Hostage system and method for intercepting encryted hostile data

• US 6,721,424 B1
• Filed: 08/19/1999
• Issued: 04/13/2004
• Est. Priority Date: 08/19/1999
• Status: Expired due to Fees

• Current Assignee: Cybersoft, Inc.
• Original Assignee: Cybersoft, Inc.
• Inventors: Radatti, Peter V.
• Primary Examiner(s): Peeso, Thomas R.
• Application Number:
  US09/377,311
• Time in Patent Office: 1,699 Days
• Field of Search: 713/171, 713/189, 713/193, 713/200, 713/201, 380/286
• US Class Current: 380/286
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

A method for intercepting data transmissions in a system which is comprised of an external network and computers within a protected local network. A proxy server located in the communication path, between the external network and the computers, is equipped with virus detection capability and includes, also, key storage means and a hostage storage facility. If the proxy server determines that an incoming transmission from the external network contains hostile data, a key is obtained from the key storage means so as to decrypt the transmission. If no such key is available, the proxy server prevents the data transmission from entering the protected network and stores the data transmission as “hostage data” within the hostage storage facility until the intended user provides the proxy server with a key capable of decrypting the hostage data transmission.

Claims

1. A method for enforcing encryption key escrow in a protected network, comprising:

providing a server having a first connection to an external source of data, a second connection with the protected network, and a key escrow means;

monitoring said first connection for a data transmission intended for a destination within the protected network at the server;

determining whether the data transmission includes encrypted data; and

if said data transmission includes encrypted data, determining whether an encryption key for decrypting said data is stored in the key escrow means; and

preventing further transmission of the data transmission to the destination unless an encryption key associated with the destination is provided to the key escrow means.

2. The method of claim 1, further comprising:

storing said data transmission until the encryption key is provided to the key escrow means;

retrieving said data transmission upon receipt of the encryption key;

decrypting said data transmission using the encryption key;

determining whether the data transmission includes hostile data; and

transmitting said data transmission to the destination of the data transmission does not include hostile data.

3. The method of claim 1, which further comprises:

generating an e-mail message to a user at the intended destination; and

requesting said user to provide an appropriate user'"'"'s key for decrypting said data transmission.

4. The method of claim 3, which further comprises storing said user'"'"'s key in said key escrow means once decryption has been accomplished.