# US 11,310,038 B2 · System and method for securing data communication between computers

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,310,038 B2
- Document ID: US11310038B2
- Status: Granted
- Kind: B2
- Application number: 16/977,380
- Filed: 2019-02-28
- Published: 2021-02-25
- Granted: 2022-04-19
- Earliest claimed: 2018-03-02
- Assignees: Nitto Denko Corporation
- Applicants: Nitto Denko Corporation
- Inventors: Mutita Donsomsakunkij; Disuan Netsirininkul; Suwan Boonprem; Juckrit Youyen; Jugkree Na Ayutthaya Plalakawong
- Web page: https://patentgrep.com/patent/US11310038B2

## CPC

- G06F 21/602: {Providing cryptographic facilities or services}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/0827: {involving distinctive intermediate devices or communication paths (network architectures or network communication protocols using different networks H04L63/18)}
- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L 63/045: {wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)}
- H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)}
- H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70)
- G06F 2221/2107: File encryption
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 2209/88: Medical equipments
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

An aspect of the present disclosure generally relates to a computer system (100) and method (200) for securing data communication between a first computer (110) and a second computer (120). The method (200) comprises: cooperatively executing (202), by the first computer (110) and the second computer (120), a first data communication instruction for communicating first data from the first computer (110) to the second computer (120); generating (204) a first session key by the first computer (110); encrypting (206), by the first computer (110) the first data using the first session key; encrypting (208), by the first computer (110) the first session key using a first public key, the first public key paired with a first private key which are generated for the second computer (120); sending (210) the encrypted first data and first session key from the first computer (110) to the second computer (120); decrypting (212), by the second computer (120), the encrypted first session key using the first private key; decrypting (214), by the second computer (120) the encrypted first data using the decrypted first session key; and processing (216), by the second computer (120), the decrypted first data based on the first data communication instruction.

## Claims

### Claim 1

A method for securing data communication between a first computer and a second computer, the method performed by the first and second computers and comprising:
cooperatively executing, by the first and second computers, a first data communication instruction for communicating first data from the first computer to the second computer;
generating a first session key by the first computer;
encrypting, by the first computer, the first data using the first session key;
encrypting, by the first computer, the first session key using a first public key, the first public key paired with a first private key, the first public-private key pair generated for the second computer by the first computer or second computer;
sending the encrypted first data and the encrypted first session key from the first computer to the second computer;
decrypting, by the second computer, the encrypted first session key using the first private key;
decrypting, by the second computer, the encrypted first data using the decrypted first session key; and
processing, by the second computer, the decrypted first data based on the first data communication instruction,
wherein the first public key or first private key is encrypted and decrypted using a token session key generated by the first computer, the token session key communicated from the first computer to the second computer;
wherein when the first public-private key pair is generated by the first computer, the first private key is encrypted by the first computer using the token session key and the encrypted first private key is communicated from first computer to the second computer, the encrypted first private key decrypted by the second computer using the token session key; and
wherein when the first public-private key pair is generated by the second computer, the first public key is encrypted by the second computer using the token session key and the encrypted first public key is communicated from second computer to the first computer, the encrypted first public key decrypted by the first computer using the token session key.

### Claim 2 (depends on 1)

The method according to claim 1, further comprising cooperatively performing, by the first and second computers, a token generation process before executing the first data communication instruction, the token generation process comprising:
generating the token session key by the first computer;
encrypting, by the first computer, a token request using the token session key;
sending the token session key and the encrypted token request from the first computer to the second computer;
decrypting, by the second computer, the encrypted token request using the token session key;
generating the first public-private key pair for and by the second computer;
encrypting, by the second computer, the first public key using the token session key;
sending the encrypted first public key from the second computer to the first computer; and
decrypting, by the first computer, the encrypted first public key using the token session key.

### Claim 3 (depends on 1)

The method according to claim 1, further comprising cooperatively performing, by the first and second computers, a token generation process before executing the first data communication instruction, the token generation process comprising:
generating the token session key by the first computer;
generating the first public-private key pair by the first computer for the second computer;
encrypting, by the first computer, the first private key using the token session key;
sending the token session key and the encrypted first private key from the first computer to the second computer; and
decrypting, by the second computer, the encrypted first private key using the token session key.

### Claim 4 (depends on 1)

The method according to claim 1, wherein the first public-private key pair has an expiry condition, such that the first public-private key pair is valid for encryption and decryption before the expiry condition is met.

### Claim 5 (depends on 1)

The method according to claim 1, wherein the first computer is a local client computer and the second computer is a remote computer server.

### Claim 6 (depends on 1)

The method according to claim 1, wherein the first computer is a remote computer server and the second computer is a local client computer.

### Claim 7 (depends on 1)

The method according to claim 1, further comprising:
cooperatively executing, by the first and second computers, a second data communication instruction for communicating second data from the second computer to the first computer;
generating a second session key by the second computer;
encrypting, by the second computer, the second data using the second session key;
encrypting, by the second computer, the second session key using a second public key, the second public key paired with a second private key, the second public-private key pair generated for the first computer by the first computer or second computer;
sending the encrypted second data and the encrypted second session key from the second computer to the first computer;
decrypting, by the first computer, the encrypted second session key using the second private key;
decrypting, by the first computer, the encrypted second data using the decrypted second session key; and
processing, by the first computer, the decrypted second data based on the second data communication instruction,
wherein the second public key or second private key is encrypted and decrypted using a token session key generated by the first computer, the token session key communicated from the first computer to the second computer;
wherein when the second public-private key pair is generated by the first computer, the second public key is encrypted by the first computer using the token session key and the encrypted second public key is communicated from first computer to the second computer, the encrypted second public key decrypted by the second computer using the token session key; and
wherein when the second public-private key pair is generated by the second computer, the second private key is encrypted by the second computer using the token session key and the encrypted second private key is communicated from second computer to the first computer, the encrypted second private key decrypted by the first computer using the token session key.

### Claim 8 (depends on 7)

The method according to claim 7, further comprising cooperatively performing, by the first and second computers, a token generation process before executing the first data communication instruction, the token generation process comprising:
generating the token session key by the first computer;
encrypting, by the first computer, a token request using the token session key;
sending the token session key and the encrypted token request from the first computer to the second computer;
decrypting, by the second computer, the encrypted token request using the token session key;
generating the first public-private key pair for and by the second computer;
generating the second public-private key pair by the second computer for the first computer;
encrypting, by the second computer, the first public key and the second private key using the token session key;
sending the encrypted first public key and the encrypted second private key from the second computer to the first computer; and
decrypting, by the first computer, the encrypted first public key and the encrypted second private key using the token session key.

### Claim 9 (depends on 7)

The method according to claim 7, further comprising cooperatively performing, by the first and second computers, a token generation process before executing the first data communication instruction, the token generation process comprising:
generating the token session key by the first computer;
generating the first public-private key pair by the first computer for the second computer;
generating the second public-private key pair for and by the first computer;
encrypting, by the first computer, the first private key and the second public key using the token session key;
sending the token session key, the encrypted first private key, and the encrypted second public key from the first computer to the second computer; and
decrypting, by the second computer, the encrypted first private key and the encrypted second public key using the token session key.

### Claim 10 (depends on 7)

The method according to claim 7, wherein each of the first and second public-private key pairs has an expiry condition, such that each of the first and second public-private key pairs is valid for encryption and decryption before the respective expiry condition is met.

### Claim 11 (depends on 7)

The method according to claim 7, wherein the first computer is a local client computer and the second computer is a remote computer server, wherein the first data comprises authentication data of a user of the local client computer, and wherein the second data comprises a message authentication code (MAC) generated by the remote computer server in response to successful authentication of the authentication data by the remote computer server.

### Claim 12

A computer system comprising a first computer and a second computer communicatively connected to each other, the computer system configured for securing data communication between the first and second computers, the first and second computers configured for performing steps comprising:
cooperatively executing, by the first and second computers, a first data communication instruction for communicating first data from the first computer to the second computer;
generating a first session key by the first computer;
encrypting, by the first computer, the first data using the first session key;
encrypting, by the first computer, the first session key using a first public key, the first public key paired with a first private key, the first public-private key pair generated for the second computer by the first computer or second computer;
sending the encrypted first data and the encrypted first session key from the first computer to the second computer;
decrypting, by the second computer, the encrypted first session key using the first private key;
decrypting, by the second computer, the encrypted first data using the decrypted first session key; and
processing, by the second computer, the decrypted first data based on the first data communication instruction,
wherein the first public key or first private key is encrypted and decrypted using a token session key generated by the first computer, the token session key communicated from the first computer to the second computer;
wherein when the first public-private key pair is generated by the first computer, the first private key is encrypted by the first computer using the token session key and the encrypted first private key is communicated from first computer to the second computer, the encrypted first private key decrypted by the second computer using the token session key; and
wherein when the first public-private key pair is generated by the second computer, the first public key is encrypted by the second computer using the token session key and the encrypted first public key is communicated from second computer to the first computer, the encrypted first public key decrypted by the first computer using the token session key.

### Claim 13 (depends on 12)

The system according to claim 12, further comprising cooperatively performing, by the first and second computers, a token generation process before executing the first data communication instruction, the token generation process comprising:
generating the token session key by the first computer;
encrypting, by the first computer, a token request using the token session key;
sending the token session key and the encrypted token request from the first computer to the second computer;
decrypting, by the second computer, the encrypted token request using the token session key;
generating the first public-private key pair for and by the second computer;
encrypting, by the second computer, the first public key using the token session key;
sending the encrypted first public key from the second computer to the first computer; and
decrypting, by the first computer, the encrypted first public key using the token session key.

### Claim 14 (depends on 12)

The system according to claim 12, further comprising cooperatively performing, by the first and second computers, a token generation process before executing the first data communication instruction, the token generation process comprising:
generating the token session key by the first computer;
generating the first public-private key pair by the first computer for the second computer;
encrypting, by the first computer, the first private key using the token session key;
sending the token session key and the encrypted first private key from the first computer to the second computer; and
decrypting, by the second computer, the encrypted first private key using the token session key.

### Claim 15 (depends on 12)

The system according to claim 12, wherein the first computer is a local client computer and the second computer is a remote computer server.

### Claim 16 (depends on 12)

The system according to claim 12, wherein the first computer is a remote computer server and the second computer is a local client computer.

### Claim 17 (depends on 12)

The system according to claim 12, the steps further comprising:
cooperatively executing, by the first and second computers, a second data communication instruction for communicating second data from the second computer to the first computer;
generating a second session key by the second computer;
encrypting, by the second computer, the second data using the second session key;
encrypting, by the second computer, the second session key using a second public key, the second public key paired with a second private key, the second public-private key pair generated for the first computer by the first computer or second computer;
sending the encrypted second data and the encrypted second session key from the second computer to the first computer;
decrypting, by the first computer, the encrypted second session key using the second private key;
decrypting, by the first computer, the encrypted second data using the decrypted second session key; and
processing, by the first computer, the decrypted second data based on the second data communication instruction,
wherein the second public key or second private key is encrypted and decrypted using a token session key generated by the first computer, the token session key communicated from the first computer to the second computer;
wherein when the second public-private key pair is generated by the first computer, the second public key is encrypted by the first computer using the token session key and the encrypted second public key is communicated from first computer to the second computer, the encrypted second public key decrypted by the second computer using the token session key; and
wherein when the second public-private key pair is generated by the second computer, the second private key is encrypted by the second computer using the token session key and the encrypted second private key is communicated from second computer to the first computer, the encrypted second private key decrypted by the first computer using the token session key.

### Claim 18 (depends on 17)

The system according to claim 17, further comprising cooperatively performing, by the first and second computers, a token generation process before executing the first data communication instruction, the token generation process comprising:
generating the token session key by the first computer;
encrypting, by the first computer, a token request using the token session key;
sending the token session key and the encrypted token request from the first computer to the second computer;
decrypting, by the second computer, the encrypted token request using the token session key;
generating the first public-private key pair for and by the second computer;
generating the second public-private key pair by the second computer for the first computer;
encrypting, by the second computer, the first public key and the second private key using the token session key;
sending the encrypted first public key and the encrypted second private key from the second computer to the first computer; and
decrypting, by the first computer, the encrypted first public key and the encrypted second private key using the token session key.

### Claim 19 (depends on 17)

The system according to claim 17, further comprising cooperatively performing, by the first and second computers, a token generation process before executing the first data communication instruction, the token generation process comprising:
generating the token session key by the first computer;
generating the first public-private key pair by the first computer for the second computer;
generating the second public-private key pair for and by the first computer;
encrypting, by the first computer, the first private key and the second public key using the token session key;
sending the token session key, the encrypted first private key, and the encrypted second public key from the first computer to the second computer; and
decrypting, by the second computer, the encrypted first private key and the encrypted second public key using the token session key.

### Claim 20 (depends on 17)

The system according to claim 17, wherein the first computer is a local client computer and the second computer is a remote computer server, wherein the first data communication instruction relates to storing of the first data on the remote computer server, and wherein the second data communication instruction relates to retrieving of the second data from the remote computer server.