# US 12,603,763 B2 · Systems and methods for ensuring ephemerality of encryption keys

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,603,763 B2
- Document ID: US12603763B2
- Status: Granted
- Kind: B2
- Application number: 18/334,560
- Filed: 2023-06-14
- Published: 2024-12-19
- Granted: 2026-04-14
- Earliest claimed: 2023-06-14
- Assignees: QUALCOMM Incorporated
- Applicants: QUALCOMM Incorporated
- Inventors: Nishant Raj; Ananda Kishore Parasa; Bedatrayee Ghosh; Santosh Pavan Kumar Dronamraju; Neeraj Kumar Soni
- Web page: https://patentgrep.com/patent/US12603763B2

## CPC

- G06F 21/575: {Secure boot}
- H04L 9/0822: {using key encryption key}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/0869: {involving random numbers or seeds}
- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Methods for updating ephemeral keys on quick boot of a computing device, including determining, by a processor of the computing device, that a power-on transition is from a quick boot and generating, in a secure portion of the processor, a new ephemeral key for use in wrapping one or more encryption keys of a key ring for use in an unsecure portion of the processor in response to the quick boot. The secure portion of the processor may unwrap each of the one or more encryption keys of the key ring with a prior ephemeral key before wrapping the one or more encryption keys with the new ephemeral key.

## Claims

### Claim 1

A method for updating ephemeral keys on quick boot of a computing device, comprising:
recognizing, by a processor of the computing device, that a power-on transition is from a quick boot;
generating, in a secure portion of the processor, a new ephemeral key for use in wrapping one or more encryption keys of a key ring for use in an unsecure portion of the processor in response to the quick boot;
generating, in the secure portion of the processor, a prior ephemeral key from a stored seed on the computing device;
unwrapping, in the secure portion of the processor, each of the one or more encryption keys of the key ring with the prior ephemeral key;
wrapping, in the secure portion of the processor, each of the one or more encryption keys individually with the new ephemeral key; and
writing the wrapped one or more encryption keys back to the unsecure portion of the processor.

### Claim 2 (depends on 1)

The method of claim 1, wherein the one or more encryption keys are written back to the key ring in a kernel of an operating system before enabling decryption of files on the processor.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
copying a portion of the key ring corresponding to the one or more encryption keys from a kernel of an operating system to the secure portion of the processor.

### Claim 4 (depends on 1)

The method of claim 1, wherein the new ephemeral key is generated from a new seed in the secure portion of the processor.

### Claim 5 (depends on 1)

The method of claim 1, wherein the one or more encryption keys are used for file based encryption in the unsecure portion of the processor.

### Claim 6

A computing device, comprising:
a processor having a secure portion and an unsecure portion, wherein the processor is configured to:
recognize that a power-on transition is from a quick boot;
generate, in the secure portion, a new ephemeral key for use in wrapping one or more encryption keys of a key ring for use in the unsecure portion in response to the quick boot
generate, in the secure portion of the processor, a prior ephemeral key from a stored seed on the computing device;
unwrap, in the secure portion of the processor, each of the one or more encryption keys of the key ring with the prior ephemeral key;
wrap, in the secure portion of the processor, each of the one or more encryption keys individually with the new ephemeral key; and
write the wrapped one or more encryption keys back to the unsecure portion of the processor.

### Claim 7 (depends on 6)

The computing device of claim 6, wherein the processor is further configured such that the one or more encryption keys are written back to the key ring in a kernel of an operating system before enabling decryption of files on the processor.

### Claim 8 (depends on 6)

The computing device of claim 6, wherein the processor is further configured to:
copy a portion of the key ring corresponding to the one or more encryption keys from a kernel of an operating system to the secure portion.

### Claim 9 (depends on 6)

The computing device of claim 6, wherein the processor is further configured such that the new ephemeral key is generated from a new seed in the secure portion.

### Claim 10 (depends on 6)

The computing device of claim 6, wherein the processor is further configured such that the one or more encryption keys are used for file based encryption in the unsecure portion.

### Claim 11

A processor for use in a computing device, the processor having a secure portion and an unsecure portion, wherein the processor is configured to:
recognize that a power-on transition is from a quick boot;
generate, in the secure portion, a new ephemeral key for use in wrapping one or more encryption keys of a key ring for use in the unsecure portion in response to the quick boot
generate, in the secure portion of the processor, a prior ephemeral key from a stored seed on the computing device;
unwrap, in the secure portion of the processor, each of the one or more encryption keys of the key ring with the prior ephemeral key;
wrap, in the secure portion of the processor, each of the one or more encryption keys individually with the new ephemeral key; and
write the wrapped one or more encryption keys back to the unsecure portion of the processor.

### Claim 12 (depends on 11)

The processor of claim 11, wherein the processor is further configured such that the one or more encryption keys are written back to the key ring in a kernel of an operating system before enabling decryption of files on the processor.

### Claim 13 (depends on 11)

The processor of claim 11, wherein the processor is further configured to:
copy a portion of the key ring corresponding to the one or more encryption keys from a kernel of an operating system to the secure portion.

### Claim 14 (depends on 11)

The processor of claim 11, wherein the processor is further configured such that the new ephemeral key is generated from a new seed in the secure portion.

### Claim 15 (depends on 11)

The processor of claim 11, wherein the processor is further configured such that the one or more encryption keys are used for file based encryption in the unsecure portion.

### Claim 16

A computing device, comprising:
means for recognizing that a power-on transition is from a quick boot;
means for generating a new ephemeral key in a secure portion for use in wrapping one or more encryption keys of a key ring for use in an unsecure portion in response to the quick boot;
means for generating, in the secure portion of the processor, a prior ephemeral key from a stored seed on the computing device;
means for unwrapping, in the secure portion of the processor, each of the one or more encryption keys of the key ring with the prior ephemeral key;
means for wrapping, in the secure portion of the processor, each of the one or more encryption keys individually with the new ephemeral key; and
means for writing the wrapped one or more encryption keys back to the unsecure portion of the processor.

### Claim 17 (depends on 16)

The computing device of claim 16, wherein the one or more encryption keys are written back to the key ring in a kernel of an operating system before enabling decryption of files.

### Claim 18 (depends on 16)

The computing device of claim 16, further comprising:
means for copying a portion of the key ring corresponding to the one or more encryption keys from a kernel of an operating system to the secure portion.

### Claim 19 (depends on 16)

The computing device of claim 16, wherein the new ephemeral key is generated from a new seed in the secure portion.