Methods and systems for indicating trustworthiness of secure communications

• US 8,661,260 B2
• Filed: 10/20/2008
• Issued: 02/25/2014
• Est. Priority Date: 10/20/2007
• Status: Expired due to Fees

• Current Assignee: Sean Joseph Leonard
• Original Assignee: Sean Joseph Leonard
• Inventors: Leonard, Sean Joseph
• Primary Examiner(s): Kim, Tae
• Assistant Examiner(s): Gao, Shu Chun
• Application Number:
  US12/254,797
• Publication Number:
  US 20090106557A1
• Time in Patent Office: 1,954 Days
• Field of Search: 713/179, 713/176, 380/30
• US Class Current: 713/179
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

Embodiments of the present invention enable a message recipient or messaging system to indicate the trustworthiness of a message, especially messages that comprise content that has been digitally signed. In addition, embodiments may alter or control the message to change user behavior by preventing the user from doing things that the message would induce the user into doing. In some embodiments, various characteristics and indicia of the message are determined. For example, for e-mail messages having digitally signed content, certain embodiments may determine the entity or entities asserting a basis for trust, the status or role of the sender, the name of the sender, the affiliation of the sender, the messaging address the location, and the most recent status of the trust relationship. Based on the determined indicia, a plain language notification is composed and the message is displayed with the notification. For example, the notification may be displayed in a display bar above or below the message'"'"'s contents, or may appear as a pop-up window. In addition, in some embodiments, the recipient may provide his or her assessment of the indicia, such as the accuracy, reliability, and the trustworthiness of the indicia. The history of interactions between various parties related to the message may also be considered. For example, the history of interactions between the sender and recipient may be considered. The trustworthiness of the certification authority or other entity may also be considered.

Claims

1. A method of indicating a trustworthiness of a received message, said method comprising:

receiving, via a software program, a message comprising content that has been digitally signed by a digital signer with a digital signature;

accessing a set of cryptographically secure attestations by a third party entity, the third party entity being known to software that received the message;

successfully identifying a cryptographic key that was used to sign the message and an entity that holds the key, the successfully identifying comprising determining cryptographically secure bindings associated with the message, the cryptographically secure bindings being between said content, said message, and said digital signer, and between said digital signer and said third party entity;

successfully verifying that the digital signature of the message is cryptographically associated with the identified cryptographic key;

calculating, using one or more computer hardware processors, a set of indicia from the message and said cryptographically secure attestations;

presenting said indicia to a user; and

after the successfully identifying the cryptographic key and the successfully verifying that the digital signature of the message is cryptographically associated with the identified cryptographic key, requesting said user to modify the indicia that were calculated from the message.

2. The method of claim 1, wherein the digital signer is a sender of the message.

3. The method of claim 1, wherein the digital signer is a recipient of the message.

4. The method of claim 1, wherein the digital signer is a third party that is trusted by at least one of a recipient or the sender.

5. The method of claim 1, wherein said digital signer is a certificate authority.

6. The method of claim 1, wherein said digital signature is based on asymmetric cryptography.

7. The method of claim 1, wherein said cryptographically secure attestations include an attestation of a time.

8. The method of claim 7, wherein the attestation of time is cryptographically signed.

9. The method of claim 7, wherein the attestation of time is a part of a message having an attestation by a third party.

10. The method of claim 9, wherein the attestation by the third party is party of an online certificate status protocol response.

11. The method of claim 1, wherein said cryptographically secure attestations include an attestation about the digital signer.

12. The method of claim 1, wherein a trusted introducer has introduced a sender of the message to a recipient of the message.

13. A non-transitory computer readable medium comprising executable program code that configures a hardware processor to perform operations comprising:

receiving, via a software program, a message comprising content that has been digitally signed by a digital signer with a digital signature;

accessing cryptographically secure attestations by a third party entity that is known to software that received the message;

successfully identifying a cryptographic key that was used to sign the message and an entity that holds the key, the successfully identifying comprising determining cryptographically secure bindings associated with the message, the cryptographically secure bindings being between said content, said message, and said digital signer, and between said digital signer and said third party entity;

successfully verifying the digital signature of the message is associated with the identified cryptographic key;

calculating, using one or more computer hardware processors, a set of indicia from the message and said cryptographically secure attestations;

presenting said indicia to a user; and

after the successfully identifying the cryptographic key and the successfully verifying the digital signature of the message, requesting said user to modify the indicia that were calculated from the message.

14. A method of assessing trustworthiness of a received message, said method comprising:

receiving, via a software program, a message comprising content that is digitally signed by a digital signer;

accessing one or more cryptographically secure attestations by a trusted entity;

identifying a cryptographic key was used to sign the message and an entity that holds the key, the identifying comprising determining cryptographically secure bindings associated with the cryptographic key, the cryptographically secure bindings being between said content, said message, and said digital signer, and between said digital signer and said trusted entity;

verifying that the message is cryptographically associated with the identified cryptographic key;

calculating, using one or more computer hardware processors, one or more indicia from secure bindings associated with the cryptographic key, the calculation being based on said cryptographically secure attestations;

determining at least one role from said indicia, the at least one role indicating a class of a sender; and

modifying the message based on said role and said indicia presented to a recipient of the received message, the modified message including role-specific information that relates to the at least one role.

15. The method of claim 14, wherein the digital signer is a sender of the message.

16. The method of claim 14, wherein the digital signer is a recipient of the message.

17. The method of claim 14, wherein the digital signer is a third party that is trusted by at least one of the recipient or a sender.

18. The method of claim 14, wherein modifying the message comprises withholding display of the message to the recipient based on the role.

19. The method of claim 14, wherein said modifying the message restricts a reference to a predetermined permutation of resources.

20. The method of claim 19, wherein said reference is to a resource to be loaded inline with said message.

21. The method of claim 19, wherein said reference is to a resource to be loaded external to said message.

22. The method of claim 19, wherein said predetermined permutation of resources indicates a time associated with the message.

23. The method of claim 14, wherein said indicia indicate an origin of said message.

24. The method of claim 14, wherein said message is an e-mail.

25. The method of claim 14, further comprising:

determining whether the message is related to at least one other message previously sent by the recipient; and

composing a notification based on the whether the message is related to at least one other message sent by the recipient.

26. The method of claim 14, further comprising:

determining whether the message is related to at least one other message previously sent by a party that is trusted by the recipient; and

composing a notification based on the whether the message is related to at least one other message sent by the party that is trusted by the recipient.

27. A non-transitory computer readable medium comprising executable program code that configures a hardware processor to perform operations comprising:

receiving, via a software program, a message comprising content and a digital signature;

accessing one or more cryptographically secure attestations by a trusted entity;

identifying a cryptographic key was used to sign the message and an entity that holds the key, the identifying comprising determining cryptographically secure bindings associated with the cryptographic key, the cryptographically secure bindings being between said content, said message, and said digital signer, and between said digital signer and said trusted entity;

verifying that the digital signature is cryptographically associated with the identified cryptographic key;

calculating, using one or more computer hardware processors, one or more indicia from secure bindings associated with the cryptographic key, the calculation being based on said cryptographically secure attestations;

determining at least one role from said indicia, the at least one role indicating a class of a sender; and

modifying the message based on said role and said indicia presented to a recipient of the received message, the modified message including role-specific information that relates to the at least one role.