Electronic data communication system

• US 8,793,491 B2
• Filed: 03/22/2007
• Issued: 07/29/2014
• Est. Priority Date: 03/28/2006
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Dancer, Andrew, Chimley, Mark, Tuaima, Adam, Baldwin, Matthew
• Primary Examiner(s): Parthasarathy, Pramila
• Assistant Examiner(s): HO, DAO Q
• Application Number:
  US12/294,819
• Publication Number:
  US 20100228973A1
• Time in Patent Office: 2,686 Days
• Field of Search: 713/153, 713/168, 726/12, 380/286, 380277-282
• US Class Current: 713/168
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065

Abstract

There is described a key server which is connected to a local area network, and an encryption authority transfers private keys for clients of the local area network to the key server. In an embodiment, the key server encrypts outgoing emails using public keys for the recipients and decrypts internal emails using private keys for the recipients. In another embodiment, the clients of the local area network download their respective private keys from the key server so that encryption operations may be performed by client software.

Claims

1. A network apparatus operable to communicate with one or more remote network devices which are associated with a group of users, the network apparatus comprising:

a request transmitter operable to transmit over a network to a remote server a request for cryptographic keys for the group of users;

a key receiver operable to receive cryptographic keys for the group of users and to store the received cryptographic keys in a cryptographic keys data store; and

a registration controller operable to control a registration procedure for registering the network apparatus with the remote server,

wherein the registration controller is operable to retrieve one or more transfer keys from the remote server and to store the transfer keys in a transfer key data store,

wherein the key receiver is operable, in response to receiving an encrypted cryptographic key, to retrieve at least one transfer key for decrypting the encrypted cryptographic key from the transfer key data store, and to decrypt the encrypted cryptographic key using the retrieved transfer key to recover the cryptographic key,

wherein the decryption using the transfer key employs a symmetric encryption algorithm,

wherein the registration controller is operable to retrieve a master transfer key associated with the network apparatus and plural user transfer keys, each user transfer key being associated with a different user within the group of users,

wherein the network apparatus has a network address and an associated electronic mail address,

wherein the registration controller is operable to receive i) a signal sent to the network address for the network apparatus conveying a first part of the master transfer key, and ii) an electronic mail message sent to the associated electronic mail address for the network apparatus conveying a second part of the master transfer key, and the registration controller is further operable to recover the master transfer key using said first and second parts.

2. A network apparatus according to claim 1, wherein subsequent to the retrieval of the master transfer key, the registration controller is operable to receive encrypted user transfer keys, to decrypt the encrypted user transfer keys using the master transfer key to recover the user transfer keys, and to store the recovered user transfer keys in the transfer key data store.

3. A network apparatus according to claim 2, wherein the encrypted user transfer keys are received by the network apparatus in the form of a network signal sent to the network address for the network apparatus.

4. A network apparatus according to claim 3, wherein subsequent to the retrieval of the user transfer keys, the registration controller is further operable i) to receive encrypted cryptographic keys, each encrypted cryptographic key being associated with a respective one user of the group of users, ii) to decrypt each encrypted cryptographic keys using the user transfer key for the associated one user of the group of users to recover the cryptographic keys, and iii) to store the recovered cryptographic keys in the cryptographic keys data store.

5. A network apparatus according to claim 4, wherein the registration controller is operable to obtain identification information for the group of users from a lightweight directory access protocol server associated with said one or more remote network devices, and

wherein in response to receiving the identification information for the group of users from the lightweight directory access protocol server, the registration controller is operable to forward said identification information to the remote server.

6. A network apparatus according to claim 5, wherein the identification information comprises electronic mail address information.

7. A network apparatus according to claim 1, wherein the network apparatus further comprises:

a key request processor operable, in response to a request from one user of the group of users for a cryptographic key associated with said one user of the group of users, to retrieve one or more cryptographic keys associated with said one user of the group of users from the data store and to transmit the one or more retrieved cryptographic keys to said one user of the group of users.

8. A network apparatus according to claim 7, wherein the request processor is operable to encrypt the cryptographic key associated with said one user of the group of users using a user transfer key associated with said one user of the group of users.

9. A network apparatus according to claim 1, wherein the network apparatus further comprises:

a decryption controller operable to control decryption of a received encrypted electronic mail message.

10. A network apparatus according to claim 9, wherein the received encrypted electronic mail message is addressed to the electronic mail address for one user of the group of users, and

wherein the decryption controller is operable to retrieve a cryptographic key associated with said addressed user and to decrypt the encrypted electronic mail message using the retrieved cryptographic key.

11. A network apparatus according to claim 9, wherein the received encrypted electronic mail message is sent from the electronic mail address for one user of the group of users, and

wherein the decryption controller is operable to retrieve a cryptographic key associated with said electronic mail address for the sender and to decrypt the encrypted electronic mail message using the retrieved cryptographic key.

12. A network apparatus according to claim 1, wherein the network apparatus further comprises:

an encryption controller operable to control encryption of a received electronic mail message sent by one user of the group of users to one or more addresses.

13. A network apparatus according to claim 12, wherein the encryption controller is operable to calculate a cryptographic key for an addressee of the received electronic mail message using the electronic mail address for the addressee.

14. A local area network comprising a network apparatus according to claim 1, wherein the transmitter of the network apparatus is operable to transmit a request for cryptographic keys to a remote server external to the local area network.

15. A network apparatus operable to communicate with one or more remote network devices which are associated with a group of users, the network apparatus comprising:

a request transmitter operable to transmit over a network to a remote server a request for cryptographic keys for the group of users;

a key receiver operable to receive cryptographic keys for the group of users and to store the received cryptographic keys in a cryptographic keys data store; and

a user registration controller operable to control a registration procedure to add a new user to the group of users,

wherein the network apparatus comprises a transfer key data store, and wherein the user registration controller is operable to retrieve a user transfer key from the remote server, to store the user transfer key in a transfer key data store, and to forward the retrieved user transfer key to said new user,

wherein the user registration controller initiates registration of the new user in response to signal from a user network address conveying a new user request including an electronic mail address for the new user and a token identifying the new user,

wherein the request processor is operable to request verification of the token from a lightweight directory access protocol server,

wherein in response to verification of the token by the lightweight directory access protocol server, the request processor is operable to transmit a signal to said user network address conveying the user transfer key for the new user, and

wherein in the absence of verification of the token by the lightweight directory access protocol server, the request processor is operable to split the user transfer key for the new user into two or more parts and to send a signal to the user network address conveying a first part of the user transfer key for the new user and to transmit an electronic message to the electronic mail address for the new user conveying a second part of the user transfer key for the new user.