Sending signed e-mail messages from a device

• US 8,281,120 B2
• Filed: 08/14/2009
• Issued: 10/02/2012
• Est. Priority Date: 08/14/2009
• Status: Expired due to Fees

• Current Assignee: Canon Kabushiki Kaisha (Canon Inc.)
• Original Assignee: Canon Kabushiki Kaisha (Canon Inc.)
• Inventors: Tsao, Yeongtau Louis
• Primary Examiner(s): Powers, William
• Application Number:
  US12/541,896
• Publication Number:
  US 20110040978A1
• Time in Patent Office: 1,145 Days
• Field of Search: None
• US Class Current: 713/150
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 51/10 Multimedia information
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

Sending signed e-mail messages. An output data stream is created for streaming a signed e-mail message, and streamed attachment data is read. In response to receiving a portion of the read streamed attachment data, the received portion of the attachment data is digested to generate a digest value, and the received portion of the attachment data is sent to a mail server via the output data stream. The received portion of the attachment data is smaller than the size of the attachment data. The digest value is updated as additional portions of the streamed attachment data are received and digested. In response to sending all attachment data to the mail server, a signer generates the signature data by signing the digest value using a signer'"'"'s private key, and the generated signature data is sent to the mail server via the output stream.

Claims

1. A method for sending a signed e-mail message to a mail server from a device that communicates with the mail server over a network, the signed e-mail message having attachment data and signature data, said method comprising:

receiving signer information, recipient information and attachment information;

packaging the signer information, recipient information, and attachment information into an e-mail message having a clear-signed secure e-mail exchange format that includes an attachment body part and a signature body part, wherein the attachment body part contains the location of at least one attachment file included in the attachment information, and wherein the signature body part contains the signer information for generating the digital signature;

creating an output data stream for streaming the e-mail message from the device to a mail server specified by the recipient information;

processing the attachment body part to acquire at least one input data stream for the at least one attachment file location contained in the attachment body part;

reading attachment data from the at least one input data stream;

in response to receiving a portion of the attachment data from the at least one input data stream, digesting the received portion of the attachment data to generate a digest value, and sending the received portion of the attachment data to the mail server via the output data stream, wherein the received portion of the attachment data is smaller than the size of the attachment data, and wherein the digest value is updated as additional portions of the streamed attachment data are received and digested; and

in response to sending all attachment data specified by the attachment information to the mail server, processing the signature body part to acquire a signer specified by the signer information contained in the signature body part, generating the signature data by using the signer to sign the digest value using a signer'"'"'s private key, and sending the generated signature data to the mail server via the output data stream.

2. The method according to claim 1, wherein the e-mail message has an S/MIME format, and wherein the signature data has a PKCS7 content type.

3. The method according to claim 1, wherein the signer

includes at least one of a secure e-mail library module, an application module, and a smart card.

4. The method according to claim 1, wherein the received portion of the attachment data is encrypted before being sent to the mail server via the output data stream.

5. The method according to claim 1, wherein the device includes a multi-function printer (MFP).

6. The method according to claim 5, wherein the streamed attachment data is generated by at least one of a scan operation and a copy operation of the MFP.

7. The method according to claim 1, wherein the attachment body part contains signer'"'"'s digest algorithm information specified by the signer information.

8. The method according to claim 1, wherein the received portion of the attachment data is digested using a digest algorithm that includes at least one of an MD5 (Message-Digest algorithm 5) digest algorithm, a Secure Hash Algorithm(SHA)-1 digest algorithm, and an SHA-2 digest algorithm, wherein the SHA-2digest algorithm includes at least one of an SHA-224 digest algorithm, an SHA-256 digest algorithm, an SHA-384 digest algorithm, and an SHA-512 digest algorithm.

9. The method according to claim 1, wherein responsive to a cancel instruction received from a user of the device, the signer specified by the signer information generates the signature data, and the generated signature data is sent to the mail server via the output data stream, such that a partially sent e-mail message is signed.

10. The method according to claim 9, wherein information is added to the message content of the partially sent e-mail message to indicate that the message is a partially sent e-mail message.

11. The method according to claim 9, wherein additional information is added to the attachment data of the partially sent e-mail message to indicate that the message is a partially sent e-mail message, wherein if the message includes a plurality of attachment files, the information is added to the attachment file that is partially sent.

12. The method according to claim 9, wherein information indicating that the message is a partially sent e-mail message is added to the partially sent e-mail message as a new attachment.

13. The method according to claim 1, wherein an application programming interface defined by a Java e-mail computing environment and an application programming interface defined by a Java object computing environment are used to send the signed e-mail message.

14. The method according to claim 1, wherein the received portion of the read attachment data is buffered in a memory buffer, wherein a capacity of the memory buffer is smaller than a size of the attachment data specified by the attachment information, wherein the buffered portion of the attachment data is digested to generate the digest value and sent to the mail server via the output data stream, and wherein after the buffered portion of the attachment data is digested and sent to the mail server, additional portions of the streamed attachment data are buffered in the memory buffer.

15. A module which sends a signed e-mail message to a mail server from a device that communicates with the mail server over a network, the signed e-mail message having attachment data and signature data, said module comprising:

an information module constructed to perform a receiving step in which signer information, recipient information and attachment information are received;

a message module constructed to perform a packaging step in which the signer information, recipient information, and attachment information are packaged into an e-mail message having a clear-signed secure e-mail exchange format that includes an attachment body part and a signature body part, wherein the attachment body part contains the location of at least one attachment file included in the attachment information and signer'"'"'s digest algorithm information specified by the signer information, and wherein the signature body part contains the signer information for generating the digital signature;

a mail module constructed to perform a creating step in which an output data stream is created for streaming the e-mail message from the device to a mail server specified by the recipient information;

a streaming module constructed to perform a processing step in which the attachment body part is processed to acquire at least one input data stream for the at least one attachment file location contained in the attachment body part;

a reading module constructed to perform a reading step in which attachment data is read from the at least one input data stream;

a sending module constructed to perform, in response to receiving a portion of the attachment data from the at least one input data stream, a sending step in which the received portion of the attachment data is digested to generate a digest value, and the received portion of the attachment data is sent to the mail server via the output data stream, wherein the received portion of the attachment data is smaller than the size of the attachment data, and wherein the digest value is updated as additional portions of the streamed attachment data are received and digested; and

a signing module constructed to perform, in response to sending all attachment data specified by the attachment information to the mail server, a signing step in which the signature body part is processed to acquire a signer specified by the signer information contained in the signature body part, the signature data is generated by using the signer to sign the digest value using a signer'"'"'s private key, and the generated signature data is sent to the mail server via the output data stream.

16. The module according to claim 15, wherein the e-mail message has an S/MIME format, and wherein the signature data has a PKCS7 content type.

17. The module according to claim 15, wherein the signer includes at least one of a secure e-mail library module, an application module, and a smart card.

18. The module according to claim 15, wherein the received portion of the attachment data is encrypted before being sent to the mail server via the output data stream.

19. The module according to claim 15, wherein the device includes a multi-function printer (MFP).

20. The module according to claim 19, wherein the streamed attachment data is generated by at least one of a scan operation and a copy operation of the MFP.

21. The module according to claim 15, wherein the attachment body part contains signer'"'"'s digest algorithm information specified by the signer information.

22. The module according to claim 15, wherein the received portion of the attachment data is digested using a digest algorithm that includes at least one of an MD5 (Message-Digest algorithm 5) digest algorithm, a Secure Hash Algorithm(SHA)-1 digest algorithm, and an SHA-2 digest algorithm, wherein the SHA-2digest algorithm includes at least one of an SHA-224 digest algorithm, an SHA-256 digest algorithm, an SHA-384 digest algorithm, and an SHA-512 digest algorithm.

23. The module according to claim 15, wherein responsive to a cancel instruction received from a user of the device, the signer specified by the signer information generates the signature data, and the generated signature data is sent to the mail server via the output data stream, such that a partially sent e-mail message is signed.

24. The module according to claim 23, wherein information is added to the message content of the partially sent e-mail message to indicate that the message is a partially sent e-mail message.

25. The module according to claim 23, wherein additional information is added to the attachment data of the partially sent e-mail message to indicate that the message is a partially sent e-mail message, wherein if the message includes a plurality of attachment files, the information is added to the attachment file that is partially sent.

26. The module according to claim 23, wherein information indicating that the message is a partially sent e-mail message is added to the partially sent e-mail message as a new attachment.

27. The module according to claim 15, wherein an application programming interface defined by a Java e-mail computing environment and an application programming interface defined by a Java object computing environment are used to send the signed e-mail message.

28. The module according to claim 15, wherein the received portion of the read attachment data is buffered in a memory buffer, wherein a capacity of the memory buffer is smaller than a size of the attachment data specified by the attachment information, wherein the buffered portion of the attachment data is digested to generate the digest value and sent to the mail server via the output data stream, and wherein after the buffered portion of the attachment data is digested and sent to the mail server, additional portions of the streamed attachment data are buffered in the memory buffer.

29. An apparatus comprising:

a computer-readable memory constructed to store computer-executable process steps; and

a processor constructed to execute the computer-executable process steps stored in the memory;

wherein the process steps stored in the memory cause the processor to send a signed e-mail message to a mail server from the apparatus, which communicates with the mail server over a network, the signed e-mail message having attachment data and signature data, wherein the process steps include computer-executable process steps to;

receive signer information, recipient information and attachment information;

package the signer information, recipient information, and attachment information into an e-mail message having a clear-signed secure e-mail exchange format that includes an attachment body part and a signature body part, wherein the attachment body part contains the location of at least one attachment file included in the attachment information and signer'"'"'s digest algorithm information specified by the signer information, and wherein the signature body part contains the signer information for generating the digital signature;

create an output data stream for streaming the e-mail message from the device to a mail server specified by the recipient information;

process the attachment body part to acquire at least one input data stream for the at least one attachment file location contained in the attachment body part;

read attachment data from the at least one input data stream;

in response to receiving a portion of the attachment data from the at least one input data stream, digest the received portion of the attachment data to generate a digest value, and send the received portion of the attachment data to the mail server via the output data stream, wherein the received portion of the attachment data is smaller than the size of the attachment data, and wherein the digest value is updated as additional portions of the streamed attachment data are received and digested; and

in response to sending all attachment data specified by the attachment information to the mail server, process the signature body part to acquire a signer specified by the signer information contained in the signature body part, generate the signature data by using the signer to sign the digest value using a signer'"'"'s private key, and send the generated signature data to the mail server via the output data stream.

30. The apparatus according to claim 29, wherein the e-mail message has an S/MIME format, and wherein the signature data has a PKCS7 content type.

31. The apparatus according to claim 29, wherein the signer includes at least one of a secure e-mail library module, an application module, and a smart card.

32. The apparatus according to claim 29, wherein the received portion of the attachment data is encrypted before being sent to the mail server via the output data stream.

33. The apparatus according to claim 29, wherein the device includes a multi-function printer (MFP).

34. The apparatus according to claim 33, wherein the streamed attachment data is generated by at least one of a scan operation and a copy operation of the MFP.

35. The apparatus according to claim 29, wherein the attachment body part contains signer'"'"'s digest algorithm information specified by the signer information.

36. The apparatus according to claim 29, wherein the received portion of the attachment data is digested using a digest algorithm that includes at least one of an MD5 (Message-Digest algorithm 5) digest algorithm, a Secure Hash Algorithm(SHA)-1 digest algorithm, and an SHA-2 digest algorithm, wherein the SHA-2digest algorithm includes at least one of an SHA-224 digest algorithm, an SHA-256 digest algorithm, an SHA-384 digest algorithm, and an SHA-512 digest algorithm.

37. The apparatus according to claim 29, wherein responsive to a cancel instruction received from a user of the device, the signer specified by the signer information generates the signature data, and the generated signature data is sent to the mail server via the output data stream, such that a partially sent e-mail message is signed.

38. The apparatus according to claim 37, wherein information is added to the message content of the partially sent e-mail message to indicate that the message is a partially sent e-mail message.

39. The apparatus according to claim 37, wherein additional information is added to the attachment data of the partially sent e-mail message to indicate that the message is a partially sent e-mail message, wherein if the message includes a plurality of attachment files, the information is added to the attachment file that is partially sent.

40. The apparatus according to claim 37, wherein information indicating that the message is a partially sent e-mail message is added to the partially sent e-mail message as a new attachment.

41. The apparatus according to claim 29, wherein an application programming interface defined by a Java e-mail computing environment and an application programming interface defined by a Java object computing environment are used to send the signed e-mail message.

42. The apparatus according to claim 29, wherein the received portion of the read attachment data is buffered in a memory buffer, wherein a capacity of the memory buffer is smaller than a size of the attachment data specified by the attachment information, wherein the buffered portion of the attachment data is digested to generate the digest value and sent to the mail server via the output data stream, and wherein after the buffered portion of the attachment data is digested and sent to the mail server, additional portions of the streamed attachment data are buffered in the memory buffer.

43. A non-transitory computer-readable memory medium on which is stored computer-executable process steps for causing a computer to send a signed e-mail message to a mail server from a device that communicates with the mail server over a network, the signed e-mail message having attachment data and signature data, wherein the process steps comprise:

receiving signer information, recipient information and attachment information;

packaging the signer information, recipient information, and attachment information into an e-mail message having a clear-signed secure e-mail exchange format that includes an attachment body part and a signature body part, wherein the attachment body part contains the location of at least one attachment file included in the attachment information and signer'"'"'s digest algorithm information specified by the signer information, and wherein the signature body part contains the signer information for generating the digital signature;

creating an output data stream for streaming the e-mail message from the device to a mail server specified by the recipient information;

processing the attachment body part to acquire at least one input data stream for the at least one attachment file location contained in the attachment body part;

reading attachment data from the at least one input data stream;

in response to receiving a portion of the attachment data from the at least one input data stream, digesting the received portion of the attachment data to generate a digest value, and sending the received portion of the attachment data to the mail server via the output data stream, wherein the received portion of the attachment data is smaller than the size of the attachment data, and wherein the digest value is updated as additional portions of the streamed attachment data are received and digested; and

in response to sending all attachment data specified by the attachment information to the mail server, processing the signature body part to acquire a signer specified by the signer information contained in the signature body part, generating the signature data by using the signer to sign the digest value using a signer'"'"'s private key, and sending the generated signature data to the mail server via the output data stream.

44. The non-transitory computer-readable memory medium according to claim 43, wherein the e-mail message has an S/MIME format, and wherein the signature data has a PKCS7 content type.

45. The non-transitory computer-readable memory medium according to claim 43, wherein the signer includes at least one of a secure e-mail library module, an application module, and a smart card.

46. The non-transitory computer-readable memory medium according to claim 43, wherein the received portion of the attachment data is encrypted before being sent to the mail server via the output data stream.

47. The non-transitory computer-readable memory medium according to claim 43, wherein the device includes a multi-function printer (MFP).

48. The non-transitory computer-readable memory medium according to claim 47, wherein the streamed attachment data is generated by at least one of a scan operation and a copy operation of the MFP.

49. The non-transitory computer-readable memory medium according to claim 43, wherein the attachment body part contains signer'"'"'s digest algorithm information specified by the signer information.

50. The non-transitory computer-readable memory medium according to claim 43, wherein the received portion of the attachment data is digested using a digest algorithm that includes at least one of an MD5 (Message-Digest algorithm 5) digest algorithm, a Secure Hash Algorithm(SHA)-1 digest algorithm, and an SHA-2 digest algorithm, wherein the SHA-2 digest algorithm includes at least one of an SHA-224 digest algorithm, an SHA-256 digest algorithm, an SHA-384 digest algorithm, and an SHA-512 digest algorithm.

51. The non-transitory computer-readable memory medium according to claim 43, wherein responsive to a cancel instruction received from a user of the device, the signer specified by the signer information generates the signature data, and the generated signature data is sent to the mail server via the output data stream, such that a partially sent e-mail message is signed.

52. The non-transitory computer-readable memory medium according to claim 51, wherein information is added to the message content of the partially sent e-mail message to indicate that the message is a partially sent e-mail message.

53. The non-transitory computer-readable memory medium according to claim 51, wherein additional information is added to the attachment data of the partially sent e-mail message to indicate that the message is a partially sent e-mail message, wherein if the message includes a plurality of attachment files, the information is added to the attachment file that is partially sent.

54. The non-transitory computer-readable memory medium according to claim 51, wherein information indicating that the message is a partially sent e-mail message is added to the partially sent e-mail message as a new attachment.

55. The non-transitory computer-readable memory medium according to claim 43, wherein an application programming interface defined by a Java e-mail computing environment and an application programming interface defined by a Java object computing environment are used to send the signed e-mail message.

56. The non-transitory computer-readable memory medium according to claim 43, wherein the received portion of the read attachment data is buffered in a memory buffer, wherein a capacity of the memory buffer is smaller than a size of the attachment data specified by the attachment information, wherein the buffered portion of the attachment data is digested to generate the digest value and sent to the mail server via the output data stream, and wherein after the buffered portion of the attachment data is digested and sent to the mail server, additional portions of the streamed attachment data are buffered in the memory buffer.