SECURITY MEASURES FOR COUNTERING UNAUTHORIZED DECRYPTION

• US 20090313705A1
• Filed: 05/12/2009
• Published: 12/17/2009
• Est. Priority Date: 05/12/2008
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Jackson, Eli Omen, Manchur, Lee Willis, Manea, Alexandru-Radu, Gandhi, Shivangi Anantrupa, Adams, Neil Patrick, Brown, Michael Kenneth, Bender, Christopher Lyle
• Granted Patent: US 9,112,732 B2
• Time in Patent Office: Days
• US Class Current: 726/30
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 2463/062 applying encryption of the keys
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 51/58 Message adaptation for wireless communication
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

After a predetermined limit for decryption attempts has been exceeded by a user attempting to decrypt an encrypted electronic message or attempting to decrypt a encrypted electronic certificate associated with an electronic message, access to the electronic message may be restricted.

Claims

1. A method of managing a plurality of electronic messages, said method comprising:

receiving an electronic message and a session key, said electronic message encrypted with said session key, said session key encrypted with a passphrase;

receiving a request to access said electronic message;

receiving a candidate passphrase;

arranging an attempt to decrypt said session key with said passphrase;

determining that said attempt has resulted in a failure;

incrementing a count of failed decryption attempts;

determining that said count of failed decryption attempts exceeds a predetermined limit for decryption attempts; and

restricting access to said electronic message.

2. The method of claim 1 wherein said restricting comprises erasing said electronic message.

3. The method of claim 2 further comprising sending a notification to a sender of said electronic message, wherein said notification indicates that said passphrase was not entered correctly.

4. The method of claim 2 wherein said restricting comprises:

identifying a sender of said electronic message;

identifying additional messages from said sender; and

erasing said additional messages.

5. The method of claim 4 wherein said additional messages are stored locally on a device on which said method is carried out.

6. The method of claim 2 wherein said restricting comprises:

identifying additional messages related to said electronic message; and

erasing said additional messages.

7. The method of claim 2 wherein said restricting comprises erasing said plurality of electronic messages.

8. The method of claim 1 wherein said restricting comprises prohibiting forwarding of said electronic message.

9. The method of claim 1 wherein said restricting comprises prohibiting replying to said electronic message.

10. The method of claim 1 wherein said restricting comprises disallowing copying of any portion of said electronic message.

11. The method of claim 1 further comprising storing said plurality of messages on a device on which said method is carried out.

12. The method of claim 11 wherein said restricting comprises disabling channels by which said electronic message may be copied from said device.

13. The method of claim 11 wherein said restricting comprises locking said device.

14. The method of claim 13 further comprising:

receiving a further passphrase;

successfully authenticating said further passphrase; and

unlocking said device.

15. The method of claim 14 further comprising, responsive to said unlocking, setting to zero said count of failed decryption attempts.

16. The method of claim 1 wherein said electronic message is an electronic mail message.

17. The method of claim 1 wherein said electronic message is an instant messaging message.

18. The method of claim 1 wherein said electronic message is a Short Messaging Service message.

19. The method of claim 1 wherein said electronic message is a Multimedia Messaging Service message.

20. The method of claim 1 wherein said electronic message is a peer-to-peer message.

21. The method of claim 20 wherein said peer-to-peer message is a PIN message.

22. The method of claim 1 wherein said attempt to decrypt said session key produces a result and said determining that said attempt has resulted in a failure comprises determining whether said result has a predetermined format.

23. A mobile communication device comprising:

a processor adapted to;

receive an electronic message and a session key, said electronic message encrypted with said session key, said session key encrypted with a passphrase;

receive a request to access said electronic message;

receive a candidate passphrase;

arrange an attempt to decrypt said session key with said candidate passphrase;

determine that said attempt has resulted in a failure;

increment a count of failed decryption attempts;

determine that said count of failed decryption attempts exceeds a predetermined limit for decryption attempts; and

restrict access to said electronic message.

24. A computer-readable medium containing computer-executable instructions that, when performed by a processor in a mobile communication device, cause said processor to:

receive an electronic message and a session key, said electronic message encrypted with said session key, said session key encrypted with a passphrase;

receive a request to access said electronic message;

receive a candidate passphrase;

arrange an attempt to decrypt said session key with said candidate passphrase;

determine that said attempt has resulted in a failure;

increment a count of failed decryption attempts;

determine that said count of failed decryption attempts exceeds a predetermined limit for decryption attempts; and

restrict access to said electronic message.

25. A method of managing a plurality of electronic messages, the method comprising:

receiving an electronic message, an electronic certificate and a session key, said electronic certificate encrypted with said session key, said session key encrypted with a passphrase;

receiving a request to access said electronic certificate;

receiving a candidate passphrase;

arranging an attempt to decrypt said session key with said candidate passphrase;

determining that said attempt has resulted in a failure;

incrementing a count of failed decryption attempts;

determining that said count of failed decryption attempts exceeds a predetermined limit for decryption attempts; and

restricting access to said electronic message.