# US 12,192,328 B1 · Systems and methods for secure communication based on random key derivation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,328 B1 - Document ID: US12192328B1 - Status: Granted - Kind: B1 - Application number: 17/662,707 - Filed: 2022-05-10 - Granted: 2025-01-07 - Earliest claimed: 2022-05-10 - Assignees: Wells Fargo Bank, N.A. - Applicants: Wells Fargo Bank, N.A. - Inventors: Jeff J. Stapleton - Web page: https://patentgrep.com/patent/US12192328B1 ## CPC - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/0852: {Quantum cryptography (transmission systems employing electromagnetic waves other than radio waves, e.g. light, infrared H04B10/00; wavelength-division multiplex systems H04J14/02; WDM arrangements H04J14/03)} - H04L 9/0869: {involving random numbers or seeds} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/12: Transmitting and receiving encryption devices synchronised or initially set up in a particular manner - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, apparatuses, methods, and computer program products are disclosed for secure communication based on random key derivation. An example method includes receiving, by communications hardware of a first device, an initial key shared between the first device and a second device. The example method also includes receiving, by the communications hardware of the first device, a first set of seed bits, wherein the first set of seed bits is also received by the second device. The example method also includes deriving, by key derivation circuitry of the first device, a first symmetric key based on the initial key and the first set of seed bits. The example method also includes performing, by data protection circuitry of the first device, a first cryptographic data protection action using the first symmetric key. ## Claims ### Claim 1 A method for secure communication based on random key derivation, the method comprising: receiving, by communications hardware of a first device, an initial key shared between the first device and a second device; receiving, by the communications hardware of the first device, a first set of seed bits, wherein the first set of seed bits is also received by the second device; deriving, by key derivation circuitry of the first device, a first symmetric key based on the initial key and the first set of seed bits; and performing, by data protection circuitry of the first device, a first cryptographic data protection action using the first symmetric key, wherein the first cryptographic data protection action facilitates secure communication between the first device and the second device based on the second device having also derived the first symmetric key. ### Claim 2 (depends on 1) The method of claim 1, further comprising, in response to occurrence of a triggering condition associated with the first symmetric key, performing a symmetric key update process comprising: receiving, by the communications hardware of the first device, a second set of seed bits; deriving, by the key derivation circuitry of the first device, a second symmetric key based on the initial key and the second set of seed bits; and performing, by the data protection circuitry of the first device, a second cryptographic data protection action using the second symmetric key, wherein the second symmetric key facilitates the secure communication between the first device and the second device, the second device having also derived the second symmetric key based on the initial key and the second set of seed bits. ### Claim 3 (depends on 2) The method of claim 2, wherein the triggering condition comprises one of a predefined amount of cryptographic data protection actions having been performed using the first symmetric key, a predefined amount of time having elapsed since the deriving of the first symmetric key, or an update, replacement, or failure of the first device or the second device. ### Claim 4 (depends on 2) The method of claim 2, wherein the key derivation circuitry of the first device derives the first symmetric key using a first key derivation function (KDF). ### Claim 5 (depends on 4) The method of claim 4, wherein the key derivation circuitry of the first device derives the second symmetric key using a second KDF different from the first KDF. ### Claim 6 (depends on 1) The method of claim 1, wherein performing the first cryptographic data protection action comprises at least one of: encrypting, by the data protection circuitry of the first device, data using the first symmetric key, decrypting, by the data protection circuitry of the first device, encrypted data using the first symmetric key, wherein the encrypted data is received from the second device, the encrypted data having been encrypted using the first symmetric key, generating, by the key derivation circuitry of the first device, a cryptographic key based at least on the first symmetric key, and generating, by the data protection circuitry of the first device, a message authentication code using the first symmetric key. ### Claim 7 (depends on 1) The method of claim 1, wherein a key generator of the first device establishes the initial key via quantum key distribution (QKD). ### Claim 8 (depends on 1) The method of claim 1, wherein the communications hardware of the first device receives the initial key from a key distribution device at an installed location of the first device. ### Claim 9 (depends on 1) The method of claim 1, wherein the first set of seed bits comprises a random number, and wherein the first set of seed bits is generated using a random number generator. ### Claim 10 (depends on 9) The method of claim 9, wherein the random number generator is a quantum random number generator (QRNG). ### Claim 11 (depends on 1) The method of claim 1, further comprising: receiving, by the communications hardware of the first device, one or more sets of seed bits; deriving, by the key derivation circuitry of the first device, one or more future symmetric keys based on the initial key and the one or more sets of seed bits; storing, by the key derivation circuitry of the first device, the one or more future symmetric keys; and in response to occurrence of a triggering condition associated with the first symmetric key, performing a symmetric key update process comprising: selecting, by the data protection circuitry of the first device, a future symmetric key from the one or more future symmetric keys; and performing, by the data protection circuitry of the first device, a second cryptographic data protection action using the future symmetric key, wherein the future symmetric key facilitates the secure communication between the first device and the second device, the second device having also derived the future symmetric key based on the initial key and the one or more sets of seed bits. ### Claim 12 An apparatus for secure communication based on random key derivation, the apparatus comprising: communications hardware of a first device configured to: receive an initial key shared between the first device and a second device, and receive a first set of seed bits, wherein the first set of seed bits is also received by the second device; key derivation circuitry of the first device configured to derive a first symmetric key based on the initial key and the first set of seed bits; and data protection circuitry of the first device configured to perform a first cryptographic data protection action using the first symmetric key, wherein the first cryptographic data protection action facilitates secure communication between the first device and the second device based on the second device having also derived the first symmetric key. ### Claim 13 (depends on 12) The apparatus of claim 12, wherein the communications hardware is further configured to, in response to occurrence of a triggering condition associated with the first symmetric key, receive a second set of seed bits; wherein the key derivation circuitry is further configured to derive a second symmetric key based on the initial key and the second set of seed bits; wherein the data protection circuitry is further configured to perform a second cryptographic data protection action using the second symmetric key, and wherein the second symmetric key facilitates the secure communication between the first device and the second device, the second device having also derived the second symmetric key based on the initial key and the second set of seed bits. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the triggering condition comprises one of a predefined amount of cryptographic data protection actions having been performed using the first symmetric key, a predefined amount of time having elapsed since the deriving of the first symmetric key, or an update, replacement, or failure of the first device or the second device. ### Claim 15 (depends on 13) The apparatus of claim 13, wherein the key derivation circuitry is configured to derive the first symmetric key using a first key derivation function (KDF). ### Claim 16 (depends on 15) The apparatus of claim 15, wherein the key derivation circuitry is configured to derive the second symmetric key using a second KDF different from the first KDF. ### Claim 17 (depends on 12) The apparatus of claim 12, wherein the data protection circuitry performs the first cryptographic data protection action by: encrypting data using the first symmetric key, decrypting encrypted data using the first symmetric key, wherein the encrypted data is received from the second device, the encrypted data having been encrypted using the first symmetric key, generating a cryptographic key based at least on the first symmetric key, and generating a message authentication code using the first symmetric key. ### Claim 18 (depends on 12) The apparatus of claim 12, further comprising a key generator configured to establish the initial key via quantum key distribution (QKD). ### Claim 19 (depends on 12) The apparatus of claim 12, wherein the communications hardware of the first device is configured to receive the initial key from a key loading device at an installed location of the first device. ### Claim 20 (depends on 12) The apparatus of claim 12, wherein the first set of seed bits comprises a random number, and wherein the first set of seed bits is received from a random number generator. ### Claim 21 (depends on 20) The apparatus of claim 20, wherein the random number generator is a quantum random number generator (QRNG). ### Claim 22 (depends on 12) The apparatus of claim 12, wherein the communications hardware is further configured to receive one or more sets of seed bits; wherein the key derivation circuitry is further configured to: derive one or more future symmetric keys based on the initial key and the one or more sets of seed bits, and store the one or more future symmetric keys; and wherein the data protection circuitry is further configured to, in response to occurrence of a triggering condition associated with the first symmetric key, perform a symmetric key update process comprising: selecting a future symmetric key from the one or more future symmetric keys; and performing a second cryptographic data protection action using the future symmetric key, wherein the future symmetric key facilitates the secure communication between the first device and the second device, the second device having also derived the future symmetric key based on the initial key and the one or more sets of seed bits. ### Claim 23 A computer program product for secure communication based on random key derivation, the computer program product comprising at least one non-transitory computer-readable storage medium storing software instructions that, when executed, cause a first device to: receive an initial key shared between the first device and a second device; receive a first set of seed bits, wherein the first set of seed bits is also received by the second device; derive a first symmetric key based on the initial key and the first set of seed bits; and perform a first cryptographic data protection action using the first symmetric key, wherein the first cryptographic data protection action facilitates secure communication between the first device and the second device based on the second device having also derived the first symmetric key.