# US 12,225,130 B2 · Embedded TLS protocol for lightweight devices

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,225,130 B2
- Document ID: US12225130B2
- Status: Granted
- Kind: B2
- Application number: 17/576,889
- Filed: 2022-01-14
- Published: 2023-07-20
- Granted: 2025-02-11
- Earliest claimed: 2022-01-14
- Assignees: Micron Technology, Inc.
- Applicants: Micron Technology, Inc.
- Inventors: Zhan Liu
- Web page: https://patentgrep.com/patent/US12225130B2

## CPC

- H04L 9/0844: {with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys}
- H04L 9/3066: {involving algebraic varieties, e.g. elliptic or hyper-elliptic curves}
- H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics}
- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 9/40: Network security protocols
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The disclosure relates to improvements in secure channel establishment. In some aspects, the techniques described herein relate to a method including: issuing, by a client device to a server, a request to establish a secure connection; receiving, by the client device, a response to the request to establish a secure connection from the server, the response including a digital certificate associated with a public key stored by the server, the public key used to establish a symmetric key; validating, by the client device, the digital certificate; and computing, by the client device, a shared secret using the public key stored by the server and a private key generated by the client device.

## Claims

### Claim 1

A method comprising:
issuing, by a client device to a server, a request to initiate a secure transport layer security (TLS) connection, the client device comprising a lightweight computing device;
receiving, by the client device, a response to the request to initiate the secure TLS connection from the server, the response comprising a ServerHello message including a digital certificate associated with an Elliptic-Curve Diffie-Hellman (ECDH) public key stored by the server, the digital certificate including the ECDH public key and an unencrypted Diffie-Hellman (DH) parameter, the digital certificate further including a key usage field indicating the ECDH public key is for key agreement, wherein the ECDH public key is associated with a static ECDH key pair of the server;
validating, by the client device, the digital certificate included in the response to the request to initiate the TLS connection;
computing, by the client device, a pre-master secret using the ECDH public key included in the response and a private key generated by the client device;
generating, by the client device, an ephemeral ECDH key pair;
computing, by the client device, a pre-master secret using the static ECDH public key and the ephemeral private key generated by the client device;
deriving, by the client device, a session key from the pre-master secret using a key derivation function that incorporates a client random value and a server random value;
establishing, by the client device, the secure TLS connection after computing the pre-master, the establishing the secure TLS connection including: encrypting, by the client device, a payload using the pre-master secret, and transmitting the payload to the server; and
erasing, by the client device, the ephemeral private key after the secure TLS connection is established.

### Claim 2 (depends on 1)

The method of claim 1, wherein the request to initiate the secure TLS connection comprises a ClientHello message.

### Claim 3 (depends on 1)

The method of claim 1, wherein the digital certificate associated with a public key stored by the server is signed by a trusted certificate authority.

### Claim 4 (depends on 1)

The method of claim 1, wherein the digital certificate associated with a public key stored by the server includes a key usage bit string configured to indicate usage of the public key for key agreement.

### Claim 5 (depends on 1)

The method of claim 1, further comprising generating a second digital certificate for a client public key corresponding to the private key generated by the client device and transmitting the second digital certificate to the server after validating the digital certificate received from the server.

### Claim 6 (depends on 1)

The method of claim 1, further comprising encrypting, by the client device, a session communication using the pre-master secret.

### Claim 7

A non-transitory computer-readable storage medium for tangibly storing computer program instructions capable of being executed by a computer processor, the computer program instructions defining steps of:
issuing, by a client device to a server, a request to initiate a secure transport layer security (TLS) connection, the client device comprising a lightweight computing device;
receiving, by the client device, a response to the request to initiate the secure TLS connection from the server, the response comprising a ServerHello message including a digital certificate associated with an Elliptic-Curve Diffie-Hellman (ECDH) public key stored by the server, the digital certificate including the ECDH public key and an unencrypted Diffie-Hellman (DH) parameter, the digital certificate further including a key usage field indicating the ECDH public key is for key agreement, wherein the ECDH public key is associated with a static ECDH key pair of the server;
validating, by the client device, the digital certificate included in the response to the request to initiate the TLS connection;
computing, by the client device, a pre-master secret using the ECDH public key included in the response and a private key generated by the client device;
generating, by the client device, an ephemeral ECDH key pair;
computing, by the client device, a pre-master secret using the static ECDH public key and the ephemeral private key generated by the client device;
deriving, by the client device, a session key from the pre-master secret using a key derivation function that incorporates a client random value and a server random value;
establishing, by the client device, the secure TLS connection after computing the pre-master secret, the establishing the secure TLS connection including: encrypting, by the client device, a payload using the pre-master secret, and transmitting the payload to the server; and
erasing, by the client device, the ephemeral private key after the secure TLS connection is established.

### Claim 8 (depends on 7)

The non-transitory computer-readable storage medium of claim 7, wherein the request to initiate the secure TLS connection comprises a ClientHello message.

### Claim 9 (depends on 7)

The non-transitory computer-readable storage medium of claim 7, wherein the digital certificate associated with a public key stored by the server is signed by a trusted certificate authority.

### Claim 10 (depends on 7)

The non-transitory computer-readable storage medium of claim 7, wherein the digital certificate associated with a public key stored by the server includes a key usage bit string configured to indicate usage of the public key for key agreement.

### Claim 11 (depends on 7)

The non-transitory computer-readable storage medium of claim 7, the steps further comprising generating a second digital certificate for a client public key corresponding to the private key generated by the client device and transmitting the second digital certificate to the server after validating the digital certificate received from the server.

### Claim 12 (depends on 7)

The non-transitory computer-readable storage medium of claim 7, the steps further comprising encrypting, by the client device, a session communication using the pre-master secret.

### Claim 13

A lightweight computing device comprising:
a processor configured to:
issue, to a server, a request to initiate a secure transport layer security (TLS) connection;
receiving a response to the request to initiate the secure TLS connection from the server, the response comprising a ServerHello message including a digital certificate associated with an Elliptic-Curve Diffie-Hellman (ECDH) public key stored by the server, the digital certificate including the ECDH public key and an unencrypted Diffie-Hellman (DH) parameter, the digital certificate comprising a digital certificate associated with an Elliptic-curve Diffie-Hellman (ECDH) key pair stored by the server, the digital certificate further including a key usage field indicating the ECDH public key is for key agreement, wherein the ECDH public key is associated with a static ECDH key pair of the server;
validating the digital certificate included in the response to the request to initiate the TLS connection;
computing a pre-master secret using the ECDH key included in the response and a private key generated by the device;
generating an ephemeral ECDH key pair;
computing a pre-master secret using the static ECDH public key and the ephemeral private key generated by the client device;
deriving a session key from the pre-master secret using a key derivation function that incorporates a client random value and a server random value;
establishing the secure TLS connection after computing the pre-master secret, the establishing the secure TLS connection including: encrypting a payload using the pre-master secret, and transmitting the payload to the server; and
erasing, by the client device, the ephemeral private key after the secure TLS connection is established.

### Claim 14 (depends on 13)

The device of claim 13, wherein the request to initiate the secure TLS connection comprises a ClientHello message and the response to the request includes a ServerHello message.

### Claim 15 (depends on 13)

The device of claim 13, wherein the digital certificate associated with a public key stored by the server is signed by a trusted certificate authority.

### Claim 16 (depends on 13)

The device of claim 13, wherein the digital certificate associated with a public key stored by the server includes a key usage bit string configured to indicate usage of the public key for key agreement.

### Claim 17 (depends on 13)

The device of claim 13, the processor further configured to generate a second digital certificate for a client public key corresponding to the private key generated by the device and transmitting the second digital certificate to the server after validating the digital certificate received from the server.