Secure message delivery using a trust broker

• US 9,917,828 B2
• Filed: 05/06/2014
• Issued: 03/13/2018
• Est. Priority Date: 06/23/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Byrum, Frank, Mehta, Mayank, Jain, Chandresh, Conceicao, Ladislau, Kress, Brian, Gourevitch, Greg, Nelte, Michael, Barnes, Chris
• Primary Examiner(s): Korsak, Oleg
• Assistant Examiner(s): Kanaan, Simon
• Application Number:
  US14/271,304
• Publication Number:
  US 20140245000A1
• Time in Patent Office: 1,407 Days
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213

Abstract

An email security system is described that allows users within different organizations to securely send email to one another. The email security system provides a federation server on the Internet or other unsecured network accessible by each of the organizations. Each organization provides identity information to the federation server. When a sender in one organization sends a message to a recipient in another organization, the federation server provides the sender'"'"'s email server with a secure token for encrypting the message to provide secure delivery over the unsecured network.

Claims

1. A computer-implemented method comprising:

storing, in a data store associated with a federation server, first identity information associated with a first server and second identity information associated with a second server, wherein;

the first server is configured to provide a computing service to a first user,

the second server is configured to provide a computing service to a second user,

the federation server is configured to communicate with, and act as a trust broker between, the first server and the second server,

the first identity information includes a first public key associated with the first server, and

the second identity information includes a second public key associated with the second server;

receiving, by the federation server, a request from the first server for a token for securely sending a message from the first server to the second server over an unsecured communication network between the first server and the second server; and

in response to the request from the first server;

identifying, by the federation server, a first private key from the request;

verifying, by the federation server, identity of the first server using the first private key and the first public key;

based on verifying the identity of the first server, generating, by the federation server, an encrypted token that is encrypted with the second public key and includes a symmetric key; and

sending, by the federation server to the first server, a response to the request, wherein the response includes the encrypted token that is decryptable by the second server using a second private key that is stored in association with the second server and corresponds to the second public key.

2. The computer-implemented method of claim 1, wherein the first server is associated with a first organization, and the second server is associated with a second organization.

3. The computer-implemented method of claim 1, wherein:

the first server is configured to secure the message by encrypting the message with a separate encryption key and encrypting the separate encryption key with the symmetric key, and

the second server is configured to obtain the symmetric key from the encrypted token, decrypt the separate encryption key using the symmetric key, and decrypt the message using the separate encryption key.

4. The computer-implemented method of claim 1, further comprising:

receiving, by the federation server from the first server, a request for each domain of a plurality of different domains identified in the message, wherein the message is addressed to multiple recipients at the different domains.

5. The computer-implemented method of claim 1, wherein the encrypted token can only be opened by the second server using the second private key.

6. The computer-implemented method of claim 1, wherein the request includes information identifying a purpose for which the token is requested.

7. The computer-implemented method of claim 1, wherein the first server is configured to secure the message by encrypting the message with the symmetric key, and the second server is configured to obtain the symmetric key from the encrypted token and decrypt the message using the symmetric key.

8. A computing system comprising:

at least one processor; and

memory storing instructions that, when executed by the at least one processor, configure the computing system to;

store, in a data store associated with a federation server, first identity information associated with a first server and second identity information associated with a second server, wherein;

the first server is configured to provide a computing service to a first user,

the second server is configured to provide a computing service to a second user,

the federation server is configured to communicate with and, act as a trust broker between, the first server and the second server,

the first identity information includes a first public key associated with the first server, and

the second identity information includes a second public key associated with the second server;

receive, by the federation server, a request from the first server for a token for securely sending a message from the first server to the second server over an unsecured communication network between the first server and the second server; and

in response to the request from the first server;

identify, by the federation server, a first private key from the request,

verify, by the federation server, identity of the first server as a sender of the message using the first private key and the first public key,

based on verifying identity of the first server, generate, by the federation server, an encrypted token that is encrypted with the second public key and includes a symmetric key that encrypts the message; and

send, by the federation server to the first server, a response to the request, wherein the response includes the encrypted token that is decryptable using a second private key that is stored in association with the second server and corresponds to the second public key.

9. The computing system of claim 8, wherein

the second server is configured to:

receive the message having the encrypted token;

access the symmetric key using the second private key corresponding to the second public key encrypted in the encrypted token; and

based on accessing the symmetric key, decrypt the message using the symmetric key.

10. The computing system of claim 8, wherein:

the first server is configured to secure the message by encrypting the message with a separate encryption key and encrypting the separate encryption key with the symmetric key, and

the second server is configured to obtain the symmetric key from the encrypted token, decrypt the separate encryption key using the symmetric key, and decrypt the message using the separate encryption key.

11. The computing system of claim 8, wherein the instructions configure the computing system to:

receive, by the federation server, a request for each domain, of a plurality of different domains identified in the message, when the message is addressed to multiple recipients at the different domains.

12. The computing system of claim 8, wherein the instructions configure the computing system to:

determine, by the second server, that the verification of the first server as a sender of the message is valid based on the second private key of the second server.

13. The computing system of claim 8, wherein the instructions configure the computing system to:

identify, by the federation server and based on the request, a purpose for which the token is requested.

14. The computing system of claim 8, wherein the first server is associated with a first organization, and the second server is associated with a second organization.

15. A federation server comprising:

at least one processor; and

memory storing instructions executable by the at least one processor, wherein the instructions, when executed, configure the federation server to;

store first identity information associated with a first server and second identity information associated with a second server, wherein;

the first server is configured to provide a computing service to a first user,

the second server is configured to provide a computing, service to a second user,

the federation server is configured to communicate with and, act as a trust broker between, the first server and the second server,

the first identity information includes a first public key associated with the first server; and

the second identity information includes a second public key associated with the second server;

receive a request from the first server for a token for securely sending a message from the first server to the second server over an unsecured communication network between the first server and the second server; and

based on the request,

identify a first private key;

based on a determination that the first private key corresponds to the first public key associated with the first server, verify identity of the first server as a sender, of the request;

based on the first server being verified as the sender of the request, generate an encrypted token that is encrypted with the second public key and a symmetric key;

send a response to the request to the first server, wherein;

the response includes the encrypted token containing the second public key and the symmetric key, and

the encrypted token is decryptable using a second private key that is stored in association with the second server and corresponds to the second public key.

16. The federation server of claim 15, wherein:

the first server is configured to secure the message by encrypting the message with the symmetric key, and

the second server is configured to obtain the symmetric key from the encrypted token and decrypt the message using the symmetric key.

17. The federation server of claim 15, wherein:

the first server is configured to secure the message by encrypting the message with a separate encryption key and encrypting the separate encryption key with the symmetric key, and

the second server is configured to obtain the symmetric key from the encrypted token, decrypt the separate encryption key using the symmetric key, and decrypt the message using the separate encryption key.

18. The federation server of claim 15, wherein the instructions configure the federation server to:

receive a request for each domain, of a plurality of different domains identified in the message, when the message is addressed to multiple recipients at the different domains.

19. The federation server of claim 15, wherein the symmetric key includes a proof of possession key that is accessed to decrypt message content contained in the message.

20. The federation server of claim 15, wherein the first server is associated with a first organization, and the second server is associated with a second organization.