AUTOMATIC ELECTRONIC MAIL (EMAIL) ENCRYPTION BY EMAIL SERVERS

• US 20190007423A1
• Filed: 06/30/2017
• Published: 01/03/2019
• Est. Priority Date: 06/30/2017
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Apvrille, Axelle
• Granted Patent: US 10,484,397 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity

Abstract

Systems and methods for automated email encryption between email servers are provided. According to one embodiment, an email, originated by a sender using a client device coupled with a private network and directed to a recipient, is received by an email server associated with the private network. A key server is queried for public keys of the recipient and the sender. When the recipient'"'"'s public key is returned by the key server, it is used to encrypt the email message; otherwise, no encryption is performed. When the sender'"'"'s public key does not exist on the key server, the email server automatically generates a temporary key pair for the sender on the fly and without requiring intervention on the part of the sender. Finally, both the email message and the public key of the sender are transmitted by the email server to the recipient.

Claims

1. A method comprising:

receiving, by an electronic mail (email) server associated with a private network, from a client device coupled with the private network, a first email message originated by a local sender using the client device and directed to a remote recipient, wherein the local sender is a first user of a plurality of users associated with the private network and wherein the remote recipient is not a user associated with the private network;

querying, by the email server, one or more key servers for a public key of the remote recipient;

when the public key of the remote recipient is returned by the one or more key servers, then using the public key of the remote recipient by the email server to encrypt the first email message;

when the public key of the remote recipient does not exist, then foregoing encryption of the first email message;

querying, by the email server, the one or more key servers for a public key of the local sender;

when the public key of the local sender does not exist on the one or more key servers, then automatically generating, by the email server, a temporary key pair for the local sender on the fly and without requiring intervention on the part of the local sender, wherein the temporary key pair for the local sender includes the public key of the local sender and a private key of the local sender; and

transmitting, by the email server, both the email message and the public key of the local sender to the remote recipient.

2. The method of claim 1, wherein the temporary key pair comprises a Pretty Good Privacy (PGP) key pair or a GNU Privacy Guard (GPG) key pair.

3. The method of claim 1, wherein said transmitting, by the email server, both the first email message and the public key of the local sender to the remote recipient comprises including the public key of the local sender as an attachment to the first email message.

4. The method of claim 1, further comprising storing, by the email server, the private key of the local sender within a secured storage area accessible by the email server.

5. The method of claim 4, wherein the secured storage area is selected from any or a combination of a secured random access memory (RAM) and an encrypted disk.

6. The method of claim 4, wherein the private key of the local sender is protected by an authentication process.

7. The method of claim 6, wherein the authentication process comprises a biometric authentication.

8. The method of claim 1, further comprising prior to said transmitting, by the email server, both the email and the public key of the local sender to the remote recipient, digitally signing, by the email server, the first email message.

9. The method of claim 1, further comprising:

receiving, by the email server, a second email message from a remote sender and directed to a local recipient, wherein the local recipient is a second user of the plurality of users;

extracting, by the email server, a public key of the remote sender from an attachment associated with the second email message;

storing, by the email server, the public key of the remote sender for future use; and

when the email message is encrypted with a public key of the local recipient, then prior to delivery of the email message to the local recipient, decrypting the email message, by the email server, with a private key of the local recipient.

10. An electronic mail (email) server associated with a private network, the email server comprising:

a non-transitory storage device having embodied therein instructions representing one or more routines; and

one or more processors coupled to the non-transitory storage device and operable to execute the one or more routines to perform a method comprising;

receiving from a client device coupled with the private network a first email message originated by a local sender using the client device and directed to a remote recipient, wherein the local sender is a first user of a plurality of users associated with the private network and wherein the remote recipient is not a user associated with the private network;

querying one or more key servers for a public key of the remote recipient;

when the public key of the remote recipient is returned by the one or more key servers, then using the public key of the remote recipient to encrypt the first email message;

when the public key of the remote recipient does not exist, then foregoing encryption of the first email message;

querying the one or more key servers for a public key of the local sender;

when the public key of the local sender does not exist on the one or more key servers, then automatically generating a temporary key pair for the local sender on the fly and without requiring intervention on the part of the local sender, wherein the temporary key pair for the local sender includes the public key of the local sender and a private key of the local sender; and

transmitting both the email message and the public key of the local sender to the remote recipient.

11. The email server of claim 10, wherein the temporary key pair comprises a Pretty Good Privacy (PGP) key pair or a GNU Privacy Guard (GPG) key pair.

12. The email server of claim 10, wherein said transmitting both the first email message and the public key of the local sender to the remote recipient comprises including the public key of the local sender as an attachment to the first email message.

13. The email server of claim 10, wherein the method further comprises storing the private key of the local sender within a secured storage area accessible by the email server.

14. The email server of claim 13, wherein the secured storage area is selected from any or a combination of a secured random access memory (RAM) and an encrypted disk.

15. The email server of claim 13, wherein the private key of the local sender is protected by an authentication process.

16. The email server of claim 15, wherein the authentication process comprises a biometric authentication.

17. The email server of claim 10, wherein the method further comprises prior to said transmitting both the email and the public key of the local sender to the remote recipient, digitally signing the first email message.

18. The email server of claim 10, wherein the method further comprises:

receiving a second email message from a remote sender and directed to a local recipient, wherein the local recipient is a second user of the plurality of users;

extracting a public key of the remote sender from an attachment associated with the second email message;

storing the public key of the remote sender for future use; and

when the email message is encrypted with a public key of the local recipient, then prior to delivery of the email message to the local recipient, decrypting the email message with a private key of the local recipient.