Cryptographic system with methods for user-controlled message recovery
First Claim
1. A system for providing public key cryptography including assistance in recovery of messages sent to users, the method comprising:
- a first key pair generated for a particular user, the first key pair comprising a public key employed for encrypting messages sent to the particular user and comprising a private key employed for decrypting messages which have been encrypted using the public key of the first key pair;
a second key pair generated for message recovery, the second key pair comprising a public key employed for recovering messages which have been encrypted using the public key of the first key pair and comprising a private key employed for decrypting messages which have been encrypted using the public key of the second key pair;
information referencing the public key of the second key pair embedded within the public key of the first key pair; and
an encryption module automatically employing the public key of the second key pair during encryption of the message under the public key of the first key pair so that the message being encrypted can be directly decrypted using the private key of the second key pair.
5 Assignments
0 Petitions
Accused Products
Abstract
A cryptosystem is described which automatically provides an extra “message recovery” recipient(s) when an encrypted message is generated in the system. The system is typically configured such that the extra recipient or “message recovery agent” (MRA)—an entity which itself has a public key (i.e., a MRA public key)—is automatically added, under appropriate circumstances, as a valid recipient for an encrypted message created by a user. In a corporate setting, for example, the message recovery agent is the “corporate” message recovery agent designated for that company (firm, organization, or other group) and the user is an employee (or member) of that company (or group). In operation, the system embeds a pointer (or other reference mechanism) to the MRA public key into the public key of the user or employee, so that encrypted messages sent to the company'"'"'s employees from outside users (e.g., those individuals who are not employees of the company) can nevertheless still be recovered by the company. Alternatively, the MRA public key itself can be embedded within the public key of the employee or user (i.e., a key within a key), but typically at the cost of increasing the storage requirement of the user'"'"'s key. By including in the user'"'"'s key (e.g., an employee) a pointer to a message recovery agent'"'"'s key (or the MRA key itself), the system provides a mechanism for assisting a user outside a group (e.g., a user who is outside a particular company) with the task of including in an automatic and non-intrusive manner the key of an additional recipient, such as one intended for message recovery.
-
Citations
32 Claims
-
1. A system for providing public key cryptography including assistance in recovery of messages sent to users, the method comprising:
-
a first key pair generated for a particular user, the first key pair comprising a public key employed for encrypting messages sent to the particular user and comprising a private key employed for decrypting messages which have been encrypted using the public key of the first key pair; a second key pair generated for message recovery, the second key pair comprising a public key employed for recovering messages which have been encrypted using the public key of the first key pair and comprising a private key employed for decrypting messages which have been encrypted using the public key of the second key pair; information referencing the public key of the second key pair embedded within the public key of the first key pair; and an encryption module automatically employing the public key of the second key pair during encryption of the message under the public key of the first key pair so that the message being encrypted can be directly decrypted using the private key of the second key pair. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. In a computer system providing public key cryptography, a method for assisting with recovery of messages sent to users, the method comprising:
-
generating a first key pair for a particular user, the first key pair comprising a public key employed for encrypting messages sent to the particular user and comprising a private key employed for decrypting messages which have been encrypted using the public key of the first key pair; generating a second key pair for message recovery, the second key pair comprising a public key employed for recovering messages which have been encrypted using the public key of the first key pair and comprising a private key employed for decrypting messages which have been encrypted using the public key of the second key pair; embedding within the public key of the first key pair information referencing the public key of the second key pair; and automatically employing the public key of the second key pair during encryption of the message under the public key of the first key pair so that the message being encrypted can be directly decrypted using the private key of the second key pair. - View Dependent Claims (12, 13, 14, 15, 16, 17, 18, 19, 20, 21)
-
-
22. A public key encryption system integrating a message recovery key, comprising:
-
a session encryption module block-cipher encrypting a plaintext message into cyphertext using a session key; a public key encryption module encrypting the session key using a public key of a user, the public key of the user being associated with a private key generated simultaneously thereto and encrypting the session key using a public key of a message recovery agent automatically triggered upon use of the public key of the user, the public key of the message recovery agent being associated with a private key generated simultaneously thereto; a digital envelope forming an encrypted message comprising the cyphertext and the encrypted session key; a reference stored into the public key of the user to automatically use the public key of the message recovery agent upon use of the public key of the user; a pointer to the public key of the message recovery agent embedded as the reference into the public key of the user; and at least one of a cryptographic hash and a message digest of the pointer stored as the reference to the public key of the message recovery agent. - View Dependent Claims (23, 24, 25, 26)
-
-
27. A method for integrating a message recovery key into a public key encryption system, comprising:
-
block-cipher encrypting a plaintext message into cyphertext using a session key; encrypting the session key using a public key of a user, the public key of the user being associated with a private key generated simultaneously thereto; encrypting the session key using a public key of a message recovery agent automatically triggered upon use of the public key of the user, the public key of the message recovery agent being associated with a private key generated simultaneously thereto; forming an encrypted message comprising the cyphertext and the encrypted session key; providing a reference into the public key of the user to automatically use the public key of the message recovery agent upon use of the public key of the user; embedding a pointer to the public key of the message recovery agent as the reference into the public key of the user; and storing the reference as at least one of a cryptographic hash and a message digest of the pointer to the public key of the message recovery agent. - View Dependent Claims (28, 29, 30, 31, 32)
-
Specification