METHODS AND SYSTEMS FOR INDICATING TRUSTWORTHINESS OF SECURE COMMUNICATIONS

• US 20090106557A1
• Filed: 10/20/2008
• Published: 04/23/2009
• Est. Priority Date: 10/20/2007
• Status: Active Grant

• Current Assignee: Sean Leonard
• Original Assignee: Sean Leonard
• Inventors: Leonard, Sean
• Granted Patent: US 8,661,260 B2
• Time in Patent Office: Days
• US Class Current: 713/179
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

Embodiments of the present invention enable a message recipient or messaging system to indicate the trustworthiness of a message, especially messages that comprise content that has been digitally signed. In addition, embodiments may alter or control the message to change user behavior by preventing the user from doing things that the message would induce the user into doing. In some embodiments, various characteristics and indicia of the message are determined. For example, for e-mail messages having digitally signed content, certain embodiments may determine the entity or entities asserting a basis for trust, the status or role of the sender, the name of the sender, the affiliation of the sender, the messaging address the location, and the most recent status of the trust relationship. Based on the determined indicia, a plain language notification is composed and the message is displayed with the notification. For example, the notification may be displayed in a display bar above or below the message'"'"'s contents, or may appear as a pop-up window. In addition, in some embodiments, the recipient may provide his or her assessment of the indicia, such as the accuracy, reliability, and the trustworthiness of the indicia. The history of interactions between various parties related to the message may also be considered. For example, the history of interactions between the sender and recipient may be considered. The trustworthiness of the certification authority or other entity may also be considered.

Claims

1. A method of indicating a trustworthiness of a received message, said method comprising:

receiving a message comprising content that has been digitally signed by a digital signer;

accessing a set of attestations by a third-party entity known, but not necessarily trusted to software that received the message;

identifying a cryptographic key was used to sign the message and an entity that holds the key;

determining a set of indicium from said secure bindings and said cryptographically secure attestation;

presenting said indicium to said user; and

requesting said user to modify said indicium.

2. The method of claim 1, wherein the digital signer is a sender of the message.

3. The method of claim 1, wherein the digital signer is a recipient of the message.

4. The method of claim 1, wherein the digital signer is a third party that is trusted by at least one of the recipient or the sender.

5. The method of claim 1, wherein identifying the cryptographic key was used to sign the message and the entity that holds the key comprises determining a plurality of cryptographically secure bindings between said content, said message, and said digital signer, and between said digital signer and said trusted entity;

6. The method of claim 1, wherein said digital signer is a certificate authority.

7. The method of claim 1, wherein said cryptographically secure bindings are based on asymmetric cryptography.

8. The method of claim 1, wherein said attestation indicates an attestation of a time.

9. The method of claim 8, wherein the attestation of time is cryptographically signed.

10. The method of claim 8, wherein the attestation of time is a part of a message having an attestation by a third party.

11. The method of claim 10, wherein the attestation by the third party is party of a an OCSP response.

12. The method of claim 1, wherein said attestation indicates an attestation about the digital signer.

13. The method of claim 1, wherein a trusted introducer has introduced a sender of the message to the recipient of the message.

14. An apparatus comprising means configured to perform the method of claim 1.

15. A computer readable medium comprising executable program code that configures a processor to perform the method of claim 1.

16. A method of assessing trustworthiness of a received message, said method comprising:

receiving a message comprising content that is digitally signed by a digital signer;

accessing a set of attestations by a trusted entity;

identifying a cryptographic key was used to sign the message and an entity that holds the key;

determining a set of indicium from said secure bindings, said cryptographically secure attestation;

determining a role from said indicium; and

modifying the message based on said role and said indicium to a recipient of the received message.

17. The method of claim 16, wherein the digital signer is a sender of the message.

18. The method of claim 16, wherein the digital signer is a recipient of the message.

19. The method of claim 16, wherein the digital signer is a third party that is trusted by at least one of the recipient or the sender.

20. The method of claim 16, wherein identifying the cryptographic key was used to sign the message and the entity that holds the key comprises determining a plurality of cryptographically secure bindings between said content, said message, and said digital signer, and between said digital signer and said trusted entity;

21. The method of claim 16, wherein modifying the message comprises withholding display of the message to the recipient based on the role.

22. The method of claim 16, wherein said modification restricts a reference to a predetermined permutation of resources.

23. The method of claim 16, wherein said reference is to a resource to be loaded inline with said message.

24. The method of claim 16, wherein said reference is to a resource to be loaded external to said message.

25. The method of claim 16, wherein said predetermined permutation of resources indicates a time associated with the message.

26. The method of claim 16, wherein said indicium indicates an origin of said message.

27. The method of claim 16, wherein said message is an e-mail.

28. An apparatus comprising means configured to perform the method of claim 16.

29. A computer readable medium comprising executable program code that configures a processor to perform the method of claim 16.

43. The method of claim 16, wherein configuring the message further comprises configuring the message to include a set of user interface elements that, when selected by the recipient, indicate the recipient'"'"'s assessment of trustworthiness of the message.

47. The method of claim 16, further comprising:

determining whether the message is related to at least one other message previously sent by the recipient; and

composing the notification based on the whether the message is related to at least one other message sent by the recipient.

48. The method of claim 16, further comprising:

determining whether the message is related to at least one other message previously sent by a party that is trusted by the recipient; and

composing the notification based on the whether the message is related to at least one other message sent by a party that is trusted by the recipient.

30. A method of indicating a trustworthiness of a message, wherein said message comprises content that is digitally signed, said method comprising:

determining a name of an entity sending the message;

classifying the entity;

determining a validity of the digital signature;

composing a notification that is configured according to a set of plain language grammar templates that indicate at least the name of the entity sending the message, whether the entity is an individual or an organization, and the validity of the digital signature; and

configuring the message to include the notification when the message is displayed.

31. The method of claim 30, wherein classifying the entity comprises classifying the entity as an individual.

32. The method of claim 30, wherein classifying the entity comprises classifying the entity as an organization.

33. The method of claim 30, wherein the message is an e-mail.

34. The method of claim 30, further comprising:

determining an address of the entity sending the message; and

composing the notification to indicate the address of the entity sending the message.

35. The method of claim 30, further comprising:

determining an attestation by a third-party about the digital signature; and

composing the notification to indicate the attestation by the third-party.

36. The method of claim 30, further comprising:

determining a time when the message existed; and

composing the notification to indicate when the message existed.

37. The method of claim 30, further comprising:

determining information based on the time when the message was received and the message; and

composing the notification to indicate when the message was received.

38. The method of claim 37, wherein determining information based on the time when the message was received and the message comprises determining a hash of the message.

39. The method of claim 30, further comprising determining a physical location of the entity sending the message.

40. The method of claim 30, wherein determining a validity of the digital signature comprises determining a certificate authority that issued a digital certificate used for the digital signature.

41. The method of claim 40, further comprising determining whether the certificate authority has revoked the digital certificate.

42. The method of claim 30, wherein determining a validity of the digital signature comprises determining whether the digital signature is based on a self-signed digital certificate.

44. The method of claim 30, further comprising:

determining a history of previous interactions between the recipient and the entity sending the message; and

composing the notification based on the history between the recipient and the entity sending the message.

45. The method of claim 30, further comprising:

identifying a certificate authority that issued a digital certificate used for the digital signature;

determining a history of previous interactions between the recipient and the certificate authority; and

composing the notification based on the history between the recipient and the certificate authority.

46. The method of claim 30, further comprising:

determining whether the message is related to at least one other message previously received by a party trusted by the recipient; and

composing the notification based on the whether the message is related to at least one other message received by the recipient.

49. An apparatus comprising means configured to perform the method of claim 30.

50. A computer readable medium comprising executable program code that configures a processor to perform the method of claim 30.

51. A method of issuing a digital certificate, said method comprising:

determining information regarding a name of a signer of a message;

determining a role of the signer, wherein the role indicates types of messages that the signer will likely sign with a key associated with the digital certificate; and

issuing the digital certificate based on the name of the signer and the role of the signer.

52. The method of claim 51, wherein issuing the digital certificate comprises issuing a digital certificate having fields that are capable of configuring a processor to compute indicium about a message that indicate a sender and an attester of the message, wherein the indicium are presented when the message is displayed.