Method for offloading encryption and decryption of a message received at a message server to remote end devices

• US 20070101133A1
• Filed: 10/27/2005
• Published: 05/03/2007
• Est. Priority Date: 10/27/2005
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: 3Com Corporation (HP Inc.)
• Inventors: Singh, Arun, Poplett, John, Liu, Xiufen
• Granted Patent: US 7,827,398 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

A method for offloading encryption and decryption of a message received at a message server to one or more end devices that are remote from the message server. An encrypting end device remote from the message server encrypts a message using cryptographic context and transmits the cryptographic context and encrypted message to the message server for storage at the message server. The message server stores the encrypted message as received without decrypting the message. The message server sends the stored cryptographic context and the encrypted message to a decrypting end device in response to the decrypting end device sending a request for the message server to transmit the encrypted message to the decrypting end device. The decrypting end device uses the cryptographic context to decrypt the encrypted message and then presents the decrypted message to a user of the decrypting end device.

Claims

1. A method for offloading encryption and decryption of a message received at a message server to one or more end devices remote from the message server, the method comprising:

at a message server, receiving a cryptographic context associated with a message encrypted with the cryptographic context and responsively storing the cryptographic context;

at the message server, receiving the encrypted message and responsively storing the encrypted message;

at the message server, receiving a request for the message server to transmit the encrypted message to a decrypting end device; and

in response to receiving the request, transmitting the cryptographic context and the encrypted message to the decrypting end device, for decryption of the encrypted message by the decrypting end device.

2. The method of claim 1, further comprising:

the message server negotiating to establish a first secure communication path between the message server and an encrypting end device;

establishing the first secure communication path, wherein the cryptographic context is received from the encrypting end device via the first secure communication path;

the message server negotiating to establish a second secure communication path between the message server and the decrypting end device, and

establishing the second secure communication path, wherein transmission of the stored cryptographic context to the decrypting end device occurs via the second secure communication path.

3. The method of claim 2, wherein the first secure communication path comprises a first Transport Layer Security (TLS) secure communication path arranged according to a TLS protocol, and the second secure communication path comprises a second TLS secure communication path arranged according to the TLS protocol.

4. The method of claim 3, further comprising:

the message server using one or more Session Initiation Protocol (SIP) messages to establish a first communication session between the message server and the encrypting end device,

wherein the encrypted message is transmitted to the message server from the encrypting end device using a Secure Real-time Transport Protocol (SRTP) during the first communication session.

5. The method of claim 4, further comprising:

the message server using one or more SIP messages to establish a second communication session between the message server and the decrypting end device,

wherein the stored encrypted message is transmitted to the decrypting end device from the message server using the SRTP during the second communication session.

6. The method of claim 3, further comprising:

the message server using one or more H.323 protocol messages to establish a first communication session between the message server and the encrypting end device,

wherein the encrypted message is transmitted to the message server from the encrypting end device using a Secure Real-time Transport Protocol (SRTP) during the first communication session.

7. The method of claim 6, further comprising:

the message server using one or more H.323 protocol messages to establish a second communication session between the message server and the decrypting end device,

wherein the stored encrypted message is transmitted to the decrypting end device from the message server using the SRTP during the second communication session.

8. The method of claim 2, wherein the encrypting end device creates the encrypted message by encrypting a message according to the cryptographic context.

9. The method of claim 1, further comprising:

the message server encrypting at least a portion of the cryptographic context such that at least a portion of the stored cryptographic context is encrypted by the message server.

10. The method of claim 9, further comprising:

the message server decrypting the at least a portion of the cryptographic context encrypted by the message server.

11. The method of claim 1, further comprising:

the message server (i) establishing a communication session with the decrypting end device, and (ii) verifying that a user of the decrypting end device is allowed to access to the stored encrypted message.

12. The method of claim 1, wherein the encrypted message comprises a voice message arranged as encoded speech.

13. The method of claim 1, wherein the encrypted message comprises a video message.

14. The method of claim 1, wherein the cryptographic context is selected from the group consisting of (i) an encryption/decryption key, (ii) a salt value, and (iii) an encryption scheme identifier.

15. The method of claim 1, wherein the cryptographic context comprises a plurality of encryption/decryption keys, wherein each of the plurality of encryption/decryption keys is associated with the encrypted message.

16. The method of claim 1, further comprising:

the decrypting end device decrypting the encrypted message according to the cryptographic context so as to produce a decrypted version of the encrypted message; and

the decrypting end device presenting the decrypted version of the encrypted message to a user of the decrypting end device.

17. A method for offloading encryption and decryption of a message received at a message server to one or more end devices remote from the message server, the method comprising:

at a message server, receiving, from an encrypting end device via a packet-network, a cryptographic context associated with a message encrypted with the cryptographic context and responsively storing the cryptographic context, wherein the message server and the encrypting end device are coupled to the packet-network;

at the message server, receiving, from the encrypting end device via the packet-network, the message encrypted with the cryptographic context, and responsively storing the encrypted message, wherein storing the encrypted message includes storing the encrypted message as encrypted by the encrypting end device;

at the message server, receiving, from the decrypting end device via the packet-network, a request for the message server to transmit the encrypted message to the decrypting end device, wherein the decrypting end device is coupled to the packet-network; and

in response to receiving the request, transmitting the cryptographic context and the encrypted message to the decrypting end device, for decryption of the encrypted message by the decrypting end device.

18. The method of claim 17, wherein the encrypting end device and the decrypting end device are both Voice over Internet Protocol (VoIP) telephones.

19. A method for offloading encryption and decryption of a message received at a message server to one or more end devices remote from the message server, the method comprising:

a message server negotiating with an encrypting end device to establish a first secure communication path, the first secure communication path being between the message server and the encrypting end device;

at the message server, receiving, via the first secure communication path, a cryptographic context associated with a message encrypted with the cryptographic context, and responsively storing the cryptographic context;

at the message server, receiving the message encrypted with the cryptographic context from the encrypting end device and responsively storing the encrypted message;

the message server negotiating with a decrypting end device to establish a second secure communication path, the second secure communication path being between the message server and the decrypting end device;

at the message server, receiving a request for the message server to transmit the encrypted message to the decrypting end device; and

in response to receiving the request for transmission of the stored encrypted message, transmitting the cryptographic context to the decrypting end device via the second secure communication path and transmitting the encrypted message to the decrypting end device, for decryption of the encrypted message by the decrypting end device.

20. A method for offloading encryption and decryption of a message received at a message server to one or more end devices remote from the message server, the method comprising:

at a message server, receiving a cryptographic context used to encrypt a message in real-time as the message is being created, and responsively storing the cryptographic context;

at the message server, receiving the encrypted message and responsively storing the encrypted message;

at the message server, receiving a request for the message server to transmit the encrypted message to a decrypting end device; and

in response to receiving the request, transmitting the cryptographic context and the encrypted message to the decrypting end device, for decryption of the encrypted message by the decrypting end device.