# US 2019/0173672 A1 · Confidential communication management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0173672 A1
- Document ID: US20190173672A1
- Status: Published application
- Kind: A1
- Application number: 16/257,882
- Filed: 2019-01-25
- Published: 2019-06-06
- Earliest claimed: 2015-02-13
- Assignees: Visa International Service Association
- Inventors: Eric Le Saint; Soumendra Bhattacharya
- Web page: https://patentgrep.com/patent/US20190173672A1

## CPC

- H04L 9/0844: {with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys}
- H04L 9/0822: {using key encryption key}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)}
- H04L 2463/062: applying encryption of the keys
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Systems and methods are provided for confidential communication management. For example, a client computer can determine a client key pair comprising a client private key and a client public key. The client computer can further determine a protected server key identifier, identify a server public key associated with the protected server key identifier, and generating a shared secret using the server public key and the client private key. The client computer can further encrypt message data using the shared secret and sending, to a server computer, a message including the encrypted message data, the protected server key identifier, and the client public key. The protected server key identifier can be associated with the server computer and can be usable by the server computer to identify a server private key to be used in decrypting the encrypted message data.

## Claims

### Claim 1

A computer-implemented method, comprising:
receiving, by a server computer from a client computer, a request message including a protected server key identifier and encrypted request data;
decrypting, by the server computer, the protected server key identifier using a server identifier encryption key to obtain a server key identifier;
determining, by the server computer, a server private key associated with the server key identifier; and
decrypting, by the server computer, the encrypted request data using the server private key to obtain request data.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, wherein the server identifier encryption key is determined based on a default key pair comprising a default public key and a default private key.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1, wherein decrypting the encrypted request data comprises:
determining a request shared secret based on the server private key and a client public key;
deriving a request session key based on the request shared secret; and
decrypting the encrypted request data using the request session key.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, wherein the protected server key identifier is decrypted to obtain the server key identifier and a padding element, and the method further comprises validating the padding element before determining the server private key associated with the server key identifier.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, further comprising:
for another request message including other encrypted request data, determining that another protected server key identifier does not map to an existing server private key and decrypting the other encrypted request data using a default server private key to obtain other request data.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1, further comprising:
determining a second server key identifier to be used in a next request from the client computer, the second server key identifier being associated with a second server private key;
encrypting the second server key identifier using the server identifier encryption key to determine a second protected server key identifier;
encrypting response data comprising the second protected server key identifier to generate encrypted response data; and
sending a response message including the encrypted response data to the client computer.

### Claim 7 (depends on 6)

The computer-implemented method of claim 6, wherein encrypting the second server key identifier comprises encrypting a combination of the second server key identifier, a padding element, and a random element using the server identifier encryption key, the padding element being a constant value or a message authentication code of the second server key identifier.

### Claim 8 (depends on 6)

The computer-implemented method of claim 6, wherein the response message further comprises an obfuscated server public key corresponding to the second server private key.

### Claim 9 (depends on 6)

The computer-implemented method of claim 6, wherein the request data includes a protected client key identifier and the response message includes the protected client key identifier, wherein protected client key identifier is used, by the client computer, to determine a client private key for decrypting the response message.

### Claim 10

A computer-implemented method, comprising:
encrypting, by a sender computer, payload data using one or more payload encryption keys to generate encrypted payload data;
encrypting, by the sender computer, protocol data using one or more protocol encryption keys to generate encrypted protocol data, the protocol data indicating a cipher suite and/or a key identifier; and
transmitting, by the sender computer to a receiver computer, a message comprising the encrypted payload data and the encrypted protocol data.

### Claim 11 (depends on 10)

The computer-implemented method of claim 10, wherein the one or more protocol encryption keys are determined based on a sender private key and a receiver public key.

### Claim 12 (depends on 10)

The computer-implemented method of claim 10, wherein the one or more payload encryption keys are determined based on a sender private key and a receiver public key.

### Claim 13 (depends on 10)

The computer-implemented method of claim 10, wherein the payload data comprises a plurality of payload elements and encrypting the payload data comprises encrypting each payload element of the plurality of payload elements using a corresponding payload encryption key to generate an encrypted payload element.

### Claim 14 (depends on 13)

The computer-implemented method of claim 13, wherein the protocol data further comprises a plurality of data-protocol mappings respectively corresponding to the plurality of payload elements, each of the plurality of data-protocol mappings comprising a corresponding key identifier and an algorithm identifier, the corresponding key identifier identifying a payload encryption key used to encrypt the corresponding payload element, and the algorithm identifier identifying a cryptographic algorithm used to encrypt the corresponding payload element.

### Claim 15 (depends on 14)

The computer-implemented method of claim 14, wherein each data-protocol mapping of the plurality of data-protocol mappings further comprises a message authentication code of the corresponding payload element.

### Claim 16 (depends on 15)

The computer-implemented method of claim 15, wherein the message further comprises a global message authentication code that is calculated based on message authentication codes corresponding to the plurality of payload elements.

### Claim 17

A computer system, comprising:
a memory that stores computer-executable instructions; and
one or more processors configured to access the memory and execute the computer-executable instructions to implement a method comprising:
receiving a message comprising encrypted protocol data and encrypted payload data;
determining one or more protocol decryption keys;
decrypting the encrypted protocol data using the one or more protocol decryption keys to obtain protocol data;
determining one or more payload decryption keys; and
decrypting the encrypted payload data using the protocol data and the one or more payload decryption keys to obtain payload data.

### Claim 18 (depends on 17)

The computer system of claim 17, wherein one or more protocol decryption keys and the one or more payload decryption keys are determined based on one or more shared secrets.

### Claim 19 (depends on 17)

The computer system of claim 17, wherein the encrypted protocol data comprises an encrypted cipher suite, and the method further comprises decrypting the encrypted cipher suite using a first protocol decryption key to obtain the cipher suite.

### Claim 20 (depends on 19)

The computer system of claim 19, wherein the encrypted payload data comprises a plurality of encrypted payload elements and the encrypted protocol data further comprises a plurality of encrypted data-protocol mappings respectively corresponding to the plurality of encrypted payload elements, and the method further comprises decrypting the plurality of encrypted data-protocol mappings using the cipher suite and a second protocol decryption key to obtain a plurality of data-protocol mappings.

### Claim 21 (depends on 20)

The computer system of claim 20, wherein decrypting the encrypted payload data comprises decrypting an encrypted payload element of the plurality of encrypted payload elements by:
determining a data-protocol mapping from the plurality of data-protocol mappings that corresponds to the encrypted payload element;
selecting a payload decryption key for decrypting the encrypted payload element from the one or more payload decryption keys based at least in part on the data-protocol mapping;
identifying a decryption algorithm for decrypting the encrypted payload element based at least in part on the data-protocol mapping; and
decrypting the encrypted payload element using the selected payload decryption key and the identified decryption algorithm to obtain the payload element.

### Claim 22 (depends on 21)

The computer system of claim 21, wherein the data-protocol mapping comprises a message authentication code and decrypting the encrypted payload data further comprises validating the message authentication code.