Granted Patent B1

US 12,732,823 · App. 19/380,586 · Granted Sep 8, 2026

Inventors: Mantas Jonytis (Grigiskes, LT); Mindaugas Valkaitis (Vilnius, LT)

Assignee: UAB 360 IT

H04W12/69H04W8/24H04W12/03

Abstract

Claims (72)

1 . A method, implemented by a client device for establishing a secure communication channel from the client device, the method comprising:

transmitting, to a remote server, a request for a security profile, the request including information related to one or more capabilities of the client device;

receiving the security profile from the remote server, wherein the security profile defines a set of communication parameters based on at least some of the one or more capabilities, the security profile comprising, within itself, an ordered sequence of cryptographic operations, protocols, and parameters specifying how to establish the secure communication channel;

interpreting the received security profile by:

parsing a handshake flow specified within the security profile, the handshake flow defining negotiation and authentication procedures for establishing the secure communication channel;

parsing a cryptographic operations order specified within the security profile, the cryptographic operations order specifying a sequence of cryptographic operations to be performed for establishing the secure communication channel; and

generating instructions from the parsed security profile for executing the cryptographic operations order to establish the secure communication channel; and

establishing the secure communication channel with a second server based on the generated instructions.

2 . The method of claim 1 , further comprising:

determining the one or more capabilities of the client device by performing a hardware detection process that identifies at least one of a central processing unit type, memory configuration, or available cryptographic hardware acceleration.

3 . The method of claim 1 , wherein the security profile includes a specific cryptographic algorithm and a corresponding cryptographic library required to execute the specific cryptographic algorithm, the method further comprises:

prior to establishing the secure communication channel, verifying a presence of the corresponding cryptographic library on the client device; and

downloading the corresponding cryptographic library from an update server based on a determination that the corresponding cryptographic library is not present.

4 . The method of claim 3 , wherein downloading the corresponding cryptographic library comprises:

transmitting a request to download a native version of the corresponding cryptographic library optimized for a specific hardware architecture of the client device; and

based on a determination that the native version is unavailable or fails to load, transmitting another request to download a virtual machine based version of the corresponding cryptographic library.

5 . The method of claim 3 , wherein downloading the corresponding cryptographic library comprises:

sending another request for the corresponding cryptographic library that specifies a target architecture of the client device; and

receiving a version of the corresponding cryptographic library compiled for the specified target architecture.

6 . The method of claim 1 , further comprising:

caching the received security profile on the client device; and

using the cached security profile for subsequent connection attempts without requesting a new security profile from the remote server.

7 . The method of claim 1 , further comprising:

maintaining a cache of multiple security profiles including a fallback security profile; and

upon failure to establish the secure communication channel using the security profile, selecting and executing the fallback security profile from the cache.

8 . A device, comprising:

a memory subsystem; and

processing circuitry, the processing circuitry configured to execute instructions stored in the memory subsystem to:

transmit, to a remote server, a request for a security profile, the request including information related to one or more capabilities of the device;

receive the security profile from the remote server, wherein the security profile defines a set of communication parameters based on at least some of the one or more capabilities, the security profile comprising, within itself, an ordered sequence of cryptographic operations, protocols, and parameters specifying how to establish a secure communication channel;

interpret the received security profile by instructions to:

parse a handshake flow specified within the security profile, the handshake flow defining negotiation and authentication procedures for establishing the secure communication channel;

parse a cryptographic operations order specified within the security profile, the cryptographic operations order specifying a sequence of cryptographic operations to be performed for establishing the secure communication channel; and

generate instructions from the parsed security profile for executing the cryptographic operations order to establish the secure communication channel; and

establish the secure communication channel with a second server based on the generated instructions.

9 . The device of claim 8 , wherein, to establish the secure communication channel, the processing circuitry is configured to execute instructions in the memory subsystem to:

initiate a handshake sequence with the second server according to the handshake flow specific within the security profile, wherein the handshake sequence includes key exchange operations and wherein the security profile specifies parameters for the key exchange operations, including key type and key length.

10 . The device of claim 8 , wherein the set of communication parameters in the security profile includes at least one of an encryption algorithm, a hashing algorithm, a key exchange method, and a digital signature algorithm.

11 . The device of claim 8 , the processing circuitry further configured to execute instructions in the memory subsystem to:

after establishing the secure communication channel, monitor performance metrics of the secure communication channel; and

transmit a second request to the remote server for a revised security profile to optimize the secure communication channel based on the performance metrics.

12 . The device of claim 8 , wherein the processing circuitry is configured to:

interpret error handling sequences defined within the security profile; and

implement recovery mechanisms based on the error handling sequences during connection establishment.

13 . The device of claim 8 , wherein, to interpret the received security profile, the processing circuitry is configured to execute instructions stored in the memory subsystem to:

validate that cryptographic algorithms specified in the security profile are compatible with the one or more capabilities of the device; and

verify cryptographic strengths of the cryptographic algorithms against a security policy.

14 . One or more non-transitory computer-readable storage media comprising instructions that, when executed by one or more processors, perform operations for establishing a secure communication channel from a client device, the operations comprising:

transmitting, to a remote server, a request for a security profile, the request including information related to one or more capabilities of the client device;

receiving the security profile from the remote server, wherein the security profile defines a set of communication parameters based on at least some of the one or more capabilities, the security profile comprising, within itself, an ordered sequence of cryptographic operations, protocols, and parameters specifying how to establish the secure communication channel;

interpreting the received security profile by:

parsing a handshake flow specified within the security profile, the handshake flow defining negotiation and authentication procedures for establishing the secure communication channel;

parsing a cryptographic operations order specified within the security profile, the cryptographic operations order specifying a sequence of cryptographic operations to be performed for establishing the secure communication channel; and

generating instructions from the parsed security profile for executing the cryptographic operations order to establish the secure communication channel; and

establishing the secure communication channel with a second server based on the generated instructions.

15 . The one or more non-transitory computer-readable storage media of claim 14 , wherein the operations further comprising:

determining the one or more capabilities of the client device by performing a hardware detection process that identifies at least one of a central processing unit type, memory configuration, or available cryptographic hardware acceleration.

16 . The one or more non-transitory computer-readable storage media of claim 14 , wherein the security profile includes a specific cryptographic algorithm and a corresponding cryptographic library required to execute the specific cryptographic algorithm, the operations further comprise:

prior to establishing the secure communication channel, verifying a presence of the corresponding cryptographic library on the client device; and

downloading the corresponding cryptographic library from an update server based on a determination that the corresponding cryptographic library is not present.

17 . The one or more non-transitory computer-readable storage media of claim 16 , wherein downloading the corresponding cryptographic library comprises:

transmitting a request to download a native version of the corresponding cryptographic library optimized for a specific hardware architecture of the client device; and

based on a determination that the native version is unavailable or fails to load, transmitting another request to download a virtual machine based version of the corresponding cryptographic library.

18 . The one or more non-transitory computer-readable storage media of claim 17 , wherein downloading the required cryptographic library comprises:

sending another request for the corresponding cryptographic library that specifies a target architecture of the client device; and

receiving a version of the corresponding cryptographic library compiled for the target architecture.

19 . The method of claim 1 , wherein interpreting the received security profile further comprises:

parsing error handling rules specified within the security profile, the error handling rules defining recovery procedures for error conditions arising during establishment of the secure communication channel; and

implementing a recovery mechanism based on the parsed error handling rules upon detecting an error condition during establishment of the secure communication channel.

20 . The method of claim 1 , wherein interpreting the received security profile further comprises:

validating that cryptographic algorithms specified within the security profile are compatible with the one or more capabilities of the client device; and

performing algorithm substitution by identifying a compatible alternative algorithm when a cryptographic algorithm specified within the security profile is unavailable on the client device.

Assignments (1)

Continuity (1)

References Cited (20)