Fast escrow delivery

• US 20020101998A1
• Filed: 06/14/2001
• Published: 08/01/2002
• Est. Priority Date: 06/10/1999
• Status: Abandoned Application

• Current Assignee: Message Secure Corp. (BAE Systems Plc)
• Original Assignee: Message Secure Corp. (BAE Systems Plc)
• Inventors: Toh, Eng-Whatt, Teo, Kok-Hoon, Yip, See-Wai, Wong, Chee-Hong, Fong, Kok-Khuan
• Application Number:
  US09/881,899
• Publication Number:
  US 20020101998A1
• Time in Patent Office: Days
• US Class Current: 380/286
• CPC Class Codes: G06F 2211/008 Public Key, Asymmetric Key, Asymmetric Encryption
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A system, method and computer readable medium for securely transmitting an information package (10) to an addressee (190) via a network (108), wherein an addressee (190) is not required to have a private-public key pair before the package (10) is sent. A sending system (102) encrypts the package (10) with a package encryption key (600) and then encrypts a package decryption key (601) with an escrow encryption key (380) obtained from an escrow key manager (116). The encrypted package (10) and encrypted package decryption key (601) are held in escrow by a server system (104), until the addressee (190) is issued a new public and private key pair (390, 391). The server system (104) decrypts the package decryption key (601), re-encrypts it with the addressee'"'"'s new public key (390), and forwards the encrypted package (10) and re-encrypted package decryption key (601) to the addressee'"'"'s receiving system (106). The receiving system (106) receives the delivery and decrypts the information package (10).

Claims

1. A computer-implemented method for securely transmitting an information package from a sender to an addressee via a network, the method comprising a server system performing the steps of:

receiving a delivery from the sender, the delivery comprising;

the information package encrypted with a package encryption key; and

a package decryption key encrypted with an escrow key;

storing the delivery in escrow for the addressee;

sending to the addressee a notification of the delivery; and

in response to receiving an acknowledgement from the addressee;

obtaining a new public key of the addressee;

decrypting the package decryption key;

encrypting the package decryption key with the addressee'"'"'s new public key; and

transmitting to the addressee the information package encrypted with the package encryption key and the package decryption key encrypted with the addressee'"'"'s new public key.

2. The method of claim 1 further comprising the server system performing the steps of:

receiving a request from the sender for a public key of the addressee;

determining whether the addressee has a public key; and

in response to not finding a public key of the addressee;

transmitting the escrow key to the sender.

3. The method of claim 2 wherein the step of determining whether the addressee has a public key comprises the sub-step of:

checking a public key database for a public key of the addressee.

4. The method of claim 1 further comprising the server system performing the steps of:

in response to the sender searching a public key database for a public key of the addressee and not finding a public key of the addressee;

receiving a request from the sender for the escrow key; and

transmitting the escrow key to the sender.

5. The method of claim 1, further comprising the server system performing the steps of:

issuing the new public key to the addressee; and

storing the addressee'"'"'s new public key in a public key database.

6. The method of claim 1, wherein the escrow key is one of a group comprising a symmetric key and an asymmetric key.

7. The method of claim 1, wherein the notification is one of a group comprising an e-mail notification, a desktop notification, a voice notification, a pager notification, and a facsimile notification.

8. The method of claim 1 further comprising the server system performing the steps of:

receiving from the sender a digest of one from a group comprising;

the information package;

the information package encrypted with the package encryption key; and

the information package encrypted with the package encryption key and the package decryption key encrypted with the escrow key; and

in response to receiving the acknowledgement from the addressee;

transmitting the digest to the addressee.

9. The method of claim 8, wherein the digest is encrypted by a private key of the sender.

10. The method of claim 1, wherein the acknowledgement from the addressee further comprises the step of authenticating the identity of the addressee.

11. A system for securely transmitting an information package from a sender to an addressee via a network, the system comprising:

a storage module, comprising a computer-readable storage medium, for receiving, and storing in escrow, a delivery from the sender, said delivery comprising;

a package decryption key encrypted with an escrow key, and

the information package encrypted with a package encryption key;

a notification module coupled to the storage module, for sending a notification to the addressee via the network;

a key registration module coupled to the notification module for, in response to receiving an acknowledgement from the addressee, receiving a new public key of the addressee; and

a transmission module coupled to the storage module, for decrypting the package decryption key and re-encrypting the package decryption key with the new public key of the addressee, and for transmitting to the addressee the information package encrypted with the package encryption key and the package decryption key encrypted with the addressee'"'"'s new public key.

12. The system of claim 11 further comprising:

a directory interface coupled to the storage module for checking, in response to receiving a request from the sender for a public key of the addressee, a public key database for the public key of the addressee; and

an escrow key manager coupled to the directory interface for providing, in response to the directory interface failing to obtain a public key of the addressee from the public key database, an escrow key for encrypting the package decryption key.

13. The system of claim 11, wherein the key registration module also stores the addressee'"'"'s new public key in a public key database.

14. The system of claim 11, further comprising:

a public key database coupled to the directory interface for storing a public key of at least one addressee.

15. The system of claim 11, wherein the escrow key comprises one from a group comprising a symmetric key and an asymmetric key.

16. The system of claim 11, wherein the notification is one of a group comprising an e-mail notification, a desktop notification, a voice notification, a pager notification, and a facsimile notification.

17. The system of claim 11 further comprising:

an authentication module coupled to the notification module for authenticating the addressee prior to transmitting the information package encrypted with the package encryption key and the package decryption key encrypted with the addressee'"'"'s new public key.

19. The computer-readable medium of claim 18 further comprising program code adapted to perform the steps of:

receiving a request from the sender for a public key of the addressee;

determining whether the addressee has a public key; and

in response to not obtaining a public key of the addressee;

transmitting the escrow key to the sender.

20. The computer-readable medium of claim 19, further comprising program code adapted to perform the step of:

checking a public key database for the public key of the addressee.

21. The computer-readable medium of claim 18, further comprising program code adapted to perform the steps of:

in response to the sender searching a public key database for a public key of the addressee and not obtaining said public key;

receiving a request from the sender for the escrow key; and

transmitting the escrow key to the sender.

22. The computer-readable medium of claim 18, further comprising program code adapted to perform the steps of:

issuing the new public key to the addressee; and

storing the addressee'"'"'s new public key in a public key database.

23. The computer-readable medium of claim 18, wherein the notification is one of a group comprising an e-mail notification, a desktop notification, a voice notification, a pager notification, and a facsimile notification.

24. The computer-readable medium of claim 18, further comprising program code adapted to perform the steps of:

receiving from the sender a digest of one from a group comprising;

the information package;

the information package encrypted with the package encryption key; and

the information package encrypted with the package encryption key and the package decryption key encrypted with the escrow key; and

in response to receiving the acknowledgement from the addressee;

transmitting the digest to the addressee.

25. The method of claim 23, wherein the digest is encrypted by a private key of the sender.

26. The computer-readable medium of claim 18, further comprising program code adapted to perform the step of:

authenticating the addressee prior to transmitting the information package encrypted with the package encryption key and the package encryption key encrypted with the addressee'"'"'s new public key.

18. A computer-readable medium comprising computer program code for securely transmitting an information package from a sender to an addressee via a network, the computer program code adapted to perform the steps of:

receiving a delivery from the sender, the delivery comprising;

the information package encrypted with a package encryption key; and

a package decryption key encrypted with an escrow key;

storing the delivery in escrow for the addressee;

sending to the addressee a notification of the delivery; and

in response to receiving an acknowledgement from the addressee;

obtaining a new public key of the addressee;

decrypting the package decryption key;

encrypting the package decryption key with the addressee'"'"'s new public key; and

transmitting to the addressee the information package encrypted with the package encryption key and the package decryption key encrypted with the addressee'"'"'s new public key.