it in memory. This “pairs” the cold storage apparatus with the interface apparatus, such that any message signed by the private key of the cold storage apparatus can be verified by the interface apparatus (since the interface apparatus knows the PK/PKY). The interface apparatus produces the message and displays it visually. The cold storage apparatus retrieves the message visually, and cryptographically signs the message utilizing public key cryptography methods. The cold storage apparatus produces the signed output on its screen visually. The interface apparatus retrieves the signed output and verifies that the cold storage apparatus signed the message, utilizing public key cryptography methods. As an alternative to the visual exchange of information, the interface apparatus and cold storage apparatus can communicate via manual user input (e.g., a keypad input).

Certain benefits and advantages of the present disclosure include a secure cold storage cryptographic authentication system that it is hack proof without physical possession of a cold storage apparatus. One or more private keys are generated by the cold storage apparatus and never leave the cold storage apparatus. The cold storage apparatus lacks a connected pathway of any kind (e.g., WiFi, cellular, BLUETOOTH, near-field communication, data transfer bus, etc.) to retrieve the private keys. The private keys can be cryptographically secured using a strong passphrase as protection against attacks involving physical possession of the cold storage apparatus.

Various exemplary use cases for the secure cold storage cryptographic authentication system and method may include, but are not limited to, authorizing transactions, including cryptocurrency transactions; authenticating access to websites; authenticating access to devices, such as automobiles, doors and garage doors; signing legal documents; and proving identity.

Turning now descriptively to the drawings, in which similar reference characters denote similar elements throughout the several views,FIG. 1depicts a functional block diagram of a secure cryptographic cold storage system100. In accordance with certain aspects of the present disclosure, system100comprises a cold storage apparatus (“CSA”)102and an interface apparatus (“IA”)202. In accordance with certain embodiments, CSA102may comprise a computing module104comprising at least one processor106and a non-transitory computer readable memory device108. Computing module104may be operably engaged with a power source114(e.g., a battery). Computing module104may be communicably engaged with at least one input device110(e.g., a touch screen, a keyboard, etc.) and an output device112(e.g., a visual display screen). Computing module104may also be communicably engaged with at least one camera116and, optionally, at least one biometric sensor118(e.g., a fingerprint scanner, a retinal scanner and the like). In accordance with certain embodiments, IA202may comprise an IA computing module204comprising an IA processor206and an IA non-transitory computer readable memory device208. IA computing module204may be operably engaged with an IA power source214(e.g., a battery). IA computing module204may be communicably engaged with at least one IA input device210(e.g., a touch screen, a keyboard, etc.) and an IA output device212(e.g., a visual display screen). IA computing module204may also be communicably engaged with at least one IA camera216. In accordance with various aspects of the present disclosure, IA202may be configured to scan a first graphical output generated at output device112of CSA102via IA camera216. Likewise, CSA102may be configured to scan a second graphical output generated at IA output device212via camera116; as described in more detail inFIG. 2, below.

Referring now toFIG. 2(with additional reference toFIG. 1), a functional block diagram of a system routine200of a cryptographic cold storage system100(as shown inFIG. 1) is shown. In accordance with certain aspects of the present disclosure, cold storage apparatus102and interface apparatus202are operably configured to executed one or more steps or operations201-223comprising routine200for secure cold storage cryptographic authentication. In accordance with certain embodiments, Steps201-223may be embodied as processor-executable instructions stored on non-transitory computer readable memory device108of cold storage apparatus102and/or IA non-transitory computer readable memory device208of interface apparatus202.

In accordance with certain aspects of the present disclosure, routine200comprises one or more steps or operations for generating, with cold storage apparatus102, a globally unique alpha-numeric identifier comprising a private key according to one or more cryptographic algorithm or framework (Step201). Routine200may continue by executing one or more steps or operations for computing, with cold storage apparatus102, an associated private key or private key hash (PK/PKH) comprising a keypair for the private key according to the one or more cryptographic algorithm or framework (Step203). Routine200may continue by executing one or more steps or operations for rendering a graphical output the PK/PKH at a display device of cold storage apparatus102(Step205). In certain embodiments, the display device is output device112of cold storage apparatus102. In certain embodiments, the PK/PKH is rendered in a machine-readable optical code format (e.g., a quick-response code). In certain embodiments, the PK/PKH is rendered in a human-readable format (e.g., an alpha-numeric string). Routine200may continue by executing one or more steps or operations for scanning, with a camera of interface apparatus202, the PK/PKH displayed at the display device of cold storage apparatus102(Step207). In certain embodiments, the camera may comprise IA camera216of interface apparatus202. Routine200may continue by executing one or more steps or operations for storing, with a memory device of interface apparatus202, the PK/PKH and associating the PK/PKH with cold storage apparatus102(Step209). Step209may be configured to “pair” cold storage apparatus102and interface apparatus202, such that any message signed by the private key of cold storage apparatus102can be verified by interface device202.

In accordance with certain aspects of the present disclosure, routine200may continue by executing one or more steps or operations for producing a message with the computing module of interface device202(Step211). In certain embodiments, the computing module is IA computing module204of interface apparatus202. Routine200may proceed by executing one or more steps or operations for rendering a graphical output of the message at a display device of interface apparatus202(Step213). In certain embodiments, the display device is IA output device212of interface apparatus202. In certain embodiments, the message is rendered in a machine-readable optical code format (e.g., a quick-response code). Routine200may continue by executing one or more steps or operations for scanning the message rendered at the display device of interface apparatus202with a camera of cold storage apparatus102(Step215). In certain embodiments, the camera is camera116of cold storage apparatus102. Routine200may continue by executing one or more steps or operations for processing the message, with the computing module of cold storage apparatus102, and cryptographically signing the message according to the one or more cryptographic algorithm or framework (Step217). Routine200may continue by executing one or more steps or operations for rendering a graphical output the signed message at the display device (e.g., output device112) of cold storage apparatus102(Step219). In certain embodiments, the signed message is rendered in a machine-readable optical code format (e.g., a quick-response code). In certain embodiments, the signed message is rendered in a human-readable format (e.g., an alpha-numeric string). Routine200may continue by executing one or more steps or operations for retrieving the signed message/output with interface apparatus202(Step221) and verifying, according to the one or more cryptographic algorithm or framework, that cold storage apparatus102signed the message (Step223). In certain embodiments, as an alternative to scanning a graphical output with a camera of cold storage apparatus102and/or interface apparatus202, cold storage apparatus102and/or interface apparatus202may receive data associated with a user-generated input via input device110and/or IA input device210.

Referring now toFIGS. 3A-3C, process flow diagrams of routines300a-300cfor pairing a cold storage device (e.g., cold storage apparatus102as shown inFIG. 1) and an interface device (e.g., interface apparatus202as shown inFIG. 1) within a cryptographic cold storage system (e.g., system100as shown inFIG. 1) are shown. In accordance with certain aspects of the present disclosure, routines300a-300cmay be sequential to one or more steps or operations of routine200(as shown inFIG. 2) and/or may comprise one or more sub-steps or sub-routines of routine200.

In accordance with certain aspects of the present disclosure, routine300amay comprise one or more steps or operations for pairing a cold storage device and an interface device via a camera and a machine-readable optical code. In accordance with certain embodiments, routine300amay be initiated by executing one or more steps or operations for computing a private key (Step302a) and a public key or public key hash (Step304a) according to a cryptographic algorithm and/or framework via the cold storage device. The private key and the public key or public key hash may comprise a public-private keypair within the cryptographic algorithm and/or framework. Routine300amay proceed by executing one or more steps or operations for generating a machine-readable optical code comprising the PK/PKH at a visual display of the cold storage device (Step306a). In accordance with certain embodiments, routine300amay proceed by executing one or more steps or operations for scanning the machine-readable optical code comprising the PK/PKH from the visual display of the cold storage device via a camera of the interface device (Step308a). Routine300amay proceed by executing one or more steps or operations for storing the PK/PKH in a non-transitory computer readable medium of the interface device (Step310a) and associating the PK/PKH with the cold storage device (Step312a). In accordance with certain aspects of the present disclosure, upon the completion of Steps302a-312a, cold storage device and interface device are operably paired within the cryptographic cold storage system.

In accordance with certain aspects of the present disclosure, routine300bmay comprise one or more steps or operations for pairing a cold storage device and an interface device via a user-generated input. In accordance with certain embodiments, routine300bmay be initiated by executing one or more steps or operations for computing a private key (Step302b) and a public key or public key hash (Step304b) according to a cryptographic algorithm and/or framework via the cold storage device. The private key and the public key or public key hash may comprise a public-private keypair within the cryptographic algorithm and/or framework. Routine300bmay proceed by executing one or more steps or operations for outputting the PK/PKH in a human-readable format (e.g., an alpha-numeric string) at a visual display of the cold storage device (Step306b). In accordance with certain embodiments, routine300amay proceed by executing one or more steps or operations for receiving a user-generated input comprising the PK/PKH alpha-numeric string via an input means of the interface device (Step308b). Routine300bmay proceed by executing one or more steps or operations for storing the PK/PKH in a non-transitory computer readable medium of the interface device (Step310b) and associating the PK/PKH with the cold storage device (Step312b). In accordance with certain aspects of the present disclosure, upon the completion of Steps302b-312b, cold storage device and interface device are operably paired within the cryptographic cold storage system.

In accordance with certain aspects of the present disclosure, routine300cmay comprise one or more steps or operations for pairing a cold storage device and an interface device via a biometric sensor, a camera and a machine-readable optical code. In accordance with certain embodiments, routine300cmay be initiated by executing one or more steps or operations for computing a private key (Step302c) and a public key or public key hash (Step304c) according to a cryptographic algorithm and/or framework via the cold storage device. The private key and the public key or public key hash may comprise a public-private keypair within the cryptographic algorithm and/or framework. Routine300cmay proceed by executing one or more steps or operations for receiving user identification data (e.g., a fingerprint) via at least one biometric sensor of the cold storage device (Step306c). In accordance with certain embodiments, routine300cmay proceed by executing one or more steps or operations for concatenating a signed hash of the user identification data with the PK/PKH according to the cryptographic algorithm and/or framework (Step308c). Routine300cmay proceed by generating a machine-readable optical code comprising the signed hash of the user identification data and the PK/PKH at a visual display of the cold storage device (Step306c). In accordance with certain embodiments, routine300cmay proceed by executing one or more steps or operations for scanning the machine-readable optical code comprising the signed hash of the user identification data and the PK/PKH from the visual display of the cold storage device via a camera of the interface device (Step308c). Routine300cmay proceed by executing one or more steps or operations for storing the signed hash of the user identification data and PK/PKH in a non-transitory computer readable medium of the interface device (Step310c) and associating the signed hash of the user identification data and the PK/PKH with the cold storage device (Step312c). In accordance with certain aspects of the present disclosure, upon the completion of Steps302c-316c, cold storage device and interface device are operably paired within the cryptographic cold storage system.

Referring now toFIG. 4, a process flow diagram of an authentication routine400within a cryptographic cold storage system is shown. In accordance with certain aspects of the present disclosure, the cryptographic cold storage system may comprise cryptographic cold storage system100, as shown inFIG. 1. In accordance with certain aspects of the present disclosure, routine400may be sequential to one or more steps or operations of routine200(as shown inFIG. 2) and/or routines300a-300c(as shown inFIGS. 3A-3C) and/or may comprise one or more sub-steps or sub-routines of routine200and/or routines300a-300c.

In accordance with certain aspects of the present disclosure, routine400may be initiated by executing one or more steps or operations for generating a message at a display of an interface apparatus (e.g., interface apparatus202ofFIG. 1) (Step402). In certain embodiments, the message may be formatted as a machine-readable optical code (e.g., a quick response code). Routine400may proceed by executing one or more steps or operations for scanning the message with a camera of a cold storage apparatus (e.g., cold storage apparatus102ofFIG. 1) (Step404). Routine400may proceed by executing one or more steps or operations for cryptographically signing the message via a cryptographic algorithm or framework executing on a computing module of the cold storage apparatus (Step406). Routine400may proceed by executing one or more steps or operations for generating a graphical output of the signed message at a visual display of the cold storage apparatus (Step408). In accordance with certain embodiments, the signed message may include user identification data comprising a biometric sensor input. In embodiments where user identification data pairing is used, a hash of the user identification data is concatenated with the signed message. In accordance with certain embodiments, the graphical output of the signed message may be formatted as a machine-readable optical code. In certain embodiments, the graphical output of the signed message may be formatted as a human-readable alpha-numeric string. Routine400may proceed by executing one or more steps or operations for scanning the signed message with a camera of the interface apparatus (Step410). Routine400may proceed by executing one or more steps or operations for authenticating and/or verifying the signature from the cold storage device via the interface apparatus. In accordance with certain embodiments, human-readable alpha-numeric format may be substituted for machine-readable optical code format and manual, user-generated input may be substituted for scanned input from the camera(s).

Referring now toFIG. 5, a functional diagram of a cryptographic cold storage apparatus500is shown. In accordance with certain aspects of the present disclosure, cryptographic cold storage apparatus500may be embodied as cold storage apparatus102, as shown inFIG. 1. In accordance with certain embodiments, an exemplary form-factor of cryptographic cold storage apparatus500may comprise a hand-held housing502comprising a first surface comprising a user-interface screen504and an optional biometric sensor506. In certain embodiments, biometric sensor506may comprise a fingerprint scanner. Cryptographic cold storage apparatus500may comprise a camera508and an output screen510disposed on a second surface of hand-held housing502. In certain embodiments, user-interface screen504may be operably configured as a view finder of camera508. In certain embodiments, output screen510may be configured to render a machine-readable optical code comprising a PK/PKH generated by a computing module of cryptographic cold storage apparatus500.

Referring now toFIG. 6, a functional diagram of a cryptographic cold storage system600is shown. In accordance with certain aspects of the present disclosure, cryptographic cold storage system600may be embodied as cryptographic cold storage system100ofFIG. 1. In accordance with certain embodiments, cryptographic cold storage system600may comprise a cold storage apparatus602and an interface apparatus604. In accordance with various aspects of the present disclosure, cold storage apparatus602may be embodied as cold storage apparatus102ofFIG. 1and interface apparatus604may be embodied as interface apparatus202ofFIG. 1. An exemplary form-factor of cryptographic cold storage apparatus602may comprise a hand-held housing comprising an input/output device608and an optional biometric interface606disposed on a first surface of the hand-held housing. An exemplary form-factor of interface apparatus604may comprise a hand-held housing comprising a receiving portion616comprising an optical output device610b(e.g., a laser or a light-emitting diode) and an optical sensor612b(e.g., a photodiode). Cryptographic cold storage apparatus602may comprise a transmitter portion614disposed on an upper surface of the hand-held housing. In certain embodiments, transmitter portion614may comprise an optical output device610a(e.g., a laser or a light-emitting diode) and an optical sensor612a(e.g., a photodiode). In certain embodiments, a form-factor of cold storage apparatus602and interface apparatus604may be configured such that transmitter portion614may be mateably interfaced with receiving portion616. In accordance with certain aspects of the present disclosure, cryptographic cold storage apparatus602may be communicably engaged with interface apparatus604via a free-space optical communication pathway61. Optical output device610a,bmay be configured to modulate a visible light output comprising a data signal comprising the PK/PKH and/or a signed message from cryptographic cold storage apparatus602, which may be received at optical sensor612a,b.

Referring now toFIG. 7, a process flow diagram of a cryptographic cold storage method700is shown. In accordance with certain aspects of the present disclosure, method700may be embodied as one or more processor-executable instructions stored on a non-transitory computer readable medium of a cryptographic cold storage apparatus. In accordance with certain embodiments, the cryptographic cold storage apparatus may comprise cryptographic cold storage apparatus102ofFIG. 1. In accordance with certain embodiments, method700may comprise one or more steps or operations for generating a cryptographic public-private keypair (Step702). Method700may further comprise one or more steps or operations for displaying, via an output device of the cryptographic cold storage apparatus, a public key or a public key hash associated with the public-private keypair (Step704). Method700may further comprise one or more steps or operations for receiving, via a camera of the cryptographic cold storage apparatus, a cryptographic message from an interface device comprising the public key or the public key hash (Step706). Method700may further comprise one or more steps or operations for verifying the cryptographic message data according to the cryptographic public-private keypair (Step708). Method700may further comprise one or more steps or operations for signing the cryptographic message in response to successfully verifying the cryptographic message data according to the cryptographic public-private keypair (Step710). Method700may further comprise one or more steps or operations for generating a signed cryptographic message according to the cryptographic public-private keypair (Step712).

In accordance with certain aspects of the present disclosure, method700may further comprise one or more steps or operations for generating a machine-readable optical code comprising the public key or the public key hash. In certain embodiments, the cryptographic message from the interface device may comprise a machine-readable optical code comprising the public key or the public key hash. In certain embodiments, method700may further comprise one or more steps or operations for verifying a user identity according to one or more user identity data (e.g., a biometric sensor input). In certain embodiments, method700may further comprise one or more steps or operations for concatenating a hash of one or more user identification data with a signed message. In certain embodiments, method700may further comprise one or more steps or operations for verifying the identity of at least one user in response to processing the at least one biometric input from the at least one biometric sensor or the camera. In certain embodiments, method700may further comprise one or more steps or operations for associating the identity of the at least one user with the public key or the public key hash.

As will be appreciated by one of skill in the art, the present invention may be embodied as a method (including, for example, a computer-implemented process, a business process, and/or any other process), apparatus (including, for example, a system, machine, device, computer program product, and/or the like), or a combination of the foregoing. Accordingly, embodiments of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.), or an embodiment combining software and hardware aspects that may generally be referred to herein as a “system.” Furthermore, embodiments of the present invention may take the form of a computer program product on a computer-readable medium having computer-executable program code embodied in the medium. In accordance with certain aspects of the present disclosure, any suitable transitory or non-transitory computer readable medium may be utilized. The computer readable medium may be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device. More specific examples of the computer readable medium include, but are not limited to, the following: an electrical connection having one or more wires; a tangible storage medium such as a portable computer diskette, a hard disk, a random-access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory) or other optical or magnetic storage device.

The computer-executable program code may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational phases to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the code portions which execute on the computer or other programmable apparatus provide phases for implementing the functions/acts specified in the flowchart and/or block diagram block(s). Alternatively, computer program implemented phases or acts may be combined with operator or human implemented phases or acts in order to carry out an embodiment of the invention.