Microsoft's New Patent Gives Aging Devices a Second Identity to Block Future Hackers
Quantum computers may one day crack the secret ID baked into your devices at the factory. Microsoft's patent application describes a way to swap in a new, safer ID after the device is already out in the world.
What Microsoft's two-identity device patent does
Ever bought a lock, then found out years later that thieves had learned to pick that exact model? That is the worry behind this filing. Every connected device gets a unique digital ID in the factory, and future quantum computers could be able to break the math that protects it.
Microsoft's answer is to give a device two identities from the start. The first is an ordinary ID used for everyday connections. Later, a firmware update (a software update for the device's built-in code) teaches the device to talk in a way quantum computers can't crack. The device then proves who it is to a server using the second ID, and the server proves itself back.
Once that works, the old ID can be locked away for good, so no one can steal it and pose as your device.
… receiving and installing, by the device, a firmware upgrade that provides the device an ability to communicate in a post-quantum (PQ) secure (PQS) manner …
Translation: The gadget downloads software that protects it against future quantum computer attacks.
How a device swaps its old ID for a new one
The claims cover a sequence. A device first signs in to a server using its legacy identity (the ID set at the factory). It then receives and installs a firmware upgrade that lets it communicate in a post-quantum secure way (using math believed to hold up against quantum computers). Next it opens a protected channel to a second server and mutually authenticates, meaning each side proves who it is to the other, using a separate post-quantum identity. Only after that succeeds do the two exchange data.
The filing adds several optional layers:
- The device checks the server's certificate and proof before sending its own, so a fake server can't trick it into handing over its new ID.
- The device can start with a temporary hash-based key (a one-time ID built from standard scrambling math) and then create a long-term identity once the server is verified.
- The ID can be tied to a leaf of a Merkle tree (a branching structure of hashes), so the server stores only one root value instead of a key for every device.
The description says these IDs sit in a trusted platform module (a dedicated security chip). The legacy ID can be disabled using a small hardware fuse, and one claimed variation does this only when biometric data, such as a fingerprint or face scan, shows an authorized user is physically present.
… mutually authenticating, by the device and with the second server, using a PQ identity (PQI) of the device, the PQI different from the legacy identity …
Translation: The device and server verify each other using a brand new quantum safe ID.
Why quantum-safe security starts with old hardware
The practical problem is that devices shipped today will still be in use when quantum computers arrive, and the standards for quantum-safe security are still being finalized. This filing describes a way to ship hardware now and add the protection later through an update. That matters for anything long-lived, such as office equipment, servers, and connected devices that can't easily be replaced.
The filing also tackles a tricky detail: a device should never reveal its new ID to a fake server. For now it is only an application, and the examiner's first review rejected the claims as filed, which is routine at this stage and usually followed by amendments. It does not describe a shipping Microsoft product.
Microsoft's 529th filing in our Microsoft coverage since May adds to a pattern that includes catching phishing emails as images and sharpening blurry game graphics.
Claim 1 is broad. It needs only five steps: sign in with an old ID, install an update, open a protected channel to a second server, prove identity both ways with a different new ID, then talk. It names no specific encryption method and no particular type of device.
That breadth is the interesting part. If granted as written, it could cover almost any upgrade path where an already-deployed gadget moves from a factory ID to a separate quantum-safe ID. The details that make the design safer, like the fuse, the fingerprint check and the Merkle tree, appear only in the dependent claims.
The examiner's first rejection fits that picture. A claim this general is likely to be narrowed. Bottom line: the idea is sensible and timely, and the final scope will depend on how much of the detailed machinery Microsoft has to write back into claim 1.
Get our take in your Top Stories
Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time Microsoft patent news breaks.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
6 drawing sheets from US 2026/0322594 A1 · click any drawing to enlarge
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →
Be the first to weigh in