Secure messaging system with automatic recipient enrollment

• US 8,099,598 B1
• Filed: 01/03/2005
• Issued: 01/17/2012
• Est. Priority Date: 01/03/2005
• Status: Active Grant

• Current Assignee: Gary Gang Liu
• Original Assignee: Gary Gang Liu
• Inventors: Liu, Gary Gang
• Primary Examiner(s): Orgad, Edan
• Assistant Examiner(s): Schmidt, Kari
• Application Number:
  US11/028,098
• Time in Patent Office: 2,570 Days
• Field of Search: 713/150, 713/156, 713/170, 380/255, 380/277, 709/206, 726/4, 726/27
• US Class Current: 713/170
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A public-key based secure messaging system with automatic receiver enrollment is disclosed. A sender in the system first determines whether a receiver has a public key. If the receiver has a public key, the messages will be sent to the receiver using a standard public-key based encryption. If the receiver does not have a public key, the first message will be sent to the receiver using a delivery method that does not require the receiver to have a pair of public and private keys prior to sending the message. However, when the receiver accesses the first message, a pair of public and private keys will be automatically generated at the receiver and the public key will be made available for encrypting subsequent messages sent to the receiver.

Claims

1. A method for sending a secure message to a receiver comprising:

determining whether a receiver is enrolled by determining whether the receiver has a public key;

if the receiver is enrolled and has a public key, encrypting the message using the receiver'"'"'s public key and sending the encrypted message to the receiver;

if the receiver is not enrolled and does not have a public key, sending the message to the receiver using a delivery method that does not require the receiver to have a pair of public and private keys prior to sending the message; and

when the receiver accesses the message sent with the delivery method, establishing a public key for encrypting subsequent messages sent to the receiver and making the receiver enrolled.

2. The method of claim 1, wherein establishing a public key for encrypting subsequent messages sent to the receiver including generating a pair of public and private keys at the receiver and posting the public key to a key server;

and determining whether a receiver has a public key including accessing the key server to retrieve the receiver'"'"'s public key.

3. The method of claim 1, wherein establishing a public key for encrypting subsequent messages sent to the receiver including generating a pair of public and private keys at the receiver and posting the public key to a certificate server, and determining whether a receiver has a public key including first determining whether an unexpired receiver'"'"'s certificate is available locally, and if not, accessing the certificate server to retrieve a receiver'"'"'s certificate.

4. The method of claim 1, wherein the delivery method that does not require the receiver to have a pair of public and private keys prior to sending the message including using an identity-based encryption method.

5. The method of claim 1, wherein the delivery method that does not require the receiver to have a pair of public and private keys prior to sending the message including a web-based delivery method.

6. The method of claim 1, wherein the delivery method that does not require the receiver to have a pair of public and private keys prior to sending the message comprising:

encrypting the message using a secret key;

making the secret key accessible to a key server;

sending the encrypted message to the receiver;

sending the secret key from the key server to the receiver after the receiver is authenticated;

using the secret key to decrypt the message at the receiver.

7. The method of claim 1, wherein the delivery method that does not require the receiver to have a pair of public and private keys prior to sending the message comprising:

encrypting the message using a secret key;

encrypting the secret key using a receiver specific key;

storing the receiver specific key associated with the receiver at the key server;

sending the encrypted secret key and the encrypted message to the receiver;

sending the receiver specific key from the key server to the receiver after the receiver is authenticated;

using the receiver specific key to decrypt the secret key;

using the secret key to decrypt the message;

storing the receiver specific key into an encrypted key file at the receiver.

8. The method of claim 1, wherein the receiver is authenticated to access the message using authentication information that can only be used to access the message for the first time.

9. The method of claim 8, wherein the authentication information includes a password sent to the receiver'"'"'s email address and the password can only be used to access the message for the first time.

10. The method of claim 1, wherein the receiver is authenticated to access the message using evidence that the receiver can receive email messages sent from at least two different sources to the receiver'"'"'s email address.

11. A secure messaging system for sending a message to a receiver comprising:

a public-key based delivery apparatus for encrypting the message using the receiver'"'"'s public key and sending the encrypted message to the receiver;

an automatic enrolling delivery apparatus for sending the message to the receiver using a delivery method that does not require the receiver to have a pair of public and private keys prior to sending the message, and when the receiver accesses the message sent with the delivery method, establishing a public key for encrypting subsequent messages sent to the receiver and making the receiver enrolled;

a device for determining whether the receiver is enrolled by determining whether the receiver has a public key; and

a delivery engine for delivering the message to the receiver using the public-key based delivery apparatus if the receiver is enrolled and has a public key, or using the automatic enrolling delivery apparatus if the receiver is not enrolled and does not have a public key.

12. The system of claim 11, wherein establishing a public key for encrypting subsequent messages sent to the receiver including generating a pair of public and private keys at the receiver and posting the public key to a key server, and determining whether the receiver has a public key including accessing the key server to retrieve the receiver'"'"'s public key.

13. The system of claim 11, wherein establishing a public key for encrypting subsequent messages sent to the receiver including generating a pair of public and private keys at the receiver and posting the public key to a certificate server, and determining whether a receiver has a public key including first determining whether an unexpired receiver'"'"'s certificate is available locally, and if not, accessing the certificate server to retrieve a receiver'"'"'s certificate.

14. The system of claim 11, wherein the delivery method that does not require the receiver to have a pair of public and private keys prior to sending the message including using an identity-based encryption method.

15. The system of claim 11, wherein the delivery method that does not require the receiver to have a pair of public and private keys prior to sending the message including a web-based delivery method.

16. The system of claim 11, wherein the delivery method that does not require the receiver to have a pair of public and private keys prior to sending the message comprising:

encrypting the message using a secret key;

making the secret key accessible to a key server;

sending the encrypted message to the receiver;

sending the secret key from the key server to the receiver after the receiver is authenticated;

using the secret key to decrypt the message at the receiver.

17. The system of claim 11, wherein the delivery method that does not require the receiver to generate a pair of public and private keys prior to sending the message comprising:

encrypting the message using a secret key;

encrypting the secret key using a receiver specific key;

storing the receiver specific key associated with the receiver at the key server;

sending the encrypted secret key and the encrypted message to the receiver;

sending the receiver specific key from the key server to the receiver after the receiver is authenticated;

using the receiver specific key to decrypt the secret key;

using the secret key to decrypt the message;

storing the receiver specific key into an encrypted key file at the receiver.

18. The system of claim 11, wherein the receiver is authenticated to access the message using authentication information that can only be used to access the message for the first time.

19. The system of claim 18, wherein the authentication information includes a password sent to the receiver'"'"'s email address and the password can only be used to access the message for the first time.

20. The system of claim 11, wherein the receiver is authenticated to access the message using evidence that the receiver can receive email messages sent from at least two different sources to the receiver'"'"'s email address.