Managing Data Encryption During System Upgrades - Red Hat Patent

ChangeBridge: Patent Grants - Networking (H04L)

Published April 7th, 2026

Detected April 8th, 2026

Summary

The USPTO granted Patent US12598065B2 to Red Hat, Inc. covering a system for managing data encryption during system upgrades. The patent contains 20 claims related to detecting component upgrades on computing devices with encrypted data, deactivating links between PCR values and decryption keys prior to boot, provisioning alternative network server links for key authorization, and updating PCR values post-boot.

View original document View source feed page

What changed

The USPTO issued Patent US12598065B2 to Red Hat, Inc. inventors Yuval Kashtan, David Elie-Dit-Cosaque, and James Ramsay for a system managing data encryption during system upgrades. The patent addresses secure decryption key handling when platform configuration register values change during component upgrades, using alternative network server provisioning to authorize key access during boot processes.

Technology companies developing secure boot systems, encryption management software, or system upgrade technologies may need to assess whether their products or services implicate this patent. Competitors in enterprise software, cloud infrastructure, or cybersecurity sectors should review this grant for potential licensing implications or freedom-to-operate concerns.

What to do next

Monitor for updates

Source document (simplified)

← USPTO Patent Grants

Managing data encryption during system upgrades

Grant US12598065B2 Kind: B2 Apr 07, 2026

Assignee

Red Hat, Inc.

Inventors

Yuval Kashtan, David Elie-Dit-Cosaque, James Ramsay

Abstract

A system can be provided for managing data encryption during system updates. For example, the system can detect an upgrade to a component of a computing device that includes encrypted data. In response to detecting the upgrade and prior to a boot process the system can deactivate a link between a set of platform configuration register (PCR) values and a decryption key usable to decrypt the encrypted data. The system can further authorize access to the decryption key during the boot process by provisioning an alternative link between a network server and the decryption key. Additionally, subsequent to the boot process, the system can update the set of PCR values and link the updated set of PCR values and the decryption key.