System and method for secure electronic communication in a partially keyless environment

• US 20040133775A1
• Filed: 06/17/2003
• Published: 07/08/2004
• Est. Priority Date: 01/07/2003
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: PGP Corporation (Gen Digital Inc.)
• Inventors: Callas, Jonathan D., Price, William F. III, Allen, David E.
• Granted Patent: US 7,640,427 B2
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

This present invention provides users with secure transparent electronic communication, allowing them to send and receive encrypted and/or signed messages with little or no user involvement. In various embodiments, the present invention provides a user with e-mail security via automated hierarchical techniques for transparently sending and receiving secure messages, and lowers the burden on administrators. Such a system can also manage cryptographic keys and certificates for the users, and creates such keys and certificates for the users when necessary. A server according to the present invention can intercept unsecured messages from a user, automatically transform those messages into secured messages, and transmit those secure messages to the intended recipients. The server can also automatically transform messages after the recipient sends a digital identity to the server and downloads the software necessary for transforming the secured messages back into readable messages (i.e., from ciphertext into plaintext). The server can further intercept an unsecured message from a user, search for a digital identity of the intended recipient, secure the unsecured message upon finding such a digital identity, and transparently send the secured message to the intended recipient.

Claims

1. A method comprising:

intercepting an unsecured message from a sender;

searching for a digital identity corresponding to a recipient of said unsecured message;

when said digital identity is found, encrypting said unsecured message using a public key for said recipient from said digital identity to create a secure message; and

transmitting said secure message to said recipient;

wherein said server transparently transmits said secure message to a recipient without initial access to a certification authority.

2. A method as in claim 1, wherein said digital identity further comprises a digital certificate.

3. A method as in claim 1, said searching further comprising checking certificates in a local cache.

4. A method as in claim 1, said searching further comprising checking certificates in a local database.

5. A method as in claim 1, said searching further comprising checking certificates in other servers in a local network.

6. A system as in claim 1, said searching further comprising checking certificates in other servers in an open communications network.

7. A method comprising:

intercepting a first message from a sender;

sending a second message to a recipient containing information on how to receive said first message;

receiving a response from said recipient requesting a computer program containing security functionality;

sending said computer program to said recipient;

receiving a digital identity from said recipient;

encrypting said first message into a secure message using a public key for said recipient from said digital identity; and

transmitting said secure message to said recipient.

8. A method comprising:

intercepting an unsecured message from a sender;

automatically creating a secure path between a secure server of said sender and said recipient; and

transmitting said secure message to said recipient over said secure path.

9. A system as in claim 8, wherein said creating a secure path further comprises providing a secure HTTP connection for said recipient to receive messages.

10. A system as in claim 8, wherein said creating a secure path further comprises:

allowing said recipient to choose a passphrase; and

authenticating said passphrase prior to providing said secure message to said user.

11. A system comprising:

a server, further comprising;

a message receive module for receiving an unsecured message from a sender;

a certificate search module for searching for a digital identity corresponding to a recipient of said unsecured message;

a crypto module for encrypting said unsecured message using a public key for said recipient from said digital identity to create a secure message, when said digital identity is found; and

a messages transmit module for transmitting said secure message to said recipient;

wherein said server transparently transmits said secure message to a recipient without initial access to a certification authority.