# US 12,225,113 B2 · End to end file-sharing schema using signed Merkle tree randomly originated keys > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,113 B2 - Document ID: US12225113B2 - Status: Granted - Kind: B2 - Application number: 17/932,904 - Filed: 2022-09-16 - Published: 2024-03-21 - Granted: 2025-02-11 - Earliest claimed: 2022-09-16 - Assignees: Lenovo (Singapore) Pte. Ltd. - Applicants: Lenovo (Singapore) Pte. Ltd. - Inventors: Igor Stolbikov; Sergei Rodionov; Scott Wentao Li - Web page: https://patentgrep.com/patent/US12225113B2 ## CPC - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 9/0631: {Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms} - H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]} - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/0833: {involving conference or group key (network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065)} - H04L 9/0869: {involving random numbers or seeds} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A process for transmitting a file from a sender device to a receiver device includes generating a random symmetric session key for the sender device, and randomly selecting a private ephemeral key for the sender device. The private ephemeral key is associated with a corresponding first public key. A public ephemeral key is randomly selected for the receiving device. The public ephemeral key is associated with a corresponding first private key. A random value is generated, an encrypted session key is calculated, and the file is encrypted using symmetric encryption. The sender device includes a first public X509 certificate comprising a second public key and a corresponding second private key that is signed by a service provider, and the receiver device includes a second public X509 certificate comprising a third public key and a corresponding third private key. ## Claims ### Claim 1 A process for transmitting a file from a sender device to a receiver device comprising: generating a random symmetric session key for the sender device; randomly selecting a private ephemeral key for the sender device, the private ephemeral key associated with a corresponding first public key; wherein the receiver device comprises a randomly selected public ephemeral key, the public ephemeral key associated with a corresponding first private key; generating a random value within a range; calculating an encrypted session key; encrypting the file using symmetric encryption; and transmitting from the sender device to the receiver device a group ID, the encrypted session key, the random value, a sender device ID, a receiver device ID, a hashed file ID, a sender key ID, and a receiver key ID, wherein the receiver device includes a record comprising the random value, the sender device ID, the hashed file ID, and the group ID; wherein the sender device comprises a first public X509 certificate comprising a second public key and a corresponding second private key that is signed by a service provider; wherein the receiver device comprises a second public X509 certificate comprising a third public key and a corresponding third private key; and wherein the encrypted session key is calculated as follows: encrypted session key=(the random symmetric session key+the random value*the first public key*the first private key+the random value*the second public key*the third public key)/(mod(the range)). ### Claim 2 (depends on 1) The process of claim 1, comprising receiving the file at the receiver device, and decrypting the file using the random symmetric session key. ### Claim 3 (depends on 2) The process of claim 2, wherein the random symmetric session key is calculated as follows: random symmetric session key=the encrypted session key−(the random value*the first public key*the public ephemeral key+the random value*the second public key*the third private key)/(mod(the range)). ### Claim 4 (depends on 1) The process of claim 1, comprising storing metadata from the file in a signed Merkle Tree structure. ### Claim 5 (depends on 1) The process of claim 1, wherein the random symmetric session key comprises an Advanced Encryption Standard (AES) key comprising 256 bits. ### Claim 6 (depends on 1) The process of claim 1, wherein the symmetric encryption comprises AES-GSM with a key derived from the random symmetric session key. ### Claim 7 (depends on 6) The process of claim 6, comprising: initializing a first chainkey with the random symmetric session key as chainkey=HMAC_SHA256 (the random symmetric session key, the sender device ID); creating a file encryption key by concatenating the first chainkey with a name of the file; and encrypting the file with the AES-GSM and a second chainkey=HMAC_SHA256 (the encrypted session key, the sender device ID). ### Claim 8 (depends on 1) The process of claim 1, wherein the process comprises a plurality of sending devices, and a different private ephemeral key is selected for each sending device. ### Claim 9 (depends on 1) The process of claim 1, wherein the process comprises a plurality of receiver devices, and a different public ephemeral key is selected for each receiver device. ### Claim 10 A non-transitory machine-readable medium comprising instructions that when executed by a processor execute a process for transmitting a file from a sender device to a receiver device comprising: generating a random symmetric session key for the sender device; randomly selecting a private ephemeral key for the sender device, the private ephemeral key associated with a corresponding first public key; wherein the receiver device comprises a randomly selected public ephemeral key, the public ephemeral key associated with a corresponding first private key; generating a random value within a range; calculating an encrypted session key; encrypting the file using symmetric encryption; and transmitting from the sender device to the receiver device a group ID, the encrypted session key, the random value, a sender device ID, a receiver device ID, a hashed file ID, a sender key ID, and a receiver key ID, wherein the receiver device includes a record comprising the random value, the sender device ID, the hashed file ID, and the group ID; wherein the sender device comprises a first public X509 certificate comprising a second public key and a corresponding second private key that is signed by a service provider; wherein the receiver device comprises a second public X509 certificate comprising a third public key and a corresponding third private key, wherein the symmetric encryption comprises AES-GSM with a key derived from the random symmetric session key; and comprising instructions for: initializing a first chainkey with the random symmetric session key as chainkey=HMAC_SHA256 (the random symmetric session key, the sender device ID); creating a file encryption key by concatenating the first chainkey with a name of the file; and encrypting the file with the AES-GSM and a second chainkey=HMAC_SHA256 (the encrypted session key, the sender device ID). ### Claim 11 (depends on 10) The non-transitory machine-readable medium of claim 10, comprising instructions for receiving the file at the receiver device, and decrypting the file using the random symmetric session key. ### Claim 12 (depends on 11) The non-transitory machine-readable medium of claim 11, wherein the random symmetric session key is calculated as follows: random symmetric session key=the encrypted session key−(the random value*the first public key*the public ephemeral key+the random value*the second public key*the third private key)/(mod(the range)). ### Claim 13 (depends on 10) The non-transitory machine-readable medium of claim 10, wherein the encrypted session key is calculated as follows: the encrypted session key=(the random symmetric session key+the random value*the first public key*the first private key+the random value*the second public key*the third public key)/(mod(the range)). ### Claim 14 (depends on 13) The non-transitory machine-readable medium of claim 13, comprising instructions for storing metadata from the file in a signed Merkle Tree structure. ### Claim 15 (depends on 10) The non-transitory machine-readable medium of claim 10, wherein the random symmetric session key comprises an Advanced Encryption Standard (AES) key comprising 256 bits. ### Claim 16 (depends on 10) The non-transitory machine-readable medium of claim 10, wherein the process comprises a plurality of sending devices, and a different private ephemeral key is selected for each sending device; and wherein the process comprises a plurality of receiver devices, and a different public ephemeral key is selected for each receiver device. ### Claim 17 A system comprising: a computer processor; and a computer memory coupled to the computer processor; wherein the computer processor and the computer memory are operable for: generating a random symmetric session key for the sender device; randomly selecting a private ephemeral key for the sender device, the private ephemeral key associated with a corresponding first public key; wherein the receiver device comprises a randomly selected public ephemeral key, the public ephemeral key associated with a corresponding first private key; generating a random value within a range; calculating an encrypted session key; encrypting the file using symmetric encryption; and transmitting from the sender device to the receiver device a group ID, the encrypted session key, the random value, a sender device ID, a receiver device ID, a hashed file ID, a sender key ID, and a receiver key ID, wherein the receiver device includes a record comprising the random value, the sender device ID, the hashed file ID, and the group ID; wherein the sender device comprises a first public X509 certificate comprising a second public key and a corresponding second private key that is signed by a service provider; wherein the receiver device comprises a second public X509 certificate comprising a third public key and a corresponding third private key; and wherein the random symmetric session key and the private ephemeral key are selected from a pool of keys, the random symmetric session key and the private ephemeral key are removed from further usage after being selected, and wherein the pool of keys is replenished after all random symmetric session keys and all private ephemeral keys are selected.