Efficient Encryption, Escrow and Digital Signatures

• US 20140281485A1
• Filed: 03/13/2013
• Published: 09/18/2014
• Est. Priority Date: 03/13/2013
• Status: Active Grant

• Current Assignee: Payfone Incorporated
• Original Assignee: Authentify, Inc. (Early Warning Services, LLC)
• Inventors: GANESAN, Ravi
• Granted Patent: US 9,148,449 B2
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A network server is operated so as to facilitate legal eavesdropping by receiving, from the first user via a network, a session key (SK) encrypted with a second user'"'"'s public key, k_pubU2, and the SK encrypted with an escrow server'"'"'s (ES) public key, k_pubES. The k_pubU2 key is the public key of the second user asymmetric private/public key pair k_priU2/k_pubU2. The k_pubES key is the public key of the ES asymmetric private/public key pair k_priES/k_pubES. The received SK encrypted with k_pubES is stored. The SK encrypted with k_pubU2 is transmitted to the second user via the network. A message encrypted with the SK is received from one of the first and the second users via the network, stored, and transmitted to the other of the first and the second users via the network.

Claims

1. A method of operating a network server to facilitate legal eavesdropping, comprising:

receiving, from the first user via the network, (i) a session key (SK) encrypted with a second user'"'"'s public key, k_pubU2, which is the public key of asymmetric private/public key pair k_priU/k_pubU2 of the second user and (ii) the SK encrypted with an escrow server'"'"'s (ES) public key, k_pubES, which is the public key of asymmetric private/public key pair k_priES/k_pubES of the ES;

storing the received SK encrypted with k_pubES;

transmitting, to the second user via the network, the received SK encrypted with k_pubU2;

receiving, from one of the first and the second users via the network, a message encrypted with the SK;

storing the received message encrypted with SK; and

transmitting, to the other of the first and the second users via the network, the received message encrypted with the SK.

2. The method of claim 1, further comprising:

transmitting to an authorized eavesdropper the stored SK encrypted with k_pubES and the stored message encrypted with SK.

3. The method of claim 1, wherein the message is a first email or text message, and further comprising:

receiving, from one of the first and the second users via the network, a second email or text message encrypted with the SK;

storing the received second message encrypted with SK; and

transmitting, to the other of the first and the second users via the network, the received second message encrypted with the SK.

4. An article of manufacture for facilitating legal eavesdropping, comprising:

non-transitory storage medium; and

logic stored on the storage medium, wherein the stored logic is configured to be readable by a processor and thereby cause the processor to operate so as to;

receive, from the first user via the network, (i) a session key (SK) encrypted with a second user'"'"'s public key, k_pubU2, which is the public key of asymmetric private/public key pair k_priU2/k_pubU2 of the second user, and (ii) the SK encrypted with an escrow server'"'"'s (ES) public key, k_pubES, which is the public key of asymmetric private/public key pair k_priES/k_pubES of the ES;

direct storage of the received SK encrypted with k_pubES;

direct transmission, to the second user via the network, of the received SK encrypted with k_pubU2;

receive, from one of the first and the second users via the network, a message encrypted with the SK;

direct storage of the received message encrypted with SK; and

direct transmission, to the other of the first and the second users via the network, of the received message encrypted with the SK.

5. The article of manufacture of claim 4, wherein the stored logic is further configured to cause the processor to operate so as to:

direct transmission, to an authorized eavesdropper, of the stored SK encrypted with k_pubES and the stored message encrypted with SK.

6. The article of manufacture of claim 4, wherein the message is a first email or text message, and the stored logic is further configured to cause the processor to operate so as to:

receive, from one of the first and the second users via the network, a second email or text message encrypted with the SK;

direct storage of the received second message encrypted with SK; and

direct transmission, to the other of the first and the second users via the network, of the received second message encrypted with the SK.

7. A network server for facilitating legal eavesdropping, comprising:

a processor configured to receive, from the first user via the network, (i) a session key (SK) encrypted with a second user'"'"'s public key, k_pubU2, which is the public key of asymmetric private/public key pair k_priU2/k_pubU2 of the second user and (ii) the SK encrypted with an escrow server'"'"'s (ES) public key, k_pubES, which is the public key of an asymmetric private/public key pair k_priES/k_pubES of the ES; and

a data store configured to store the received SK encrypted with k_pubES,

wherein the processor is further configured to (a) direct transmission, to the second user via the network, of the received SK encrypted with k_pubU2, and (b) receive, from one of the first and the second users via the network, a message encrypted with the SK;

wherein the data store is further configured to stored the received message encrypted with SK; and

wherein the processor is further configured to direct transmission, to the other of the first and the second users via the network, the received message encrypted with the SK.

8. The network server of claim 7, wherein:

the processor is further configured to direct transmission to an authorized eavesdropper of the stored SK encrypted with k_pubES and the stored message encrypted with SK.

9. The network server of claim 7, wherein:

the message is a first email or text message, and further comprising;

the processor is further configured to receive, from one of the first and the second users via the network, a second email or text message encrypted with the SK;

the data store is further configured to store the received second message encrypted with SK; and

the processor is further configured to direct transmission, to the other of the first and the second users via the network, the received second message encrypted with the SK.

10. A method of operating a user smart communication device to securely communicate email or text messages to another user via a network, comprising:

retrieving, from a network server in the cloud, the other user'"'"'s certificate, where the other user'"'"'s certificate includes k_pubOU, which is the public key of the other user'"'"'s private/public asymmetric key pair k_priOU/k_pubOU;

creating a session key (SK) for securing communications between the user and the other user;

storing the SK;

encrypting the SK with the other user'"'"'s public key, k_pubOU;

transmitting, to the other user via the network server, the encrypted SK;

transmitting, to the other user via the network server, a first email or text message encrypted with the SK;

receiving, from the other user via the network server, a second email or text message encrypted with the SK; and

decrypting the received encrypted second message with the stored SK.

11. A method of operating a user'"'"'s smart communication device, having a touchpad, to graphically and digitally sign messages, comprising:

automatically generating, transparent to the user, a private/public asymmetric key pair, k_priU/k_pubU, for the user, where k_priU is the private key and k_pubU is the public key of the user asymmetric private/public key pair;

transmitting k_pubU to a Certificate Authority (CA) via a network;

receiving, from the CA via the network, a certificate, including k_pubU, signed with a private key, k_priCA, of the CA, where k_priCA is the private key of an asymmetric private/public key pair, i.e. k_priCA/k_pubCA, of the CA;

receiving, from another user via the network, a request to sign a message;

receiving, via the touchpad, a user input corresponding to a graphical signature of the user;

in response to receipt of the user input, automatically digitally signing the message with k_priU; and

transmitting, to the other user via the network, the graphical signature, the digitally signed message and the signed certificate.