Network securing device data using two post-quantum cryptography key encapsulation mechanisms

A network for conducting secure communications with a device, the network comprising:

• a nonvolatile memory configured to store a first set of key exchange mechanism (KEM) parameters;
• a wide area network (WAN) interface configured to:
• a) receive, from the device, a first message comprising (i) a device ephemeral public key, (ii) a second set of KEM parameters, and (iii) a first KEM algorithm for both the first set of KEM parameters and the second set of KEM parameters, wherein the device ephemeral public key supports the first KEM algorithm;
• b) send, to the device, a second message comprising a first asymmetric ciphertext and a first symmetric ciphertext;
• and
• c) receive, from the device, a third message comprising a second symmetric ciphertext and a third symmetric ciphertext, wherein the second symmetric ciphertext is encrypted with a first symmetric ciphering key, and wherein the third symmetric ciphertext is encrypted with a second symmetric ciphering key;
• and
• a random access memory (RAM) storing computer executable instructions configured to:
• a) generate a server private key and a server public key for the first set of KEM parameters, wherein the server public key corresponds to the server private key;
• and
• b) select (i) a second KEM algorithm of both the first set of KEM parameters and the second set of KEM parameters, and (ii) the server public key for the second KEM algorithm, wherein the first KEM algorithm and the second KEM algorithm comprise different algorithm types;
• and
• a first processor configured to:
• a) conduct a KEM encapsulation (ENCAPS) function with the device ephemeral public key and the first KEM algorithm in order to generate the first asymmetric ciphertext and a first shared secret;
• b) derive the first symmetric ciphering key using at least the first shared secret;
• c) encrypt at least (i) the server public key and (ii) an identifier for the second KEM algorithm with the first symmetric ciphering key into the first symmetric ciphertext;
• d) decrypt the second symmetric ciphertext with the first symmetric ciphering key in order to read a second asymmetric ciphertext;
• e) derive the second symmetric ciphering key with an HMAC-based Extract-and-Expand Key Derivation Function (HKDF) for at least the first shared secret and a second shared secret;
• and
• f) decrypt the third symmetric ciphertext with the second symmetric ciphering key;
• and
• a second processor configured to conduct a KEM decapsulation (DECAPS) function with the server private key, the second KEM algorithm, and the second asymmetric ciphertext in order to generate the second shared secret.