Efficient encryption, escrow and digital signatures

• US 9,712,519 B2
• Filed: 08/25/2015
• Issued: 07/18/2017
• Est. Priority Date: 03/13/2013
• Status: Active Grant

• Current Assignee: Payfone Incorporated
• Original Assignee: Early Warning Services, LLC (Bank of America Corp.)
• Inventors: Ganesan, Ravi
• Primary Examiner(s): Cribbs, Malcolm
• Application Number:
  US14/835,046
• Publication Number:
  US 20150381608A1
• Time in Patent Office: 693 Days
• Field of Search: None
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A network server is operated so as to facilitate legal eavesdropping by receiving, from the first user via a network, a session key (SK) encrypted with a second user'"'"'s public key, k_pubU2, and the SK encrypted with an escrow server'"'"'s (ES) public key, k_pubES. The k_pubU2 key is the public key of the second user asymmetric private/public key pair k_priU2/k_pubU2 The k_pubES key is the public key of the ES asymmetric private/public key pair k_priES/k_pubES. The received SK encrypted with k_pubES is stored. The SK encrypted with k_pubU2 is transmitted to the second user via the network. A message encrypted with the SK is received from one of the first and the second users via the network, stored, and transmitted to the other of the first and the second users via the network.

Claims

1. A method of operating a user smart communication device to securely communicate email or text messages to another user via a network, comprising:

retrieving, from a network server, the other user'"'"'s certificate, where the other user'"'"'s certificate includes k_pubOU, which is the public key of the other user'"'"'s private/public asymmetric key pair k_priOU/k_pubOU;

creating a session key (SK) for securing communications between the user and the other user;

storing the SK;

encrypting the SK with the other user'"'"'s public key, k_pubOU;

encrypting the SK with an escrow public key k_pubES received from an escrow server;

transmitting, to the network server, the SK encrypted with the other user'"'"'s public key k_pubOU and the SK encrypted with the escrow public key k_pubES, for forwarding the SK encrypted with the other user'"'"'s public key k_pubOU to the other user via the network server and for storing the SK encrypted with the escrow public key k_pubES at the network server, the stored SK encrypted with the escrow public key k_pubES being accessible at the network server for transmission to an authorized eavesdropper for decrypting messages between the user and the other user;

transmitting, to the other user via the network server, a first email or text message encrypted with the SK;

receiving, from the other user via the network server, a second email or text message encrypted with the SK; and

decrypting the received encrypted second message with the stored SK.

2. The method of operating a user smart communication device according to claim 1, further comprising:

receiving, from an escrow server, a certificate, including the escrow public key k_pubES; and

retrieving the escrow public key k_pubES from the certificate received from the escrow server.

3. A method of operating a user smart communication device to securely communicate email or text messages to another user via a network, comprising:

retrieving, from a network server, the other user'"'"'s certificate, where the other user'"'"'s certificate includes k_pubOU, which is the public key of the other user'"'"'s private/public asymmetric key pair k_priOU/k_pubOU;

creating a session key (SK) for securing communications between the user and the other user;

storing the SK;

encrypting the SK with the other user'"'"'s public key, k_pubOU;

encrypting the SK with an escrow public key k_pubES received from an escrow server;

transmitting, to the network server, the SK encrypted with the other user'"'"'s public key k_pubOU and the SK encrypted with the escrow public key k_pubES, for forwarding the SK encrypted with the other user'"'"'s public key k_pubOU to the other user via the network server and for storing the SK encrypted with the escrow public key k_pubES at the network server, the stored SK encrypted with the escrow public key k_pubES being accessible at the network server for transmission to an authorized eavesdropper for decrypting messages between the user and the other user; and

transmitting, to the other user via the network server, a first email or text message encrypted with the SK.

4. The method of operating a user smart communication device according to claim 3, further comprising:

receiving, from an escrow server, a certificate, including the escrow public key k_pubES; and

retrieving the escrow public key k_pubES from the certificate received from the escrow server.