# US 2021/0344486 A1 · Extended-life asymmetric cryptographic key scheme > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344486 A1 - Document ID: US20210344486A1 - Status: Published application - Kind: A1 - Application number: 16/861,590 - Filed: 2020-04-29 - Published: 2021-11-04 - Earliest claimed: 2020-04-29 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Narayana Aditya Madineni; Peter T. WALTENBERG; Simon D. McMahon - Web page: https://patentgrep.com/patent/US20210344486A1 ## CPC - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/0869: {involving random numbers or seeds} - H04L 9/3247: {involving digital signatures} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/3265: {using certificate chains, trees or paths; Hierarchical trust model} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Extending the useful life of finite lifetime asymmetric cryptographic keys by referencing the number of uses of the keys in conjunction with or instead of the elapsed time since generation of the finite lifetime keys. By integrating asymmetric cryptographic keys into a limited use security scheme, the lifetime of finite lifetime asymmetric cryptographic keys is based on the practical risk of security breach during use rather than an arbitrary duration in which the keys are valid. ## Claims ### Claim 1 A computer-implemented method for a limited operation asymmetric cryptographic key scheme, the method comprising: configuring a master key pair for use in a cryptographic key system, the master key pair having certificate authority for a pre-defined number of signature operations; generating a plurality of random key pairs from the master key pairs; and establishing a first certificate chain layer for the plurality of random key pairs by creating subordinate certificates for each random key pair in the plurality of random key pairs, each random key pair having the pre-defined number of signature operations of the master key pair. ### Claim 2 (depends on 1) The computer-implemented method of claim 1 further comprising: validating a first signature operation with reference to a certificate chain from the subordinate certificate of a first random key pair of the plurality of random key pairs to the certificate authority of the master key pair. ### Claim 3 (depends on 1) The computer-implemented method of claim 1 further comprising: performing a series of signature operations using the first random key pair; deleting a first private component of the first random key pair upon determination that the series of signature operations performed by the first random key pair is equal to the pre-defined number of signature operations. ### Claim 4 (depends on 1) The computer-implemented method of claim 1 further comprising: issuing the master key pair having the pre-defined number of signature operations. ### Claim 5 (depends on 1) The computer-implemented method of claim 1 further comprising: determining a fixed number representing the pre-defined number of signature operations permitted for the master key pair. ### Claim 6 (depends on 1) The computer-implemented method of claim 1 further comprising: generating an additional certificate chain layer having the number of keys equal to the fixed number. ### Claim 7 A computer program product for a limited operation asymmetric cryptographic key scheme, the computer program product comprising: a machine readable storage device; and computer code stored on the machine readable storage device, with the computer code including instructions for causing a processor(s) set to perform operations including the following: configuring a master key pair for use in a cryptographic key system, the master key pair having certificate authority for a pre-defined number of signature operations, generating a plurality of random key pairs from the master key pairs, and establishing a first certificate chain layer for the plurality of random key pairs by creating subordinate certificates for each random key pair in the plurality of random key pairs, each random key pair having the pre-defined number of signature operations of the master key pair. ### Claim 8 (depends on 7) The computer program product of claim 7 wherein the computer code further includes instructions for causing the processor(s) set to perform the following operation(s): validating a first signature operation with reference to a certificate chain from the subordinate certificate of a first random key pair of the plurality of random key pairs to the certificate authority of the master key pair. ### Claim 9 (depends on 7) The computer program product of claim 7 wherein the computer code further includes instructions for causing the processor(s) set to perform the following operation(s): performing a series of signature operations using the first random key pair; deleting a first private component of the first random key pair upon determination that the series of signature operations performed by the first random key pair is equal to the pre-defined number of signature operations. ### Claim 10 (depends on 7) The computer program product of claim 7 wherein the computer code further includes instructions for causing the processor(s) set to perform the following operation(s): issuing the master key pair having the pre-defined number of signature operations. ### Claim 11 (depends on 7) The computer program product of claim 7 wherein the computer code further includes instructions for causing the processor(s) set to perform the following operation(s): determining a fixed number representing the pre-defined number of signature operations permitted for the master key pair. ### Claim 12 (depends on 7) The computer program product of claim 7 wherein the computer code further includes instructions for causing the processor(s) set to perform the following operation(s): generating an additional certificate chain layer having the number of keys equal to the fixed number. ### Claim 13 A computer system for a limited operation asymmetric cryptographic key scheme, the computer system comprising: a processor(s) set; a machine readable storage device; and computer code stored on the machine readable storage device, with the computer code including instructions for causing the processor(s) set to perform operations including the following: configuring a master key pair for use in a cryptographic key system, the master key pair having certificate authority for a pre-defined number of signature operations, generating a plurality of random key pairs from the master key pairs, and establishing a first certificate chain layer for the plurality of random key pairs by creating subordinate certificates for each random key pair in the plurality of random key pairs, each random key pair having the pre-defined number of signature operations of the master key pair. ### Claim 14 (depends on 13) The computer system of claim 13 wherein the computer code further includes instructions for causing the processor(s) set to perform the following operation(s): validating a first signature operation with reference to a certificate chain from the subordinate certificate of a first random key pair of the plurality of random key pairs to the certificate authority of the master key pair. ### Claim 15 (depends on 13) The computer system of claim 13 wherein the computer code further includes instructions for causing the processor(s) set to perform the following operation(s): performing a series of signature operations using the first random key pair; deleting a first private component of the first random key pair upon determination that the series of signature operations performed by the first random key pair is equal to the pre-defined number of signature operations. ### Claim 16 (depends on 13) The computer system of claim 13 wherein the computer code further includes instructions for causing the processor(s) set to perform the following operation(s): issuing the master key pair having the pre-defined number of signature operations. ### Claim 17 (depends on 13) The computer system of claim 13 wherein the computer code further includes instructions for causing the processor(s) set to perform the following operation(s): determining a fixed number representing the pre-defined number of signature operations permitted for the master key pair. ### Claim 18 (depends on 13) The computer system of claim 13 wherein the computer code further includes instructions for causing the processor(s) set to perform the following operation(s): generating an additional certificate chain layer having the number of keys equal to the fixed number.