Secure messaging systems

• US 8,627,084 B1
• Filed: 10/23/2012
• Issued: 01/07/2014
• Est. Priority Date: 04/04/2003
• Status: Expired due to Term

• Current Assignee: entIT Software LLC (Open Text Corporation)
• Original Assignee: Voltage Security Incorporated (HP Inc.)
• Inventors: Pauker, Matthew J., Spies, Terence, Kacker, Rishi, Appenzeller, Guido
• Primary Examiner(s): Chea, Philip
• Assistant Examiner(s): Hoang, Daniel
• Application Number:
  US13/658,678
• Time in Patent Office: 441 Days
• Field of Search: 713/168, 713/182, 380/258, 380/178, 380/286, 380/44, 380/30
• US Class Current: 713/171
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/3073 involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

A system is provided that uses cryptographic techniques to support secure messaging between senders and recipients. A sender may encrypt a message for a recipient using the recipient'"'"'s public key. The sender may send the encrypted message to the message address of a given recipient. A server may be used to decrypt the encrypted message for the recipient, so that the recipient need not install a decryption engine on the recipient'"'"'s equipment.

Claims

1. A method for securely conveying a message over a communications network from a sender to a recipient, wherein the recipient has an identity-based-encryption public key and an identity-based-encryption private key for use in encryption and decryption, wherein the message is encrypted using the identity-based-encryption public key of the recipient, wherein forwarding notification information is added to the encrypted message in the form of instructions for the recipient that direct the recipient to forward the encrypted message for decryption, wherein the encrypted message with the added forwarding notification is provided to the recipient, comprising:

at a server, creating an interactive message prompt formed from a universal resource locator in response to receiving the forwarded encrypted message;

using the server to obtain credentials from the recipient in response to the recipient clicking on the universal resource locator;

with a decryption engine on the server, using the recipient'"'"'s credentials to obtain a copy of the recipient'"'"'s identity-based-encryption private key; and

with the decryption engine on the server, decrypting the encrypted message using the copy of the recipient'"'"'s identity-based-encryption private key to produce a decrypted version of the message, wherein the recipient is provided with access to the decrypted version of the message.

2. The method defined in claim 1, wherein the server is co-located with the sender, the method further comprising:

at the recipient, forwarding the encrypted message to the server.

3. The method defined in claim 1, wherein the server is co-located with the sender, further comprising:

at the server, receiving the forwarded encrypted message from the recipient.

4. The method defined in claim 1, wherein the server is co-located with the sender, further comprising:

at the server, receiving the forwarded encrypted message from a cellular telephone at the recipient.

5. The method defined in claim 1, wherein using the server to obtain credentials from the recipient in response to the recipient clicking on the universal resource locator comprises using the server to obtain credentials from the recipient over a secure communications link.

6. The method defined in claim 1, further comprising:

using the server to provide the recipient with access to the decrypted version of the message in the form of a web page provided to the recipient by the server over a secure communications link.

7. The method defined in claim 1 wherein using the server to obtain credentials from the recipient in response to the recipient clicking on the universal resource locator comprises obtaining a username and password from the recipient using the server.

8. The method defined in claim 1 wherein using the recipient'"'"'s credentials to obtain a copy of the recipient'"'"'s identity-based-encryption private key comprises using the server to present the recipient'"'"'s identity-based-encryption public key to an identity-based-encryption private key generator with a request for a copy of the recipient'"'"'s identity-based-encryption private key.

9. The method defined in claim 1 further comprising:

at the server, storing the encrypted message in an encrypted message database.

10. The method defined in claim 1 further comprising:

at the server, storing the decrypted message in a decrypted message database.