# US 12,015,600 B2 · System and method for providing a privacy layer to secure client data in a network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,600 B2 - Document ID: US12015600B2 - Status: Granted - Kind: B2 - Application number: 17/590,949 - Filed: 2022-02-02 - Published: 2022-05-19 - Granted: 2024-06-18 - Earliest claimed: 2019-05-13 - Assignees: Verizon Patent and Licensing Inc. - Applicants: Verizon Patent and Licensing Inc. - Inventors: Manuel Enrique Caceres; Taussif Khan; Mauricio Pati Caldeira De Andrada; Warren Hojilla Uy - Web page: https://patentgrep.com/patent/US12015600B2 ## CPC - H04L 63/045: {wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/0272: {Virtual private networks} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A device may receive a request to establish a virtualized environment to support a session for a client device in communication with the computing device over a network. The device may instantiate the virtualized environment in a trusted execution environment of the device, wherein the trusted execution environment may include one or more hardware resources that isolate the virtualized environment from a rich execution environment associated with the device. The device may cause a hardware security module associated with the device to obtain one or more cryptographic keys by communicating with a secure element of the client device, and the device may secure communication between a local operating system executing on the client device and the virtualized environment instantiated in the trusted execution environment using the one or more cryptographic keys. ## Claims ### Claim 1 A method, comprising: instantiating, by a computing device, a virtualized environment in a trusted execution environment, wherein the trusted execution environment includes one or more hardware resources isolating data stored or processed in the trusted execution environment from a rich execution environment associated with the computing device, and wherein the computing device is associated with a unique identity mapped to a hardware security module in communication with the computing device; causing, by the computing device, the hardware security module to obtain one or more keys by communicating with a secure element of a client device according to one or more permissions granted to the unique identity using a blockchain controlled by the client device, wherein the blockchain is configured to limit writing of entries of transactions to the client device; and securing, by the computing device, communication between a local operating system executing on the client device and the virtualized environment using the one or more keys, for establishing a chain of trust and regulating interactions between the secure element, the hardware security module, and the trusted execution environment, wherein securing the communication between the local operating system executing on the client device and the virtualized environment includes: passing ciphertext data to the hardware security module for decryption into cleartext data using the one or more keys; and processing the cleartext data in the trusted execution environment. ### Claim 2 (depends on 1) The method of claim 1, wherein the one or more keys comprise information related to: one or more symmetric keys, or one or more asymmetric keys. ### Claim 3 (depends on 1) The method of claim 1, wherein the hardware security module is co-located with the computing device in an edge region of a network. ### Claim 4 (depends on 1) The method of claim 1, wherein the rich execution environment is used to execute a main operating system. ### Claim 5 (depends on 1) The method of claim 1, wherein applications executed in the trusted execution environment have access to computing resources of the computing device. ### Claim 6 (depends on 1) The method of claim 1, further comprising: recording, in the blockchain, a request to migrate the one or more keys to a target hardware security module mapped to a target computing node based on determining that the virtualized environment is to be migrated to the target computing node. ### Claim 7 (depends on 1) The method of claim 1, wherein the hardware security module is mapped to a particular identity associated with a computing node associated with the virtualized environment. ### Claim 8 A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising: one or more instructions that, when executed by one or more processors of a computing device, cause the computing device to: instantiate a virtualized environment in a trusted execution environment, wherein the trusted execution environment includes one or more hardware resources, isolating data stored or processed in the trusted execution environment from a rich execution environment associated with the computing device, and wherein the computing device is associated with a unique identity mapped to a hardware security module in communication with the computing device; cause the hardware security module to obtain one or more keys by communicating with a secure element of a client device according to one or more permissions granted to the unique identity using a blockchain controlled by the client device, wherein the blockchain is configured to limit writing of entries of transactions to the client device; and secure communication between a local operating system executing on the client device and the virtualized environment using the one or more keys, for establishing a chain of trust and regulating interactions between the secure element, the hardware security module, and the trusted execution environment, wherein the one or more instructions, that cause the computing device to secure the communication between the local operating system executing on the client device and the virtualized environment, cause the computing device to: pass ciphertext data to the hardware security module for decryption into cleartext data using the one or more keys; and process the cleartext data in the trusted execution environment. ### Claim 9 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the one or more keys comprise information related to: one or more symmetric keys, or one or more asymmetric keys. ### Claim 10 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the hardware security module is co-located with the computing device in an edge region of a network. ### Claim 11 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the rich execution environment is used to execute a main operating system. ### Claim 12 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein applications executed in the trusted execution environment have access to computing resources of the computing device. ### Claim 13 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the one or more instructions further cause the computing device to: record, in the blockchain, a request to migrate the one or more keys to a target hardware security module mapped to a target computing node based on determining that the virtualized environment is to be migrated to the target computing node. ### Claim 14 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the one or more instructions further cause the computing device to: record a transaction in the blockchain associated with modifying an identity of the hardware security module. ### Claim 15 A device, comprising: one or more processors configured to: instantiate a virtualized environment in a trusted execution environment, wherein the trusted execution environment includes one or more hardware resources, isolating data stored or processed in the trusted execution environment from a rich execution environment associated with the device, and wherein the device is associated with a unique identity mapped to a hardware security module in communication with the device; cause the hardware security module to obtain one or more keys by communicating with a secure element of a client device according to one or more permissions granted to the unique identity using a blockchain controlled by the client device, wherein the blockchain is configured to limit writing of entries of transactions to the client device; and secure communication between a local operating system executing on the client device and the virtualized environment using the one or more keys, for establishing a chain of trust and regulating interactions between the secure element, the hardware security module, and the trusted execution environment, wherein the one or more processors, to secure the communication between the local operating system executing on the client device and the virtualized environment, are configured to: pass ciphertext data to the hardware security module for decryption into cleartext data using the one or more keys; and process the cleartext data in the trusted execution environment. ### Claim 16 (depends on 15) The device of claim 15, wherein the one or more keys comprise information related to: one or more symmetric keys, or one or more asymmetric keys. ### Claim 17 (depends on 15) The device of claim 15, wherein the hardware security module is co-located with the device in an edge region of a network. ### Claim 18 (depends on 15) The device of claim 15, wherein the rich execution environment is used to execute a main operating system. ### Claim 19 (depends on 15) The device of claim 15, wherein the one or more processors are further configured to: record, in the blockchain, a request to migrate the one or more keys to a target hardware security module mapped to a target computing node based on determining that the virtualized environment is to be migrated to the target computing node. ### Claim 20 (depends on 15) The device of claim 15, wherein the one or more processors are further configured to: determine whether a transaction granting the hardware security module access to the one or more keys is recorded in the blockchain.