Granted Patent B1

US 12,200,122 · App. 17/396,089 · Granted Jan 14, 2025

Inventors: Massimiliano Pala (Superior, CO); Bernardo Huberman (Palo Alto, CA); Jing Wang (Broomfield, CO)

Assignee: Cable Television Laboratories, Inc.

H04L9/0891H04L9/3242H04L9/3268H04L63/062

Abstract

Claims (66)

1. A server device for authenticating client devices on a communication network, comprising:

a transceiver configured for operable communication with at least one client device of the communication network;

a processor including a memory configured to store computer-executable instructions, which, when executed by the processor, cause the server device to:

receive an authentication request from a client device, wherein the authentication request is received prior to a transition to post-quantum cryptography;

authenticate the client device based upon the authentication request;

if the client device is authenticated, generate a seed for a first post quantum key for the client device;

if the client device is authenticated, encrypt the seed for the first post quantum key;

if the client device is authenticated, transmit, to the client device, an authentication reply including the encrypted seed for the first post quantum key and one or more operations to be performed on the seed for first post quantum key to generate the first post quantum key, wherein the authentication reply is transmitted prior to a transition to post-quantum cryptography;

receive a hash of the first post quantum key from the client device, wherein the client device decrypted the seed and performed the one or more operations on the seed to generate the first post quantum key prior to generating the hash of the first post quantum key; and

validate the first post quantum key based upon the hash of the first post quantum key.

2. The server device of claim 1 , wherein the authentication reply also includes at least one non-reversible operation for the client device to perform on the seed of the first post quantum key to generate the first post quantum key.

3. The server device of claim 1 , wherein the authentication reply further includes a hash of a network key for validation purposes.

4. The server device of claim 1 , wherein the server device is further programmed to:

receive an encrypted network key from the client device;

decrypt and store the network key;

generate a hash of the network key; and

transmit the hash of the network key to the client device for validation.

5. The server device of claim 4 , wherein the server device is further programmed to:

receive at least one operation with the encrypted network key; and

perform the at least one operation on the encrypted network key to generate the network key.

6. The server device of claim 1 , wherein the seed for the first post quantum key is transmitted prior to availability of post-quantum cryptography.

7. The server device of claim 1 , wherein the server device is further programmed to:

determine an update to the first post quantum key;

transmit the update to the first post quantum key to the client device;

receive a hash of the updated first post quantum key from the client device; and

validate the updated first post quantum key based on the hash of the updated first post quantum key.

8. The server device of claim 7 , wherein the update includes one or more non-reversible operations to be performed on the first post quantum key to generate the updated first post quantum key.

9. The server device of claim 7 , wherein the update includes an update key to be applied to the first post quantum key to generate the updated first post quantum key.

10. A server device for authenticating client devices on a communication network, comprising:

a transceiver configured for operable communication with at least one client device of the communication network;

a processor including a memory configured to store computer-executable instructions, which, when executed by the processor, cause the server device to:

receive an authentication request from a client device, wherein the client device stores a first post quantum key, wherein the authentication request is received prior to a transition to post-quantum cryptography;

authenticate the client device based upon the authentication request;

if the client device is authenticated, determine an update to the first post quantum key;

if the client device is authenticated, encrypt the update for the first post quantum key;

if the client device is authenticated, transmit, to the client device, an authentication reply including the encrypted update to the first post quantum key and one or more operations to be performed on the update for first post quantum key and the first post quantum key to generate the updated first post quantum key, wherein the authentication reply is transmitted prior to a transition to post-quantum cryptography;

receive a hash of the updated first post quantum key from the client device, wherein the client device decrypted the update for the first post quantum key and performed the one or more operations on the update for the first post quantum key and the first post quantum key prior to generating the hash of the updated first post quantum key; and

validate the updated first post quantum key based on the hash of the updated first post quantum key.

11. The server device of claim 10 , wherein the update includes one or more non-reversible operations to be performed on the first post quantum key to generate the updated first post quantum key.

12. The server device of claim 10 , wherein the update includes an update key to be applied to the first post quantum key to generate the updated first post quantum key.

13. The server device of claim 10 , wherein the update for the first post quantum key further includes an encrypted version of the updated first post quantum key.

14. The server device of claim 10 , wherein the server device is further programmed to:

generate a seed for the first post quantum key for the client device;

transmit the seed for the first post quantum key to the client device;

receive a hash of the first post quantum key from the client device; and

validate the first post quantum key based on the hash of the first post quantum key.

15. The server device of claim 14 , wherein the server device is further programmed to transmit, to the client device, at least one operation for the client device to perform on the seed of the first post quantum key to generate the first post quantum key.

16. The server device of claim 14 , wherein the seed for the first post quantum key is transmitted prior to availability of post-quantum cryptography.

17. A client device for communicating on a communication network, comprising:

a transceiver configured for operable communication with at least one server device of the communication network;

a processor including a memory configured to store computer-executable instructions, which, when executed by the processor, cause the server device to:

transmit an authentication request to a server device, wherein the authentication request is transmitted prior to a transition to post-quantum cryptography;

receive an authentication reply including an encrypted seed for a first post quantum key and one or more operations to be performed on the seed for first post quantum key to generate the first post quantum key from the server device, wherein the authentication reply is received prior to a transition to post-quantum cryptography;

decrypt the seed for the first post quantum key;

perform the one or more operations on the seed of the first post quantum key to generate the first post quantum key;

store the first post quantum key;

generate a hash of the first post quantum key; and

transmit the hash of the first post quantum key for validation to the server device.

18. The client device of claim 17 , wherein the client device is further programmed to:

receive, from the server device, at least one non-reversible operation for the client device to perform on the seed of the first post quantum key to generate the first post quantum key; and

generate the first post quantum key by performing the at least one non-reversible operation on the seed.

19. The client device of claim 17 , wherein the authentication reply further includes a hash of a network key for validation purposes.

20. The client device of claim 17 , wherein the client device is further programmed to:

transmit an encrypted network key to the server device;

receive a hash of a network key from the server device, wherein the network key is based on the encrypted network key; and

validate the network key based on the hash.

Assignments (1)

Continuity (1)

References Cited (127)

Cited By (1)

US 12,476,984