SYSTEMS AND METHODS FOR PROVIDING INDIVIDUAL ELECTRONIC DOCUMENT SECURE STORAGE, RETRIEVAL AND USE

• US 20120179909A1
• Filed: 12/31/2011
• Published: 07/12/2012
• Est. Priority Date: 01/06/2011
• Status: Abandoned Application

• Current Assignee: Pitney Bowes Incorporated (Böwe Systec AG)
• Original Assignee: Pitney Bowes Incorporated (Böwe Systec AG)
• Inventors: Sagi, Surya R., Ryan, Frederick W. Jr., Gracy, Bernard E.
• Application Number:
  US13/341,959
• Publication Number:
  US 20120179909A1
• Time in Patent Office: Days
• US Class Current: 713/167
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 9/0872 using geo-location information, e.g. location data, time, relative position or proximity to other entities
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

Systems and methods for providing secure digital mail document storage, retrieval and use in a cloud computing environment, such as by advantageously configuring a hybrid cloud computing environment are described. In one, a privately hosted data processing system includes a private key and a PKI decryption subsystem, and a publicly hosted data processing system includes a symmetric key decryption subsystem, wherein digital documents are encrypted by a corresponding individual symmetric key and each of the symmetric keys is encrypted by a public key associated with the private key. In another configuration, document decryption is handled differently depending upon the type of client making the request.

Claims

1. A system for cryptographically securing a plurality of digital documents comprising:

a first data processing system that is privately hosted, the first data processing system including at least one private key and a PKI decryption subsystem,

a second data processing system that is in a public shared hosted environment, the second data processing system including a symmetric key decryption subsystem, and memory storage for storing each of the plurality of digital documents and a corresponding symmetric key for each of said digital documents, wherein each of the plurality of digital documents is encrypted by the corresponding symmetric key and each of the corresponding symmetric key is encrypted by a public key corresponding to the at least one private key,

the second data processing system including a second virtual processor and memory for executing instructions including, sending the encrypted symmetric key to the first data processing system using a secure communications channel, and

the first data processing system including a first processor and memory for executing instructions including, decrypting the symmetric key using the at least one private key and returning the decrypted symmetric key to the second data processing system.

2. The system of claim 1, wherein,

the first data processing system includes a private cloud computer processing system, and

the second data processing system includes a public cloud computer processing system.

3. The system of claim 2, wherein,

the second processing system memory storage further stores a corresponding thumbnail for each of the plurality of digital documents and wherein each thumbnail is also encrypted by the corresponding symmetric key associated with the corresponding digital document.

4. The system of claim 1, further comprising:

the second data processing system including a second virtual processor and memory for executing further instructions including, decrypting a corresponding one of the plurality of digital documents using the returned decrypted symmetric key.

5. The system of claim 1, wherein the at least one private key includes at least two private keys, further comprising:

the first data processing system including a first processor and memory for executing further instructions including, determining an appropriate one private key of the at least two private keys,

and decrypting the symmetric key using the appropriate one private key.

6. The system of claim 5, wherein,

determining an appropriate one private key of the at least two private keys includes utilizing a geographic identifier.

7. The system of claim 6, wherein,

the geographic identifier includes an Internet Protocol (IP) address associated with the second data processing system.

8. The system of claim 5, wherein,

determining an appropriate one private key of the at least two private keys includes utilizing a mail carrier identifier associated with the digital document.

9. The system of claim 1, wherein,

the second data processing system communicates only with the first data processing system.

10. A computer program system being executed on a data processing and secure storage system for processing a plurality of digitized items from a plurality of mailers associated with a digital mailbox and a user comprising:

the data processing system executing instructions including,

creating a cryptographic key for each of the plurality of digitized items,

encrypting each of the digitized items to create an encrypted digitized item,

encrypting each of the respective cryptographic keys using one of at least one system public keys and associating each of the respective cryptographic keys with the respective digitized item, and

storing each of the respective encrypted cryptographic keys and the encrypted digitized items in the secure storage system.

11. A computer implemented method for processing a request from a client for a secure digital document based upon client type, the secure digital document encrypted by a first key and the first key encrypted by a second key to form a first encrypted key, the first encrypted key decrypted by a third key, the method comprising:

determining a type of client making the request;

if the determined type of client is a first type, decrypting the encrypted first key using the third key and sending the decrypted first key and the encrypted digital document to the client, and

if the determined type of client is a second type, different from the first type, decrypting the first encrypted key using the third key, decrypting the digital document using the first key and sending the decrypted digital document to the client.

12. The method of claim 11, wherein:

the digital document includes a digital mail piece and a thumbnail.

13. The method of claim 11, wherein:

the first type is selected from a group consisting of a mobile application, a heavy client and a browser with a plug-in.

14. The method of claim 11, wherein:

the second type is a browser without a plug-in.

15. The method of claim 11, wherein:

the first key is a symmetric key.

16. The method of claim 15, wherein:

the second key is a public key of an asymmetric key pair.

17. The method of claim 11, further comprising:

if the determined type of client is the first type, then responding to the request using a first virtual machine, and

if the determined type of client is the second type, then responding to the request using a second type of virtual machine, different from the first virtual machine.

18. The method of claim 11, wherein:

the third key is selected from one of a group of keys.

19. The method of claim 11, wherein:

the second key is selected using geographic data.

20. The method of claim 11, wherein:

the second key is associated with a carrier associated with the digital document.

21. The method of claim 11, wherein:

the second and third keys are the public and private key, respectively, of an asymmetric key pair.

22. The method of claim 11, wherein:

the second and third keys are the same.