# US 10,320,560 B1 · Key management and dynamic perfect forward secrecy > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,560 B1 - Document ID: US10320560B1 - Status: Granted - Kind: B1 - Application number: 15/387,595 - Filed: 2016-12-21 - Granted: 2019-06-11 - Earliest claimed: 2014-02-24 - Assignees: Wickr Inc. - Applicants: Wickr Inc. - Inventors: Robert Statica; Christopher A. Howell - Web page: https://patentgrep.com/patent/US10320560B1 ## CPC - H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 2209/24: Key scheduling, i.e. generating round keys or sub-keys for block encryption - H04L 2209/80: Wireless - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An indication is received from a server that a first pool of public keys should be transmitted to a server. At least one public-private keypair is generated in response to the received indication. The public key portion of the generated keypair is transmitted to the server. A subsequent indication is received from the server that an additional public key should be transmitted to the server. ## Claims ### Claim 1 A system, comprising: an interface configured to: receive a pool of public keys from a first device, wherein the pool has a first pool size that reflects a target number of keys to be included in the pool; a processor configured to: designate one of the received public keys included in the pool of public keys as a reserve key; and select a public key from the pool of public keys for use in conjunction with encrypting a communication to the first device, wherein the selecting includes preferentially selecting a public key that is not designated as a reserve key when at least one such key is present in the pool in addition to the reserve key, and select the reserve key for use in conjunction with encrypting the communication when the reserve key is the only key remaining in the pool without deleting the reserve key from the pool until the pool is replenished; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system of claim 1 wherein the processor is further configured to delete the selected public key from the pool. ### Claim 3 (depends on 1) The system of claim 1 wherein the processor is further configured to transmit the selected public key to a second device. ### Claim 4 (depends on 1) The system of claim 1 wherein the first device is configured to generate a plurality of public-private keypairs, and wherein the first device is configured to retain the private keys included in the generated keypairs, and transmit the public keys as the pool. ### Claim 5 (depends on 1) The system of claim 1 wherein the processor is further configured to determine that the number of keys currently in the pool is below a threshold and to instruct the first device to transmit additional public keys to replenish the pool. ### Claim 6 (depends on 1) The system of claim 1 wherein the processor is further configured to determine whether the reserve key has been selected and, in response to a determination that the reserve key has been selected, set a flag indicating that the first device should be instructed to generate additional keys. ### Claim 7 (depends on 6) The system of claim 6 wherein the processor is further configured to delete the reserve key and to designate one of the additional keys as a new reserve key. ### Claim 8 (depends on 6) The system of claim 6 wherein the processor is further configured to increase the first pool size to a second pool size. ### Claim 9 (depends on 1) The system of claim 1 wherein the processor is further configured to increase the first pool size to a second pool size. ### Claim 10 A method, comprising: receiving a pool of public keys from a first device, wherein the pool has a first pool size that reflects a target number of keys to be included in the pool; designating one of the received public keys included in the pool of keys as a reserve key; and selecting a public key from the pool of received public keys for use in conjunction with encrypting a communication to the first device, wherein the selecting includes preferentially selecting a public key that is not designated as a reserve key, if at least one such key is present in the pool in addition to the reserve key; and selecting the reserve key for use in conjunction with encrypting the communication when the reserve key is the only key remaining in the pool without deleting the reserve key from the pool until the pool is replenished. ### Claim 11 (depends on 10) The method of claim 10 further comprising deleting the selected public key from the pool. ### Claim 12 (depends on 10) The method of claim 10 further comprising transmitting the selected public key to a second device. ### Claim 13 (depends on 10) The method of claim 10 wherein the first device is configured to generate a plurality of public-private keypairs, and wherein the first device is configured to retain the private keys included in the generated keypairs, and transmit the public keys as the pool. ### Claim 14 (depends on 10) The method of claim 10 further comprising determining that the number of keys currently in the pool is below a threshold and instructing the first device to transmit additional public keys to replenish the pool. ### Claim 15 (depends on 10) The method of claim 10 further comprising determining whether the reserve key has been selected and, in response to a determination that the reserve key has been selected, setting a flag indicating that the first device should be instructed to generate additional keys. ### Claim 16 (depends on 15) The method of claim 15 further comprising deleting the reserve key and designating one of the additional keys as a new reserve key. ### Claim 17 (depends on 15) The method of claim 15 further comprising increasing the first pool size to a second pool size. ### Claim 18 (depends on 10) The method of claim 10 further comprising increasing the first pool size to a second pool size. ### Claim 19 A computer program product, the computer program product being embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for: receiving a pool, having a first pool size, of public keys from a first device, wherein the pool size reflects a target number of keys to be included in the pool; designating one of the received public keys included in the pool of keys as a reserve key; selecting a public key from the pool of received public keys for use in conjunction with encrypting a communication to the first device, wherein the selecting includes preferentially selecting a public key that is not designated as a reserve key, if at least one such key is present in the pool in addition to the reserve key, and selecting the reserve key for use in conjunction with encrypting the communication when the reserve key is the only key remaining in the pool without deleting the reserve key from the pool until the pool is replenished.