Granted Patent B2

US 12,335,241 · App. 17/990,544 · Granted Jun 17, 2025

Inventors: C. Jay Wack (Clarksville, MD); Roger Butler (Centreville, VA)

Assignee: Safe Harbor Digital Asset Security LLC

H04L63/0428H04L9/0861

Abstract

Claims (64)

1. A method of cryptographically binding communication parties, comprising:

assigning respective attributes to a sending party and to a receiving party; and

performing a combine operation;

wherein the combine operation includes creating, by the sending party, communication keys;

wherein the attributes include an identity attribute, and input parameters;

wherein the input parameters include an originator attribute and a list of contacts; and

wherein creating the communication keys includes:

combining values from the attributes to create an ephemeral key wrapping key;

using the ephemeral key wrapping key to protect an ephemeral key generating key; and

mixing at least the ephemeral key generating key and a static key generating key to create the session key.

2. The method of claim 1 , wherein the identity attribute includes at least one of:

an origination encryption key pair;

a pairing key pair;

an origination signing key pair;

an attribute symmetric key;

a static key generating key;

an identity ID; and

an identity name.

3. The method of claim 1 , further comprising performing a key-rolling operation, comprising utilizing rolling key values to re-key at least one of the attributes.

4. The method of claim 1 , further comprising encrypting communication data using the session key; and

sending the encrypted communication data to the receiving party.

5. The method of claim 4 , further comprising creating output parameters, wherein the output parameters include at least some of the input parameters, and ephemeral data.

6. The method of claim 5 , further comprising performing a recombine operation;

wherein the recombine operation includes:

receiving, by the receiving party, the output parameters and the sending party identity attribute;

validating the output parameters; and

identifying and validating the originator.

7. The method of claim 6 , further comprising:

receiving, by the receiving party, the encrypted communication data;

receiving, by the receiving party, the session key, if validating the output parameters and identifying and validating the originator were successful; and

decrypting the encrypted communication data by the receiving party, using the session key.

8. The method of claim 6 , further comprising zeroing at least some of the output parameters if at least one of

validating the output parameters, and

identifying and validating the originator,

was unsuccessful.

9. A cryptographic communication binder, comprising:

an attribute mixer configured to assign respective attributes to a sending party and to a receiving party; and

a combiner configured to create, by the sending party, communication keys;

wherein the attributes include an identity attribute, and input parameters;

wherein the input parameters include an originator attribute and a list of contacts; and

wherein the combiner further includes a communication key generator configured to combine values from the attributes to create an ephemeral key wrapping key, use the ephemeral key wrapping key to protect an ephemeral key generating key, and mix at least the ephemeral key generating key and a static key generating key to create the session key.

10. The cryptographic communication binder of claim 9 , wherein the identity attribute includes at least one of:

an origination encryption key pair;

a pairing key pair;

an origination signing key pair;

an attribute symmetric key;

a static key generating key;

an identity ID; and

an identity name.

11. The cryptographic communication binder of claim 9 , further comprising a key roller configured to utilize rolling key values to re-key at least one of the attributes.

12. The cryptographic communication binder of claim 9 , further comprising a first cryptographic engine configured to encrypt communication data using the session key and send the encrypted communication data to the receiving party.

13. The cryptographic communication binder of claim 12 , wherein the first cryptographic engine is further configured to create output parameters, wherein the output parameters include at least some of the input parameters and ephemeral data.

14. The cryptographic communication binder of claim 13 , further comprising a recombiner configured to:

receive, by the receiving party, the output parameters and the sending party identity attribute;

validate the output parameters; and

identify and validate the originator.

15. The cryptographic communication binder of claim 14 , further comprising a second cryptographic engine configured to:

receive, by the receiving party, the encrypted communication data;

receive, by the receiving party, the session key, if validating the output parameters and identifying and validating the originator were successful; and

decrypt the encrypted communication data by the receiving party, using the session key.

16. The cryptographic communication binder of claim 14 , wherein the recombiner is further configured to zero at least some of the output parameters if at least one of

validating the output parameters, and

identifying and validating the originator,

was unsuccessful.

Assignments (1)

Continuity (2)

References Cited (13)