# US 12,763,945 B2 · Network arrangement for secure use of a private key remotely accessed through an open network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,763,945 B2 - Document ID: US12763945B2 - Status: Granted - Kind: B2 - Application number: 19/011,867 - Filed: 2025-01-07 - Published: 2025-09-11 - Granted: 2026-10-13 - Earliest claimed: 2021-04-08 - Assignees: Tactical Lighting Systems - Applicants: Tactical Lighting Systems - Inventors: James P. McGee - Web page: https://patentgrep.com/patent/US12763945B2 ## CPC - H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)} - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Carrying out, over a network infrastructure, secure execution of cryptographic operations using a public/private key pair is described, wherein the private key is permanently stored on a second computing device that is remote to and accessible to the first computing device through an open network. The method includes establishing a secure connection over the open network between the first computing device and the second computing device, sending a file via the secure connection over the open network to the second computing device and instructing the second computing device to: encrypt or decrypt the file with a private key, of the public/private key pair, that is stored on the second computing device; and send the encrypted or decrypted file to the first computing device via the secure connection over the open network. The encrypted or decrypted file is then received over the open network from the second computing device. ## Claims ### Claim 1 A method, carried out by a first computing device over a network infrastructure, for participating in completing cryptographically secured transactions with a server, using a first public/private key pair, wherein a first public key of the first public/private key pair is used by the server and the first private key of the first public/private key pair is currently stored on a second computing device that is accessible to the first computing device through an open network, the method comprising: providing a simultaneous user access to both the first computing device and the second computing device; establishing, during the providing the simultaneous user access, a connection over the open network between the first computing device and the second computing device by performing the following: generating, by the first computing device, a second public/private key pair, wherein a second public key of the second public/private key pair is provided to the second computing device; generating, by the first computing device, a message digest of a second public key of the second public/private key pair; presenting, by the first computing device via a display interface, a code value corresponding to the message digest to the user; transferring, using an action performed by the user, the code value corresponding to the message digest from the first computing device to the second computing device; and using, by the second computing device, the message digest to authenticate the second public key provided to the second computing device in association with the generating a second public/private key pair; sending, by the first computing device to the second computing device via the connection over the open network, a message requiring cryptographic processing using the first private key, wherein the message causes the second computing device to: perform a cryptographic operation on contents of the message using the first private key to render a cryptographically processed message; and send the cryptographically processed message to the first computing device via the connection over the open network; and receiving the cryptographically processed message over the open network from the second computing device; and providing the cryptographically processed message to the server. ### Claim 2 (depends on 1) The method of claim 1, wherein the cryptographically secured transactions are performed to establish a secure connection over the open network between the server and the first computing device. ### Claim 3 (depends on 1) The method of claim 1, wherein the cryptographically secured transactions are performed to establish a two-way secure socket layer (SSL) handshake between the first computing device and a server. ### Claim 4 (depends on 1) The method of claim 1, wherein the cryptographically secured transactions are performed to digitally sign a file that is stored on the first computing device. ### Claim 5 (depends on 1) The method of claim 1, wherein the cryptographically secured transactions are performed to encrypt a file stored on the first computing device, and wherein the file comprises an encryption key. ### Claim 6 (depends on 1) The method of claim 1, wherein the cryptographically secured transactions are performed to enable the first computing device to decrypt a file that stored on the first computing device, and wherein the file comprises an encryption key. ### Claim 7 (depends on 1) The method of claim 1, wherein the cryptographically secured transactions are performed to enable the second device, using the private key on the second computing device, to create a shared secret using a public key that is provided by the first computing device, and wherein the method further comprises receiving the shared secret, by the first computing device from the second computing device via the connection over the open network. ### Claim 8 (depends on 1) The method of claim 1, wherein the first private key is a key type taken from the group consisting of: an RSA key; and an elliptic curve cryptography (ECC) key. ### Claim 9 (depends on 1) The method of claim 1, wherein the message requiring cryptographic processing using the first private key is a verification message issued by the server. ### Claim 10 (depends on 1) The method of claim 1, wherein the code value is presented by the first computing device in a Quick Response (QR) code format. ### Claim 11 A first computing device including: a processor; and a non-transitory computer-readable medium including computer-executable instructions, that, when executed by the processor, cause the first computing device to carry out a method over a network infrastructure, for participating in completing cryptographically secured transactions with a server, using a first public/private key pair, wherein a first public key of the first public/private key pair is used by the server and the first private key of the first public/private key pair is currently stored on a second computing device that is accessible to the first computing device through an open network, and wherein the method comprises: providing a simultaneous user access to both the first computing device and the second computing device; establishing, during the providing the simultaneous user access, a connection over the open network between the first computing device and the second computing device by performing the following: generating, by the first computing device, a second public/private key pair, wherein a second public key of the second public/private key pair is provided to the second computing device; generating, by the first computing device, a message digest of a second public key of the second public/private key pair; presenting, by the first computing device via a display interface, a code value corresponding to the message digest to the user; transferring, using an action performed by the user, the code value corresponding to the message digest from the first computing device to the second computing device; and using, by the second computing device, the message digest to authenticate the second public key provided to the second computing device in association with the generating a second public/private key pair; sending, by the first computing device to the second computing device via the connection over the open network, a message requiring cryptographic processing using the first private key, wherein the message causes the second computing device to: perform a cryptographic operation on contents of the message using the first private key to render a cryptographically processed message; and send the cryptographically processed message to the first computing device via the connection over the open network; and receiving the cryptographically processed message over the open network from the second computing device; and providing the cryptographically processed message to the server. ### Claim 12 (depends on 11) The first computing device of claim 11, wherein the cryptographically secured transactions are performed to establish a secure connection over the open network between the server and the first computing device. ### Claim 13 (depends on 11) The first computing device of claim 11, wherein the cryptographically secured transactions are performed to establish a two-way secure socket layer (SSL) handshake between the first computing device and a server. ### Claim 14 (depends on 11) The first computing device of claim 11, wherein the cryptographically secured transactions are performed to digitally sign a file that is stored on the first computing device. ### Claim 15 (depends on 11) The first computing device of claim 11, wherein the cryptographically secured transactions are performed to encrypt a file stored on the first computing device, and wherein the file comprises an encryption key. ### Claim 16 (depends on 11) The first computing device of claim 11, wherein the cryptographically secured transactions are performed to enable the first computing device to decrypt a file that stored on the first computing device, and wherein the file comprises an encryption key. ### Claim 17 (depends on 11) The first computing device of claim 11, wherein the cryptographically secured transactions are performed to enable the second device, using the second private key on the second computing device, to create a shared secret using a public key that is provided by the first computing device, and wherein the method further comprises receiving the shared secret, by the first computing device from the second computing device via the connection over the open network. ### Claim 18 (depends on 11) The first computing device of claim 11, wherein the private key is a key type taken from the group consisting of: an RSA key; and an elliptic curve cryptography (ECC) key. ### Claim 19 (depends on 11) The computing device of claim 11, wherein the message requiring cryptographic processing using the first private key is a verification message issued by the server. ### Claim 20 (depends on 11) The computing device of claim 11, wherein the code value is presented by the first computing device in a Quick Response (QR) code format; and wherein, during the transferring the code value corresponding to the message digest from the first computing device to the second computing device, the action performed by the user comprises presenting a QR code image, corresponding to the message digest, to a camera of the second computing device.