MESSAGE ARCHIVAL ASSURANCE FOR ENCRYPTED COMMUNICATIONS

• US 20080019530A1
• Filed: 05/30/2006
• Published: 01/24/2008
• Est. Priority Date: 05/30/2006
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Kern, David S., Eldridge, Alan D.
• Application Number:
  US11/420,986
• Publication Number:
  US 20080019530A1
• Time in Patent Office: Days
• US Class Current: 380/286
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 9/16 the keys or algorithms being changed during operation

Abstract

Embodiments of the present invention address deficiencies of the art in respect to encrypted message management in an archival environment, and provide a novel and non-obvious method, system and computer program product for message archival assurance. In one embodiment of the invention, a message archival assurance method can be provided that can include receiving an encrypted message designated for receipt by a messaging client; determining whether the encrypted message is decryptable using one of a set of a bulk keys accessible by the messaging system; and, archiving and forwarding the encrypted message to the messaging client only if the encrypted message is decryptable using one of a set of bulk keys accessible by the messaging system and otherwise discarding the encrypted message.

Claims

1. In a messaging system, a message archival assurance method comprising:

receiving an encrypted message designated for receipt by a messaging client;

determining whether the encrypted message is decryptable using one of a set of a bulk keys accessible by the messaging system; and

,

archiving and forwarding the encrypted message to the messaging client only if the encrypted message is decryptable using one of a set of bulk keys accessible by the messaging system and otherwise discarding the encrypted message.

2. The method of claim 1, further comprising, responsive to determining that the encrypted message is not decryptable using an archival key accessible by the messaging system, obtaining a key from the messaging client able to decrypt the encrypted message, adding the obtained key to a set of bulk keys for the messaging system, and archiving and forwarding the encrypted message to the messaging client.

3. The method of claim 2, wherein obtaining a key from the messaging client able to decrypt the encrypted message, comprises:

forwarding an encrypted set of bulk keys associated with the encrypted message to the messaging client;

receiving a decrypted one of the set of bulk keys associated with the encrypted message from the messaging client; and

,

adding the decrypted one of the set of bulk keys to the bulk keys accessible by the messaging system.

4. The method of claim 3, wherein receiving a decrypted one of the set of bulk keys associated with the encrypted message from the messaging client, comprises:

receiving a re-encrypted one of the set of bulk keys using a public form of an archival key for the messaging system; and

,

decrypting the re-encrypted one of the set of bulk keys using a private form of the archival key for the messaging system.

5. The method of claim 4, further comprising:

decrypting the encrypted message to produce a decrypted message; and

,

validating the decrypted message.

6. The method of claim 2, wherein obtaining a key from the messaging client able to decrypt the encrypted message, comprises:

receiving a selected bulk data key encrypted with a public form of an archival key for the messaging system; and

,

verifying that the encrypted selected bulk data key is marked as decryptable by a private form of the archival key for the messaging system.

7. A messaging data processing system comprising:

a messaging system configured for coupling to a plurality of messaging clients;

a message archive coupled to the messaging system;

a plurality of bulk data keys accessible by the messaging system for decrypting archived messages in the message archive; and

,

message archival assurance logic comprising program code enabled to determine whether a received encrypted message is decryptable using one of the bulk data keys and to archive and forward the encrypted message to a designated one of the messaging clients only if the encrypted message is decryptable using one of a the bulk keys and to otherwise discard the encrypted message.

8. A computer program product comprising a computer usable medium having computer usable program code for message archival assurance in a messaging system, the computer program product including:

computer usable program code for receiving an encrypted message designated for receipt by a messaging client;

computer usable program code for determining whether the encrypted message is decryptable using one of a set of a bulk keys accessible by the messaging system; and

,

computer usable program code for archiving and forwarding the encrypted message to the messaging client only if the encrypted message is decryptable using one of a set of bulk keys accessible by the messaging system and otherwise discarding the encrypted message.

9. The computer program product of claim 8, further comprising computer usable program code for obtaining a key from the messaging client able to decrypt the encrypted message, adding the obtained key to a set of bulk keys for the messaging system, and archiving and forwarding the encrypted message to the messaging client, in response to determining that the encrypted message is not decryptable using an archival key accessible by the messaging system.

10. The computer program product of claim 9, wherein the computer usable program code for obtaining a key from the messaging client able to decrypt the encrypted message, comprises:

computer usable program code for forwarding an encrypted set of bulk keys associated with the encrypted message to the messaging client;

computer usable program code for receiving a decrypted one of the set of bulk keys associated with the encrypted message from the messaging client; and

,

computer usable program code for adding the decrypted one of the set of bulk keys to the bulk keys accessible by the messaging system.

11. The computer program product of claim 10, wherein the computer usable program code for receiving a decrypted one of the set of bulk keys associated with the encrypted message from the messaging client, comprises:

computer usable program code for receiving a re-encrypted one of the set of bulk keys using a public form of an archival key for the messaging system; and

,

computer usable program code for decrypting the re-encrypted one of the set of bulk keys using a private form of the archival key for the messaging system.

12. The computer program product of claim 11, further comprising:

computer usable program code for decrypting the encrypted message to produce a decrypted message; and

,

computer usable program code for validating the decrypted message.

13. The computer program product of claim 9, wherein the computer usable program code for obtaining a key from the messaging client able to decrypt the encrypted message, comprises:

computer usable program code for receiving a selected bulk data key encrypted with a public form of an archival key for the messaging system; and

,

computer usable program code for verifying that the encrypted selected bulk data key is marked as decryptable by a private form of the archival key for the messaging system.