Methods and arrangements to enable safe signage

Description

1 / 33 METHODS AND ARRANGEMENTS TO ENABLE SAFE SIGNAGE TECHNICAL FIELD OF THE INVENTION

[01] The invention generally relates to the technical field of security required in the use of digital services between two or more communicating parties. In particular, the invention relates to the task of signaling to a party in such a way as to prevent possible unauthorized observers from discovering the initiator of the signaling. BACKGROUND OF THE INVENTION

[02] In telecommunications, signaling means the use of signals to control communications. Typically, signaling involves the exchange of relatively simple pieces of information for the purpose of establishing and maintaining a connection for communications between two or more communicating parties. The difference between signaling and communications can, in many cases, be described such that communications serve to transfer information of arbitrary payload while signaling serves to ensure that payload information can be transferred as intended. However, this characterization is not universally applicable, as some signaling protocols also include the possibility of using signaling to transmit some limited number of arbitrary bytes that may involve application-related payload data.

[03] A frequently used example of signaling involves the procedures used to make a communication device (and its user) aware that another communication device (and its user) intends to establish an active connection for communications. In telephony, these procedures are briefly described as a user “calling”. As the “called” device initially Petition 870260061607, dated 06 / 23 / 2026, page 5 / 68 2 / 33 is unaware of the incoming call, so the characterization of "waking up" the device is also used. Other examples of signaling include, among others, push messages and triggers designed to cause the target device to perform a desired action, such as providing a status report.

[04] Known signaling procedures, particularly for the purpose of waking up a communication device or making it aware of the need to establish a connection, involve a disadvantage related to digital security. To expedite the establishment of a connection and also provide an intended recipient with the possibility of choosing whether or not to respond, the signaling used to wake up the communication device contains an identifier of the “caller,” that is, the party that took the initial active steps to initiate communications. In short, known forms of signaling allow the called user to see who is calling. If an unauthorized observer has the means to intercept the signaling, they could eventually generate a map of who is communicating with whom. Even under normal conditions, revealing this information to unauthorized parties has its risks.In a state of war or other extreme danger, becoming exposed can be fatal to the communicating parties.

[05] Because the signaling stage occurs right at the beginning of an active connection for communication between the parties, it was considered difficult to protect the signaling stage with reliable cryptographic solutions: only after the first exchange of signals can the parties proceed to a stage of acquiring sufficient public keys or other cryptographic material known to both, to guarantee mutual confidential communication. A natural solution would be Petition 870260061607, dated 06 / 23 / 2026, page 6 / 68 3 / 33 require all devices to preliminarily acquire and maintain the cryptographic keys of all potential partners they may communicate with later, but this would easily lead to impossibly complicated data logistics. Not only would the amount of stored data be large, but it would also have to be constantly updated as new partnerships emerge, old partners become obsolete, and keys expire after a certain interval. SUMMARY OF THE INVENTION

[06] This summary is provided to introduce in a simplified way a selection of concepts that are described further below in the detailed description. This summary is not intended to identify the main or essential features of the claimed subject matter nor is it intended to be used to limit the scope of the claimed subject matter.

[07] It is an objective to provide methods and arrangements to enable secure signaling between devices, such that the signaling does not reveal confidential information to any third-party eavesdropping.

[08] According to a first aspect, a device is provided for initiating signaling to an intended recipient device. The device comprises a cryptographic engine configured to produce cryptoproducts from certain input data and a transceiver configured to establish and maintain communications with remote parties. Said cryptographic engine is configured to use a public key of said intended recipient device and a seed as inputs for a first cryptographic operation to produce a shared secret and an encapsulated element that is an encapsulated form of said shared secret, and to use at least said shared secret and a message as inputs. Petition 870260061607, dated 06 / 23 / 2026, page 7 / 68 4 / 33 for one or more additional cryptographic operations to produce an encrypted message. Said transceiver is configured to use at least said encapsulated element and said encrypted message as information elements of a signaling message and to transmit said signaling message to one of said remote parties for further forwarding to said intended destination device.

[09] According to one embodiment, said cryptographic engine is configured to, as part of said one or more additional cryptographic operations, use a nonce of said shared secret and a salt as inputs to a second cryptographic operation to produce a secret key, and use said message, said secret key and said nonce as inputs to a third cryptographic operation to produce said encrypted message. Said transceiver may then be configured to also use said nonce as an information element of said signaling message. This involves at least the advantage of providing additional security against possible attacks by unauthorized parties who may aim to breach said shared secret.

[010] According to one embodiment, said cryptographic engine is configured to, as part of said one or more additional cryptographic operations, use at least said message as an input for a MAC calculation to produce a MAC value. Said transceiver can then be configured to use said MAC value as an information element of said signaling message. This involves at least the advantage that the receiving device can easily verify the immutability of the received message.

[011] According to one realization, the said cryptographic engine is Petition 870260061607, dated 06 / 23 / 2026, page 8 / 68 5 / 33 is configured to verify, before producing said shared secret and said encapsulated element, whether it possesses a valid form of said public key of said intended recipient device at its disposal. Said cryptographic engine can then be configured to, in response to the finding that it does not possess any valid form of said public key of said intended recipient device at its disposal, use said transceiver to request said valid form of said public key of said intended recipient device from one of said remote parties. This involves at least the advantage that the device can adapt to systems in which keys are only valid for a certain period of validity. Furthermore, the device is also capable of using this type of communication to signal to devices whose essential information elements it does not yet know.

[012] According to one embodiment, said transceiver is configured to check, in response to a detected need to initiate said signaling, whether it has an active connection with a dedicated node between said remote parties. Said transceiver can then be configured to, in response to the finding that it does not have any active connection with a dedicated node between said remote parties, transmit a request to one of said remote parties to establish a dedicated node. This involves at least the advantage that the device is able to utilize those communication modes that pass through dedicated nodes.

[013] According to a second aspect, a device is provided to respond to signaling initiated by an initiator device. The device comprises a cryptographic engine configured to produce cryptoproducts from certain input data, and a Petition 870260061607, dated 06 / 23 / 2026, page 9 / 68 6 / 33 transceiver configured to establish and maintain communications with remote parties. Said transceiver is configured to forward information elements from a received signaling message to said cryptographic engine. Said cryptographic engine is configured to use a locally stored private key and an encapsulated element, said encapsulated element being forwarded as one of said information elements by said transceiver, as inputs for a first decryption operation to decrypt said encapsulated element into a shared secret and to use at least said shared secret and an encrypted message forwarded as one of said information elements by said transceiver as inputs for one or more additional cryptographic operations to decrypt said encrypted message into a message.

[014] According to one embodiment, said cryptographic engine is configured to, as part of said one or more additional cryptographic operations, use said shared secret, a locally stored salt and a nonce forwarded as one of said information elements by said transceiver as inputs to a second decryption operation to produce a secret key and use said secret key, said encrypted message and said nonce as inputs to a third decryption operation to decrypt said encrypted message in said message. This involves at least the advantage of providing additional security against possible attacks by unauthorized parties who might aim to breach said shared secret.

[015] According to one embodiment, said cryptographic engine is configured to, as part of said operation, one or more operations Petition 870260061607, dated 06 / 23 / 2026, page 10 / 68 7 / 33 additional cryptographic methods, use a forwarded MAC value as one of the said information elements by said transceiver as an input to said third decryption operation to decrypt said encrypted message in said message. This involves at least the advantage that the device can easily verify the immutability of the received message.

[016] According to a third aspect, a method is provided for initiating signaling to an intended recipient device. The method comprises using a public key of said intended recipient device and a seed as inputs to a first cryptographic operation to produce a shared secret and an encapsulated element that is an encapsulated form of said shared secret, and using at least said shared secret and a message as inputs to one or more additional cryptographic operations to produce an encrypted message. The method comprises using at least said encapsulated element and said encrypted message as information elements of a signaling message, and transmitting said signaling message to a remote party for further forwarding to said intended recipient device.

[017] According to one embodiment, the method comprises, as part of said one or more additional cryptographic operations, using a nonce, said shared secret and a salt as inputs to a second cryptographic operation to produce a secret key, and using said message, said secret key and said nonce as inputs to a third cryptographic operation to produce said encrypted message. The method may then also comprise using said nonce as an information element of said Petition 870260061607, dated 06 / 23 / 2026, page 11 / 68 8 / 33 signaling message. This involves at least the advantage of providing additional security against possible attacks by unauthorized parties who might aim to breach said shared secret.

[018] According to one embodiment, the method comprises, as part of said one or more additional cryptographic operations, using said message as an input to a MAC calculation to produce a MAC value, and using said MAC value as an information element of said signaling message. This involves at least the advantage that the receiving device can easily verify the immutability of the received message.

[019] According to one embodiment, the method comprises verifying, before producing said shared secret and said encapsulated element, whether a valid form of said public key of said intended recipient device is available. The method may then comprise, in response to the finding that no valid form of said public key of said intended recipient device is available, requesting said valid form of said public key of said intended recipient device from a remote party. This involves at least the advantage that the device can adapt to systems in which keys are only valid for a certain period of validity. Furthermore, the device is able to use this type of communication also to signal to devices that it does not yet know all the essential information elements.

[020] According to one embodiment, the method comprises checking, in response to a detected need to initiate said signaling, whether an active connection to a dedicated node in a remote location is available. The method may then comprise, as a response to Petition 870260061607, dated 06 / 23 / 2026, page 12 / 68 9 / 33 finding that no active connection to a dedicated node in a remote location is available, transmit a request to a remote location to establish a dedicated node. This involves at least the advantage that the device is able to utilize such communication modes that reach the dedicated nodes.

[021] According to a fourth aspect, a method is provided for responding to signaling initiated by an initiating device. The method comprises forwarding the information elements of a received signaling message to a cryptographic engine and using a locally stored private key and an encapsulated element, said encapsulated element being forwarded as one of said information elements, as inputs to a first decryption operation to decrypt said encapsulated element into a shared secret. The method comprises using at least said shared secret and an encrypted message forwarded as one of said information elements as inputs to one or more additional cryptographic operations to decrypt said encrypted message (213) into a message.

[022] According to a fifth aspect, a computer program product is provided comprising one or more sets of one or more machine-executable instructions that are configured so that, when executed by one or more processors, they cause said one or more processors to execute a method of a type described above. BRIEF DESCRIPTION OF THE DRAWINGS

[023] In the drawings:

[024] Figure 1 illustrates a sequence of events between two users Petition 870260061607, dated 06 / 23 / 2026, page 13 / 68 10 / 33 and one or more mediators;

[025] Figure 2 illustrates a method executed by an initiator device;

[026] Figure 3 illustrates a signaling message;

[027] Figure 4 illustrates a method executed by a destination device;

[028] Figure 5 illustrates a sequence of events between two users and one or more mediators;

[029] Figure 6 illustrates a method executed by an initiator device; and

[030] Figure 7 illustrates a device for initiating and receiving signaling. DETAILED DESCRIPTION OF THE INVENTION

[031] In the following description, reference is made to the attached drawings, which form part of the disclosure and in which specific aspects in which the present disclosure can be incorporated are shown by way of illustration. It is understood that other aspects may be used, and structural or logical changes may be made without departing from the scope of the present disclosure. Therefore, the detailed description below should not be understood in a limiting sense, since the scope of the present disclosure is defined as the attached claims.

[032] For example, it is understood that a disclosure in connection with a described method may also be true for a corresponding device or system configured to perform the method, and vice versa. For example, if a specific method step is described, a corresponding device may include a unit to perform the described method step, even if that Petition 870260061607, dated 06 / 23 / 2026, page 14 / 68 11 / 33 unit is not explicitly described or illustrated in the figures. On the other hand, for example, if a specific apparatus is described based on functional units, a corresponding method may include a step that performs the described functionality, even if such a step is not explicitly described or illustrated in the figures. Furthermore, it is understood that the features of the various exemplary aspects described herein may be combined with each other, unless specifically noted otherwise.

[033] Regarding terminology, in this description the term cryptoproduct means the result of a cryptographic operation. Examples of cryptoproducts include, among others, cryptographic keys, key sets, certificates, and digital signatures. Cryptographic operations (or crypto-operations, for short) can also be characterized in many cases as encryption operations or decryption operations. Also regarding terminology, it can be observed that signaling with “z” and signaling with “s” are considered the same here.

[034] Fig. 1 shows an exemplary sequence of events involving user A, user B, and one or more remote parties referred to as mediators. User A's intention is to signal to user B, using a method that would not reveal confidential information to any possible third-party eavesdropper. As a non-limiting example, the purpose of this signaling could be to make user B aware of user A's desire to initiate end-to-end communications, such as a call, and to instruct user B to take the necessary actions to establish these end-to-end communications. Other examples include, but are not limited to, transmitting some simple piece of information to user B; and instructing user B to establish Petition 870260061607, dated 06 / 23 / 2026, page 15 / 68 12 / 33 Additional communication connection at another location.

[035] Step 100 is a preliminary step in which user B communicates with a remote party that could be characterized as a trusted provider. The purpose of step 100 is to establish a digital identity for user B or to update a previously established digital identity of user B. Methods and hardware aspects that can be used for step 100 are, for example, those described in a co-pending patent application EP 22157019.5, although the exact methods and hardware aspects used are of little importance. The only assumption that needs to be made here with reference to step 100 is that, as a result of this, there exists a post-quantum cryptographic certificate of user B. The post-quantum cryptographic certificate may comprise (or from the quantum cryptographic certificate it may be possible to unequivocally derive) a pair of digital cryptographic keys.These can be called the public key and private key of user B, and they are cryptographically linked to each other, so that encryption performed with one of them can only be decrypted with the other. For ideal security, the public key and the private key of user B must be long enough to be quantum secure, meaning that a brute-force attack to break the encryption made with them would take an impractically long time if attempted with a quantum computer.

[036] Using the CRYSTALS-Kyber algorithm as an example, and the Kyber-1024 method in particular, the generation of public and private keys for user B can be represented with the following Golang example: k := kyber.NewKyber1024() Petition 870260061607, dated 06 / 23 / 2026, page 16 / 68 13 / 33 pk, pv := k.KeyGen(*Seed)

[037] Here pk is the public key, pv is the private key, and Seed is a random seed obtained from a source capable of producing random outputs of high cryptographic entropy. The ability to produce this type of random seed is a characteristic feature of arrangements that can be employed as a trust provider.

[038] Step 101 represents actions by user A to initiate signaling. Since user A can actually be a person or a digital automaton that additionally needs a communication device to participate in the process of fig. 1, step 101 can be considered as interaction with the respective communication device with the objective of making it execute the necessary steps to initiate signaling. Returning to the assumption of initiating a call as in the example, if user A is a person, in step 101 user A can use the user interface of a respective communication device to enter or select the name or other identifier of user B as identification of the party to be called.

[039] Step 102 in Fig. 1 is optional in the sense that it pertains only to a particular way of establishing and maintaining point-to-point calls between users as the desired result of signaling. Here it is assumed that these point-to-point calls require a so-called dedicated node on a mediating party, to which the dedicated node of the communicating parties establishes an active connection. Unless users A and B have been recently involved in this point-to-point call, no dedicated node can be assumed to be currently available. In that case, necessary actions are taken in step 102 to ensure that a dedicated node is Petition 870260061607, dated 06 / 23 / 2026, page 17 / 68 14 / 33 available for the intended communications.

[040] Overall, Step 103 represents all such possible interaction steps between user A and one or more mediators aimed at ensuring that user A possesses the necessary information elements about user B to signal to user B, in accordance with the invention. In particular, user A must have user B's public key. User A may use user B's public key to generate, possibly in further cooperation with one or more mediators, one or more so-called one-time-use keys that will only be used for this particular case of signaling. In Step 104, user A uses these one-time-use keys to create a message, encrypt it, and construct a signaling message containing said encrypted message and other information elements. Advantageous methods for generating one-time-use keys, for encrypting a message, and for constructing the signaling message are described in detail later in this text.

[041] In step 105, the constructed signaling message is transmitted from user A to a mediator. It should be noted that the signaling message transmitted in step 105 does not contain any information that would identify user A as its originator. In particular, it is assumed here that user A, unlike typical methods of the previous technique, did not use any private encryption key in constructing the signaling message that would require decryption with a corresponding public key of user A. Namely, since any public key of user A can be assumed to be available to unauthorized third parties as well, that third party could attempt to decrypt the signaling message or some part thereof with a key. Petition 870260061607, dated 06 / 23 / 2026, page 18 / 68 15 / 33 public key of user A. Successful decryption with a public key of user A would then identify user A as the originator of the signaling message, which is undesirable within the scope of the present invention.

[042] The mediator(s) to whom user A transmits the signaling message in step 105 must be able to eventually forward the signaling message to its intended recipient, user B. The manner in which this is accomplished is not important in itself for the present invention. For example, any known message forwarding service may be used, such as the Firebase Cloud Messaging (FCM) service offered by Google, Inc.; Amazon Simple Notification Service offered by Amazon.com, Inc.; Microsoft Azure Notification Hubs offered by Microsoft Corporation; or OneSignal offered by OneSignal, Inc. at the time of writing. The specifications of the message forwarding service used then define the manner in which an identifier of the intended recipient must be derived from the transmitted signaling message.All actions performed by the mediator(s) to receive and forward the signaling message are generally represented by step 106 in Fig. 1. In step 107, the signaling message is eventually received by user B.

[043] Step 108 is optional and represents an acknowledgment transmitted to user A that the signaling message has been forwarded to user B. Whether this acknowledgment is transmitted or not - or whether any forwarding mediator is still capable of transmitting an acknowledgment - depends on the transmission protocols used. Petition 870260061607, dated 06 / 23 / 2026, page 19 / 68 16 / 33

[044] In step 109, user B decrypts the signaling message to read its contents. As described in more detail later in this text, step 109 can involve multiple cryptographic operations, as there may be multiple layers of cryptography involved. For decryption, user B needs – among other things – their own private key, which was previously provided in step 100.

[045] Step 110 is again optional and can involve user B announcing their readiness for whatever intent the signaling was triggered for. For example, if the intent was to establish point-to-point communications through a dedicated node on a broker, in step 110 user B can establish an active connection with such a dedicated node. Since point-to-point communications were the example used here, step 111 in Fig. 1 represents the communications between users A and B as a result of successful signaling.

[046] Fig. 2 shows an example of a detailed form in which a user-initiated device (user A in the example above) can initiate signaling to an intended destination device. While little needs to be assumed about the functional structure or organization of the device, for the sake of unambiguous reference, it is assumed to comprise at least a cryptographic engine configured to produce cryptoproducts from certain input data and a transceiver configured to establish and maintain communications with the remote parties. Of these, Fig. 2 refers particularly to the cryptographic engine.

[047] As shown in the upper part of Fig. 2, the cryptographic engine is configured to use a seed 201 and a public key 202 of the intended recipient as inputs for the first operation of Petition 870260061607, dated 06 / 23 / 2026, page 20 / 68 17 / 33 cryptography 203. In general, the intended recipient can be understood as an intended receiving device, an intended receiving person, or some other intended receiving entity. The actual nature of the intended recipient is not important for the present description, as long as the intended recipient is an entity known and recognized by the trust provider that issued the post-quantum cryptography certificate that served as the source of the public key 202.

[048] The seed 201 must be a random sequence that represents the highest cryptographic entropy possible in practice. The device may comprise a random number generator (RNG) tasked with producing the seed 201. Alternatively, the device may receive the seed from an external source, such as a trusted provider. At the time of writing, sufficient randomness of the seed 201 can be achieved with a seed of 64 bytes in length, for example. For clarity, it should be noted that the seed intended here is not the same seed that was previously used to generate the public and private keys of user B.

[049] The device may have obtained the intended recipient device's public key 202 in several ways. As an example, the device may have requested the intended recipient device's public key 202 from an external trust provider, such as a vault service responsible for storing users' public keys. Vault services of this type can be configured to return a public key of any user known to them as a response to a request containing some type of identifier, such as a hashed user identifier commonly known by the acronym HUId. It is also possible that the device has Petition 870260061607, dated 06 / 23 / 2026, page 21 / 68 18 / 33 the public key 202 of the intended destination device is already stored, for example, if the signaling of the type described here has already been performed previously or if the device has a local storage of public keys of possible destination devices known for other reasons.

[050] As a HUId observation, it is highly recommended to always protect a plaintext user ID with a one-way hash, so that a user ID is not revealed other than between those parties who know it in plaintext. This is a further way of making it more difficult for potential eavesdroppers to identify a party involved in communications, compared to simpler cases where one simply uses a phone number or email address directly to identify a user.

[051] The first encryption operation 203 is preferably of a type that produces, from the inputs provided, both a shared secret 205 and an encapsulated element 206 which is an encapsulated form of said shared secret 205. In Fig. 2, this is illustrated by showing separately an encapsulation part 204 of the first encryption operation.In cryptography, cryptographic operations of this type are generally referred to as Key Encapsulation Mechanisms or KEMs. They offer certain advantages compared to traditional approaches to symmetric key exchange, where a random symmetric key is first generated and subsequently encrypted using a chosen public-key algorithm. Because symmetric keys are usually short, these traditional approaches require padding, with the consequent susceptibilities associated with padding schemes. KEMs simplify the process by generating a single element. Petition 870260061607, dated 06 / 23 / 2026, page 22 / 68 19 / 33 randomly selects a finite group underlying the public key system and derives the symmetric key from hashing that element, eliminating the need for padding. A well-known example of a KEM is the CRYSTALS-Kyber algorithm.

[052] Known applications of KEMs typically require that the parties have previously shared their public keys, which then means that the process cannot be done completely anonymously with respect to the communicating parties. Here, a different approach is proposed, in which the transmitting party uses a public key of the receiving party intended to encapsulate a new randomly generated cryptographic key. The process explained here produces the encapsulated key and a key for use in encryption, of which the encapsulated key will be transmitted to the receiving party.

[053] The dashed arrow from the shared secret 205 to the encapsulation operation shown separately 204 in fig. 2 is a reminder of the fact that different KEMs can work in different ways: there are methods that produce the encapsulated shared secret 206 directly from the inputs, but also methods that first produce a shared secret 205 and therefore only encapsulate it in a subsequent step. For the purposes of this description, it is irrelevant which of these approaches is used, as long as the first encryption operation has other characteristics, as described.

[054] Written in the form of a Golang example, the first encryption operation can be represented as: k := kyber.NewKyber1024() encSS, sharedS := k.Encaps(*receiverPk, *Seed) where sharedS is the shared secret 205 to be Petition 870260061607, dated 06 / 23 / 2026, p. 23 / 68 20 / 33 formed, encSS is the encapsulated element 206 to be formed, receiverPk is the public key 202 of the intended recipient device and Seed is the seed 201.

[055] The cryptographic engine is configured to then use at least the shared secret 205 and a message 211 as inputs for one or more additional cryptographic operations to produce an encrypted message 213. In Fig. 2, these additional cryptographic operations are the second encryption operation 209 and the third encryption operation 212. The elements that the device transceiver then uses as information elements of the signaling message to be constructed include at least the encapsulated element 206 and the encrypted message 213. Once constructed, this signaling message is then transmitted to a remote party for further forwarding to the intended destination device.

[056] In this way, it would be possible to use the shared secret 205 directly as an encryption key in a relatively straightforward cryptographic operation to encrypt message 211 into an encrypted message. Suitable candidates for these cryptographic operations could be, for example, the AES256-GCM or ChaCha20-Poly1305 algorithms. However, this may not be the most advantageous choice, since the shared secret 205 may be susceptible to attacks. For this reason, as part of said additional cryptographic operations, it may be advantageous to perform the shared secret further through a key derivation or hashing function, such as HMAC (hash-based message authentication code), KDF (key derivation function), or SHA (secure hash algorithm), of which there are advantageous forms such as Petition 870260061607, dated 06 / 23 / 2026, page 24 / 68 21 / 33 SHA2_256 or SHA3_256.

[057] As shown in the middle of Fig. 2, the parts of said one or more additional cryptographic operations may be what is here termed the second cryptographic operation 209 and the third cryptographic operation 212. The cryptographic engine may be configured to use a nonce 207, the shared secret 205 described above, and a salt 208 as inputs to the second cryptographic operation 209 to produce the secret key 210. Of these, the nonce 207 is – as its name implies – an arbitrary number that should be used only once in subsequent cryptographic communication, to ensure that old communications cannot be reused in repeated attacks. The salt 208 is here assumed to be an additional cryptographic input, the use of which was previously agreed upon between the possible initiating and responding devices. As an example, the public key 202 of user B may be reused as the salt 208 in Fig.2, but this is just one example, and other ways of using a salt can be presented. One possibility is that no salt is used at this stage, while another possibility is that both a separate salt and the public key 202 of user B are used as cryptographic inputs. Whatever approach is agreed upon, both the transmitting and receiving parties should know in advance, so that it becomes clear in the continuation.

[058] As an exemplary Golang representation of the second cryptographic operation 209, there is: secretK := Hash256(sharedS, keyNonce, keySalt) where secretK is the secret key to be produced, sharedS is the shared secret, keyNonce, and keySalt is the salt. Petition 870260061607, dated 06 / 23 / 2026, page 25 / 68 22 / 33 208 (if used). The length of the 210 secret key can be, for example, 32 bytes, that is, 256 bits.

[059] As shown in the lower part of Fig. 2, the cryptographic engine can be configured to use the message 211, the secret key 210, and the nonce 207 as inputs for the third encryption operation 212 to produce the encrypted message 213. Examples of algorithms that can be used to implement the third encryption operation 212 include, among others, AES256-GCM and ChaCha20Poly1305. A particular advantage of these is that, in addition to the encrypted message, they can produce a so-called MAC value (message authentication code) 214 as an output. Regardless of whether the production of a MAC value is part of some other algorithm or not, it is advantageous in any case if the cryptographic engine is configured to, as part of what has been described above as one or more additional cryptographic operations, use at least the message 211 as an input for a MAC calculation to produce a MAC value 214.

[060] The outputs of the operations shown in Fig. 2 that the device transceiver can use as signaling message information include at least the encapsulated element 206 and the encrypted message 213. As schematically shown in Fig. 3, the signaling message 301 can also contain the MAC value 214 as an information element if the cryptographic engine has been configured to produce one. If a nonce 207 is used as an input for one or more of the cryptographic operations, the transceiver can also be configured to use the nonce 207 as an information element of the signaling message 301.

[061] Fig. 4 shows an example of a detailed form in which the Petition 870260061607, dated 06 / 23 / 2026, page 26 / 68 23 / 33 A receiving user's device (user B in the example above) can decrypt and read a signaling message that an initiating user has prepared using a method, as per Fig. 2. Again, although little needs to be assumed about the functional structure or organization of the device, for the sake of unambiguous reference, it is presumed to comprise at least a cryptographic engine configured to produce cryptoproducts from certain input data and a transceiver configured to establish and maintain communications with the remote parties. Of these, Fig. 4 refers particularly to the cryptographic engine.For the sake of clarity, it can be noted that a cryptoproduct that a cryptographic engine produces from certain input data may be an encrypted version of at least some of the input data if the cryptographic engine is operating in message initiation or construction mode, although a cryptoproduct may be a decrypted version of at least some of the input data if the cryptographic engine is operating in message reception or read mode.

[062] As a prerequisite for the actions shown at the top of Fig. 4, the transceiver of the device described here is configured to forward information elements from a received signaling message to the cryptographic engine. The cryptographic engine, in turn, is configured to use a locally stored private key 401 and the encapsulated element 206 (which was forwarded by one of the information elements by the transceiver) as input for a first decryption operation (referred to as a fourth crypto-operation in Fig. 4) 402 to decrypt the encapsulated element 206 into a shared secret 205. This means that the first operation of Petition 870260061607, dated 06 / 23 / 2026, page 27 / 68 24 / 33 encryption 203 (and 204) in Fig. 2 and the first decryption operation 402 are cryptographically linked: the encapsulation performed by the former can be reversed, that is, decapsulated, by the latter. Since the intended shared secret 205 here is thus the same shared secret that emerged as an output of step 203 in Fig. 2, the decryption of step 402 in Fig. 4 can also be called regeneration of the shared secret. If, according to the example given earlier, the algorithm used in step 203 of Fig. 2 was the Kyber1024 algorithm from the CRYSTALS-Kyber package, the Decapsulate function of the Kyber1024 algorithm can be used in step 402 of Fig. 4, as illustrated in the following Golang example: k := kyber.NewKyber1024() sharedS := k.Decaps(*pv, *encSS) where sharedS is the shared secret to be regenerated by decapsulation, pv is the private key 401, and encSS is the encapsulated element 206.

[063] As shown in the middle and lower parts of Fig. 4, the cryptographic engine is configured to use at least the shared secret 205 and the encrypted message 213 (which was forwarded as one of the information elements by the transceiver) as inputs for one or more additional cryptographic operations to decrypt said encrypted message 213 into a message 211. In the exemplary embodiment of Fig. 4, and in accordance with the example shown earlier in Fig. 2, the cryptographic engine can use the shared secret 205 (regenerated), a locally stored salt 208, and a nonce 207 (which was forwarded as one of the information elements by the transceiver) as Petition 870260061607, dated 06 / 23 / 2026, page 28 / 68 25 / 33 entries for a second decryption operation 209 to produce the secret key. A Golang representation of this operation is the same as step 209 in Fig. 2, that is, secretK := Hash256(sharedS, keyNonce, keySalt)

[064] Subsequently, the cryptographic engine can use said secret key 210 and encrypted message 213 as inputs to a third decryption operation 403 to decrypt said encrypted message 213 into message 211 in the unencrypted text.

[065] It is noteworthy that, in these examples, the second decryption operation 209 is actually the same as the second encryption operation 209 in Fig. 2, only referred to here as a decryption operation to emphasize its role as a step in decrypting the encrypted message 213 in the plaintext form of message 211 in Fig. 4. This similarity of operations is emphasized in Fig. 4 by using the label “second crypto-operation” and the reference designator 209, as in Fig. 2. As previously pointed out, it would not be necessary to use the second encryption operation 209 in Fig. 2 if it were considered sufficient to use the shared secret 205 directly as a key in place of the secret key 210. In that case, the second decryption operation 209 in Fig. 4 could also be omitted. However, as also previously pointed out, from the point of view of sufficient security against attacks, it is preferable to use such an intermediate step at both ends.

[066] The lower part of Fig. 4 also includes using the MAC value 214 (which was routed as one of the information elements by the transceiver) to guarantee the authenticity of message 211. Overall, it can be said that the cryptographic mechanism can be configured to, as Petition 870260061607, dated 06 / 23 / 2026, p. 29 / 68 26 / 33 part of said one or more additional cryptographic operations, use a MAC value 214 forwarded as one of the information elements by the transceiver as an input to a third decryption operation to decrypt said encrypted message 213 to said message 211, or as an input to some general form of MAC checking, wherein the received MAC value is compared to a respective recalculated MAC value of the same input data after receipt. To ensure the unambiguous use of the term “crypto-operation”, the third decryption operation 403 is labeled as the fifth crypto-operation in Fig. 4.

[067] Fig. 5 is essentially a slightly more detailed illustration of the general process shown earlier in Fig. 1, with three of the so-called mediators now named separately as node service(s), a signal service and a vault service. No action corresponding to step 100 of Fig. 1 is shown in Fig.5, although in any case it is assumed that the public and private keys were generated for user B.

[068] The actions of user A's device in Fig. 5 can be read together with the flowchart representation in Fig. 6. Initiation step 101 may correspond to initiation step 601 in Fig. 6. In step 602 of Fig. 6, the device checks, in response to a detected need for signaling, whether an active connection to a dedicated node in a remote area (here: in the node service) is available. In Fig. 6, the dedicated node is referred to as a group node, emphasizing that the purpose of the signaling to be initiated may be to establish so-called cryptogroup relationships between users A and B. As a response to the finding that no active connection to a dedicated node in a remote area is available, Petition 870260061607, dated 06 / 23 / 2026, page 30 / 68 27 / 33 A 501 request can be transmitted to a remote party (here: to the node service) to establish a dedicated node. Sending this request is shown as step 603 in Fig. 6, and the actions taken by the node service to establish the dedicated node are shown as step 502 in Fig. 5. In step 503, the node service returns a node address from the dedicated node to user A's device, and in step 504 in Fig. 5 and step 604 in Fig. 6, an active connection to the dedicated node is established. If, in Fig. 6, the discovery in step 602 was positive, a transition occurs directly to step 604, so that step 604 now only represents ensuring that the connection remains active.

[069] In Fig. 6, an additional check is performed at step 605 regarding whether user B has already been found on the dedicated node. This could be the case if a previous session of active communications with user B ended only very recently, so that another session could be initiated without having to send any actual signaling message of the type described above. Assuming a negative discovery at step 605, a transition to step 606 occurs there, which means initiating a so-called wake-up signal for user B.

[070] Step 607 in Fig. 6 involves verifying, before producing any shared secrets or encapsulated elements, whether a valid form of the intended recipient device's public key is available. As a response to the finding that no valid form of said intended recipient device's public key is available, a transition occurs to step 608 to request a valid form of the intended recipient device's public key from a remote party. In Fig. Petition 870260061607, dated 06 / 23 / 2026, page 31 / 68 28 / 33 Figure 5 shows this request as step 505 and is directed to a mediator called a vault service. This vault service may be the same service with which user B previously communicated to establish a digital identity and generate the public and private keys described earlier in this text. In Figure 5, step 506 represents the vault service responding with a valid form of user B's public key.

[071] Step 507 in Fig. 5 is essentially the same as step 609 in Fig. 6 and involves all those actions whose example was demonstrated and described earlier in this text with reference to Figs. 2 and 3. To recap, these include at least: - Use a seed and a public key from the intended recipient device as inputs for the first encryption operation to produce a shared secret and an encapsulated element that is an encapsulated form of said shared secret; - to use at least the said shared secret and a message as inputs for one or more additional cryptographic operations to produce an encrypted message; and - to use at least the said encapsulated element and the said encrypted message as information elements of a signaling message.

[072] Optionally, these actions may include: - as part of said one or more additional cryptographic operations, use a nonce, said shared secret, and a salt as inputs to the second cryptographic operation to produce the secret key; use said message, said secret key, and said nonce as inputs to the third cryptographic operation. Petition 870260061607, dated 06 / 23 / 2026, page 32 / 68 29 / 33 to produce said encrypted message; and also to use said nonce as an information element of said signaling message.

[073] Optionally, these actions may also include: - as part of said one or more additional cryptographic operations, use said message as an input for a MAC calculation to produce a MAC value; and - use the said MAC value (214) as an information element of the said signaling message (301).

[074] Step 508 in Fig. 5 and step 610 in Fig. 6 represent the transmission of the signaling message produced to a remote party for further forwarding to the intended recipient device. In Fig. 5, this means transmitting the signaling message to a signaling service, which takes care of forwarding it to user B.

[075] Regarding the optional acknowledgment in step 509, an exemplary scenario might be one in which a part of the mediator(s) referred to as a signaling service in Fig. 5 is “internal” in the sense that it knows the identity of user A, while it could also be an “external” service involved, such as the Firebase Cloud Messaging service, for example. In this case, user A and the internal signaling service can apply the TLS protocol in their mutual communications, and the original transmission from user A in step 508 could be an HTTP REQUEST (REST API) to the internal signaling service. According to the protocol, the internal signaling service must respond with an HTTP RESPONSE (REST API), which would be the acknowledgment shown in step 509. The internal signaling service will only transmit the HTTP RESPONSE (REST API) after it has received the information from Petition 870260061607, dated 06 / 23 / 2026, page 33 / 68 30 / 33 Firebase Cloud Messaging service notification that the transmission was successfully routed.

[076] However, it should be noted here that due to the nature of push messages, even at this point there is no certainty that user B actually received the transmission. In the exemplary case considered here, it may happen that user B's device has not updated its FCM token despite a request from the FCM service (or user B has not, as might be a prerequisite, updated said FCM token for the internal signal service), in which case the final delivery of the transmission to user B will not be successful. In practice, user A may have to wait until the timeout on the dedicated node (if one is allocated) to check if user B appears there after having received and decrypted the message properly.

[077] Step 510 in Fig. 5 involves all those actions whose example was demonstrated and described earlier in this text with reference to Figs. 3 and 4. To recap, these include at least: - To forward information elements from a received signaling message to a cryptographic engine; - to use a locally stored private key and an encapsulated element, said encapsulated element being forwarded as one of said information elements, as inputs to the first decryption operation to decrypt said encapsulated element into a shared secret; and - to use at least the said shared secret and an encrypted message (forwarded as one of the said information elements) as inputs for one or more additional cryptographic operations to decrypt the said message. Petition 870260061607, dated 06 / 23 / 2026, page 34 / 68 31 / 33 encrypted in a message.

[078] Fig. 5 is consistent with Fig. 1 in that it is again assumed here that, as a result of successful message decryption, user B's device is prepared for point-to-point communications with user A's device using the dedicated node in the node service as a mediator. In Fig. 5, these communications begin with a so-called ring 511 message from user A and a so-called ring 512 reply message from user B to user A. In Fig. 6, the corresponding steps are steps 612 and 613. If the communications between users A and B did not involve a dedicated node on which user A could have waited for user B to appear, what was said above about the timeout applies to user A waiting until a timeout if user B replies to a ring 511 message with a reply 512 message.

[079] Above, CRYSTALS-Kyber was used as an example of a PQC (post-quantum cryptography) algorithm that defines a key encapsulation method. This is not a limitation, as other key encapsulation methods can be used. An example of another key encapsulation method is ML-KEM (Module Grid-Based Key Encapsulation Mechanism), which is a direct descendant of CRYSTALS-Kyber and standardized by NIST (National Institute of Standards and Technology). Mathematically and in terms of security features, ML-KEM is comparable to CRYSTALS-Kyber, but does not encompass so-called hybrid versions (AES-based hashes).

[080] Any variation or device value provided here can be extended or changed without losing the desired effect. Furthermore, Petition 870260061607, dated 06 / 23 / 2026, page 35 / 68 32 / 33 Any realization may be combined with another realization, except as explicitly prohibited.

[081] Although the subject matter has been described in language specific to structural features and / or actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features or actions described above are disclosed as examples of implementation of the claims, and other equivalent features and actions are intended to be within the scope of the claims.

[082] It will be understood that the benefits and advantages described above may relate to one achievement or may relate to several achievements. Achievements are not limited to those that solve all or any of the stated problems or those that solve all and any of the stated benefits and advantages. It will further be understood that a reference to “one” item may refer to one or more of these items.

[083] The steps of the methods described herein may be performed in any suitable order or simultaneously, when appropriate. Furthermore, individual blocks may be omitted from any of the methods without departing from the spirit and scope of the matter described herein. Aspects of any of the realizations described above may be combined with aspects of any other realizations described to form additional realizations without losing the desired effect.

[084] The term “comprising” is used here to mean including the identified method, blocks or elements, but that these blocks or elements do not comprise an exclusive list and a method or Petition 870260061607, dated 06 / 23 / 2026, page 36 / 68 33 / 33 apparatus may contain additional blocks or elements.

[085] It will be understood that the above description is provided by way of example only and that various modifications may be made by those skilled in the art. The above specification, examples and data provide a complete description of the structure and use of exemplary embodiments. Although various embodiments have been described above with a degree of particularity, or in reference to one or more individual embodiments, those skilled in the art could make various changes to the embodiments disclosed without departing from the spirit or scope of this descriptive report. Petition 870260061607, dated 06 / 23 / 2026, page 37 / 68

Claims

1 / 9 CLAIMS:

1. DEVICE (701) FOR INITIATING SIGNALING TO A INTENDED DESTINATION DEVICE, characterized in that the device comprises: - a cryptographic engine (703) configured to produce cryptoproducts from certain input data, and - a transceiver (704) configured to establish and maintain communications with remote parties;wherein said cryptographic engine (703) is configured to: - use a public key (202) of said intended recipient device and a seed (201) as inputs to a first cryptographic operation (203, 204) to produce a shared secret (205) - use said public key (202) of said intended recipient device and said seed (201) as inputs to said first cryptographic operation (203, 204) to also produce an encapsulated element (206) that is in an encapsulated form of said shared secret (205), and - use at least said shared secret (205) and a message (211) as inputs to one or more additional cryptographic operations (209, 212) to produce an encrypted message (213);and wherein said transceiver (704) is configured to: - use at least said encapsulated element (206) and said encrypted message (213) as information elements of Petition 870260061607, dated 23 / 06 / 2026, page 38 / 68 2 / 9 a signaling message (301), and - transmit said signaling message (301) to one of said remote parties to forward it further towards said intended recipient device.; 2. DEVICE (701), according to claim 1, characterized by: - ​​said cryptographic engine (703) being configured to, as part of said cryptographic operation, perform one or more additional cryptographic operations: - using a nonce (207), said shared secret (205) and a salt (208) as inputs to a second cryptographic operation (209) to produce a secret key (210); and - using said message (211), said secret key (210) and said nonce (207) as inputs to a third cryptographic operation (212) to produce said encrypted message (213); and - said transceiver (704) being configured to also use said nonce (207) as an information element of said signaling message (301).

3. DEVICE (701), according to any one of claims 1 or 2, characterized in that: - said cryptographic engine (703) being configured to, as part of said one or more additional cryptographic operations, use at least said message (211) as an input for a MAC calculation (212) to produce a MAC value (214); and - said transceiver (704) being configured to use said MAC value Petition 870260061607, dated 23 / 06 / 2026, page 39 / 68 3 / 9 (214) as an information element of said signaling message (301).

4. DEVICE (701), according to any of the preceding claims, characterized in that: - said cryptographic engine (703) being configured to check, before producing said shared secret (205) and said encapsulated element (206), whether it possesses a valid form of said public key (202) of said intended recipient device at its disposal; - said cryptographic engine (703) being configured to, in response to the finding that it does not possess any valid form of said public key (202) of said intended recipient device at its disposal, use said transceiver (704) to request (505) said valid form of said public key (202) of said intended recipient device from one of said remote parties.

5. DEVICE (701), according to any of the preceding claims, characterized by: - ​​said transceiver (704) being configured to check, in response to a detected need to initiate said signaling, whether it has an active connection to a dedicated node between said remote parties; and - said transceiver (704) being configured to, in response to the finding that it does not have any active connection to a dedicated node between said remote parties, transmit a Petition 870260061607, dated 23 / 06 / 2026, page 40 / 68 4 / 9 request (501) to one of said remote parties to establish a dedicated node.

6. DEVICE (701) FOR RESPONDING TO SIGNALING INITIATED BY AN INITIATING DEVICE, characterized in that the device comprises: - a cryptographic engine (703) configured to produce cryptoproducts from certain input data; and - a transceiver (704) configured to establish and maintain communications with remote parties; wherein said transceiver (704) is configured to forward the information elements of a received signaling message (301) to said cryptographic engine (703), and wherein said cryptographic engine (703) is configured to: - use a locally stored private key (401) and an encapsulated element (206), said encapsulated element (206) being forwarded as one of said information elements by said transceiver (704), as inputs for a first decryption operation (402) to decrypt said encapsulated element (206) into a shared secret (205);and - use the at least said shared secret (205) and an encrypted message (213) forwarded as one of the said information elements by the said transceiver (704) as inputs to one or more additional cryptographic operations (209, 403) to decrypt the said encrypted message (213) in Petition 870260061607, dated 06 / 23 / 2026, page 41 / 68 5 / 9 a message (211).; 7. DEVICE, according to claim 6, characterized in that said cryptographic engine (703) is configured to, as part of said cryptographic operation, perform one or more additional cryptographic operations: - use said shared secret (205), a locally stored salt (208) and a nonce (207) forwarded as one of said information elements by said transceiver (704) as inputs to a second decryption operation (209) to produce a secret key (210); and - use said secret key (210), said encrypted message (213) and said nonce (207) as inputs to a third decryption operation (403) to decrypt said encrypted message (213) in said message (211).

8. DEVICE, according to claim 7, characterized by: - ​​said cryptographic engine (703) being configured to, as part of said one or more additional cryptographic operations, use a MAC value (214) forwarded as one of said information elements by said transceiver (704) as an input to said third decryption operation (403) to decrypt said encrypted message (213) in said message (211).

9. METHOD FOR INITIATING SIGNALING TO A INTENDED TARGET DEVICE, characterized by the method comprising: Petition 870260061607, dated 06 / 23 / 2026, page 42 / 68 6 / 9 - using a public key (202) of said intended target device and a seed (201) as inputs to said first encryption operation (203, 204) to produce a shared secret (205), - using said public key (202) of said intended target device and said seed (201) as inputs to said first encryption operation (203, 204) to also produce an encapsulated element (206) which is an encapsulated form of said shared secret (205); - use at least the said shared secret (205) and a message (211) as inputs for one or more additional cryptographic operations (209, 212) to produce an encrypted message (213);- use at least the said encapsulated element (206) and the said encrypted message (213) as information elements of a signaling message (301); and - transmit the said signaling message (301) to a remote party for further forwarding to the said intended recipient device.

10. METHOD, according to claim 9, characterized by comprising: as a part of said one or more additional cryptographic operations: - using a nonce (207), said shared secret (205) and a salt (208) with inputs for a second cryptographic operation (209) to produce a secret key (210); and - using said message (211), said secret key (210) and said nonce (207) as inputs for a third cryptographic operation (212) to produce said encrypted message (213); and - also using said nonce (207) as an information element of said signaling message (301).

11. METHOD, according to any one of claims 9 or 10, characterized by comprising: - as a part of said one or more additional cryptographic operations, using said message (211) as an input to a MAC calculation (212) to produce a MAC value (214); and - using said MAC value (214) as an information element of said signaling message (301).

12. METHOD, according to any one of claims 9 to 11, characterized by comprising: - verifying, before producing said shared secret (205) and said encapsulated element (206), whether a valid form of said public key (202) of said intended recipient device is available; - as a response to the finding that no valid form of said public key (202) of said intended recipient device is available, requesting (505) said valid form of said public key (202) of said intended recipient device from a remote party. Petition 870260061607, dated 23 / 06 / 2026, p. 44 / 68 8 / 9 13. METHOD, according to any one of claims 9 to 12, characterized by comprising: - verifying, in response to a detected need to initiate said signaling, whether an active connection to a dedicated node in a remote party is available; and - in response to the finding that no active connection to a dedicated node in a remote party is available, transmitting a request (501) to a remote party to establish a dedicated node.

14. METHOD FOR RESPONDING TO SIGNALING INITIATED BY AN INITIATING DEVICE, characterized by the method comprising: - forwarding the information elements of a received signaling message (301) to a cryptographic engine (703); - using a locally stored private key (401) and an encapsulated element (206), said encapsulated element (206) being forwarded as one of said information elements, as inputs to a first decryption operation (402) to decrypt said encapsulated element (206) into a shared secret (205); and - using at least said shared secret (205) and an encrypted message (213) forwarded as one of said information elements as inputs to one or more additional cryptographic operations (209, 403) to decrypt said encrypted message (213) into a message (211). Petition 870260061607, dated 06 / 23 / 2026, page 45 / 68 9 / 9 15. COMPUTER PROGRAM PRODUCT, characterized by comprising one or more sets of one or more machine-executable instructions that are configured to, when executed by one or more processors, cause said one or more processors to execute a method according to any of claims 9 to 13, or according to claim 14. Petition 870260061607, dated 06 / 23 / 2026, pp. 46 / 68

Images