Certificate based security using post quantum cryptography

Patent metadata

Field	Value
Publication number	US-11716206-B2
Application number	US-202017086510-A
Country	US
Kind code	B2
Filing date	Nov 2, 2020
Priority date	Nov 2, 2020
Publication date	Aug 1, 2023
Grant date	Aug 1, 2023

Abstract

Establishing secure communications by sending a server certificate message, the certificate message including a first certificate associated with a first encryption algorithm and a second certificate associated with a second encryption algorithm, the first certificate and second certificate bound to each other, signing a first message associated with client-server communications using a first private key, the first private key associated with the first certificate, signing a second message associated with the client-server communications using a second private key, the second private key associated with the second certificate, the second message including the signed first message, and sending a server certificate verify message, the server certificate verify message comprising the signed first message and the signed second message.

First claim

What is claimed is:

1. A computer implemented method for establishing secure network communications, the method comprising:
sending, by one or more server computer processors, a server certificate message in response to a client hello message, the certificate message comprising a first certificate associated with a first encryption algorithm and a second certificate associated with a second encryption algorithm, the first certificate and second certificate bound to each other;
signing, by the one or more server computer processors, a first message associated with client-server communications using a first private key, the first private key associated with the first certificate;
signing, by the one or more server computer processors, a second message associated with the client-server communications using a second private key, the second private key associated with the second certificate, the second message including the first message;
sending, by the one or more server computer processors in response to receiving the client hello message, a server certificate verify message, the server certificate verify message comprising the first message and the second message;
receiving, by the one or more server computer processors, a client certificate message in response to the server hello message, the client certificate message comprising a third certificate associated with the first encryption algorithm and a fourth certificate associated with the second encryption algorithm, the third certificate and fourth certificate bound to each other; and
receiving, by the one or more server computer processors, a client certificate verify message, the client certificate verify message comprising a third message associated with client-server communications signed using a third private key, the third private key associated with the third certificate, and a fourth message associated with the client-server communications signed using a fourth private key, the fourth private key associated with the fourth certificate, the fourth message including the third message.

2. The computer implemented method according to claim 1 , wherein the first encryption algorithm comprises a lattice-based encryption algorithm.

3. The computer implemented method according to claim 1 , wherein the first message comprises a transcript of client-server messaging.

4. The computer implemented method according to claim 1 , wherein the first certificate and the second certificate have an identical subject name.

5. The computer implemented method according to claim 1 , wherein an attribute of the second certificate comprises a hashed value of the first certificate.

6. The computer implemented method according to claim 1 , further comprising sending, by the one or more server computer processors, data encrypted using the first encryption algorithm.

7. A computer program product for establishing secure network communications, the computer program product comprising one or more computer readable storage devices and collectively stored program instructions on the one or more computer readable storage devices, the stored program instructions comprising:
program instructions to send a server certificate message in response to a client hello message, the certificate message comprising a first certificate associated with a first encryption algorithm and a second certificate associated with a second encryption algorithm, the first certificate and second certificate bound to each other;
program instructions to sign a first message associated with client-server communications using a first private key, the first private key associated with the first certificate;
program instructions to sign a second message associated with the client-server communications using a second private key, the second private key associated with the second certificate, the second message including the first message;
program instructions to send, in response to receiving the client hello message, a server certificate verify message, the server certificate verify message comprising the first message and the second message;
program instructions to receive a client certificate message in response to the server hello message, the client certificate message comprising a third certificate associated with the first encryption algorithm and a fourth certificate associated with the second encryption algorithm, the third certificate and fourth certificate bound to each other; and
program instructions to receive a client certificate verify message, the client certificate verify message comprising a third message associated with client-server communications signed using a third private key, the third private key associated with the third certificate, and a fourth message associated with the client-server communications signed using a fourth private key, the fourth private key associated with the fourth certificate, the fourth message including the third message.

8. The computer program product according to claim 7 , wherein the first encryption algorithm comprises a lattice-based encryption algorithm.

9. The computer program product according to claim 7 , wherein the first message comprises a transcript of client-server messaging.

10. The computer program product according to claim 7 , wherein the first certificate and the second certificate have an identical subject name.

11. The computer program product according to claim 7 , wherein an attribute of the second certificate comprises a hashed value of the first certificate.

12. The computer program product according to claim 7 , the stored program instructions further comprising program instructions to send data encrypted using the first encryption algorithm.

13. A computer system for establishing secure network communications, the computer system comprising:
one or more computer processors;
one or more computer readable storage devices; and
stored program instructions on the one or more computer readable storage devices for execution by the one or more computer processors, the stored program instructions comprising:
program instructions to send a server certificate message in response to a client hello message, the certificate message comprising a first certificate associated with a first encryption algorithm and a second certificate associated with a second encryption algorithm, the first certificate and second certificate bound to each other;
program instructions to sign a first message associated with client-server communications using a first private key, the first private key associated with the first certificate;
program instructions to sign a second message associated with the client-server communications using a second private key, the second private key associated with the second certificate, the second message including the first message;
program instructions to send, in response to receiving the client hello message, a server certificate verify message, the server certificate verify message comprising the first message and the second message;
program instructions to receive a client certificate message in response to the server hello message, the client certificate message comprising a third certificate associated with the first encryption algorithm and a fourth certificate associated with the second encryption algorithm, the third certificate and fourth certificate bound to each other; and
program instructions to receive a client certificate verify message, the client certificate verify message comprising a third message associated with client-server communications signed using a third private key, the third private key associated with the third certificate, and a fourth message assoc

Assignees

• IBM

Inventors

• Gray Michael W
• Madineni Narayana Aditya
• Mcmahon Simon D
• Green Matthew
• Waltenberg Peter T

Classifications

• H04L63/166 Primary

  at the transport layer · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L9/3265

  using certificate chains, trees or paths; Hierarchical trust model · CPC title

• H04L9/3268

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title