Granted Patent B2

US 12,632,537 · App. 18/535,432 · Granted May 19, 2026

Inventors: Nicolas Michel Raphaël Ponsini (Mougins, FR); Sebastian Jürgen Hans (Berlin, DE)

Assignee: Oracle International Corporation

G06F21/53H04L9/0618H04L9/0825H04L9/3247

Abstract

Claims (121)

1 . A method, comprising:

executing a secure element (SE) platform runtime environment on at least one SE hardware processor comprised in a first computing entity, wherein the SE platform runtime environment comprises instructions, which when executed by the at least one SE hardware processor, cause performance of operations, comprising:

receiving a request from a device host hardware element of the first computing entity via a SE interface for transferring messages from the device host hardware element to the at least one SE hardware processor;

responsive at least in part to the request, performing a set of cryptographic operations at least by executing a set of SE applications within the SE platform runtime environment, wherein the set of SE applications are isolated, within the SE platform runtime environment, from the device host hardware element, wherein the set of cryptographic operations comprises:

executing a first SE application, of the set of SE applications, wherein executing the first SE application comprises:

generating, by the first SE application, a first shared secret;

generating, by the first SE application, a ciphertext at least by encapsulating the first shared secret with a first key encapsulation mechanism (KEM) public key associated with a second computing entity in accordance with an encapsulation algorithm;

executing a second SE application, of the set of SE applications, wherein executing the second SE application comprises:

obtaining, by the second SE application, the first shared secret from the first SE application for securely accessing data from the first SE application, and

generating, by the second SE application, an encryption key based at least in part on the first shared secret, wherein the second SE application is different from the first SE application;

directing, from the at least one SE hardware processor to the device host hardware element via the SE interface, a response to the request, the response comprising the ciphertext; and

transmitting the ciphertext from the first computing entity to the second computing entity,

wherein subsequent to transmitting the ciphertext to the second computing entity:

the second computing entity (a) derives the first shared secret by decapsulating the ciphertext with a KEM private key corresponding to the first KEM public key and (b) generates a decryption key based at least in part on the first shared secret, and

the first computing entity and the second computing entity exchange at least one encrypted message,

wherein the first computing entity encrypts the at least one encrypted message with the encryption key and wherein the second computing entity decrypts the at least one encrypted message with the decryption key.

2 . The method of claim 1 , wherein the encapsulation algorithm comprises at least one of: a legacy cryptographic algorithm, or a quantum-resistant cryptographic algorithm.

3 . The method of claim 1 , wherein the set of SE applications comprises a key encapsulation mechanism module; and

wherein executing the set of SE applications within the SE platform runtime environment comprises:

encapsulating the first shared secret with the first KEM public key in accordance with the encapsulation algorithm at least by executing the key encapsulation mechanism module,

wherein an output of the key encapsulation mechanism module comprises the ciphertext.

4 . The method of claim 1 , wherein the set of cryptographic operations further comprise:

generating a first key agreement (KA) private key;

generating a second shared secret at least by combining the first KA private key with a first KA public key associated with the second computing entity in accordance with a KA algorithm;

generating a combined shared secret at least by combining, in accordance with a combination function, the first shared secret, the second shared secret, and a combination parameter associated with the combination function;

wherein the second computing entity derives the second shared secret at least by:

generating a second KA private key, and

combining the second KA private key with a second KA public key associated with the first computing entity in accordance with the KA algorithm;

wherein the second computing entity derives the combined shared secret at least by combining, in accordance with the combination function, the first shared secret, the second shared secret, and the combination parameter associated with the combination function;

wherein the encryption key comprises, or is based at least in part on, the combined shared secret.

5 . The method of claim 4 , wherein the operations further comprise:

selecting the combination function from a set of combination functions.

6 . The method of claim 4 , wherein the operations further comprise:

receiving the first KEM public key and the first KA public key from the second computing entity;

validating the first KEM public key and the first KA public key;

responsive to validating the first KEM public key and the first KA public key, performing the set of cryptographic operations; and

transmitting a first encrypted message to the second computing entity, wherein the first encrypted message is encrypted with the encryption key.

7 . The method of claim 1 , further comprising:

initializing the SE platform runtime environment at least in part via an electromagnetic field generated by a near-field communication element associated with the second computing entity; and

receiving the first KEM public key from the second computing entity subsequent to initializing the SE platform runtime environment.

8 . The method of claim 1 , wherein the first computing entity and the second computing entity are communicatively coupled via a wired or wireless network.

9 . The method of claim 1 , wherein the operations further comprise:

initiating a cryptography module within the SE platform runtime environment; and

selecting, via the cryptography module, the set of SE applications for execution within the SE platform runtime environment.

10 . The method of claim 1 , wherein the operations further comprise:

selecting the encapsulation algorithm from a set of encapsulation algorithms using an application programming interface.

11 . The method of claim 1 , wherein an application programming interface is utilized to perform at least one of: generating, configuring, or selecting, the set of SE applications.

12 . The method of claim 1 , wherein the operations further comprise:

configuring one or more parameters associated with the set of cryptographic operations based on one or more user inputs,

wherein the one or more parameters comprises at least one of: the first KEM public key, or a selection of the encapsulation algorithm,

wherein at least one of the one or more parameters is provided as a byte array.

13 . One or more non-transitory computer-readable media comprising instructions, which when executed by one or more hardware processors associated with a first computing entity, cause performance of operations comprising:

initiating a cryptography module within a secure element (SE) platform runtime environment, wherein the one or more hardware processors comprise at least one SE hardware processor, and wherein the SE platform runtime environment is executed on the at least one SE hardware processor;

receiving a request from a device host hardware element of the first computing entity via a SE interface for transferring messages from the device host hardware element to the at least one SE hardware processor;

responsive at least in part to the request, performing a set of cryptographic operations at least by executing a set of SE applications within the SE platform runtime environment, wherein the set of SE applications are isolated, within the SE platform runtime environment, from the device host hardware element, wherein the set of cryptographic operations comprises:

executing a first SE application, of the set of SE applications, wherein executing the first SE application comprises:

generating, by the first SE application, a first shared secret;

generating, by the first SE application, a ciphertext at least by encapsulating the first shared secret with a first key encapsulation mechanism (KEM) public key associated with a second computing entity in accordance with an encapsulation algorithm;

executing a second SE application, of the set of SE applications, wherein executing the second SE application comprises:

obtaining, by the second SE application, the first shared secret from the first SE application for securely accessing data from the first SE application, and

generating, by the second SE application, an encryption key based at least in part on the first shared secret, wherein the second SE application is different from the first SE application;

directing, from the at least one SE hardware processor to the device host hardware element via the SE interface, a response to the request, the response comprising the ciphertext; and

transmitting the ciphertext from the first computing entity to the second computing entity,

wherein subsequent to transmitting the ciphertext to the second computing entity:

the second computing entity (a) derives the first shared secret by decapsulating the ciphertext with a KEM private key corresponding to the first KEM public key and (b) generates a decryption key based at least in part on the first shared secret, and

the first computing entity and the second computing entity exchange at least one encrypted message,

wherein the first computing entity encrypts the at least one encrypted message with the encryption key and wherein the second computing entity decrypts the at least one encrypted message with the decryption key.

14 . The one or more non-transitory computer-readable media of claim 13 , wherein the set of SE applications comprises a key encapsulation mechanism module; and

wherein executing the set of SE applications within the SE platform runtime environment comprises:

encapsulating the first shared secret with the first KEM public key in accordance with the encapsulation algorithm at least by executing the key encapsulation mechanism module,

wherein an output of the key encapsulation mechanism module comprises the ciphertext.

15 . The one or more non-transitory computer-readable media of claim 13 , wherein the set of cryptographic operations further comprise:

generating a first key agreement (KA) private key;

generating a second shared secret at least by combining the first KA private key with a first KA public key associated with the second computing entity in accordance with a KA algorithm;

generating a combined shared secret at least by combining, in accordance with a combination function, the first shared secret, the second shared secret, and a combination parameter associated with the combination function;

wherein the second computing entity derives the second shared secret at least by:

generating a second KA private key, and

combining the second KA private key with a second KA public key associated with the first computing entity in accordance with the KA algorithm;

wherein the second computing entity derives the combined shared secret at least by combining, in accordance with the combination function, the first shared secret, the second shared secret, and the combination parameter associated with the combination function;

wherein the encryption key comprises, or is based at least in part on, the combined shared secret.

16 . The one or more non-transitory computer-readable media of claim 15 , wherein the operations further comprise:

receiving the first KEM public key and the first KA public key from the second computing entity;

validating the first KEM public key and the first KA public key;

responsive to validating the first KEM public key and the first KA public key, performing the set of cryptographic operations; and

transmitting a first encrypted message to the second computing entity, wherein the first encrypted message is encrypted with the encryption key.

17 . The one or more non-transitory computer-readable media of claim 13 , wherein the operations further comprise:

initializing the SE platform runtime environment at least in part via an electromagnetic field generated by a near-field communication element associated with the second computing entity; and

receiving the first KEM public key from the second computing entity subsequent to initializing the SE platform runtime environment.

18 . The one or more non-transitory computer-readable media of claim 13 , wherein the operations further comprise:

initiating a cryptography module within the SE platform runtime environment; and

selecting, via the cryptography module, the set of SE applications for execution within the SE platform runtime environment.

19 . The one or more non-transitory computer-readable media of claim 13 , wherein the operations further comprise:

configuring one or more parameters associated with the set of cryptographic operations based on one or more user inputs,

wherein the one or more parameters comprises at least one of: the first KEM public key, or a selection of the encapsulation algorithm,

wherein at least one of the one or more parameters is provided as a byte array.

20 . A system, comprising:

at least one secure element (SE) hardware processor associated with a first computing entity;

an SE platform runtime environment executable on the at least one SE hardware processor;

wherein the SE platform runtime environment is configured to execute operations, using the at least one SE hardware processor, the operations comprising:

receiving a request from a device host hardware element of the first computing entity via a SE interface for transferring messages from the device host hardware element to the at least one SE hardware processor;

responsive at least in part to the request, performing a set of cryptographic operations at least by executing a set of SE applications within the SE platform runtime environment, wherein the set of SE applications are isolated, within the SE platform runtime environment, from the device host hardware element, wherein the set of cryptographic operations comprises: executing a first SE application, of the set of SE applications, wherein executing the first SE application comprises:

generating, by the first SE application, a first shared secret;

generating, by the first SE application, a ciphertext at least by encapsulating the first shared secret with a first key encapsulation mechanism (KEM) public key associated with a second computing entity in accordance with an encapsulation algorithm;

executing a second SE application, of the set of SE applications, wherein executing the second SE application comprises:

obtaining, by the second SE application, the first shared secret from the first SE application for securely accessing data from the first SE application, and

generating, by the second SE application, an encryption key based at least in part on the first shared secret, wherein the second SE application is different from the first SE application;

directing, from the at least one SE hardware processor to the device host hardware element via the SE interface, a response to the request, the response comprising the ciphertext; and

transmitting the ciphertext from the first computing entity to the second computing entity,

wherein subsequent to transmitting the ciphertext to the second computing entity:

the second computing entity (a) derives the first shared secret by decapsulating the ciphertext with a KEM private key corresponding to the first KEM public key and (b) generates a decryption key based at least in part on the first shared secret, and

the first computing entity and the second computing entity exchange at least one encrypted message,

wherein the first computing entity encrypts the at least one encrypted message with the encryption key and wherein the second computing entity decrypts the at least one encrypted message with the decryption key.

21 . The system of claim 20 , wherein obtaining the first shared secret from the first SE application comprises:

generating a shareable interface object, and

utilizing the shareable interface object to obtain the first shared secret from the first SE application.

22 . The system of claim 20 ,

wherein executing the first SE application further comprises:

storing the first shared secret in a transient memory element, and

generating a transient object handle comprising a reference to the first shared secret in the transient memory element;

wherein obtaining the first shared secret from the first SE application comprises:

utilizing the transient object handle to access the first shared secret from the transient memory.

Assignments (3)

Continuity (2)

References Cited (45)