Granted Patent B2

US 12,567,981 · App. 17/570,813 · Granted Mar 3, 2026

Inventor: Massimiliano Pala (Denver, CO)

Assignee: Cable Television Laboratories, Inc.

H04L9/3268H04L9/0825H04L9/14H04L9/3247

Abstract

Claims (59)

1 . A system for enhanced public key infrastructure (PKI), comprising:

a computer device having at least one processor in communication with at least one memory device configured to store a plurality of instructions, which, when executed by the at least one processor, cause the at least one processor to:

receive a digital certificate including a first combined signature including a first signature of a plurality of digital signatures and a second combined signature including a second signature of the plurality of digital signatures and different from the first signature, wherein the first combined signature is encrypted with a first key and the second combined signature is encrypted with a second key, wherein the digital certificate includes a plurality of fields, and wherein the plurality of fields include (i) the first key in a first field of the plurality of fields, (ii) a first identifier for a first cryptographic algorithm in a second field of the plurality of fields, (iii) the second key in a third field of the plurality of fields, and (iv) a second identifier for a second cryptographic algorithm in a fourth field of the plurality of fields;

retrieve the first key associated with the first combined signature from the digital certificate;

decrypt the first combined signature using the first key to retrieve first signature and the second combined signature;

validate the first signature;

retrieve, from the digital certificate, a second key associated with the second combined signature;

decrypt the second combined signature using the second key to retrieve the second signature;

validate the second signature; and

deny the digital certificate upon failure to validate a signature of the plurality of digital signatures.

2 . The system in accordance with claim 1 , wherein the instructions further cause the at least one processor to:

decrypt the second combined signature using the second key to retrieve the second signature and a third combined signature including a third signature of the plurality of digital signatures;

retrieve, from the digital certificate, a third key associated with the third signature; and

validate the third signature.

3 . The system in accordance with claim 1 , wherein the instructions further cause the at least one processor to determine the first cryptographic algorithm associated with the first key.

4 . The system in accordance with claim 3 , wherein the instructions further cause the at least one processor to determine if the first cryptographic algorithm is valid.

5 . The system in accordance with claim 4 , wherein the instructions further cause the at least one processor to determine if the first cryptographic algorithm is valid based on at least one of an Online Certificate Status Protocol (OCSP) and a Certificate Revocation List (CRL).

6 . The system in accordance with claim 3 , wherein the instructions further cause the at least one processor to determine if the computer device is capable of processing the first cryptographic algorithm.

7 . The system in accordance with claim 3 , wherein the instructions further cause the at least one processor to determine the second cryptographic algorithm associated with the second signature, wherein the first cryptographic algorithm is different from the second cryptographic algorithm.

8 . The system in accordance with claim 1 , wherein the instructions further cause the at least one processor to validate the digital certificate if all of the plurality of digital signatures associated with the digital certificate are validated.

9 . The system in accordance with claim 1 , wherein an innermost signature of the plurality of digital signatures includes at least one of (i) a secret, and (ii) a public key for decrypting a message.

10 . The system in accordance with claim 1 , wherein the instructions further cause the at least one processor to include a revoked algorithm associated with one of the plurality of digital signatures.

11 . A system for enhanced public key infrastructure (PKI), comprising:

a computer device having at least one processor in communication with at least one memory device configured to store a plurality of instructions, which, when executed by the at least one processor, cause the at least one processor to:

receive a digital certificate including a combined signature field having a plurality of nested signatures and a threshold, wherein the plurality of nested signatures includes at least a first signature and a second signature, wherein the threshold represents a number of valid signatures required, wherein the digital certificate includes a plurality of fields, and wherein the plurality of fields include (i) a first key in a first field of the plurality of fields, (ii) a first identifier for a first cryptographic algorithm in a second field of the plurality of fields, (iii) a second key in a third field of the plurality of fields, and (iv) a second identifier for a second cryptographic algorithm in a fourth field of the plurality of fields;

retrieve, from the digital certificate, the first key associated with the first signature from the digital certificate;

retrieve the first signature and a second combined signature from the combined signature field;

validate the first signature;

retrieve, from the digital certificate, a second key associated with the second signature;

retrieve the second signature from the second combined signature;

validate the second signature;

compare a number of validated signatures;

validate the digital certificate if the number of validated signatures meets the threshold based on the comparison; and

deny the digital certificate upon failure to validate a signature of the plurality of digital signatures.

12 . The system in accordance with claim 11 , wherein the instructions further cause the at least one processor to continue to validate signatures of the plurality of nested signatures until the number of validated signatures meets the threshold or all of the plurality of nested signatures have been analyzed.

13 . The system in accordance with claim 12 , wherein the instructions further cause the at least one processor to:

receive a revocation status message for one or more keys, wherein the revocation status message includes a threshold update; and

update the threshold based on the threshold update, wherein the threshold update increases the threshold.

14 . A computing device for enhanced public key infrastructure (PKI), comprising:

a processor; and

a memory device in communication with the processor,

wherein the memory device is configured to store a plurality of instructions, which, when executed by the processor, cause the processor to:

receive a digital certificate including a first combined signature including a first signature of a plurality of digital signatures and a second combined signature including a second signature of the plurality of digital signatures and different from the first signature, wherein the first combined signature is encrypted with a first key and the second combined signature is encrypted with a second key, wherein the digital certificate includes a plurality of fields, and wherein the plurality of fields include (i) the first key in a first field of the plurality of fields, (ii) a first identifier for a first cryptographic algorithm in a second field of the plurality of fields, (iii) the second key in a third field of the plurality of fields, and (iv) a second identifier for a second cryptographic algorithm in a fourth field of the plurality of fields;

retrieve the first key associated with the first combined signature from the digital certificate;

decrypt the first combined signature using the first key to retrieve first signature and the second combined signature;

validate the first signature;

retrieve, from the digital certificate, a second key associated with the second combined signature;

decrypt the second combined signature using the second key to retrieve the second signature;

validate the second signature; and

deny the digital certificate upon failure to validate a signature of the plurality of digital signatures.

15 . The computer device in accordance with claim 14 , wherein the instructions further cause the at least one processor to:

decrypt the second combined signature using the second key to retrieve the second signature and a third combined signature including a third signature of the plurality of digital signatures;

retrieve, from the digital certificate, a third key associated with the third signature; and

validate the third signature.

16 . The computer device in accordance with claim 14 , wherein the instructions further cause the at least one processor to determine the first cryptographic algorithm associated with the first key.

17 . The computer device in accordance with claim 16 , wherein the instructions further cause the at least one processor to determine if the first cryptographic algorithm is valid.

18 . The computer device in accordance with claim 17 , wherein the instructions further cause the at least one processor to determine if the first cryptographic algorithm is valid based on at least one of an Online Certificate Status Protocol (OCSP) and a Certificate Revocation List (CRL).

19 . The computer device in accordance with claim 16 , wherein the instructions further cause the at least one processor to determine if the computer device is capable of processing the first cryptographic algorithm.

20 . The computer device in accordance with claim 16 , wherein the instructions further cause the at least one processor to determine the second cryptographic algorithm associated with the second signature, wherein the first cryptographic algorithm is different from the second cryptographic algorithm.

Assignments (1)

Continuity (5)

References Cited (130)