AUTOMATED PROVISIONING OF A NETWORK APPLIANCE

• US 20120023326A1
• Filed: 07/22/2010
• Published: 01/26/2012
• Est. Priority Date: 07/22/2010
• Status: Active Grant

• Current Assignee: ZixCorp Systems, Inc. (Open Text Corporation)
• Original Assignee: Zixcorp Systems
• Inventors: Kalan, John, Rego, Charles A.
• Granted Patent: US 9,363,088 B2
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Network communication and provisioning systems and methods are provided to enable automatic provisioning of an appliance to provide encryption services for email messages and other types of electronic messages addressed to or from an email domain.

Claims

1. A method, comprising:

receiving an indication of a domain name;

receiving a public key;

encrypting a secret message using the public key;

generating an electrometric message, comprising;

generating a random electronic message address at the domain name; and

generating a body of the electronic message that includes the secret message; and

directing the electronic message to an appliance.

2. The method of claim 1 further comprising:

receiving the secret message as decrypted from the appliance; and

authenticating the appliance as being associated with the domain name.

3. The method of claim 2, wherein the secret message is received within a predetermined period of time.

4. The method of claim 2 further comprising provisioning encryption services for the appliance for the domain name.

5. The method of claim 2 further comprising denying a subsequent attempt to authenticate the domain name as being associated with at least one of the appliance and another appliance.

6. The method of claim 1 further comprising:

waiting for the secret message to be returned as decrypted by an appliance associated with the domain name; and

determining that a predetermined period of time has elapsed without the secret message being delivered as decrypted.

7. The method of claim 6 further comprising resending the electronic message.

8. The method of claim 6 further comprising determining that the domain name should remain available for encryption provisioning.

9. A method implemented by an appliance for provisioning the appliance to provide electronic message encryption, comprising:

receiving a private key;

receiving a public key;

receiving an electronic message that;

is addressed to a domain delivered by the appliance; and

includes a secret message;

determining the electronic message includes a predetermined set of symbols;

utilizing the private key to decrypt the secret message; and

sending the secret message as decrypted to a remote device.

10. The method of claim 9 further comprising:

in response to sending the secret message as decrypted, receiving one or more commands to enable provisioning of the appliance to provide security services for electronic messages associated with the domain; and

provisioning the application to provide the security services for the domain.

11. The method of claim 10 further comprising:

receiving an additional electronic message addressed to an electronic message account associated with the domain; and

determining whether the additional electronic message is encrypted.

12. The method of claim 11 further comprising:

in response to determining the additional electronic message is encrypted, decrypting the additional electronic message; and

relaying the additional electronic message as decrypted.

13. The method of claim 11 further comprising:

in response to determining the additional electronic message is unencrypted relaying the additional electronic message.

14. A method comprising:

generating a public key;

generating a private key;

sending the public key to a network appliance associated with a domain;

sending the private key to the network appliance;

sending the public key to a certificate server; and

sending a name of the domain to the certificate server.

15. The method of claim 14 further comprising:

receiving a confirmation from the network appliance that the private key has been successfully received by the network appliance; and

waiting to send the public key to the certificate server until the confirmation is received.

16. A method of claim 14 further comprising:

generating a certificate; and

sending the certificate to the certificate server.

17. A certificate server, comprising:

at least one processor configured to;

receive an indication of a domain name;

receive a public key;

encrypt a secret message using the public key;

generate an electronic message, comprising;

generate a random electronic message address at the domain name; and

generate a body of the electronic message that includes the secret message; and

provide the electronic message to an outgoing mail server.

18. The certificate server of claim 17, wherein the at least one processor is further configured to:

receive the secret message as decrypted from an appliance; and

authenticate the appliance as being associated with the domain name based on the secret message that was received as decrypted.

19. The certificate server of claim 18, wherein the secret message is received within a predetermined period of time.

20. The certificate server of claim 18, wherein the at least one processor is further configured to provision encryption services for the appliance for the domain name.

21. The certificate server of claim 18, wherein the at least one processor is further configured to deny a subsequent attempt to authenticate the domain name as being associated with at least one of the appliance and another appliance.

22. The certificate server of claim 17, wherein the at least one processor is further configured to:

wait for the secret message to be returned as decrypted by an appliance associated with the domain name; and

determine that a predetermined period of time has elapsed without the secret message being delivered as decrypted.

23. The certificate server of claim 22, wherein the at least one processor is further configured to resend the electronic message.

24. The certificate server of claim 22, wherein the at least one processor is further configured to determine that the domain name should remain available for encryption provisioning.