Secure message system with remote decryption service

• US 7,698,745 B2
• Filed: 07/30/2007
• Issued: 04/13/2010
• Est. Priority Date: 09/25/2003
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Voltage Security Incorporated (HP Inc.)
• Inventors: Kacker, Rishi R., Appenzeller, Guido, Pauker, Matthew J., Spies, Terence, Ryan, Lucas C.
• Primary Examiner(s): SMITHERS, MATTHEW
• Application Number:
  US11/888,290
• Publication Number:
  US 20080049937A1
• Time in Patent Office: 988 Days
• Field of Search: 726/27, 713/165, 380/270
• US Class Current: 726/27
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/3073 involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing

Abstract

Systems and methods for secure messaging are provided. A sender may encrypt content and send the encrypted content to a recipient over a communications network. The encrypted content may be decrypted for the recipient using a remote decryption service. Encrypted message content may be placed into a markup language form. Encrypted content may be incorporated into the form as a hidden form element. Form elements for collecting recipient credential information such as username and password information may also be incorporated into the form. At the recipient, the recipient may use the form to provide recipient credential information to the remote decryption service. The recipient may also use the form to upload the encrypted content from the form to the decryption service. The decryption service may provide the recipient with access to a decrypted version of the uploaded content over the communications network.

Claims

1. A method for providing recipients with access to message content in a system in which a sender sends a message having encrypted message content in at least one image tag to a recipient over a communications network, comprising:

at the recipient, receiving the message that has the encrypted message content in the image tag;

at the recipient, uploading the image tag including the encrypted message content to a remote decryption service over the communications network; and

at the decryption service, decrypting the encrypted message content from the image tag and providing access to the decrypted message content to the recipient over the communications network.

2. The method defined in claim 1 further comprising:

at the sender, placing the encrypted message content into a plurality of image tags; and

at the sender, sending the plurality of image tags to the recipient in the message.

3. The method defined in claim 1 wherein the image tag comprises a GIF image tag, the method further comprising:

at the sender, placing the encrypted message content into the GIF image tag; and

at the sender, sending the GIF image tag to the recipient in the message.

4. The method defined in claim 1 further comprising:

at the sender, placing the encrypted message content into a plurality of GIF image tags; and

at the sender, sending the plurality of GIF image tags to the recipient in the message.

5. The method defined in claim 1 further comprising:

at the sender, placing the encrypted message content into a plurality of GIF image tags; and

at the sender, sending the plurality of GIF image tags to the recipient in the message, wherein each GIF image tag includes a message identifier that is associated with the message.

6. The method defined in claim 1 further comprising:

at the sender, placing the encrypted message content into a plurality of GIF image tags; and

at the sender, sending the plurality of GIF image tags to the recipient in the message, wherein;

receiving the message at the recipient comprises receiving the plurality of GIF image tags in the message;

uploading to the remote decryption service comprises uploading the plurality of GIF image tags in the message to the decryption service; and

decrypting the encrypted message content comprises decrypting the encrypted message content from the plurality of uploaded GIF image tags.

7. The method defined in claim 1 further comprising:

at the sender, encrypting the message content with an IBE public key to produce the encrypted message content;

at the sender, placing the encrypted message content into a plurality of image tags;

at the sender, sending the plurality of image tags to the recipient in the message, wherein;

receiving the message at the recipient comprises receiving the plurality of image tags in the message;

uploading to the remote decryption service comprises uploading the plurality of image tags in the message to the decryption service; and

decrypting the encrypted message content comprises decrypting the encrypted message content from the plurality of uploaded image tags.

8. The method defined in claim 1 further comprising:

at the sender, encrypting the message content with a PKE public key to produce the encrypted message content;

at the sender, placing the encrypted message content into a plurality of image tags;

at the sender, sending the plurality of image tags to the recipient in the message, wherein;

receiving the message at the recipient comprises receiving the plurality of image tags in the message;

uploading to the remote decryption service comprises uploading the plurality of image tags in the message to the decryption service; and

decrypting the encrypted message content comprises decrypting the encrypted message content from the plurality of uploaded image tags.

9. The method defined in claim 1 further comprising:

at the sender, encrypting the message content for the message with a public key to produce the encrypted message content;

at the sender, breaking the encrypted message content into pieces; and

at the sender, embedding each piece of the encrypted message content into a corresponding image tag with a unique message identifier, wherein the unique message identifier identifies the message.

10. The method defined in claim 1 further comprising:

at the sender, encrypting the message content for the message with a public key to produce the encrypted message content;

at the sender, breaking the encrypted message content into pieces; and

at the sender, embedding each piece of the encrypted message content into a corresponding image tag with a message part identifier that identifies that piece; and

at the decryption service, using the message part identifiers associated with the pieces of the encrypted message content to reconstruct the encrypted message.

11. The method defined in claim 1 further comprising:

at the sender, encrypting the message content for the message with a public key to produce the encrypted message content;

at the sender, breaking the encrypted message content into pieces; and

embedding each piece of the encrypted message content into a corresponding image tag with a unique message identifier and a message part identifier, wherein the unique message identifier identifies the message to which that piece of the encrypted message content belongs and wherein the message part identifier identifies that piece of the encrypted message content.

12. The method defined in claim 1 further comprising:

at the sender, encrypting the message content for the message with a public key to produce the encrypted message content;

embedding each piece of the encrypted message content into a corresponding image tag with a unique message identifier, a message part identifier, and a web address, wherein the unique message identifier identifies the message to which that piece of the encrypted message content belongs, wherein the message part identifier identifies that piece of the encrypted message content, and wherein the web address is associated with a web server at the decryption service.

13. The method defined in claim 1 further comprising:

at the sender, placing the encrypted message content into a plurality of image tags; and

at the sender, sending the plurality of image tags to the recipient in the message, wherein;

receiving the message at the recipient comprises receiving the plurality of image tags in the message; and

uploading to the remote decryption service comprises automatically uploading the plurality of image tags in the message to the decryption service with a web browser engine.

14. The method defined in claim 1 wherein the encrypted message content is placed into a plurality of image tags at the sender and wherein each image tag includes a web address of a web server at the decryption service, wherein receiving the message at the recipient comprises receiving the plurality of image tags in the message, and wherein uploading to the remote decryption service comprises automatically uploading the plurality of image tags in the message to the web server at the decryption service with a web browser engine.

15. The method defined in claim 1 wherein the encrypted message content is placed into a plurality of GIF image tags at the sender and wherein each GIF image tag includes a web address of a web server at the decryption service, wherein receiving the message at the recipient comprises receiving the plurality of image tags in the message, and wherein uploading to the remote decryption service comprises automatically uploading the plurality of GIF image tags in the message to the web server at the decryption service with a web browser engine by sending a plurality of associated GIF image requests to the web server.

16. The method defined in claim 1 further comprising:

at the decryption service, authenticating the recipient before decrypting the encrypted message content.

17. A method for providing recipients with access to message content comprising:

encrypting message content at a sender to produce encrypted message content;

breaking the encrypted message content into pieces;

sending a message to a recipient over the Internet from the sender that contains the encrypted message content embedded in a plurality of image tags, each of which contains a respective one of the pieces of encrypted message content and each of which contains a message part identifier that identifies that piece;

uploading the plurality of image tags from the recipient to a decryption service over the Internet;

at the decryption service, reconstructing the encrypted message content from the pieces of encrypted message content using the message part identifiers;

at the decryption service, decrypting the encrypted message content to produce the message content for the recipient; and

providing the recipient with access to the message content at the decryption service over the Internet.

18. The method defined in claim 17 wherein the image tags each include a web address for a web server at the decryption service and wherein uploading the plurality of image tags to the web server with a web browser engine.

19. The method defined in claim 17 wherein encrypting the message content at the sender comprises encrypting the message content with an IBE public key.

20. The method defined in claim 17 wherein encrypting the message content at the sender comprises encrypting the message content with an PKE public key.