Secure and reliable document delivery using routing lists

• US 7,596,689 B2
• Filed: 07/30/2007
• Issued: 09/29/2009
• Est. Priority Date: 07/07/2000
• Status: Expired due to Fees

• Current Assignee: BAE Systems Applied Intelligence US Corp. (BAE Systems Plc)
• Original Assignee: Perimeter eSecurity Inc.
• Inventors: Toh, Eng-Whatt, Teo, Kok-Hoon
• Primary Examiner(s): CHEN, SHIN HON
• Application Number:
  US11/878,964
• Publication Number:
  US 20070294533A1
• Time in Patent Office: 792 Days
• Field of Search: 713/150, 713/168, 713/156, 380/286, 709/220, 709/223, 709/229
• US Class Current: 713/150
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

An operations center (OC) (200) acts as an intermediary for securely and reliably transmitting a document (3) from a sender (100) to a next recipient (300) on a routing list. The OC (200) identifies (464) a recipient (300) from the next stage of the routing list and provides either the recipient'"'"'s public key (404) or an escrow encryption key (406). The OC (200) optionally can authenticate the sender (100) and/or the recipient (300), thus increasing security.

Claims

1. A method for facilitating a secure delivery of a document over a network from a sender to a next stage on a routing list, the method comprising the steps of:

receiving an indication that a sender desires to deliver a document to a next stage on a routing list for the document;

identifying a recipient from the next stage of the routing list;

sending an inquiry to a public key database to determine whether the recipient has a public key listed in the public key database;

receiving a response to said inquiry, said response selected from the group of said recipient having a public key in said database and said recipient not having a public key in said database;

if said response is said recipient having a public key in said public key database, completing the steps of;

(a) retrieving said public key from said public key database;

(b) setting a message encryption key for encrypting the document equal to said public key;

(c) encrypting the document prior to sending said document using the message encryption key; and

(d) sending the encrypted document to the recipient;

if said response is said recipient not having a public key in said public key database, completing the steps of;

(a) providing an escrow encryption key not equal to the recipient'"'"'s public key and not equal to the sender'"'"'s private key, wherein an escrow unencryption key for unlocking said escrow encryption key is not made available to said recipient or to the sender and

(b) encrypting the document using the generated escrow encryption key, and storing the escrow key encrypted document in escrow;

(c) notifying the recipient of the document stored in escrow; and

(d) only in response to receiving an acknowledgement from the recipient, unencrypting the escrow encryption key encrypted document using the escrow unencryption key and re-encrypting the document using a document encryption key prior to sending said document to the recipient, wherein neither the escrow encryption key or the escrow unencryption key is provided to the recipient.

2. The method of claim 1 comprising the additional step of verifying the identity of the recipient after receiving the acknowledgement from the recipient and prior to unencrypting the document using the escrow unencryption key.

3. The method of claim 1 wherein the document is unencrypted using the escrow unencryption key prior to sending the document over a network to the recipient.

4. The method of claim 1 wherein the escrow encryption key is one of a public and private key not assigned to the recipient.

5. The method of claim 4 wherein the escrow encryption key is one of a public and private key not assigned to the sender.

6. A method for facilitating a secure delivery of a document over a network from a sender to a recipient, the method comprising the steps of:

receiving an indication that the sender desires to deliver a document to the recipient for the document;

sending an inquiry to a public key database to determine whether the recipient has a public key listed in the public key database;

receiving a response to said inquiry, said response selected from the group of said recipient having a public key in said database and said recipient not having a public key in said database;

if said response is said recipient having a public key in said public key database, completing the steps of;

(a) retrieving said public key from said public key database;

(b) setting a message encryption key for encrypting the document equal to said public key;

(c) encrypting the document prior to sending said document using the message encryption key; and

(d) sending the encrypted document to the recipient;

if said response is said recipient not having a public key in said public key database, completing the steps of;

(a) providing an escrow encryption key not equal to the recipient'"'"'s public key and not equal to the sender'"'"'s private key, wherein a respective escrow unencryption key for unlocking said escrow encryption key is not made available to said recipient or to the sender;

(b) encrypting the document using the generated escrow encryption key and storing the escrow key encrypted document in escrow;

(c) notifying the recipient of the document stored in escrow; and

(d) only in response to receiving an acknowledgement from the recipient, unencrypting the escrow encryption key encrypted document using the escrow unencryption key prior to sending said document; and

(e) re-encrypting the escrow unencryption key unencrypted document using an encryption not equal to the escrow encryption key or a public or private encryption key of recipient;

and wherein the escrow encryption key is not provided to the recipient.

7. The method of claim 6, including the step of sending the document to the recipient in a secured state by encrypting the document.

8. The method of claim 6, including the step of sending the document to the recipient in a secured state by sending the document over a secure socket layer.

9. The method of claim 6, including the step of sending the document to the recipient in a secured state by encrypting the document and by sending the document a virtual private network.

10. The method of claim 6 wherein the recipient is on a next stage of a routing list for the document.

11. The method of claim 6 wherein the document encryption does not utilize a public private key pair.

12. A method for facilitating a secure delivery of a document over a network from a sender to a recipient, the method comprising the steps of:

receiving an indication that a sender desires to deliver a document to a recipient for the document;

sending an inquiry to a public key database to determine whether the recipient has a public key listed in the public key database;

receiving a response to said inquiry, said response selected from the group of said recipient having a public key in said database and said recipient not having a public key in said database;

if said response is said recipient having a public key in said public key database, completing the steps of;

(a) retrieving said public key from said public key database;

(b) setting a message encryption key for encrypting the document equal to said public key;

(c) encrypting the document prior to sending said document using the message encryption key; and

(d) sending the message encryption key encrypted document to the recipient;

if said response is said recipient not having a public key in said public key database, completing the steps of;

(a) providing an escrow encryption key not equal to the recipient'"'"'s public key and not equal to the sender'"'"'s private key, wherein an escrow unencryption key for unlocking said escrow encryption key is not made available to said recipient and

(b) encrypting the document using the generated escrow encryption key, and storing the escrow key encrypted document in escrow;

(c) notifying the recipient of the document stored in escrow; and

(d) only in response to receiving an acknowledgement from the recipient, unencrypting the escrow encryption key encrypted document using the escrow unencryption key prior to sending said document to the recipient; and

(e) sending the document to the recipient in a secured state by encrypting the document or by sending the document over one of the group of a secure channel, a secure socket layer or a virtual private network.

13. The method of claim 12 wherein the recipient is listed on a stage of a routing list for the document.

14. The method of claim 12 including encrypting the document with a document encryption key prior to sending the document to the recipient;

wherein the document encryption key is not equal to the escrow encryption key or a public or private recipient key.

15. The method of claim 12 wherein the document encryption key is not a part of a public private key pair.

16. The method of claim 12 wherein the document encryption key is a symmetric key.

17. The method of claim 12, including the step of sending the document to the recipient in a secured state by encrypting the document.

18. The method of claim 12, including the step of sending the document to the recipient in a secured state by encrypting the document and by sending the document over a secure socket layer.

19. The method of claim 12, including the step of sending the document to the recipient in a secured state by encrypting the document and by sending the document over a virtual private network.