Method and apparatus for effecting secure document format conversion

• US 6,151,675 A
• Filed: 07/23/1998
• Issued: 11/21/2000
• Est. Priority Date: 07/23/1998
• Status: Expired due to Term

• Current Assignee: Axway Incorporated (Axway Software SA)
• Original Assignee: Tumbleweed Software Corporation
• Inventors: Smith, Jeffrey C.
• Primary Examiner(s): Swann, Tod R.
• Assistant Examiner(s): Smithers, Matthew
• Application Number:
  US09/122,619
• Time in Patent Office: 852 Days
• Field of Search: 380/18, 379/88.22, 707/512, 709/246, 713/150, 713/153, 713/200
• US Class Current: 713/153
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2211/008 Public Key, Asymmetric Key, Asymmetric Encryption
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A method and apparatus is provided for effecting secure document delivery in any of various document formats. A document is encrypted with the public key of a server associated with the recipient of the document, instead of with the public key of the intended recipient. The receiving server is located within a firewall. The encrypted document is forwarded to the server within the firewall. The server decrypts the document using its corresponding private key, converts the document to a new data representation, and then either forwards the document to the recipient inside the firewall, or re-encrypts the document with the public key of an intended recipient outside of the firewall or with the public key of another server that is associated with the intended recipient of the document.

Claims

1. A method for effecting secure document delivery in any of a plurality of document formats, the method comprising:

encrypting said document with a public key of a server associated with a recipient of the document, wherein said server is located within a firewall;

forwarding said encrypted document to said server within said firewall;

decrypting said document with said server using said server'"'"'s corresponding private key;

converting said document to a new data representation;

forwarding said document to said recipient; and

reencrypting said document with, a public key of said recipient, wherein said recipient is located outside of said firewall.

2. A method for effecting secure document delivery in any of a plurality of document formats, the method comprising:

encrypting said document with a public key of a server associated with a recipient of the document, wherein said server is located within a firewall;

forwarding said encrypted document to said server within said firewall;

decrypting said document with said server using said server'"'"'s corresponding private key;

converting said document to a new data representation;

forwarding said document to said recipient; and

reencrypting said document with a public key of a remote server, wherein said remote server is associated with said recipient.

3. A method for effecting secure document delivery in any of a plurality of document formats, the method comprising:

encrypting said document with a public key of a server associated with a recipient of the document, wherein said server is located within a firewall;

forwarding said encrypted document to said server within said firewall;

decrypting said document with said server using said server'"'"'s corresponding private key;

converting said document to a new data representation;

forwarding said document to said recipient;

sending a public key from said recipient to said server via a network;

reencrypting said converted document using said recipient'"'"'s public key;

sending said encrypted, converted document via said network to said recipient; and

decrypting said encrypted, converted document received by said recipient with said recipient'"'"'s private key;

wherein said encrypted document is initially decrypted and converted in a secure, private network behind said firewall; and

wherein said converted document is reencrypted before it is sent to said recipient, which is located outside of said secure environment established by said firewall.

4. A method for effecting secure document delivery in any of a plurality of document formats, the method comprising:

encrypting said document with a public key of a server associated with a recipient of the document, wherein said server is located within a firewall;

forwarding said encrypted document to said server within said firewall;

decrypting said document with said server using said server'"'"'s corresponding private key;

converting said document to a new data representation;

forwarding said document to said recipient;

reencrypting said converted using a public key of a remote server;

sending said converted, encrypted document via a network to said remote server;

wherein said remote server is located in a secure environment behind a firewall associated with said remote server;

decrypting said encrypted, converted document at said remote server with a remote server private key; and

forwarding said converted document to said recipient.

5. A method for effecting secure document delivery in any of a plurality of document formats, the method comprising:

encrypting said document;

forwarding said encrypted document to a server within said firewall;

decrypting said document with said server;

converting said document to a new data representation;

forwarding said document to a recipient; and

reencrypting said document prior to forwarding to said recipient, wherein said recipient is located outside of said firewall.

6. A method for effecting secure document delivery in any of a plurality of document formats the method comprising:

encrypting said document;

forwarding said encrypted document to a server within said firewall;

decrypting said document with said server;

converting said document to a new data representation;

forwarding said document to a recipient; and

reencrypting said document prior to forwarding to a remote server;

wherein said remote server is located behind an associated firewall; and

wherein said remote server is associated with said recipient.

7. A method for effecting secure document format conversion, the method comprising:

sending a document having a high level representation to a recipient;

intercepting said document at a secure server and performing document format conversion in a secure environment established by said server; and

forwarding said converted document to a recipient in a secure fashion, within any of said server'"'"'s secure environment or via a secure delivery technique which includes;

reencrypting said document after it is converted; and

forwarding said encrypted, converted document directly to said recipient.

8. A method for effecting secure document format conversion, the method comprising:

sending a document having a high level representation to a recipient;

intercepting said document at a secure server and performing document format conversion in a secure environment established by said server; and

forwarding said converted document to a recipient in a secure fashion, within any of said server'"'"'s secure environment or via a secure delivery technique which includes;

reencrypting said document after it is converted; and

forwarding said encrypted, converted document to a secure server associated with said recipient.

9. An apparatus for effecting secure document delivery in any of a plurality of document formats, the apparatus comprising:

means for encrypting said document with a public key of a server associated with a recipient of the document wherein said server is located within a firewall;

means for forwarding said encrypted document to said server within said firewall;

means for decrypting said document with said server using said server'"'"'s corresponding private key;

means for converting said document to a new data representation;

means for forwarding said document to said recipient; and

means for reencrypting said document with a public key of said recipient, wherein said recipient is located outside of said firewall.

10. An apparatus for effecting secure document delivery in any of a plurality of document formats, the apparatus comprising:

means for encrypting said document with a public key of a server associated with a recipient of the document, wherein said server is located within a firewall;

means for forwarding said encrypted document to said server within said firewall;

means for decrypting said document with said server using said server'"'"'s corresponding private key;

means for converting said document to a new data representation;

means for forwarding said document to said recipient; and

means for reencrypting said document with a public key of a remote server, wherein said remote server is associated with said recipient.

11. An apparatus for effecting secure document delivery in any of a plurality of document formats, the apparatus comprising:

means for encrypting said document with a public key of a server associated with a recipient of the document, wherein said server is located within a firewall;

means for forwarding said encrypted document to said server within said firewall;

means for decrypting said document with said server using said server'"'"'s corresponding private key;

means for converting said document to a new data representation;

means for forwarding said document to said recipient;

means for sending a public key from said recipient to said server via a network;

means for reencrypting said converted document using said recipient'"'"'s public key;

means for sending said encrypted, converted document via said network to said recipient; and

means for decrypting said encrypted, converted document received by said recipient with said recipient'"'"'s private key;

wherein said encrypted document is initially decrypted and converted in a secure, private network behind said firewall; and

wherein said converted document is reencrypted before it is sent to said recipient, which is located outside of said secure environment established by said firewall.

12. An apparatus for effecting secure document delivery in any of a plurality of document formats, the apparatus comprising:

means for encrypting said document with a public key of a server associated with a recipient of the document, wherein said server is located within a firewall;

means for forwarding said encrypted document to said server within said firewall;

means for decrypting said document with said server using said server'"'"'s corresponding private key;

means for converting said document to a new data representation;

means for forwarding said document to said recipient;

means for reencrypting said converted using a public key of a remote server;

means for sending said converted, encrypted document via a network to said remote server;

wherein said remote server is located in a secure environment behind a firewall associated with said remote server;

means for decrypting said encrypted, converted document at said remote server with a remote server private key; and

means for forwarding said converted document to said recipient.

13. An apparatus for effecting secure document delivery in any of a plurality of document formats, the apparatus comprising:

means for encrypting said document;

means for forwarding said encrypted document to a server within said firewall;

means for decrypting said document with said server;

means for converting said document to a new data representation;

means for forwarding said document to a recipient; and

means for reencrypting said document prior to forwarding to said recipient, wherein said recipient is located outside of said firewall.

14. An apparatus for effecting secure document delivery in any of a plurality of document formats, the apparatus comprising:

means for encrypting said document;

means for forwarding said encrypted document to a server within said firewall;

means for decrypting said document with said server;

means for converting said document to a new data representation;

means for forwarding said document to a recipient, and

means for reencrypting said document prior to forwarding to a remote server;

wherein said remote server is located behind an associated firewall; and

wherein said remote server is associated with said recipient.

15. An apparatus for effecting secure document format conversion, the apparatus comprising:

means for sending a document having a high level representation to a recipient;

means for intercepting said document at a secure server and performing document format conversion in a secure environment established by said server; and

means for forwarding said converted document to a recipient in a secure fashion, within any of said server'"'"'s secure environment or via a secure delivery mechanism which includes;

means for reencrypting said document after it is converted; and

means for forwarding said encrypted, converted document directly to said recipient.

16. An apparatus for effecting secure document format conversion, the apparatus comprising:

means for sending a document having a high level representation to a recipient;

means for intercepting said document at a secure server and performing document format conversion in a secure environment established by said server; and

means for forwarding said converted document to a recipient in a secure fashion, within any of said server'"'"'s secure environment or via a secure delivery mechanism which includes;

means for reencrypting said document after it is converted; and

means for forwarding said encrypted, converted document to a secure server associated with said recipient.