Secure communication apparatus and method

• US 7,693,285 B2
• Filed: 03/06/2002
• Issued: 04/06/2010
• Est. Priority Date: 03/06/2002
• Status: Active Grant

• Current Assignee: ZixCorp Systems, Inc. (Open Text Corporation)
• Original Assignee: Entrust Incorporated (Entrust Corp.)
• Inventors: Curry, Ian
• Primary Examiner(s): Pich, Ponnoreay
• Application Number:
  US10/092,277
• Publication Number:
  US 20030172262A1
• Time in Patent Office: 2,953 Days
• Field of Search: None
• US Class Current: 380/281
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]

Abstract

A method and apparatus, such as a secure distribution server, receives encrypted information from a sender, wherein the encrypted information is for transmission to a plurality of intended recipients. In addition to the encrypted information, the method includes receiving an encrypted secret key that is encrypted using a public key associated with the secure distribution server. The method and apparatus decrypts the encrypted secret key to produce a decrypted secret key. The method and apparatus then encrypts the decrypted secret key with the corresponding public key of at least one (or each of a plurality of) intended recipient(s) to produce at least one (or plurality of) recipient-specific secure secret keys. The method and apparatus then forwards the received encrypted information sent by the sender and also sends at least one recipient-specific secure secret key to a corresponding intended recipient.

Claims

1. A method for securing information comprising

receiving encrypted information from a sender for transmission to at least one intended recipient, receiving information indicating a transfer protocol to use when sending the encrypted information to the at least one intended recipient, and receiving an encrypted secret key encrypted using a secure distribution server specific public key of a public/private key pair specific to the secure distribution server;

decrypting the encrypted secret key to produce a decrypted secret key;

obtaining a corresponding public key of the at least one intended recipient;

encrypting the decrypted secret key for the at least one intended recipient using a corresponding public key specific to the at least one intended recipient to produce at least one recipient specific secure secret key; and

forwarding, according to the information indicating the transfer protocol, the encrypted information sent by the sender and at least one recipient specific secure key to the at least one intended recipient.

2. The method of claim 1 including determining a plurality of intended recipients and retrieving corresponding public keys of the plurality of intended recipients for encrypting the decrypted secret key.

3. The method of claim 1 wherein the step of encrypting the decrypted secret key with a corresponding public key of the at least one intended recipient includes encrypting a copy of the decrypted secret key for each intended recipient with a corresponding recipient public key.

4. The method of claim 1 including the steps of:

encrypting information with the secret key to produce the encrypted information, encrypting the secret key with the secure distribution server specific public key of the secure distribution sewer to produce the encrypted secret key, and sending the encrypted information and the encrypted secret key to the secure distribution server.

5. The method of claim 4 wherein encrypting the secret key includes encrypting the secret key using a public key for each of a plurality of secure distribution servers to produce a plurality of secure distribution sewer specific encrypted secret keys.

6. The method of claim 4 including storing the encrypted information in an encrypted form locally on a device that performed the step of encrypting information with the secret key.

7. The method of claim 4 further including the step of encrypting the secret key, by a sending device, with a public key associated with at least one of a user of the sending device and the sending device.

8. The method of claim 4 including the step of digitally signing the information using a private signing key associated with at least one of a user of a sending device and the sending device.

9. The method of claim 1 further including the step of receiving the encrypted information and the encrypted secret key and forwarding the encrypted information and the encrypted secret key to the secure distribution sewer without decrypting the encrypted secret key.

10. The method of claim 1 including the step of determining, by the secure distribution sewer, if the encrypted information needs to be sent to other entities, if so, encrypting the decrypted secret key using a public key associated with each of the additional entities.

11. The method of claim 1 including the steps of:

encrypting the decrypted secret key using a public key associated with a content scanning device;

sending the encrypted information and the encrypted secret key to the content scanning device;

receiving a result back from the content scanning device, forwarding the encrypted information based on the result sent by the content scanning device and based on at least one recipient specific secure secret key for at least one intended recipient.

12. The method of claim 2 wherein retrieving the corresponding public keys of the plurality of intended recipients for encrypting the decrypted secret key includes obtaining the corresponding public keys from at least one of:

a certificate retrieval and validation service, an LDAP lookup and a certificate directory lookup.

13. The method of claim 1 including the steps of:

encrypting information with a secret key to produce the encrypted information offline, encrypting the secret key with the non-group public key associated with the secure distribution server to produce the encrypted secret key offline, and during an online session, sending the encrypted information and the encrypted secret key to the secure distribution server.

14. The method of claim 1 including sending the encrypted information to a time stamper and receiving a time stamped result prior to forwarding the encrypted information and the at least one recipient specific secure secret key for the at least one corresponding intended recipient.

15. A method for securing information comprising:

receiving, by a secure distribution server, encrypted information for transmission to a plurality of intended recipients, receiving information indicating a transfer protocol to use when sending the encrypted information to the at least one intended recipient, and receiving an encrypted secret key encrypted using a secure distribution server specific public key of a public/private key pair specific to the secure distribution server;

decrypting, by the secure distribution server, the encrypted secret key to produce a decrypted secret key;

obtaining, by the secure distribution server, a corresponding public key of at least one intended recipient;

encrypting, by the secure distribution server, the decrypted secret key for the at least one intended recipient using a corresponding public key specific to the at least one intended recipient to produce a recipient specific secret key; and

forwarding, by the secure distribution server, according to the information indicating the transfer protocol, the encrypted information and the recipient specific secure secret key to a corresponding intended recipient.

16. The method of claim 15 including determining a plurality of intended recipients and retrieving corresponding public keys of the plurality of intended recipients for encrypting the secret key.

17. The method of claim 16 wherein the step of encrypting includes encrypting a copy of the decrypted secret key for each intended recipient with a corresponding recipient public key.

18. A network element comprising:

one or more processing devices operative to;

decrypt a received encrypted secret key encrypted using a secure distribution server specific public key of a public/private key pair specific to the secure distribution server corresponding to the network element to produce a decrypted secret key;

obtaining a corresponding public key of at least one intended recipient;

encrypt the decrypted secret key for the at least one intended recipient using a corresponding public key specific to the at least one intended recipient to produce a recipient specific secure secret key; and

forward, to the at least one intended recipient, the encrypted information sent by a sender, according to information specified by the sender which indicates a transfer protocol to use when sending the encrypted information, and at least one recipient specific secure secret key to the at least one intended recipient.

19. The network element of claim 18 wherein the one or more processing devices retrieves the corresponding public keys specific to the at least one intended recipient of a plurality of intended recipients for encrypting the decrypted secret key from at least one of:

a certificate retrieval and validation service, an LDAP lookup and a certificate directory lookup.

20. A storage medium comprising:

memory containing executable instructions that when read by one or more processing devices, causes the one or more processing devices to;

receive encrypted information from a sender for transmission to at least one intended recipient, receive information indicating a transfer protocol to use when sending the encrypted information to the at least one intended recipient, and receive an encrypted secret key encrypted using a secure distribution server specific public key of a public/private key pair specific to the secure distribution server;

decrypt the encrypted secret key to produce a decrypted secret key;

obtained a corresponding public key of the at least one intended recipient specific to the at least one intended recipient;

encrypt the decrypted secret key for the at least one intended recipient using the corresponding public key to produce a recipient specific secure secret key; and

forward, according to the information indicating the transfer protocol, the encrypted information sent by the sender and the at least one recipient specific secure key to the at least one intended recipient.

21. The storage medium of claim 20 including memory containing executable instructions that when read by the one or more processing devices causes the one or more processing devices to:

determine a plurality of intended recipients and retrieve corresponding public keys of the plurality of intended recipients for encrypting the decrypted secret key.

22. The storage medium of claim 20 including memory containing executable instructions that when read by the one or more processing devices causes the one or more processing devices to encrypt a copy of the decrypted secret key for each intended recipient with a corresponding recipient public key.

23. The storage medium of claim 20 including memory containing executable instructions that when read by the one or more processing devices causes the one or more processing devices to determine if the encrypted information needs to be sent to other entities, if so, encrypting the decrypted secret key using a public key associated with each of the other entities.

24. A secure communication system comprising:

at least one sender that encrypts information with a secret key to produce encrypted information, encrypts the secret key with a secure distribution sever specific public key of a public/private key pair specific to the secure distribution server associated with a network element to produce an encrypted secret key, and during an online session, sends the encrypted information and the encrypted secret key to the network element;

at least one intended recipient;

at least one network element, operatively coupled to the sender and to the at lest one intended recipient, including;

one or more processing devices operative to;

decrypt a received encrypted secret key encrypted using a secure distribution server specific public key of a public/private key pair specific to the secure distribution server corresponding to the network element to produce a decrypted secret key;

obtaining a corresponding public key of at least one intended recipient;

encrypt the decrypted secret key for the at least one intended recipient using a corresponding public key specific to the at least one intended recipient to produce a recipient specific secure secret key; and

forward, to the at least one intended recipient, the encrypted information sent by a sender, according to information specified by the sender which indicates a transfer protocol to use when sending the encrypted information and at least one recipient specific secure secret key to the at least one intended recipient.

25. The system of claim 24 wherein a sender encrypts information with the secret key to produce the encrypted information offline, encrypts the secret key with a public key associated with the network element to produce the encrypted secret key offline, and during an online session, sends the encrypted information and the encrypted secret key to the network element.

26. The system of claim 24 wherein the network element retrieves corresponding public keys of a plurality of intended recipients for encrypting the decrypted secret key from at least one of:

a certificate retrieval and validation service, an LDAP lookup and a certificate directory lookup.

27. The system of claim 24 wherein the network element encrypts the decrypted secret key using the secure distribution server specific public key associated with a content scanning device;

sends the encrypted information and sends the encrypted secret key to the content scanning device;

receives a result back from the content scanning device, and forwards the encrypted information based on the result sent by the content scanning device and based on at least one recipient specific secure secret key for at least one intended recipient.