# US 12,603,863 B2 · Hybrid cryptography virtual private networks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,863 B2 - Document ID: US12603863B2 - Status: Granted - Kind: B2 - Application number: 18/653,362 - Filed: 2024-05-02 - Published: 2025-03-27 - Granted: 2026-04-14 - Earliest claimed: 2023-09-26 - Assignees: Uab 360 It - Applicants: Uab 360 It - Inventors: Karolis Pabijanskas; Mantas Jonytis - Web page: https://patentgrep.com/patent/US12603863B2 ## CPC - H04L 63/0272: {Virtual private networks} - H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation} - H04L 9/3073: {involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing} - H04L 9/32: including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A virtual private network (VPN) client receives data including a pre-shared key (PSK). The VPN client decrypts the data based on a short-term key pair to obtain a ciphertext. The VPN client then decrypts the ciphertext based on a short-term quantum-resistant key pair to obtain the PSK. A VPN tunnel is then established between the VPN client and a VPN server based on the PSK. ## Claims ### Claim 1 A method, comprising: receiving, by a virtual private network (VPN) client, data including a pre-shared key (PSK), wherein the data includes a ciphertext generated by encrypting the PSK using a public key of a short-term quantum-resistant key pair associated with the VPN client and then encrypting the ciphertext using a public key of a short-term key pair associated with the VPN client, wherein the VPN client is a single device, and wherein the data is received in response to a request to establish a VPN tunnel transmitted by the VPN client, and wherein the short-term key pair and the short-term quantum-resistant key pair are different from long-term public keys exchanged during a handshake process; decrypting, by the VPN client, the data based on a short-term private key of the short-term key pair to obtain the ciphertext; decrypting, by the VPN client, the ciphertext based on a short-term private key of the short-term quantum-resistant key pair to obtain the PSK; and establishing the VPN tunnel between the VPN client and a VPN server using the long-term public keys and based on the PSK. ### Claim 2 (depends on 1) The method of claim 1, wherein in response to the request to establish the VPN tunnel received from the VPN client, the VPN server authenticates and authorizes the VPN client. ### Claim 3 (depends on 1) The method of claim 1, further comprising: generating, by the VPN client, the short-term key pair based on an elliptic-curve Diffie-Hellman (ECDH) algorithm. ### Claim 4 (depends on 1) The method of claim 1, further comprising: generating the short-term quantum-resistant key pair based on a Kyber algorithm. ### Claim 5 (depends on 1) The method of claim 1, further comprising: selecting, by the VPN client with the VPN server, a tunnel protocol from a set comprising Open VPN, Internet Protocol Security (IPSec), Layer 2 Tunneling Protocol with IPSec (L2TP/IPSec), Point-to-Point Tunneling Protocol (PPTP), Secure Socket Tunneling Protocol (SSTP), and WireGuard. ### Claim 6 (depends on 1) The method of claim 1, further comprising: using, by the VPN client, the PSK to encrypt subsequent communications after the VPN tunnel is established. ### Claim 7 (depends on 1) The method of claim 1, wherein the short-term key pair uses lattice-based cryptography. ### Claim 8 A system, comprising: a virtual private network (VPN) client that is a single device, the VPN client configured to execute instructions to: receive, from a VPN server, data including a pre-shared key (PSK), wherein the data includes a ciphertext generated by encrypting the PSK using a public key of a short-term quantum-resistant key pair associated with the VPN client and then encrypting the ciphertext using a public key of a short-term key pair associated with the VPN client, wherein the data is received in response to a request to establish a VPN tunnel transmitted by the VPN client, and wherein the short-term key pair and the short-term quantum-resistant key pair are different from long-term public keys exchanged during a handshake process; decrypt the data based on a short-term private key of the short-term key pair to obtain the ciphertext; decrypt the ciphertext based on a short-term private key of the short-term quantum-resistant key pair to obtain the PSK; and establish the VPN tunnel between the VPN client and the VPN server based on the PSK; and the VPN server, the VPN server configured to execute instructions to: transmit the data including the PSK to the VPN client. ### Claim 9 (depends on 8) The system of claim 8, wherein the short-term key pair is generated using an elliptic-curve Diffie-Hellman (ECDH) algorithm. ### Claim 10 (depends on 8) The system of claim 8, wherein the VPN server is further configured to execute instructions to: authenticate and authorize the VPN client in response to the request from the VPN client to establish the VPN tunnel. ### Claim 11 (depends on 8) The system of claim 8, wherein the VPN server is further configured to execute instructions to: encrypt the PSK based on the short-term quantum-resistant key pair to obtain the ciphertext; and encrypt the ciphertext based on the short-term key pair to obtain the data. ### Claim 12 (depends on 8) The system of claim 8, wherein the short-term quantum-resistant key pair is generated using a Kyber algorithm. ### Claim 13 (depends on 8) The system of claim 8, wherein the VPN client and the VPN server are further configured to execute respective instructions to select a tunnel protocol from a set comprising OpenVPN, Internet Protocol Security (IPSec), Layer 2 Tunneling Protocol with IPSec (L2TP/IPSec), Point-to-Point Tunneling Protocol (PPTP), Secure Socket Tunneling Protocol (SSTP), and WireGuard. ### Claim 14 A non-transitory computer-readable storage medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations comprising: receiving, by a virtual private network (VPN) client, data including a pre-shared key (PSK), wherein the data includes a ciphertext generated by encrypting the PSK using a public key of a short-term quantum-resistant key pair associated with the VPN client and then encrypting the ciphertext using a public key of a short-term key pair associated with the VPN client, wherein the VPN client is a single device, and wherein the data is received in response to a request to establish a VPN tunnel transmitted by the VPN client, and wherein the short-term key pair and the short-term quantum-resistant key pair are different from long-term public keys exchanged during a handshake process; decrypting, by the VPN client, the data based on a short-term private key of the short-term key pair to obtain the ciphertext; decrypting, by the VPN client, the ciphertext based on a short-term private key of the short-term quantum-resistant key pair to obtain the PSK; and establishing the VPN tunnel between the VPN client and a VPN server using the long-term public keys and based on the PSK. ### Claim 15 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein in response to the request to establish the VPN tunnel received from the VPN client, the VPN server authenticates and authorizes the VPN client. ### Claim 16 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the short-term key pair is generated using an elliptic-curve Diffie-Hellman (ECDH) algorithm. ### Claim 17 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the short-term quantum-resistant key pair is generated using a Kyber algorithm. ### Claim 18 (depends on 14) The non-transitory computer-readable storage medium of claim 14, further comprising: selecting, by the VPN client with the VPN server, a tunnel protocol from a set comprising OpenVPN, Internet Protocol Security (IPSec), Layer 2 Tunneling Protocol with IPSec (L2TP/IPSec), Point-to-Point Tunneling Protocol (PPTP), Secure Socket Tunneling Protocol (SSTP), and WireGuard. ### Claim 19 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the PSK is used to encrypt subsequent communications after the VPN tunnel is established. ### Claim 20 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the short-term key pair uses lattice-based cryptography.