Method and system for dynamic server document encryption

• US 6,061,448 A
• Filed: 04/01/1997
• Issued: 05/09/2000
• Est. Priority Date: 10/24/1996
• Status: Expired due to Term

• Current Assignee: Axway Incorporated (Axway Software SA)
• Original Assignee: Tumbleweed Communications Corporation (Axway Software SA)
• Inventors: Smith, Jeffrey C., Bandini, Jean-Christophe
• Primary Examiner(s): Hayes, Gail O.
• Assistant Examiner(s): SONG, HOSUK
• Application Number:
  US08/829,976
• Time in Patent Office: 1,134 Days
• Field of Search: 380/21, 380/49, 380/23, 380/25, 379/201, 340/825.31, 340/825.34, 709/223, 709/224, 709/229
• US Class Current: 380/282
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]

Abstract

A method and system are provided for secure document delivery over a wide area network, such as the Internet. A sender directs a Delivery Server to retrieve an intended recipient'"'"'s public key. The Delivery Server dynamically queries a certificate authority and retrieves the public key. The public key is transmitted from the Delivery Server to the sender. The sender encrypts the document using a secret key and then encrypts the secret key using the public key. Both encrypted document and encrypted secret key are uploaded to the Delivery Server, and transmitted to the intended recipient. The intended recipient then uses the private key associated with the public key to decrypt the secret key, and uses the secret key to decrypt the document. In an alternative, equally preferred embodiment of the invention, the sender uses the public key to encrypt the document. In yet another embodiment, the server transmits the document to the Delivery Server for encryption.

Claims

1. A method for secure document delivery from a sender over a wide area network, comprising the steps of:

a sender encrypting a document using a secret key;

the sender contacting a Delivery Server to query a public key associated with an intended recipient;

the Delivery Server dynamically retrieving the public key in real time from a certificate authority;

the Delivery Server transmitting the public key back to the sender;

the sender encrypting the secret key with the public key; and

the sender transmitting the encrypted document and the encrypted secret key to the Delivery Server for transmission to the recipient.

2. The method of claim 1, further comprising the step of the recipient decrypting the secret key using a private key.

3. The method of claim 2, further comprising the step of the recipient decrypting the document using the secret key.

4. The method of claim 1, wherein the sender encrypts the document prior to receiving the public key from the Delivery Server.

5. The method of claim 1, wherein the sender encrypts the document subsequent to receiving the public key from the Delivery Server.

6. The method of claim 1, wherein the wherein the document is one of a contiguous collection of data, a stream of data, a video, audio data, an animation, a formatted document, or a database.

7. The method of claim 1, further comprising the step of the sender forwarding the address of the intended recipient and document delivery instructions to the Delivery Server.

8. The method of claim 1, wherein the wide area network is the Internet.

9. The method of claim 1, wherein the recipient is one of a desktop computer, a printer, a fax machine, a personal digital assistant, or a network computer device.

10. The method of claim 1, wherein the sender is one of a desktop computer, an Internet browser device, an Internet telephone device, or a network computer device.

11. The method of claim 1, wherein the database server dynamically retrieves the public key from one of a certificate authority, an Internet server, personal digital assistant, the intended recipient'"'"'s desktop computer, or from an intranet server connected to the intended recipient'"'"'s desktop computer.

12. A method for secure document delivery from a sender over a wide area network, comprising the steps of:

a sender contacting a Delivery Server to query a public key associated with an intended recipient of a document;

the Delivery Server dynamically retrieving the public key in real time from a certificate authority;

the Delivery Server transmitting the public key back to the sender;

the sender encrypting the document with the public key; and

the sender transmitting the encrypted document to the Delivery Server for transmission to the recipient.

13. The method of claim 12, further comprising the step of the recipient decrypting the document using a private key.

14. The method of claim 12, wherein the recipient is one of a desktop computer, a printer, a fax machine, a personal digital assistant, or a network computer device.

15. The method of claim 12, wherein the sender is one of a desktop computer, an Internet browser device, an Internet telephone device, or a network computer device.

16. The method of claim 12, wherein the database server dynamically retrieves the public key from one of a certificate authority, an Internet server, personal digital assistant, the intended recipient'"'"'s desktop computer, or from an intranet server connected to the intended recipient'"'"'s desktop computer.

17. A method for secure document delivery from a sender over a wide area network, comprising the steps of:

a sender contacting a Delivery Server to query a public key associated with an intended recipient;

the Delivery Server dynamically retrieving the public key in real time from a certificate authority;

the sender transmitting the document to the Delivery Server;

the Delivery Server encrypting the document with a secret key and encrypting the secret key with the public key; and

the Delivery Server transmitting the encrypted secret key and the encrypted document to the intended recipient.

18. The method of claim 17, further comprising the step of the recipient decrypting the secret key using a private key.

19. The method of claim 18, further comprising the step of the recipient decrypting the document using the secret key.

20. The method of claim 17, wherein the recipient is one of a desktop computer, a printer, a fax machine, a personal digital assistant, or a network computer device.

21. The method of claim 17, wherein the sender is one of a desktop computer, a network computer device, an Internet browser device, an Internet telephone device, or a fax machine.

22. The method of claim 17, wherein the database server dynamically retrieves the public key from one of a certificate authority, an Internet server, personal digital assistant, the intended recipient'"'"'s desktop computer, or from an intranet server connected to the intended recipient'"'"'s desktop computer.

23. The method of claim 17, further comprising the step of:

dynamically generating a public key at said Delivery Server where said recipient does not have a public key at the time of said retrieval.

24. The method of claim 23, said dynamic generating step further comprising the steps of:

forwarding a message to said recipient, the reading of which retrieves a module that constructs a private/public key pair on said recipient'"'"'s system.

25. The method of claim 24, said dynamic generating step further comprising the step of:

forwarding said public key from said recipient'"'"'s system to said Delivery Server.

26. A system for secure document delivery from a sender over a wide area network, comprising:

a Delivery Server for querying a public key associated with an intended recipient at the direction of a sender, the Delivery Server dynamically retrieving the public key in real time from a certificate authority and transmitting the public key back to the sender;

the sender for encrypting a document using a secret key, the sender encrypting the secret key with the public key and the sender transmitting the encrypted document and the encrypted secret key to the Delivery Server for transmission to the intended recipient.

27. The system of claim 26, further comprising:

means for decrypting the secret key by the recipient using a private key; and

means for decrypting the encrypted document using the secret key.