# US 12,113,894 B1 · Quantum secured internet transport > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,894 B1 - Document ID: US12113894B1 - Status: Granted - Kind: B1 - Application number: 17/743,377 - Filed: 2022-05-12 - Granted: 2024-10-08 - Earliest claimed: 2020-04-03 - Assignees: Cable Television Laboratories, Inc. - Applicants: Cable Television Laboratories, Inc. - Inventors: Bernardo Huberman; Jing Wang; Robert M. Lund - Web page: https://patentgrep.com/patent/US12113894B1 ## CPC - H04L 9/0852: {Quantum cryptography (transmission systems employing electromagnetic waves other than radio waves, e.g. light, infrared H04B10/00; wavelength-division multiplex systems H04J14/02; WDM arrangements H04J14/03)} - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 63/166: {at the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods provide quantum secured internet transport. Quantum key distribution (QKD) is made universally available to existing Transport Layer Security (TLS) Internet services without requiring modification of existing applications. QKD keys may be prefetched and transferred to user devices at secure sites using QKD over an optical link (e.g., a continuous wave fiber or free-space optical link). A proxy QKD TLS tunnel client and a QKD TLS tunnel server are transparent to the user devices and select QKD keys for use with existing TLS client and TLS server services to form a QKD TLS tunnel between the user devices for secure communication. One-time-pad (OTP) encryption uses pre-shared QKD keys to provide secure OTP based encryption. ## Claims ### Claim 1 A method for secured Internet transport, comprising: prefetching, by a key manager of a first host computer at a first secure site, a quantum key distribution (QKD) key from a QKD layer; receiving, within a QKD transport layer security (TLS) client of the first host computer, a request from a client application of the first host computer for secure communication with a server application of a second host computer; initiating communication with a QKD TLS server of the second host computer; receiving, from the QKD TLS server, a pre-shared key (PSK) identity-hint; sending the PSK identity-hint to the key manager; receiving the QKD key and a PSK identity of the QKD key from the key manager; sending the PSK identity to the QKD TLS server; and forming a secure communication channel between the client application and the server application via QKD TLS using the QKD TLS client and the QKD key. ### Claim 2 (depends on 1) The method of claim 1, further comprising using a QKD TLS tunnel client proxy with a conventional TLS client to implement the QKD TLS client. ### Claim 3 (depends on 1) The method of claim 1, wherein prefetching comprises using a quantum channel to exchange quantum bits between the key manager and a second key manager of the QKD layer. ### Claim 4 (depends on 1) The method of claim 1, storing, by the key manager, the QKD key in association with a host identity of the second host computer. ### Claim 5 (depends on 4) The method of claim 4, the host identity comprising a network address of the second host computer. ### Claim 6 (depends on 4) The method of claim 4, the second host computer having a secure application entity that is defined by a framework for QKD networks of the European Standard Organization. ### Claim 7 (depends on 1) The method of claim 1, wherein the PSK identity is a JavaScript Object Notation (JSON) object storing an identity of the QKD key and a network address of the second host computer. ### Claim 8 A method for secured Internet transport, comprising: prefetching, by a key manager of a first host computer at a first secure site, a quantum key distribution (QKD) key from a QKD layer; receiving, by a quantum key distribution (QKD) transport layer security (TLS) server at the first host computer from a QKD TLS client at a second host computer, a request from a client application of the second host computer for secure communication with a server application of the first host computer; generating a pre-shared key (PSK) identity-hint in response to the request; sending the PSK identity-hint to the QKD TLS client; receiving a PSK identity from the QKD TLS client; sending the PSK identity to a key manager of the first host computer; receiving a QKD key from the key manager; and forming a secure communication channel between the server application and the client application via QKD TLS using the QKD TLS server and the QKD key. ### Claim 9 (depends on 8) The method of claim 8, further comprising using a QKD TLS tunnel server proxy with a conventional TLS server to implement the QKD TLS server. ### Claim 10 (depends on 8) The method of claim 8, wherein prefetching comprises using a quantum channel to exchange quantum bits between the key manager and a second key manager of the QKD layer. ### Claim 11 (depends on 8) The method of claim 8, further comprising storing, by the key manager, the QKD key in association with a host identity of the second host computer. ### Claim 12 (depends on 11) The method of claim 11, the host identity comprising a network address of the second host computer. ### Claim 13 (depends on 11) The method of claim 11, the second host computer having a secure application entity that is defined by a framework for QKD networks of the European Standard Organization. ### Claim 14 (depends on 8) The method of claim 8, wherein the PSK identity is a JavaScript Object Notation (JSON) object storing an identity of the QKD key and a network address of the second host computer.