GENERALIZED CERTIFICATE USE IN POLICY-BASED SECURE MESSAGING ENVIRONMENTS

• US 20170126665A1
• Filed: 01/14/2017
• Published: 05/04/2017
• Est. Priority Date: 03/13/2013
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Dixon, Bret W.
• Granted Patent: US 9,948,634 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Within a secure messaging environment, a determination is made that a request to send a message has been generated by a message sender. A message protection policy configured to process the message within the secure messaging environment is identified. The message protection policy specifies that, within the secure messaging environment, a secured digital certificate, other than a digital certificate of the message sender, is configured with an associated private key to digitally sign the message on behalf of the message sender. Based upon the message protection policy, a determination is made to digitally sign the message using the private key of the secured digital certificate. The message is signed on behalf of the message sender using the private key of the secured digital certificate.

Claims

1. A method, comprising:

determining, within a secure messaging environment, that a request to send a message has been generated by a message sender;

identifying a message protection policy configured to process the message within the secure messaging environment, where the message protection policy specifies that, within the secure messaging environment, a secured digital certificate, other than a digital certificate of the message sender, is configured with an associated private key to digitally sign the message on behalf of the message sender;

determining, based upon the message protection policy, to digitally sign the message using the private key of the secured digital certificate; and

signing the message on behalf of the message sender using the private key of the secured digital certificate.

2. The method of claim 1, further comprising protecting, by the secure messaging environment, the secured digital certificate against access by the message sender.

3. The method of claim 1, where the secured digital certificate comprises at least one of:

a digital certificate assigned to a secure messaging component within the secure messaging environment; and

a digital certificate managed by the secure messaging component within the secure messaging environment.

4. The method of claim 3, where the secure messaging component comprises one of a queue manager within the secure messaging environment and a data protection module within the secure messaging environment that interfaces with the queue manager.

5. The method of claim 1, where the message protection policy further specifies that the secured digital certificate is configured to digitally sign messages on behalf of a plurality of message senders, and further comprising:

signing messages of the plurality of message senders using the private key of the secured digital certificate.