US 12,763,935 B2Granted

Public key exchange with authenticated ECDHE and security against quantum computers

AssigneeNetwork-1 Technologies, Inc.

InventorJohn A Nix

Life of this patent

Estimating the term…

Loading patent…

Abstract

Elliptic Curve Cryptography (ECC) can provide security against quantum computers that could feasibly determine private keys from public keys. A server communicating with a device can store and use PKI keys comprising server private key ss, device public key Sd, and device ephemeral public key Ed. The device can store and use the corresponding PKI keys, such as server public key Ss. The key use can support all of (i) mutual authentication, (ii) forward secrecy, and (iii) shared secret key exchange. The server and the device can conduct an ECDHE key exchange with the PKI keys to mutually derive a symmetric ciphering key K1. The device can encrypt a device public key PK.Device with K1 and send to the server as a first ciphertext. The server can encrypt a server public key PK.Network with at least K1 and send to the device as a second ciphertext.

Claims14

Dependent claims

A system for securely communicating with a device comprising:

(a) a first server comprising (i) at least one first processor and (ii) a first memory operatively connected to the at least one first processor, the first memory including first processor executable code that, when executed by the at least one first processor, performs the steps of:
(1) storing, in the first memory, (i) first elliptic curve cryptography (ECC) parameters for an elliptic curve Diffie Hellman (ECDH) key exchange algorithm, and (ii) a first server private key corresponding to a first server public key for the first ECC parameters;
(2) receiving a message from the device comprising:
(i) a first device public key supporting the first ECC parameters;
(ii) a value for selecting the first server private key;
and
(iii) a symmetric ciphertext comprising a second device public key supporting second ECC parameters, a domain name for a second server, and a random number;
(3) generating a first symmetric ciphering key from the ECDH key exchange algorithm with the first device public key and the first server private key;
(4) decrypting the symmetric ciphertext in order to read the second device public key, the domain name, and the random number as plaintext;
(5) selecting, a second server using the domain name;
(6) sending, to the second server, the second device public key and the random number;
(b) a second server comprising (i) at least one second processor and (ii) a second memory operatively connected to the at least one second processor, the second memory including second processor executable code that, when executed by the at least one second processor, performs the steps of:
(1) storing, in the second memory, (i) the second ECC parameters, (ii) a second server private key corresponding to a second server public key for the second ECC parameters, and (iii) the domain name for the second server;
(2) generating (i) a second symmetric ciphering key from the ECDH key exchange algorithm with the second device public key and the second server private key and (ii) a response;
(3) encrypting the response with the second symmetric ciphering key in order to generate an encrypted response;
and
(4) sending the encrypted response in a message for the device.

14 more elements

A system for securely communicating with a device comprising:

(a) a first server comprising (i) at least one first processor and (ii) a first memory operatively connected to the at least one first processor, the first memory including first processor executable code that, when executed by the at least one first processor, performs the steps of:
(1) storing, in the first memory, (i) first elliptic curve cryptography (ECC) parameters for an elliptic curve Diffie Hellman (ECDH) key exchange algorithm, and (ii) a first server private key corresponding to a first server public key associated with the first ECC parameters;
(2) receiving a message from the device comprising:
(i) a first device public key associated with the first ECC parameters;
(ii) a value for selecting the first server private key;
and
(iii) a symmetric ciphertext including a second device public key associated with second ECC parameters, a domain name for a second server, and a random number;
(3) generating a first symmetric ciphering key using the ECDH key exchange algorithm with the first device public key, and the first server private key;
(4) obtaining, by decrypting from the symmetric ciphertext, the second device public key, the domain name, and the random number as plaint text;
(5) selecting, by the domain name, a second server;
(6) sending, to the second server, a second message including the second device public key and the random number;
(b) the second server comprising (i) at least one second processor and (ii) a second memory operatively connected to the at least one second processor, the second memory including second processor executable code that, when executed by the at least one second processor, performs the steps of:
(1) storing, in the second memory, (i) the second ECC parameters, (ii) a second server private key corresponding to a second server public key for the second ECC parameters, and (iii) the domain name for the second server;
(2) receiving the second message;
(3) generating (i) a second symmetric ciphering key using the ECDH key exchange algorithm with the second device public key and the second server private key and (ii) a response;
(4) generate a response to the second message;
(5) generating an encrypted response by encrypting the response with the second symmetric ciphering key;
and
(6) ending the encrypted response in a message for the device.

16 more elements

Dependencies are inferred from the claim text.

Facts

Application: 18/904,406Filed 2 Oct 2024 · continuation
Priority: 1 Mar 2019
Published: US 2025/0106010 A127 Mar 2025
Granted: 13 Oct 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 9/0844
Involving Diffie-Hellman or related key agreement protocols: with user authentication or key authentication, e.g. ElGamal, MTI,…
H04L 9/0618
The encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions;…
H04L 9/0852
Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for…:…
H04L 9/0869
Generation of secret information including derivation or calculation of cryptographic keys or passwords: involving random numbers or seeds

Family

Application62/812,710Us provisional application · filed 1 Mar 2019
Application16/805,172Parent of this continuation · filed 28 Feb 2020
Application17/748,706Parent of this continuation · filed 19 May 2022
US 11,343,084 B2Parent of this continuation · filed 24 May 2022
Application18/479,099Parent of this continuation · filed 1 Oct 2023
US 11,777,719 B2Parent of this continuation · filed 3 Oct 2023
US 2025/0106010 A1Pre-grant publication · published 27 Mar 2025
US 12,143,478 B2Parent of this continuation
US 2020/0280436 A1Published application
US 2022/0278833 A1Published application
US 2024/0031137 A1Published application
US 12,763,935 B2This patent

From the US filing history. Foreign family members aren’t listed.