System and method for secure electronic communication services

• US 20090198997A1
• Filed: 05/19/2008
• Published: 08/06/2009
• Est. Priority Date: 11/20/2006
• Status: Active Grant

• Current Assignee: Toposis Corporation
• Original Assignee: Toposis Corporation
• Inventors: Yeap, Tet Hin, Goeller, Thomas Anton
• Granted Patent: US 8,538,028 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: H04L 51/23 Reliability checks, e.g. acknowledgments or fault reporting
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

A system, method and software module for secure electronic communication services, wherein a public key (25) of private-public-key pair (30,25) is associated with an email address (24), internet name or other registered unique identifier; the registered user of the unique identifier holds the private-key (30) securely, and the respective public-key (25) is made accessible on a key server (6) for look-up and retrieval by other users, for encryption of communications to be sent to the holder of the private-key, and optionally for message confidentiality, message integrity and authentication of sender and recipient, without requiring certificates. A distributed and scalable system is provided by a server network (600; 401, 501) for registration, key distribution and management preferably using a kDNS server hierarchy (601,602,603) or a key-DNS server hierarchy (701,702,) and associated protocols so that public-keys of recipients can be searched and retrieved over the internet based on the recipients email address or other unique identifier, thus facilitating secure communication between users in different network domains and organizations.

Claims

1. A system for public-key management for secure electronic communication services for a plurality of users, comprising,

means for registering (1;

501) to a user a unique identifier (24,28) and attaching to the unique identifier a public-key (25,29) of a private-public key pair (20,29;

30,25) of the user,

means for storing (6,6a;

401) unique identifiers and attached public-keys for lookup and retrieval of a public key based on a unique identifier,

means for responding (6;

600;

401) to key requests for a public-key for a unique identifier.

2. A method for public-key management for secure electronic communication services for a plurality of users, comprising:

registering (110) to a user a unique identifier and attaching a public-key of a private-public key pair of the user;

storing (130,150,170,190) die unique identifier and the attached public-key for lookup and retrieval of a public-key based on a unique identifier;

responding to key requests (320,340) for a public-key for a respective unique identifier.

57. A method according to claim 2 wherein the step of registering comprises:

receiving a registration request for registration to a user of a unique identifier,

registering the unique identifier, and triggering generation of a public-private-key pair associated with the unique identifier,

and, providing the registered user with secure access to the private-key,

sending a key request to a key server for storage of the registered unique identifier and

the associated public-key.

58. A method according to claim 57 wherein the step of registering further comprises:

triggering generation for a user of a customized program module for a communication client containing the unique identifier, providing secure access to the private-key, and providing communication agents for public-key look-up, and encryption and decryption.

59. A method according to claim 2 wherein responding to key requests comprises receiving a key request for one of public-key storage and public-key look-up, and determining the address of a key server assigned for storing and look-up of the requested public-key, forwarding the request for response.

60. A method according to claim 59 employing at least one of recursive and non-recursive searches to determine, for a specified unique identifier, a corresponding key server, and thereby find the public-key associated with the specified unique identifier.

61. A method according to claim 59 employing hash table search techniques to locate the public-key.

62. A system according to claim 59 comprising signing a retrieved public-key with a private-key of the respective key server before sending the retrieved key to the requestor.

63. A method according to claim 57 comprising receiving registration requests from users from the internet for self-registration of unique identifiers by users.

64. A method according to claim 59 wherein a public-key request is directed first to a key server in a first domain, and if unsuccessful, the public key request is then directed to key servers in other domains for response.

65. A method according to claim 64 wherein a directory server responds to a request with a preliminary answer indicating a key server or key server farm where a public-key is stored if an unique identifier exists, and has an associated public-key, and then redirects the request to the indicated key server.

66. A method according to claim 59 wherein a key request is required to contain the unique identifier for which public-key lookup and retrieval is requested and also the unique identifier of the requestor, the latter also being is associated with a respective public-key, and wherein the key server encrypts the requested public-key with the public-key of the requestor before sending to the requestor, so that the requested public-key can only be retrieved with the requestors private-key.

3. A method for providing secure electronic communication services between a plurality of users, comprising:

registering (110) to a user a unique identifier for electronic communications;

associating (130,150,170) with the unique identifier a private-public key pair of the registered user;

making the respective public-key accessible (320,340) to other users for encryption of communications to be sent to the registered user; and

providing the registered user with secure access to the private-key (33) for decryption of encrypted communications received from other users.

4. A method according to claim 3 wherein making the public-key accessible to other users comprises storing the unique identifier and the associated public-key on a key server (6;

401), and providing for look-up and retrieval of the associated public-key based on the unique identifier.

5. A method according to claim 3 wherein making the public-key accessible to other users comprises providing key distribution and management on a distributed key server network (6;

600;

401), comprising storing the unique identifier and the associated public-key on at least one key server and providing for look-up and retrieval of the associated public-key based on the unique identifier.

6. A method according to claim 3 wherein the unique identifier and the associated public-key are made accessible via the internet for look-up and retrieval of public keys.

7. A method according to claim 3 wherein the unique identifier comprises a communication address.

8. A method according to claim 3 wherein the unique identifier comprises one of an internet name, IP address, an email address, a VOIP address, SIP URI, SMS address, a phone number, and other unique identifiers for electronic communications.

9. A method according to claim 3 wherein the unique identifier comprises one of a social insurance number, customer number, account number, name, or other unique identifier of an entity or individual.

10. A method according to claim 3 wherein the unique identifier comprises biometric data associated with an individual.

11. A method according to claim 3 wherein the private-public key pair provides for encryption of communications to provide at least one of message confidentiality, message integrity and authentication of sender and recipient.

12. A method according to claim 4 wherein making the respective public-key accessible to other users comprises restricting access to a group of authorized users.

13. A method according to claim 3 wherein the step of registering comprises:

receiving from a user a registration request for a unique identifier;

registering the unique identifier, and triggering generation of a public-private-key pair associated with the unique identifier.

14. A method according to claim 3 further comprising:

making available to the registered user a customized software module for a communication client containing the unique identifier, providing secure access to the private-key, and agents for the communication client for public-key look-up and retrieval and for encrypting and decrypting communications.

15. A method according to claim 14 wherein making available to the registered user a customized software module for a communication client comprises delivering to the user a plug-in for a preferred communication client, the plug-in comprising secure storage of the private-key, and agents for the communication client for public-key look-up and retrieval, and automatically encrypting and decrypting communications.

16. A method according to claim 3 wherein providing the registered user with secure access to the private-key comprises storing the private-key on a trusted private-key server, and applying an applet to a web based communications client for performing key look-up, message encryption, and message decryption.

17. A method according to claim 3 wherein providing the registered user with secure access to the private-key comprises storing the private-key in a private key store, and comprising applying an applet to a web based communications client for perforating private-key look-up from the private store, and performing key look-up, message encryption, and message decryption.

18. A method according to claim 4 comprising signing a retrieved public-key with a private-key of the server before sending to a requestor.

19. A method according to claim 4 wherein providing lookup and retrieval of a public key comprises responding to a key request from a requestor for a public key associated with a unique identifier, the key request containing the unique identifier for which a public key is requested, and a unique identifier of the requestor, and wherein the retrieved public key is signed with the respective public key of the requestor.

20. A method according to claim 13 wherein receiving a registration request from a user comprises generating a new unique identifier.

21. A method according to claim 13 comprising receiving a registration request from a user for an existing unique identifier, and wherein the method further comprises authenticating the user as the authorized user of the existing identifier before registration of the existing identifier.

22. A method according to claim 13 wherein receiving a registration request comprises receiving a request for revocation of an existing key pair and replacement with a new public-private-key pair for the users unique identifier, and wherein the method further comprises authentication of the user before issue of the new public-private-key pair.

23. A method according to claim 3 comprising periodically generating updated public-private-key pairs and distributing updated public and private-keys.

24. A system for public-key management for secure communications services between a plurality of users, comprising:

a key server (6) storing, for each of a plurality of registered users, a unique identifier (24,28) and a respective public key (25,29) of a public-private key pair (30,25;

20,29) of a registered user associated with the unique identifier,

the key server (6) operable to respond to key requests for storing for a registered user a unique identifier and a respective public key associated with the unique identifier, and

the key server operable to respond to key requests for look-up and retrieval of a public key associated with a unique identifier.

25. A system according to claim 24 further comprising:

a registration server for registering to a user a unique identifier, triggering generation of a public-private key pair, sending a key request for storing the unique identifier and the associated public key on the key server, and providing the registered user with secure access to the associated private key.

26. A system according to claim 25 wherein the key server comprises part of a distributed server network comprising a plurality of key servers, and further comprising:

a kDNS means for receiving key requests for storage and retrieval of a public key associated with a unique identifier, determining based on the unique identifier an assigned key server for storing a public key associated with the unique identifier, and directing the key request to the respective assigned key server.

27. A system according to claim 26 wherein the kDNS means comprises a kDNS server.

28. A system according to claim 26 wherein a network element comprising said key server further comprises said kDNS means.

29. A system according to claim 26 wherein said network element comprises a key-DNS server (701,702) comprising said key server and k-DNS means, said key-DNS server being operable as key server to respond to key requests for storing for a registered user a unique identifier and a respective public key associated with the unique identifier, and to respond to key requests for look-up and retrieval of a public key associated with a unique identifier, and said key-DNS server being operable on receiving key requests for storage or retrieval of a public-key associated with a unique identifier for a user, when a requested key is not returned by said key server,

for determining, based on the unique identifier, an address of an assigned key DNS server, for public-key storage or retrieval;

and

directing the key request to the assigned key DNS server.

30. A system for providing secure electronic communication services for a plurality of users, comprising:

a registration server (1;

501) for performing steps of;

receiving a registration request for registration to a user of a unique identifier, registering the unique identifier, and triggering generation of a public-private-key pair associated with the unique identifier, and

providing the registered user with secure access to the private-key, sending a key request to a key server for storage of the registered unique identifier and the associated public-key,

and

a key server means (6;

401) for performing the steps of;

storing, for each of a plurality of registered users, a unique identifier and a respective public key of a public-private key pair of a registered user associated with the unique identifier,

responding to key requests for storing for a registered user a unique identifier and a respective public key associated with the unique identifier, and

responding to key requests for look-up and retrieval of a public key associated with a unique identifier.

31. A system according to claim 30 wherein the registration server (1) and key server (6;

401) are provided by a common network element.

32. A system according to claim 30 comprising a distributed server network comprising a plurality of network elements in different network domains each providing key server means (6;

401),

the system further comprising a kDNS means (600, 601,602,603) for

receiving key requests for storage or retrieval of a public-key associated with a unique identifier for a user,

determining, based on the unique identifier, an address of an assigned key server for public-key storage or retrieval; and

directing the key request to the assigned key server.

33. A system according to claim 32 wherein in a network domain, a key DNS server provides both said key server means and kDNS means.

34. A system according to claim 30 wherein the registration server further provides means (7) for triggering generation for a user of a customized software module for a communication client containing the unique identifier, providing secure access to the private-key, and providing communication agents for public-key look-up, and encryption and decryption.

35. A system according to claim 30 wherein one or more of the registration server and the key server are implemented as distributed server farms (600).

36. A system according to claim 30 wherein one or more of the registration server and the key server are implemented as a server network (600) having a hierarchical structure.

37. A system according to claim 36 wherein the hierarchical structure comprises a hierarchical domain tree structure.

38. A system according to claim 37 wherein the domain tree based hierarchy comprises one root level domain, a plurality of top level domains, and user domains.

39. A system according to claim 38 wherein the server organization comprises a plurality of registration servers and key servers within the domains;

each domain being registered to only one key server and one registration server, and wherein only top domain key servers and registration servers can delegate respective sub-domain key servers and registration servers.

40. A system according to claim 39 wherein a key server organization is implemented hierarchically, with topmost hierarchies acting as directory servers which redirect public-key requests to appropriate key servers.

41. A system according to claim 40 wherein the system further comprising a kDNS server means for receiving key requests for public-key storage and look-up and determining the address of a key server for storing and look-up of the requested public-key.

42. A system according to claim 41 wherein the kDNS server means comprises a kDNS server organization hierarchy which follows a domain name server hierarchy.

43. A system according to claim 42 wherein the kDNS server organization hierarchy maintains name server records (NS) and IP Address records (A).

44. A system according to claim 33 wherein the key DNS means comprises a key-DNS server organization hierarchy, wherein the key-DNS server organization maintains name server records (NS) and IP Address records (A) and records for respective associated public keys.

45. A system according to claim 44 providing for at least one of recursive and non-recursive searches to determine, for a specified unique identifier, a corresponding key server, and thereby find the public-key associated with the specified unique identifier.

46. A system according to claim 30 wherein the key server employs hash table search techniques to locate the public-key.

47. A system according to claim 30 wherein the key server signs a retrieved public-key with a private-key of the server before sending the retrieved key to the requestor.

48. A system according to claim 30 wherein the key server comprises a standardized interface, wherein the standardized interface comprises one of DNS and Open POP.

49. A system according to claim 30 wherein the registration server is accessible from the internet for self-registration of unique identifiers by users.

50. A system according to claim 30 wherein the registration server (1) and key server (6) are linked to one or more communication servers (4) for providing communication services in one or more network domains.

51. A system according to claim 50 wherein in a network domain public-key request services are offered under a specified port for addresses with the domain.

52. A system according to claim 50 wherein a public-key request is first directed to a key server in a first domain, and if unsuccessful, the public key request is then directed to key servers in other domains.

53. A system according to claim 40 wherein the directory servers respond to a request with a preliminary answer indicating the key server or key server farm where a public-key is stored if an unique identifier exists, and has an associated public-key, and then redirects the request to the indicated key server.

54. A system according to claim 53 wherein the directory servers form a hierarchy with the topmost directory server resolving higher level domains, and the lower directory server levels resolving subdomains and specific addresses.

55. A system according to claim 30 wherein a key request is required to contain the unique identifier for which public-key lookup and retrieval is requested and also the unique identifier of the requestor, the latter also being is associated with a respective public-key, and wherein the key server encrypts the requested public-key with the public-key of the requestor before sending to the requestor, so mat the requested public-key can only be retrieved with the requestors private-key.

56. A system according to claim 30 wherein the key server further triggers generation of a certificate along with the public-private key pair, to provide for inclusion of the key in a certificate store.

67. A method for secure email communication between a plurality of users, comprising:

receiving a registration request for registration to a user of a unique email address;

registering the unique email address, and triggering generation of a public-private-key pair associated with the unique email address;

providing the registered user with secure access to the private-key for use by an email client for encrypting and decrypting communications;

making available on a key server the registered unique email address and the associated public-key for look-up and retrieval by other users for encryption of mail to be sent the registered user.

76. A method according to claim 67 wherein receiving a registration request from a user for comprises generating a new unique email address.

77. A method according to claim 67 comprising receiving a registration request from a user for an existing email address, and wherein the method further comprises authenticating the user as the authorized user of the existing email address before registration of the existing email address.

78. A method according to claim 67, wherein receiving a registration request comprises receiving a request for revocation of an existing key pair and replacement with a new public-private-key pair for die users unique identifier, wherein the method further comprises authentication of the user before issue of the new public-private-key pair.

79. A method according to claim 67 comprising periodically generating updated public-private-key pairs and distributing updated public and private-keys.

80. A method according to claim 67 wherein providing the registered user with secure access to the private-key for use by an email client for encrypting and decrypting communications comprises making available to the registered user a user customized software module for an email client comprising the unique identifier, private-key, and agents for the email client for public-key look-up, encrypting and decrypting communications.

81. A method according to claim 67 wherein providing the registered user with secure access to the private-key for use by an email client for encrypting and decrypting communications comprises delivering to the user a plug-in for a preferred communication client, the plug-in comprising the private-key, and agents providing functionality for public-key look-up and automatically encrypting and decrypting communications.

82. A method according to claim 67 wherein for a user employing a server based mail client, the step of providing the registered user with secure access to the private-key comprises storing the private-key on a trusted key server for access by the server based mail client.

83. A method according to claim 67 wherein the registration server creating the plug in for the user, causes the plug-in to be delivered to the user in one of a hardware form, a USB key, a writeable disc, a memory card and other external media, which hold the private-key in a secure way.

84. A method according to claim 67 wherein, receiving a registration request from a user comprises receiving from the user registration information submitted through a secure web interface.

85. A method according to claim 67 wherein making the plug-in available to the user comprises using a users preferred mail client to provide to the user an email containing instructions for retrieving and installing the encrypted private-key and the email plug-in.

86. A method according to claim 80 wherein the software module further provides user feedback on the security status of an email for one or more recipients before sending the email.

68. A system for secure email communication, comprising a registration server and a key server,

the registration server performing steps of:

receiving from a user a registration request for a unique email address,

registering the unique identifier, and triggering generation of a public-private-key pair associated with the unique email address,

sending a key request to a key server for storing the registered unique email address and the associated public-key for look-up and retrieval by other users for encryption of mail to be sent the registered user, and

the key server for storing for each registered user a registered unique email address and an associated public-key for lookup and retrieval by other users, and responding to key requests for lookup and retrieval of a public-key associated with a unique identifier.

69. A system according to claim 68, wherein the registration server provides for generation for the user of a customized software module for use by a communication client and containing the unique email address, secure access to the private-key, and communication agents providing for public-key look-up, encryption and decryption.

70. A system according to claim 68 wherein the registration server and the key server are provided by a common network element.

71. A system according to claim 68 wherein one or both of the registration server and the key server are implemented as distributed server farms.

72. A system according to claim 68 wherein one or both of the registration server and the key server are implemented using a hierarchical server structure.

73. A system according to claim 68 comprising a distributed server network wherein the registration server and the key server are in different network domains, and further comprising a kDNS server means for responding to key requests, determining based on the unique email address an assigned key server for storing of the associated public key, and forwarding the key request to the assigned key server.

74. A system according to claim 73 wherein the registration server and the key server are linked to one of more email servers for providing email services in one or more network domains.

75. A system according to claim 68 wherein the key server generates a certificate along with the public-private-key pair to allow for inclusion of the key in certificate stores for access by other secure communications applications.

87. A program module created by a registration server for an email client for a registered user for secure email communication, providing functionality based on a public-key/private-key pair registered to the user, the program module providing instructions for

automatic look-up and retrieval of recipient'"'"'s public-keys from a server based on the recipients email address, and encryption of emails to recipients having an email address associated with a public-key;

automatic decryption of incoming mail; and

one or more of;

signing of email content, sender and recipient email identities using sender'"'"'s private-key to provide message confidentiality and integrity, providing a digital signature, authentication of the sender'"'"'s email identity using sender'"'"'s public-key automatically retrieved from key server, and verification of message integrity, and providing user feedback on the security status of an email for one or more recipients before sending of the email.