System and method for secure electronic communication services

• US 8,538,028 B2
• Filed: 05/19/2008
• Issued: 09/17/2013
• Est. Priority Date: 11/20/2006
• Status: Expired due to Fees

• Current Assignee: Toposis Corporation
• Original Assignee: Toposis Corporation
• Inventors: Yeap, Tet Hin, Goeller, Thomas Anton
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): Okeke, Izunna
• Application Number:
  US12/153,413
• Publication Number:
  US 20090198997A1
• Time in Patent Office: 1,947 Days
• Field of Search: None
• US Class Current: 380/278
• CPC Class Codes: H04L 51/23 Reliability checks, e.g. acknowledgments or fault reporting
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

A distributed and scalable system for public key registration, distribution and management is provided, comprising a hierarchical key server network providing key address resolution (kDNS) functionality based on a kDNS server hierarchy or a key-DNS server hierarchy and associated protocols. Thus, public-keys of users, such as email recipients, can be searched and retrieved over the internet based on a unique identifier of the user, facilitating secure communication between users in different network domains and organizations.

Claims

1. A system for public-key distribution and management for a plurality of users in a communications network comprising a plurality of domains, each domain served by a Domain Name System (DNS) server hierarchy, and the system comprising:

a distributed server network comprising a plurality of key servers organized as a hierarchical network structure (key server hierarchy) comprising a domain tree hierarchy, each domain being registered to a respective key server, and a topmost level of the key server hierarchy comprising a directory server;

one or more registration servers for registration of users, independently of domain registration and name service by the DNS server hierarchy, each user having a unique identifier and a public-private key pair;

each registration server registering to a user a respective public key of the public-private key pair of the user associated with the unique identifier of the user, and sending a key request for storing the unique identifier and the associated public key on an assigned key server of the key server hierarchy;

the key server hierarchy storing, for each user, on an assigned key server, the respective public key of the user associated with the unique identifier for look-up and retrieval by other users; and

the key server hierarchy further comprising;

a plurality of key address resolution (kDNS) servers, each network domain being registered to a respective kDNS server, each kDNS server storing for each of a plurality of said unique identifiers, an address of a key server storing the respective public key; and

each kDNS server responding to key requests for storage and retrieval of a public key associated with a unique identifier by;

determining, based on the unique identifier, an address of a respective assigned key server,

directing the key request to the respective assigned key server for resolution, or

directing unresolved requests to a kDNS server in another domain for resolution.

2. A system according to claim 1

wherein at least one of said registration servers further performs the steps of:

on registering a user, obtaining a public-private key pair for the user,

associating the unique identifier of the user with the respective public key, and further to sending the key request for storing the unique identifier and the associated public key on one or more assigned key server of the key server hierarchy,

providing the registered user with secure access to the respective private key.

3. A system according to claim 1 wherein the key server hierarchy comprises a plurality of a key DNS servers, and each key DNS server acts as the respective key server and kDNS server for a domain.

4. A system according to claim 3 wherein the plurality of key DNS servers are organized as the domain tree hierarchy, with each domain registered to a respective key DNS server, and topmost level key DNS servers acting as directory servers for redirecting key requests to traverse the key DNS server hierarchy in accordance with a hierarchical search protocol.

6. A system according to claim 2 wherein for a domain, the registration server and key server are provided by a common network element.

7. A system according to claim 1 wherein in a network domain, a key DNS server comprises both said key server and kDNS server.

8. A system according to claim 2 wherein the registration server further performs the steps of:

triggering generation for a user of a customized software module for a communication client containing the unique identifier,

providing secure access to the private-key, and providing communication agents for public-key look-up, and encryption and decryption.

9. A system according to claim 1 wherein the server network is implemented as a distributed server farm.

10. A system according to claim 1 wherein the domain tree based hierarchy comprises one root level domain, a plurality of top level domains, and user domains.

11. A system according to claim 10 wherein each domain is registered to only one key server and one registration server, and wherein only top domain key servers and registration servers can delegate respective sub-domain key servers and registration servers.

12. A system according to claim 1 wherein the kDNS server organization hierarchy maintains name server records (NS) for a plurality of unique identifiers and IP Address records (A) for the respective associated key server storing the public key associated with each of the unique identifiers.

15. A system according to claim 1 wherein the key server hierarchy employs hash table search techniques to locate the public-key.

16. A system according to claim 1 wherein each key server signs a retrieved public-key with a private-key of the key server before sending the retrieved key to the requestor.

17. A system according to claim 1 wherein each key server comprises a standardized interface, wherein the standardized interface comprises one of DNS and Open PGP.

18. A system according to claim 2 wherein the registration server is accessible from the internet for self-registration of unique identifiers by users.

19. A system according to claim 1 wherein each registration server and key server is linked to one or more communication servers for providing communication services in one or more network domains.

20. A system according to claim 19 wherein, in a network domain, public-key request services are offered under a specified port for addresses with the domain.

21. A system according to claim 1 wherein the kDNS servers respond to a key request with a preliminary answer indicating a key server or key server farm where a public-key is stored if an unique identifier exists, and has an associated public-key, and then redirects the request to the indicated key server.

22. A system according to claim 1 wherein the kDNS servers form a hierarchy with the topmost kDNS server resolving key requests from higher level domains, and the lower kDNS server levels resolving key requests from subdomains and specific addresses.

23. A system according to claim 1 wherein a key request is required to contain the unique identifier for which public-key lookup and retrieval is requested and also the unique identifier of the requestor, the latter also being is associated with a respective public-key, and wherein the key server encrypts the requested public-key with the public-key of the requestor before sending to the requestor, so that the requested public-key can only be retrieved with the requestors private-key.

24. A system according to claim 2 wherein the registration server further triggers generation of a certificate along with the public-private key pair, to provide for inclusion of the key in a certificate store.

34. A system according claim 1 wherein keys for a first domain are stored by an assigned key server in a second domain and the first domain is served by a kDNS server in a different domain, the kDNS servers performing the steps of:

responding to key requests for a unique identifier from the first domain, determining based on the unique identifier an assigned key server for storing of the associated public key, and forwarding the key request to the assigned key server.

5. A system for public-key distribution and management for secure communications services for a plurality of users in a communications network comprising a plurality of network domains served by a Domain Name System (DNS) server hierarchy, the system comprising:

a distributed server network comprising a plurality of key DNS servers organized as a hierarchical domain tree network structure (key DNS server hierarchy), said key DNS server hierarchy being distinct from the DNS server hierarchy, and each network domain being registered to a key DNS server;

and at least a topmost level of the key DNS server hierarchy further comprising a registration server for registering of users, independently of domain registration and name service by the DNS server hierarchy, each user having a unique identifier and a public private-key pair;

each registration server registering to a user a respective public key of the public-private key pair of the user associated with the unique identifier of the user, and sending a key request for storing the unique identifier and the associated public key on an assigned key-DNS server of the key-DNS server hierarchy;

the key DNS server hierarchy storing, for each user, on an assigned key DNS server, the respective public key associated with the unique identifier for look-up and retrieval by another user;

each key-DNS server being operable as a key server to respond to key requests for storing for a registered user a unique identifier and a respective public key associated with the unique identifier, and to respond to key requests for look-up and retrieval of a public key associated with a unique identifier, by returning the requested public key;

each key-DNS server further being operable for key address resolution (kDNS) comprising,

when a key request for storage or retrieval of a public-key associated with a unique identifier for a user is not resolved, determining, based on the unique identifier, an address of an assigned key DNS server, for public-key storage or retrieval; and

directing the key request to the assigned key DNS server.

13. A system according to claim 5 wherein the key-DNS server organization hierarchy maintains name server records (NS) for a plurality of unique identifiers and IP Address records (A) for the respective associated key server storing the public key associated with each of the unique identifiers.

14. A system according to claim 13 providing for at least one of recursive and non-recursive searches to determine, for a specified unique identifier, an address of an assigned key server.

25. A method for public-key distribution and management for secure electronic communication services for a plurality of users in a communication network comprising one or more domains served by a domain name system (DNS) server hierarchy, one or more registration servers for registration of users independently of domain registration and name service by the DNS server hierarchy, and a key server hierarchy comprising a plurality of key servers organized as a hierarchical network structure comprising a domain tree hierarchy, each domain being registered to a respective key server, and a topmost level of the key server hierarchy comprising a directory server, the method comprising:

registering to each user a unique identifier and attaching a respective public-key of a private-public key pair of the user;

for each user, storing on at least one assigned key server of the key server hierarchy, the unique identifier and the attached public-key for lookup and retrieval of the public-key by another user based on the unique identifier;

and storing, on a directory server of at least a top level of the key server hierarchy, each unique identifier and the address of an assigned key server storing the respective key; and

responding to key requests for public-key storage or retrieval based on a respective unique identifier, by steps comprising;

querying a local key server of the key server hierarchy and resolving the request by storing or returning the requested public-key;

or

redirecting unsuccessful key requests to a key server in a next level of the hierarchy for resolution;

or

redirecting unsuccessful key requests to a directory server of the key server hierarchy for key address resolution comprising;

determining the address of an assigned key server and forwarding the key request for response.

26. A method according to claim 25 wherein the step of registering further comprises:

triggering generation for a user of a customized program module for a communication client containing the unique identifier, providing secure access to the private-key, and providing communication agents for public-key look-up, and encryption and decryption.

27. A method according to claim 26 employing at least one of recursive and non-recursive searches to determine, for a specified unique identifier, a corresponding key server, and thereby find the public-key associated with the specified unique identifier.

28. A method according to claim 26 employing hash table search techniques to locate the public-key.

29. A system according to claim 26 comprising signing a retrieved public-key with a private-key of the respective key server before sending the retrieved key to the requestor.

30. A method according to claim 26 comprising receiving registration requests from users from the internet for self-registration of unique identifiers by users.

31. A method according to claim 26 wherein the communications network comprises a plurality of network domains, each domain is registered to a key server in the key server hierarchy, and wherein a public-key request is directed first to a key server in a first domain, and if unsuccessful, the public key request is then directed to key servers in other domains for response.

32. A method according to claim 31 wherein a directory server responds to a request with a preliminary answer indicating a key server or key server farm where a public-key is stored if an unique identifier exists, and has an associated public-key, and then redirects the request to the indicated key server.

33. A method according to claim 26 wherein a key request is required to contain the unique identifier for which public-key lookup and retrieval is requested and also the unique identifier of the requestor, the latter also being is associated with a respective public-key, and wherein the key server encrypts the requested public-key with the public-key of the requestor before sending to the requestor, so that the requested public-key can only be retrieved with the requestors private-key.