System and method for secure use of messaging systems

• US 9,721,119 B2
• Filed: 09/17/2015
• Issued: 08/01/2017
• Est. Priority Date: 05/21/2010
• Status: Active Grant

• Current Assignee: CyberArk Software Ltd.
• Original Assignee: Vaultive Ltd.
• Inventors: Tal, Maayan, Matzkel, Ben, Lahav, Aviad
• Primary Examiner(s): NDIAYE, CHEIKH T
• Application Number:
  US14/857,260
• Publication Number:
  US 20160004883A1
• Time in Patent Office: 684 Days
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity

Abstract

A system and method for secure use of messaging systems. A mediator may receive an original message, process the original message to produce a processed message, and may forward the processed message to a server or a messaging system. A mediator may receive a processed message from a server or a messaging system, process the received processed message to produce an unprocessed message that may be substantially identical to the original message and may forward the unprocessed message to a destination.

Claims

1. A system for securing messages comprising one or more computing devices of a restricted access network including:

a computing device configured to function as a forward mediator of the restricted access network to;

receive an original plaintext message comprising an original recipient address having an original recipient domain,

process the original message to provide a processed message, wherein the processing includes transforming at least a portion of the original plaintext message and the recipient address and replacing the original recipient domain by appending a different domain of a reverse mediator to cause a server to route the processed message via the reverse mediator, and

forward the at least one processed message to the server of a messaging system of a public network; and

a computing device configured to function as a reverse mediator of the restricted access network to;

receive a processed message from the server, and

process the received processed message to provide an unprocessed plaintext message for forwarding to a recipient.

2. The system of claim 1, wherein said transforming at least a portion of the original message includes encrypting the portion of the original message.

3. The system of claim 1, wherein the portion is selected from the group consisting of:

a sender address, a subject associated with the message, at least one attachment, at least one message header, and a body of the message.

4. The system of claim 1, wherein processing the recipient address is designed to cause the server to send the processed message to the reverse mediator.

5. The system of claim 1, wherein said original message and said unprocessed message are email messages.

6. The system of claim 1, wherein processing the original message includes classifying the original message to produce message classification information.

7. The system of claim 1, wherein:

processing the original message to produce the processed message includes;

generating at least one secured search term based on at least one original term included in the original message; and

including the generated at least one secured search term in the processed message.

8. The system of claim of claim 7, wherein the processing of the original message to produce the processed message includes changing a location of an original term and said at least one secured search term.

9. The system of claim 7, wherein the processing of the original message to produce the processed message includes deterministically encrypting said at least one original search terms using a secret key or applying non-reversible keyed security transformation to at least one original search term.

10. The system of claim 1, further comprising a search mediator, said search mediator to:

receive a first request from a client;

generate a second request based on the first request;

generate at least one secured search term based on at least one original search term included in the first request;

include the at least one secured search term in the second request; and

forward the second request to the server.

11. The system of claim 1, wherein the processing of the original message to produce the processed message includes changing a location of at least a portion of the original message.

12. The system of claim 1, wherein the processing of the original message to produce the processed message is according to:

a sender of the message or a receiver of the message.

13. The system of claim 1, wherein the forward mediator is configured to include a parameter in the processed message and, the reverse mediator is configured to validate the processed message based on the parameter.

14. The system of claim 13, wherein validating the processed message is based on at least one of:

an integrity parameter and a time the original message was received by the forward mediator.

15. The system of claim 1, wherein the processing of the original message to produce the processed message includes normalizing at least one original term included in the original message and generating a secured search term based on the normalized at least one original term.

16. The system of claim 1, wherein the processing of the original message to produce the processed message includes selecting at least one original search term based on at least one of:

a length of an original search term, a presence of an original search term in a set of terms, and an absence of an original search term in a set of terms.

17. The method of claim 1 comprising hiding the identity of a user by hiding the recipient address of an incoming message.

18. The method of claim 1 comprising generating a fake recipient address that is adapted to be identified as fake by the reverse mediator but not by the server.

19. The method of claim 1 comprising placing the processed recipient address in another message part selected from the group consisting of:

the message body or the message subject.

20. The method of claim 1 comprising changing a location of the original recipient address to generate the processed recipient address by moving the original recipient address between an email “

cc”

or “

bcc”

recipient list and a “

to”

recipient list.

21. A method of securing messages in a restricted access network, the method comprising:

at a forward mediator of the restricted access network;

receiving an original plaintext message comprising an original recipient address having an original recipient domain destined to a recipient;

processing the original message to provide a processed message, wherein the processing includes transforming at least a portion of the original plaintext message and the recipient address and replacing the original recipient domain by appending a different domain of a reverse mediator to cause a server to route the processed message via the reverse mediator;

forwarding the processed message to the server of a messaging system;

at a reverse mediator of the restricted access network;

receiving the processed message from the server;

processing the received processed message to provide an unprocessed plaintext message; and

forwarding the unprocessed message to the recipient.

22. The method of claim 21, wherein processing the original message includes encrypting at least a portion of the original message.

23. The method of claim 21, wherein processing the original message includes encrypting at least a portion of the original message, wherein the portion is selected from the group consisting of:

a sender address, a subject associated with the message, at least one attachment, at least one message header, and a body of the message.

24. The method of claim 21, wherein processing the recipient address is designed to cause the server to send the processed message to the reverse mediator.

25. The method of claim 21, wherein said original message and said unprocessed message are email messages.

26. The method of claim 21, wherein processing the original message includes classifying the original message to produce message classification information.

27. The method of claim 21, wherein processing the original message includes generating at least one secured search term corresponding to at least one original search terms included in the original message, wherein said generating includes at least one of:

normalizing at least one original search terms, selecting at least one original search term according to a length of an original search term, selecting at least one original search term according to a presence in a set of terms, encrypting at least one original search term using a secret key and applying a one-way keyed security transformation to at least one original search term.