METHODS AND SYSTEMS FOR AUTHENTICATING ELECTRONIC MESSAGES USING CLIENT-GENERATED ENCRYPTION KEYS

• US 20130166914A1
• Filed: 12/22/2011
• Published: 06/27/2013
• Est. Priority Date: 12/22/2011
• Status: Active Grant

• Current Assignee: Xerox Corporation (Xerox Holdings Corp.)
• Original Assignee: Xerox Corporation (Xerox Holdings Corp.)
• Inventors: VANDERVORT, David Russell
• Granted Patent: US 9,065,842 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Systems and methods for authenticating electronic messages using client-generated encryption keys provide for a sender transmitting an original message to a recipient device that includes a digital signature of the original message content and the key used to generate the digital signature. The sender may store an association between the digital signature, the key, and the recipient'"'"'s address. The recipient may verify the integrity of the original message using the received digital signature and may further verify the authenticity of the message by transmitting a confirmation request message back to the sender that includes the original digital signature and a second digital signature of the confirmation request message using the received key. The sender may either confirm or deny that it sent the original message by determining whether a record exists that associates the digital signature and the key received from the recipient as well as the recipient'"'"'s address.

Claims

1. A computer-implemented method of sending and authenticating an electronic message performed by a sender, the method comprising:

sending a first message to a recipient address associated with a recipient, wherein the first message comprises first content;

storing a record of association between the first content and the recipient address in memory;

receiving a second message from the recipient in response to the first message, wherein the second message comprises a request for confirmation that the sender sent the first content to the recipient; and

in response to the request for confirmation;

locating the record of association between the first content and the recipient address; and

sending a third message to the recipient address, wherein the third message communicates an acknowledgement that the sender sent the first content to the recipient address.

2. The method of claim 1, wherein the first message comprises a digest of the first content.

3. The method of claim 2, wherein the record of association comprises:

the recipient address; and

the digest of the first content.

4. The method of claim 1, wherein the first message comprises a first digital signature of the first content that was generated using a cryptographic key.

5. The method of claim 4, wherein the first message further comprises the cryptographic key.

6. The method of claim 5, wherein the record of association further associates the first content and the recipient address with the first digital signature and the cryptographic key.

7. The method of claim 6, wherein the second message from the recipient further comprises the first digital signature.

8. The method of claim 7, wherein the second message from the recipient further comprises:

second content generated by the recipient;

a second digital signature of the second content that was generated by the recipient using the cryptographic key; and

the cryptographic key.

9. The method of claim 8, wherein the second content generated by the recipient further comprises:

the first digital signature; and

the request for confirmation that the sender sent the first content to the recipient.

10. The method of claim 9, further comprising:

verifying integrity of the second content using the cryptographic key.

11. A computer-implemented method of authenticating an electronic message received by a recipient, the method comprising:

receiving a first message at a recipient address associated with the recipient, wherein the first message comprises first content and a putative sender address from which the first message purportedly originated;

sending a second message to the putative sender address in response to the first message, wherein the second message comprises;

information reflecting the first content; and

a request for confirmation that a sender associated with the putative sender address sent the first content to the recipient; and

determining whether the first message is authentic based on whether a third message is received from the putative sender address acknowledging or repudiating that the sender sent the first content to the recipient.

12. The method of claim 11, wherein:

the first message comprises a digest of the first content; and

the information reflecting the first content in the second message comprises the digest of the first content.

13. The method of claim 11, wherein the first message comprises a first digital signature of the first content that was generated using a cryptographic key.

14. The method of claim 13, wherein the first message further comprises the cryptographic key.

15. The method of claim 14, further comprising:

verifying integrity of the first content using the cryptographic key.

16. The method of claim 14, wherein the information reflecting the first content in the second message comprises the first digital signature.

17. The method of claim 16, wherein the second message further comprises:

second content generated by the recipient;

a second digital signature of the second content that was generated by the recipient using the cryptographic key; and

the cryptographic key.

18. The method of claim 17, wherein the second content comprises:

the first digital signature; and

the request for confirmation that the sender sent the first content to the recipient.

19. The method of claim 11, wherein determining whether the first message is authentic comprises:

receiving a third message from the putative sender address acknowledging that the sender sent the first content to the recipient; and

deeming the first message authentic based on receiving the third message.

20. The method of claim 11, wherein determining whether the first message is authentic comprises:

receiving a third message from the putative sender address repudiating that the sender sent the first content to the recipient; and

deeming the first message non-authentic based on receiving the third message.

21. The method of claim 11, wherein determining whether the first message is authentic comprises:

deeming the first message non-authentic based on receiving no response from the putative sender address in response to the second message within a specified period of time.

22. A system configured to send and authenticate an electronic message from a sender, the system comprising:

a processing system comprising one or more processors; and

a memory system comprising one or more computer-readable media, wherein the one or more computer-readable media contain instructions stored thereon that, if executed by the processing system, cause the system to perform operations comprising;

sending a first message to a recipient address associated with a recipient, wherein the first message comprises first content;

storing a record of association between the first content and the recipient address in the memory system;

receiving a second message from the recipient in response to the first message, wherein the second message comprises a request for confirmation that the sender sent the first content to the recipient; and

in response to the request for confirmation;

locating the record of association between the first content and the recipient address; and

sending a third message to the recipient address, wherein the third message communicates an acknowledgement that the sender sent the first content to the recipient address.

23. A system configured to authenticate an electronic message received by a recipient, the system comprising:

a processing system comprising one or more processors; and

a memory system comprising one or more computer-readable media, wherein the one or more computer-readable media contain instructions stored thereon that, if executed by the processing system, cause the system to perform operations comprising;

receiving a first message at a recipient address associated with the recipient, wherein the first message comprises first content and a putative sender address from which the first message purportedly originated;

sending a second message to the putative sender address in response to the first message, wherein the second message comprises;

information reflecting the first content; and

a request for confirmation that a sender associated with the putative sender address sent the first content to the recipient; and

determining whether the first message is authentic based on whether a third message is received from the putative sender address acknowledging or repudiating that the sender sent the first content to the recipient.