Secure message system with remote decryption service

• US 8,171,563 B2
• Filed: 02/26/2010
• Issued: 05/01/2012
• Est. Priority Date: 09/25/2003
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Voltage Security Incorporated (HP Inc.)
• Inventors: Pauker, Matthew J., Kacker, Rishi R., Spies, Terence, Ryan, Lucas C., Appenzeller, Guido
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US12/714,010
• Publication Number:
  US 20100161984A1
• Time in Patent Office: 795 Days
• Field of Search: 726/27
• US Class Current: 726/27
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/3073 involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing

Abstract

Systems and methods for secure messaging are provided. A sender may encrypt content and send the encrypted content to a recipient over a communications network. The encrypted content may be decrypted for the recipient using a remote decryption service. Encrypted message content may be placed into a markup language form. Encrypted content may be incorporated into the form as a hidden form element. Form elements for collecting recipient credential information such as username and password information may also be incorporated into the form. At the recipient, the recipient may use the form to provide recipient credential information to the remote decryption service. The recipient may also use the form to upload the encrypted content from the form to the decryption service. The decryption service may provide the recipient with access to a decrypted version of the uploaded content over the communications network.

Claims

1. A method for providing recipients with access to message content in a system in which a sender sends a message having encrypted message content in a form to a recipient over a communications network and in which the recipient uploads the encrypted message content using a form, the method comprising:

at a remote decryption service, receiving the encrypted message content uploaded from the recipient using the form; and

at the remote decryption service, decrypting the encrypted message content and providing access to the decrypted message content to the recipient over the communications network.

2. The method defined in claim 1 wherein the form comprises a markup language form and wherein receiving the encrypted message content comprises receiving the encrypted message content in the markup language form.

3. The method defined in claim 1 wherein the encrypted message content is encrypted using an identity-based-encryption public key associated with the recipient and wherein decrypting the encrypted message content comprises using an identity-based-encryption private key associated with the recipient to decrypt the encrypted message content.

4. The method defined in claim 1 further comprising:

at the remote decryption service, receiving recipient credential information uploaded from the recipient in the form.

5. The method defined in claim 1 wherein receiving the encrypted message content comprises, at the remote decryption service, receiving the encrypted message content uploaded using an http POST or GET operation.

6. The method defined in claim 5 further comprising authenticating the recipient at the remote decryption service.

7. The method defined in claim 1 further comprising authenticating the recipient at the remote decryption service.

8. The method defined in claim 1 further comprising:

at the remote decryption service, receiving username and password information uploaded from the recipient in the form.

9. The method defined in claim 1, wherein private keys are provided by a private key service over the communications network, the method further comprising:

at the remote decryption service, requesting a private key for the recipient from the private key service;

at the remote decryption service, obtaining the private key from the private key service over the communications network; and

at the remote decryption service, using the private key to decrypt the encrypted message content.

10. The method defined in claim 1 wherein the message includes a plurality of forms each of which includes encrypted message content and wherein receiving the encrypted message content comprises:

at the remote decryption service, receiving the encrypted message content uploaded from the recipient using the plurality of forms.

11. A method for using a decryption service to provide recipients with access to encrypted message content over a communications network, wherein at least part of the message content is encrypted and placed into an html form and wherein a recipient uploads the encrypted message content using the html form, the method comprising:

at the remote decryption service, receiving the encrypted message content uploaded from the recipient using the html form;

at the decryption service, decrypting the encrypted message content to produce decrypted message content; and

at the decryption service, providing the recipient with access to the decrypted message content over the communications network.

12. The method defined in claim 11 further comprising:

at the decryption service, authenticating the recipient.

13. The method defined in claim 12 wherein authenticating the recipient comprises:

at the decryption service, receiving username and password information uploaded from the recipient using the html form.

14. The method defined in claim 12 further comprising:

at the decryption service and in response to successfully authenticating the recipient, obtaining a private key of the recipient.

15. The method defined in claim 14 wherein decrypting the encrypted message content to produce the decrypted message content comprises decrypting the encrypted message content using the private key to produce the decrypted message content.

16. A method for using a decryption service to provide recipients with access to message content, wherein at least part of the message content is encrypted and wherein a sender sends a message that contains the encrypted message content and a URL to a recipient, the method comprising:

at the decryption service, providing a web page for the recipient when the recipient clicks on the URL, wherein the web page provides the recipient with an opportunity to upload the encrypted message content to the decryption service;

at the decryption service, receiving the encrypted message content over a communications network;

at the decryption service, decrypting the encrypted message content to produce decrypted message content; and

at the decryption service, providing the recipient with access to the decrypted message content over the communications network.

17. The method defined in claim 16 further comprising:

at the decryption service, authenticating the recipient.

18. The method defined in claim 17 wherein authenticating the recipient comprises:

at the decryption service, receiving username and password information from the recipient.

19. The method defined in claim 17 further comprising:

at the decryption service and after the recipient has been authenticated, obtaining a private key of the recipient.

20. The method defined in claim 19 wherein decrypting the encrypted message content to produce the decrypted message content comprises decrypting the encrypted message content using the private key to produce the decrypted message content.