Public key infrastructure using quantum computers (PKIQC)

Patent metadata

Field	Value
Publication number	US-12438707-B2
Application number	US-202318531600-A
Country	US
Kind code	B2
Filing date	Dec 6, 2023
Priority date	Dec 6, 2023
Publication date	Oct 7, 2025
Grant date	Oct 7, 2025

Abstract

The present disclosure is directed to systems, methods, and non-transitory computer-readable media for generating a first signature on a first certificate of the plurality of certificates using a first digital signature generation algorithm based on a first private key. The first signature is validated by a relying party device using a first public key in certificate chain validation. The first public key and the first private key form a first public/private key pair. A second signature is generated on a second certificate of the plurality of certificates using a second digital signature generation algorithm based on a second private key. The second signature is validated by the relying party device using a second public key in the certificate chain validation. The second public key and the second private key form a second public/private key pair. The relying party device uses a third public key in the second certificate to verify a third signature on signed data. The relying party device includes a classical computer having at least one processor that processes bits.

First claim

What is claimed is:

1. A system, comprising:
at least one memory; and
at least one processor that processes bits, the at least one processor configured to:

perform certificate chain validation comprising validating a plurality of certificates, wherein performing the certificate chain validation comprises:
validating a first signature on a first certificate of the plurality of certificates using a first public key, wherein the first signature is generated for the first certificate by a first quantum computer using a first digital signature generation algorithm based on a first private key, and wherein the first public key and the first private key form a first public/private key pair; and
validating a second signature on a second certificate of the plurality of certificates using a second public key, wherein the second signature is generated for the second certificate by a second quantum computer using a second digital signature generation algorithm based on a second private key, and wherein the second public key and the second private key form a second public/private key pair; and
in response to successfully completing the certificate chain validation, use a third public key in the second certificate to verify a third signature on signed data, wherein the first quantum computer and the second quantum computer processes quantum bits, wherein

the signed data is signed by an end entity device using a third private key of the end entity device;
the third public key and the third private key form a third public/private key pair;
the end entity device comprising a classical computer having at least one processor that processes bits; and
the signed data comprises a message, code, document, file, program, or application signed by the end entity using the third private key.

2. The system of claim 1 , wherein
the end entity device secures the third private key in a Hardware Security Module (HSM) or a cryptographic software module;
the end entity device comprises the HSM, or the HSM is provided in another classical computer having at least one processor that processes bits; and
the cryptographic software module runs on the end entity device, or the cryptographic software module runs on another classical computer having at least one processor that processes bits.

3. The system of claim 1 , wherein the first quantum computer and the second quantum computer are identical.

4. The system of claim 1 , wherein the first quantum computer and the second quantum computer are different.

5. The system of claim 1 , wherein each of the first digital signature generation algorithm and the second digital signature generation algorithm is calculated or processed, wholly or at least partially, using the quantum bits by the first quantum computer and the second quantum computer respectively.

6. The system of claim 1 , where the at least one processor is configured to receive the signed data and the second certificate from an end entity device or another device.

7. The system of claim 1 , wherein
the first certificate comprises an Issuing Certificate Authority (ICA) certificate of an ICA;
the first signature is signed by the first quantum computer of a Subordinary Certificate Authority (SCA) or a Root Certificate Authority (RCA); and
the first certificate comprises the second public key.

8. The system of claim 1 , wherein
the first certificate comprises an Subordinary Certificate Authority (SCA) certificate of an SCA;
the first signature is signed by the first quantum computer of a Root Certificate Authority (RCA) or another SCA; and
the first certificate comprises a fourth public key used by the at least one processor to validate a fourth signature on a fourth certificate of the plurality of certificates.

9. The system of claim 1 , wherein
the first certificate comprises a Root Certificate Authority (RCA) certificate of an RCA;
the first signature is signed by the first quantum computer of the RCA; and
the first certificate comprises a fourth public key used by the at least one processor to validate a fourth signature on a fourth certificate of the plurality of certificates.

10. A system, comprising:
at least one memory; and
at least one processor that processes quantum bits, the at least one processor configured to:

generate a first signature on a first certificate of the plurality of certificates by a first quantum computer using a first digital signature generation algorithm based on a first private key, wherein the first signature is validated by a relying party device using a first public key in certificate chain validation, and wherein the first public key and the first private key form a first public/private key pair; and
generate a second signature on a second certificate of the plurality of certificates by a second quantum computer using a second digital signature generation algorithm based on a second private key, wherein the second signature is validated by the relying party device using a second public key in the certificate chain validation, and wherein the second public key and the second private key form a second public/private key pair, wherein
the relying party device uses a third public key in the second certificate to verify a third signature on signed data, and wherein the relying party device comprises a classical computer having at least one processor that processes bits, wherein

the signed data is signed by an end entity device using a third private key of the end entity device;
the third public key and the third private key form a third public/private key pair;
the end entity device comprising a classical computer having at least one processor that processes bits; and
the signed data comprises a message, code, document, file, program, or application signed by the end entity using the third private key.

11. The system of claim 10 , wherein
the at least one processor comprises a first processor of the first quantum computer that processes the quantum bits, wherein the first processor generates the first signature on the first certificate using the first digital signature generation algorithm; and

the at least one processor comprises a second processor of the second quantum computer that processes the quantum bits, wherein the second processor generates the second signature on the second certificate using the second digital signature generation algorithm.

12. The system of claim 11 , wherein each of the first digital signature generation algorithm and the second digital signature generation algorithm is calculated or processed, wholly or at least partially, using the quantum bits by the first quantum computer and the second quantum computer respectively.

13. The system of claim 10 , wherein the at least one processor of a same quantum computer generates the first signature on the first certificate using the first digital signature generation algorithm and the second signature on the second certificate using the second digital signature generation algorithm.

14. The system of claim 10 , wherein
the first certificate comprises an Issuing Certificate Authority (ICA) certificate of an ICA;
the first signature is signed by the at least one processor of a Subordinary Certificate Authority (SCA) or a Root Certificate Authority (RCA); and
the first certificate comprises the second public key.

15. The system of claim 10 , wherein
the first certificate comprises an Subordinary Certificate Authority (SCA) certificate of an SCA;
the first signature is signed by the at least one processor of a Root Cert

Assignees

• Wells Fargo Bank Na

Inventors

• Stapleton Jeffrey J
• Toohey Richard Orlando

Classifications

• H04L9/0877

  using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM] · CPC title

• H04L9/321 Primary

  involving a third party or a trusted authority · CPC title

• H04L9/007

  involving hierarchical structures · CPC title

• H04L9/50

  using hash chains, e.g. blockchains or hash trees · CPC title

• H04L9/3265

  using certificate chains, trees or paths; Hierarchical trust model · CPC title