System and method for securing data

• US 20050244007A1
• Filed: 11/09/2004
• Published: 11/03/2005
• Est. Priority Date: 04/30/2004
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Research In Motion Limited (Blackberry Limited)
• Inventors: Brown, Michael S, Hammell, Jonathan F., Brown, Michael K., Little, Herbert A., Adams, Neil P, Kirkup, Michael G
• Granted Patent: US 8,130,957 B2
• Time in Patent Office: Days
• US Class Current: 380/270
• CPC Class Codes: G06F 16/81 Indexing, e.g. XML tags; Data structures therefor; Storage structures
• CPC Class Codes: H04L 51/066 Format adaptation, e.g. format conversion or compression
• CPC Class Codes: H04L 51/58 Message adaptation for wireless communication
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/0478 applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic

Abstract

In accordance with the teachings described herein, systems and methods are provided for securing data for transmission to a wireless device. The disclosed systems and methods may include an electronic messaging system used to send and receive data over a first network and also used to forward data to a wireless device operable in a second network. The electronic messaging system may receive an electronic message encrypted with a first encryption algorithm and addressed to a message recipient in the first network, the message recipient having an associated wireless device operable in the second network. The electronic messaging system may determine that the electronic message is to be transported across the second network to the wireless device, and in response to determining that the electronic message is to be transported across the second network, encrypt the electronic message using a second encryption algorithm and transmit the encrypted message over the second network to the wireless device, with the second encryption algorithm being a stronger encryption algorithm than the first encryption algorithm.

Claims

1. In an electronic messaging system operable to send and receive electronic messages over a first network and also operable to redirect electronic messages over a second network to a wireless device, a method of encrypting electronic messages comprising:

receiving an electronic message that is protected by a first encryption algorithm and addressed to a message recipient in the first network, the message recipient having an associated wireless device operable in the second network;

determining that the electronic message is to be transported across the second network to the wireless device; and

in response to determining that the electronic message is to be transported across the second network, encrypting the electronic message using a second encryption algorithm and transmitting the encrypted message over the second network to the associated wireless device, the second encryption algorithm being a more secure security method than the first encryption algorithm.

2. The method of claim 1, wherein the second encryption algorithm is a symmetric algorithm.

3. The method of claim 2, wherein the second encryption algorithm is an AES-256 encryption algorithm.

4. The method of claim 1, wherein the first encryption algorithm is a Triple DES encryption algorithm.

5. The method of claim 1, further comprising:

retrieving a public encryption key for the message recipient, wherein the public encryption key is used by the second encryption algorithm.

6. The method of claim 5, wherein the public encryption key is received from a certificate authority.

7. The method of claim 5, further comprising:

decrypting the electronic message on the associated device using a private encryption key.

8. The method of claim 1, further comprising:

storing the electronic message on the wireless device in encrypted form; and

decrypting the electronic message on the wireless device when the electronic message is accessed by an electronic messaging application.

9. The method of claim 1, further comprising:

determining if the received electronic message is a classified message or an unclassified message; and

encrypting the received electronic message using the second encryption algorithm only if the received electronic message is a classified message.

10. The method of claim 1, wherein the first network is a local area network and the second network is a wireless network.

11. In an electronic messaging system having an electronic messaging server that is operable to send and receive data over a local area network (LAN) and over a wide area network (WAN), wherein the electronic messaging server and the LAN are isolated from the WAN by a firewall, a system for securing data for transmission to a wireless device, comprising:

a public key look-up database for storing public encryption keys associated with a plurality of wireless devices;

an enterprise server operable to forward electronic messages from the electronic messaging server over a wireless network to a wireless device;

the enterprise server being further operable to receive an electronic message from the electronic messaging system that is protected by a first encryption algorithm and that is designated for delivery to the wireless device, access a public encryption key from the public key look-up database that is associated with the wireless device, and encrypt the electronic message using the public encryption key and a second encryption algorithm, the second encryption algorithm providing more protection than the first encryption algorithm.

12. The system of claim 11, wherein the second encryption algorithm is a symmetric algorithm.

13. The system of claim 12, wherein the second encryption algorithm is an AES-256 encryption algorithm.

14. The system of claim 11, wherein the enterprise server is further operable to communicate with a certificate authority over the WAN to negotiate the public encryption key for the wireless device and to store the public encryption key in the public key look-up database.