Secure communication apparatus and method for facilitating recipient and sender activity delegation

• US 20030182559A1
• Filed: 03/22/2002
• Published: 09/25/2003
• Est. Priority Date: 03/22/2002
• Status: Abandoned Application

• Current Assignee: Entrust Incorporated (Entrust Corp.), Entrust Technologies Limited
• Original Assignee: Entrust Incorporated (Entrust Corp.)
• Inventors: Sutherland, Blake, Curry, Ian, Simzer, Kevin
• Application Number:
  US10/105,046
• Publication Number:
  US 20030182559A1
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates

Abstract

A method and apparatus, such as a secure distribution server, receives encrypted information from a sender, wherein the encrypted information is for transmission to a plurality of intended recipients. In addition to the encrypted information, the method includes receiving an encrypted secret key that is encrypted using a public key associated with the secure distribution server. The method and apparatus decrypts the encrypted secret key to produce a decrypted secret key. The method and apparatus then obtains a public key associated with one or more delegates of the intended recipient(s), sender(s) or other entity and encrypts the decrypted secret key with the corresponding public key of at least one delegate (or each of a plurality of delegates) associated with the intended recipient(s) or sender(s) to produce at least one delegate-specific secure secret key (or plurality of delegate-specific secure secret keys). The method and apparatus then forwards the received encrypted information sent by the sender and also sends at least one delegate-specific secure secret key to a corresponding delegate of the intended recipient(s) or sender(s).

Claims

1. A method for securing information comprising:

receiving encrypted information from a sender for transmission to at least one intended recipient and an encrypted secret key encrypted using a public key associated with a network element;

decrypting the encrypted secret key to produce a decrypted secret key;

determining if a delegate is designated for at least one of the intended recipient and a sender;

obtaining a corresponding public key of the delegate;

encrypting the decrypted secret key for the delegate using a public key corresponding to the delegate to produce a delegate-specific secure secret key; and

forwarding, for the delegate, the encrypted information sent by the sender and the delegate-specific secure secret key.

2. The method of claim 1 including receiving delegate identification data associated with at least one of the intended recipient and sender, storing the delegate identification data and wherein the step of obtaining the corresponding public key of the delegate is based on the stored delegate identification data.

3. The method of claim 1 including sending, by at least one of the intended recipient and a sender, the delegate identification data to a secure distribution server that stores delegate identification for at least one of a plurality of intended recipients and sender.

4. The method of claim 1 including sending, by a third party, delegate identification data to a secure distribution server that stores delegate identification for at least one of a plurality of intended recipients and a plurality of senders.

5. The method of claim 1 including the step of storing for at least one of a plurality of intended recipients and senders, delegate identification data wherein the delegate identification data represents at least one of:

a delegated application and a delegated device.

6. The method of claim 1 wherein each of the steps of receiving, decrypting, determining, obtaining, encrypting and forwarding are performed by the secure distribution server.

7. A method for securing information comprising:

receiving, by a secure distribution server, encrypted information from a sender for transmission to at least one intended recipient and an encrypted secret key encrypted using a public key associated with the secure distribution server;

decrypting the encrypted secret key to produce a decrypted secret key;

obtaining a corresponding public key of the at least one intended recipient;

encrypting the decrypted secret key for the at least one intended recipient using a corresponding public key to produce at least one recipient-specific secure secret key;

determining if a delegate is designated for at least one of the intended recipient and a sender;

obtaining a corresponding public key of the delegate;

encrypting the decrypted secret key for the delegate using a public key corresponding to the delegate to produce a delegate-specific secure secret key;

forwarding the encrypted information sent by the sender and at least one recipient-specific secure secret key for the at least one corresponding intended recipient; and

forwarding the encrypted information sent by the sender and the delegate-specific secure secret key for the delegate.

8. The method of claim 7 including receiving delegate identification data associated with the intended recipient or at least one sender, storing the delegate identification data and wherein the step of obtaining the corresponding public key of the delegate is based on the stored delegate identification data.

9. The method of claim 7 including sending, by the intended recipient, the delegate identification data to a secure distribution server that stores delegate identification for a plurality of intended recipients or a plurality of senders.

10. The method of claim 7 including sending, by a third party, the delegate identification data to a secure distribution server that stores delegate identification data for at least one of a plurality of intended recipients and a plurality of senders.

11. The method of claim 7 including the step of storing for a plurality of intended recipients, delegate identification data wherein the delegate identification data represents at least one of:

a delegated application and a delegated device.

12. The method of claim 7 including determining a plurality of intended recipients and retrieving corresponding public keys of the plurality of intended recipients for encrypting the secret key and for each of the plurality of intended recipients, also retrieving corresponding public keys associated with delegates.

13. The method of claim 7 wherein encrypting the secret key includes encrypting the secret key using a public key for each of a plurality of secure distribution servers to produce a plurality of secure distribution server specific encrypted secret keys.

14. The method of claim 7 including storing the encrypted information in an encrypted form locally on the device that performed the step of encrypting information with the secret key.

15. The method of claim 7 including the step of determining, by the secure distribution server, if the encrypted information needs to be sent to other entities, if so, encrypting the decrypted secret key using a public key associated with each of the additional entities.

16. The method of claim 7 wherein obtaining the corresponding public key of the delegate includes obtaining the corresponding public key from at least one of:

a certificate retrieval and validation service, a local cache, an LDAP lookup and a certificate directory lookup.

17. A network element comprising:

means for decrypting a received encrypted secret key encrypted using a public key associated with the network element to produce a decrypted secret key;

means, operatively coupled to the means for decrypting, for obtaining a corresponding public key of at least one delegate associated with at least one of an intended recipient and a sender;

means, operatively coupled to the means for obtaining, for encrypting the decrypted secret key for the at least one delegate using a corresponding public key to produce a delegate-specific secure secret key; and

means for forwarding the encrypted information sent by a sender and at least one delegate-specific secure secret key for at least one corresponding delegate associated with the intended recipient or the sender.

18. The network element of claim 17 including memory, operably coupled to the means for obtaining, that stores the delegate identification data and wherein the means for obtaining uses the stored delegate identification data to obtain the corresponding public key of the delegate.

19. The network element of claim 18 wherein the memory stores delegate identification for at least one of a plurality of intended recipients and a plurality of senders.

20. The network element of claim 17 wherein the delegate identification data represents at least one of:

a delegated application and a delegated device.

21. The network element of claim 18 wherein the means for obtaining retrieves corresponding public keys of a plurality of delegates associated with at least one of a sender and a plurality of intended recipients, for encrypting the decrypted secret key from at least one of:

a certificate retrieval and validation service, an LDAP lookup, a local cache and a certificate directory lookup.

22. A storage medium comprising:

memory containing executable instructions that when read by one or more processing devices, causes the one or more processing devices to;

receive encrypted information from a sender for transmission to at least one intended recipient and an encrypted secret key encrypted using a public key associated with a network element;

decrypt the encrypted secret key to produce a decrypted secret key;

determine if a delegate is designated for at least one of the intended recipient and a sender;

obtain a corresponding public key of the delegate;

encrypt the decrypted secret key for the delegate using a public key corresponding to the delegate to produce a delegate-specific secure secret key; and

forward, for the delegate, the encrypted information sent by the sender and the delegate-specific secure secret key.

23. The storage medium of claim 22 including memory containing executable instructions that when read by the one or more processing devices causes the one or more processing devices to:

receive delegate identification data associated with at least one of the intended recipient and the sender, store the delegate identification data and obtain the corresponding public key of the delegate based on the stored delegate identification data.

24. The storage medium of claim 22 including memory containing executable instructions that when read by the one or more processing devices causes the one or more processing devices to:

send, by at least one of the intended recipient and the sender, the delegate identification data to a secure distribution server that stores delegate identification data for a plurality of intended recipients.

25. The storage medium of claim 22 including memory containing executable instructions that when read by the one or more processing devices causes the one or more processing devices to:

send, by a third party, the delegate identification data to a secure distribution server that stores delegate identification for at least one of a plurality of intended recipients and a plurality of senders.

26. The storage medium of claim 22 including memory containing executable instructions that when read by the one or more processing devices causes the one or more processing devices to:

store for at least one of a plurality of intended recipients and a plurality of senders, delegate identification data wherein the delegate identification data represents at least one of;

a delegated application and a delegated device.

27. The storage medium of claim 22 including memory containing executable instructions that when read by the one or more processing devices causes the one or more processing devices to:

determine a plurality of intended recipients and retrieve corresponding public keys of the plurality of intended recipients for encrypting the secret key.

28. The storage medium of claim 22 including memory containing executable instructions that when read by the one or more processing devices causes the one or more processing devices to determine if the encrypted information needs to be sent to other entities, if so, encrypting the decrypted secret key using a public key associated with each of the additional entities.

29. A secure communication system comprising:

at least one sender that encrypts information with a secret key to produce encrypted information, encrypts the secret key with a public key associated with a network element to produce an encrypted secret key, and during an online session, sends the encrypted information and the encrypted secret key to the network element;

at least one intended recipient;

at least one network element, operatively coupled to the sender and to the at least one intended recipient, including;

means for decrypting a received encrypted secret key encrypted using a public key associated with the network element to produce a decrypted secret key;

means, operatively coupled to the means for decrypting, for obtaining a corresponding public key of at least one delegate associated with an intended recipient or a sender;

means, operatively coupled to the means for obtaining, for encrypting the decrypted secret key for the at least one delegate using a corresponding public key to produce a delegate-specific secure secret key; and

means for forwarding the encrypted information sent by a sender and at least one delegate-specific secure secret key for at least one corresponding delegate associated with the intended recipient.

30. The system of claim 29 including memory, operably coupled to the means for obtaining, that stores the delegate identification data and wherein the means for obtaining uses the stored delegate identification data to obtain the corresponding public key of the delegate.

31. The system of claim 30 wherein the memory stores delegate identification data for a plurality of intended recipients or a plurality of senders.