Mechanism for efficient private bulk messaging

• US 20010055396A1
• Filed: 02/26/2001
• Published: 12/27/2001
• Est. Priority Date: 02/24/2000
• Status: Active Grant

• Current Assignee: Mailgate, LLC
• Original Assignee: Tumbleweed Communications Corporation (Axway Software SA)
• Inventors: Jevans, David
• Granted Patent: US 6,912,285 B2
• Time in Patent Office: Days
• US Class Current: 380/282
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]

Abstract

Secure bulk messaging mechanism in which, roughly described, a sender first encrypts a message once. The message can be decrypted with a message decryption key. These can be symmetric or asymmetric keys. For each recipient, the sender then encrypts the message decryption key with the recipient'"'"'s public key. The sender then sends the encrypted message and the encrypted message decryption keys to a store-and-forward server. Subsequently, one or more recipients connect to the server and retrieve the encrypted message and the message encryption key that has been encrypted with the recipient'"'"'s public key. Alternatively, the server can forward these items to each individual recipient. The recipient then decrypts the encrypted message decryption key with the recipient'"'"'s private key, resulting in an un-encrypted message decryption key. The recipient then decrypts the message using the un-encrypted message decryption key.

Claims

1. A method for transmitting a message, comprising the steps of

encrypting said message to develop an encrypted message, said encrypted message being decryptable using a first decryption key;

encrypting said first decryption key with encryption keys of a plurality of target recipients, to develop a plurality of encrypted decryption keys; and

transmitting said encrypted message and said encrypted decryption keys to said target recipients.

2. A method according to

claim 1

, wherein said step of encrypting said message comprises the step of encrypting said message with a symmetric encryption algorithm.

3. A method according to

claim 1

, wherein said step of encrypting said message comprises the step of encrypting said message with an asymmetric encryption algorithm.

4. A method according to

claim 1

, wherein said step of encrypting said first decryption key, with respect to a first one of said target recipients, comprises the step of encrypting said first decryption key with a symmetric encryption algorithm.

5. A method according to

claim 1

, wherein said step of encrypting said first decryption key, with respect to a first one of said target recipients, comprises the step of encrypting said first decryption key with an asymmetric encryption algorithm.

6. A method according to

claim 1

, wherein said step of encrypting said first decryption key, with respect to a first one of said target recipients, comprises the steps of:

encrypting said decryption key with a key of an additional party, to develop a partially encrypted decryption key; and

encrypting said partially encrypted decryption key with the key of said first target recipient.

7. A method according to

claim 1

, wherein said step of transmitting comprises the step of broadcasting said encrypted message and said encrypted decryption keys to a plurality of listeners, not all of which are members of said plurality of target recipients.

8. A method according to

claim 1

, wherein said step of transmitting comprises the steps of:

sending said encrypted message to a server; and

said server forwarding said encrypted message to each of said target recipients.

9. A method according to

claim 8

, wherein said step of transmitting further comprises the step of sending said encrypted decryption keys to one of said target recipients bypassing said server.

10. A method according to

claim 8

, wherein said step of transmitting further comprises the step of sending said encrypted decryption keys to said server.

11. A method according to

claim 10

, further comprising the step of sending to said server an additional encrypted decryption key, encrypted with a key of an additional target recipient, after said step of sending said encrypted decryption keys to said server.

12. A method according to

claim 10

, further comprising the step of deleting or changing one of said encrypted decryption keys on said server after said step of sending said encrypted decryption keys to said server.

13. A method according to

claim 10

, further comprising the step of sending to said server a digital signature covering at least one of said encrypted decryption keys.

14. A method according to

claim 10

, further comprising the step of sending to said server a digital signature covering all of said encrypted decryption keys.

15. A method for receiving a message, comprising the steps of:

receiving an encrypted message, said encrypted message being decryptable using a first decryption key;

receiving in conjunction with said encrypted message a plurality of encrypted decryption keys for said encrypted message;

decrypting a particular one of said encrypted decryption keys to recover said first decryption key; and

decrypting said encrypted message using said first decryption key.

16. A method according to

claim 15

, wherein said step of decrypting a particular encrypted decryption key comprises the steps of:

decrypting said encrypted decryption key with a key of a first party, to develop a partially decrypted decryption key; and

decrypting said partially decrypted decryption key with a key of a second party.

17. A method according to

claim 15

, wherein said step of receiving an encrypted message comprises the step of receiving said encrypted message from a server.

18. A method according to

claim 17

, wherein said step of receiving a plurality of encrypted decryption keys comprises the step of receiving said plurality of encrypted decryption keys bypassing said server.

19. A method according to

claim 17

, wherein said step of receiving a plurality of encrypted decryption keys comprises the step of accessing said server, said plurality of encrypted decryption keys being stored on said server.

20. A method according to

claim 17

, wherein said step of receiving a plurality of encrypted decryption keys comprises the step of a user accessing said server, said plurality of encrypted decryption keys being stored on said server in conjunction with said encrypted message, said server permitting access to only those messages stored thereon for which said user is a target recipient.

21. A method according to

claim 15

, further comprising the step of downloading said encrypted message from said server prior to said step of decrypting said encrypted message using said first decryption key.

22. Apparatus including at least one computer readable storage medium, said apparatus carrying data comprising:

an encrypted message, said encrypted message being decryptable using a first decryption key; and

a plurality of encrypted decryption keys stored in conjunction with said encrypted message, each of said encrypted decryption keys including said first decryption key encrypted with an encryption key of a respective target recipient of said message.

23. Apparatus according to

claim 22

, wherein one of said target recipients is a monitor.

24. Apparatus according to

claim 22

, wherein said data further comprises a digital signature protecting at least a portion of said encrypted decryption keys.