# US 11,909,874 B2 · Secure confidential use of communication session keys > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,874 B2 - Document ID: US11909874B2 - Status: Granted - Kind: B2 - Application number: 17/454,051 - Filed: 2021-11-08 - Published: 2022-05-12 - Granted: 2024-02-20 - Earliest claimed: 2020-11-09 - Assignees: Hub Data Security Ltd. - Applicants: Hub data security Ltd. - Inventors: Andrey Iaremenko - Web page: https://patentgrep.com/patent/US11909874B2 ## CPC - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)} - H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract At least one non-transitory computer readable medium, that at least one non-transitory computer readable medium stores instructions for (a) generating master keys by a keys security entity (KSE) that is established within a KSE; (b) generating one-time connection session keys, by the KSE, based on the master keys; (c) outputting, by the KSE, the one-time connection session keys to a Connection Security Entity (CSE) enclave in which a CSE is established, over a secure communication link; and (d) preventing access, by the KSE, to the master keys. ## Claims ### Claim 1 A method for secure communication, the method comprises: generating master keys by a keys security entity (KSE) enclave that is established within a KSE; generating one-time connection session keys, by the KSE enclave, based on the master keys; outputting the one-time connection session keys to a Connection Security Entity (CSE) and/or a CSE enclave that is established within the CSE, over a secure communication link; and preventing access, by the KSE enclave, to the master keys. ### Claim 2 (depends on 1) The method according to claim 1 comprising: verifying, by the KSE enclave, a state of the CSE and/or CSE enclave; and preventing a sending a one-time connection session key to the CSE and/or CSE enclave when failing to verify that a state of the CSE and/or CSE enclave is not compromised. ### Claim 3 (depends on 2) The method according to claim 2 comprising periodically verifying the state of the CSE enclave. ### Claim 4 (depends on 2) The method according to claim 2 comprising verifying the state of the CSE and/or CSE enclave before sending to the CSE and/or CSE enclave at least some of the one-time connection session keys. ### Claim 5 (depends on 1) The method according to claim 1 comprising: managing, by the CSE and/or CSE enclave, real time connections with multiple edge devices using the one-time connection session keys, and deleting, by the CSE and/or CSE enclave, each one-time connection session key at an end of a connection session to which the one-time connection session key is allocated. ### Claim 6 (depends on 1) The method according to claim 1 wherein the CSE is a cloud-based software-based CSE of a datacenter. ### Claim 7 (depends on 1) The method according to claim 1 comprising: requesting, by the CSE and/or CSE enclave and from the KSE, to provide a one-time connection session key for a connection session; providing to the CSE and/or CSE enclave the one-time connection session key; establishing, by the CSE and/or CSE enclave, a connection session using the one-time connection session key. ### Claim 8 (depends on 1) The method according to claim 1 comprising: requesting the KSE enclave to provide a one-time connection session key for a connection session; verifying, by the KSE enclave, whether a state of the CSE and/or CSE enclave is non-compromised state; following a successful verifying, responding to the request. ### Claim 9 A non-transitory computer readable medium for secure communication, the non-transitory computer readable medium comprises: generating master keys by a keys security entity (KSE) enclave that is established within a KSE; generating one-time connection session keys, by the KSE enclave, based on the master keys; outputting the one-time connection session keys to a Connection Security Entity (CSE) and/or a CSE enclave that is established within the CSE, over a secure communication link; and preventing access, by the KSE enclave, to the master keys. ### Claim 10 (depends on 9) The non-transitory computer readable medium according to claim 9 that stores instructions for: verifying, by the KSE enclave, a state of the CSE and/or CSE enclave; and preventing a sending a one-time connection session key to the CSE and/or CSE enclave when failing to verify that a state of the CSE and/or CSE enclave is not compromised. ### Claim 11 (depends on 10) The non-transitory computer readable medium according to claim 10 that stores instructions for periodically verifying the state of the CSE enclave. ### Claim 12 (depends on 10) The non-transitory computer readable medium according to claim 10 that stores instructions for verifying the state of the CSE and/or CSE enclave before sending to the CSE and/or CSE enclave at least some of the one-time connection session keys. ### Claim 13 (depends on 9) The non-transitory computer readable medium according to claim 9 that stores instructions for: managing, by the CSE and/or CSE enclave, real time connections with multiple edge devices using the one-time connection session keys, and deleting, by the CSE and/or CSE enclave, each one-time connection session key at an end of a connection session to which the one-time connection session key is allocated. ### Claim 14 (depends on 9) The non-transitory computer readable medium according to claim 9 wherein the CSE is a cloud-based software-based CSE of a datacenter. ### Claim 15 (depends on 9) The non-transitory computer readable medium according to claim 9 that stores instructions for: requesting, by the CSE and/or CSE enclave and from the KSE, to provide a one-time connection session key for a connection session; providing to the CSE and/or CSE enclave the one-time connection session key; establishing, by the CSE and/or CSE enclave, a connection session using the one-time connection session key. ### Claim 16 (depends on 9) The non-transitory computer readable medium according to claim 9 that stores instructions for: requesting the KSE enclave to provide a one-time connection session key for a connection session; verifying whether a state of the CSE and/or CSE enclave is non-compromised state; following a successful verifying, responding to the request. ### Claim 17 A system for secure communication, the system comprises: a keys security entity (KSE) enclave that is established in a KSE, the KSE enclave is configured to (a) generate master keys, (b) generate one-time connection session keys, by the KSE enclave, based on the master keys, (c) output the one-time connection session keys to a Connection Security Entity (CSE) and/or a CSE enclave that is established within the CSE, over a secure communication link; and (d) prevent access, by the KSE enclave, to the master keys. ### Claim 18 (depends on 17) The system according to claim 17 comprising the CSE and the CSE enclave. ### Claim 19 (depends on 17) The system according to claim 17 wherein the KSE enclave is configured to verify a state of the CSE and/or CSE enclave; and wherein the system is configured to prevent a sending a one-time connection session key to the CSE and/or CSE enclave when failing to verify that a state of the CSE and/or CSE enclave is not compromised.