Stateless Server-Based Encryption Associated With A Distribution List

• US 20180083947A1
• Filed: 11/27/2017
• Published: 03/22/2018
• Est. Priority Date: 02/25/2015
• Status: Active Grant

• Current Assignee: Red Hat Israel Ltd. (International Business Machines Corporation)
• Original Assignee: Red Hat Israel Ltd. (International Business Machines Corporation)
• Inventors: Tsirkin, Michael
• Granted Patent: US 10,375,051 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

An example method of decrypting electronic messages includes receiving, by an authentication module of a decryptor device, authentication requests from a plurality of destination clients. The method also includes receiving, by a decryption module of the decryptor device, encrypted electronic messages from the plurality of destination clients. The encrypted electronic messages are derived from a common electronic message sent by a common source client. The method further includes authenticating, based on an authentication table, the plurality of destination clients. The authentication table stores user credentials that are used to authenticate destination clients. The method also includes for each encrypted electronic message received from an authenticated destination client of the plurality of destination clients, decrypting the encrypted electronic message using a common private key and providing the decrypted electronic message to the authenticated destination client. The private key is stored at the decryptor device.

Claims

1. A method of decrypting electronic messages, comprising:

receiving, by a decryption module of the decryptor device, a first encrypted electronic message from a first destination client;

receiving, by the decryption module, a second encrypted electronic message from a second destination client, wherein the first and second encrypted electronic messages are encrypted using a common public key; and

decrypting, by the decryption module, the first and second encrypted electronic messages using a common private key, wherein the first and second destination clients are listed in a distribution list that is associated with the common private key.

2. The method of claim 1, further including:

receiving, by the decryptor module, an identifier of the common public key from a destination client.

3. The method of claim 2, further including:

retrieving, based on the identifier, the common private key to decrypt the first and second encrypted electronic messages.

4. The method of claim 1, further including:

generating, by the decryptor module, the common public key; and

generating, by the decryptor module, the common private key that is paired with the common public key.

5. The method of claim 2, wherein the identifier is associated with the distribution list of the first destination client.

6. The method of claim 2, wherein the identifier is included in a message header associated with the first encrypted electronic message.

7. The method of claim 6, wherein the identifier is included in a field of the message header.

8. The method of claim 1, wherein a payload of the first and second encrypted electronic messages is the same.

9. The method of claim 1, wherein a payload of the first and second decrypted electronic messages is the same.

10. The method of claim 1, wherein the first destination client is different from the second destination client.

11. A system for decrypting electronic messages, comprising:

a decryption module that receives a first encrypted electronic message from a first destination client and receives a second encrypted electronic message from a second destination client, wherein the first and second encrypted electronic messages are encrypted using a common public key, and

wherein the decryption module decrypts the first and second encrypted electronic messages using a common private key, and the first and second destination clients are listed in a distribution list that is associated with the common private key.

12. The system of claim 11, further including:

a message relay server that stores the distribution list identifying the first and second destination clients.

13. The system of claim 12, wherein an encrypted channel connects the message relay server to the first destination client.

14. The system of claim 11, further including:

an encryption module that receives a first electronic message, generates the first encrypted electronic message by encrypting the first electronic message, and generates the second encrypted electronic message by encrypting the first electronic message.

15. The system of claim 14, further including:

a source client that sends the first electronic message.

16. The system of claim 15, wherein an encrypted channel connects the message relay server to the source client.

17. The system of claim 11, wherein the message relay server discards the first encrypted electronic message after sending the first encrypted electronic message to the first and second destination clients.

18. The system of claim 11, further including:

an authentication module that authenticates one or more destination clients, wherein in response to successfully authenticating a given destination client, the authentication module sends an authentication token to the given destination client.

19. The system of claim 18, wherein the decryption module determines that the first destination client has been authenticated if the decryption module receives an authentication token from the first destination client.

20. A machine-readable medium comprising a plurality machine-readable instructions that when executed by one or more processors is adapted to cause the one or more processors to perform a method comprising:

receiving, by a decryption module of the decryptor device, a first encrypted electronic message from a first destination client;

receiving, by the decryption module, a second encrypted electronic message from a second destination client, wherein the first and second encrypted electronic messages are encrypted using a common public key; and

decrypting, by the decryption module, the first and second encrypted electronic messages using a common private key, the first and second destination clients being listed in a distribution list that is associated with the common private key.