JP2009503963A - Message transmission method and system, and encryption key generator suitable therefor - Google Patents

Abstract

As long as the sender first queries the directory service, the directory service searches for the recipient address in the encryption key directory (8), and as long as the recipient address is included in the encryption key directory (8). The receiver key (7) assigned to the recipient address in the encryption key directory (8) is read out and notified to the sender, and then the sender sends the recipient key In a message transmission method comprising encrypting a message using (7) and transmitting the message to the recipient address, the recipient address is not included in the encryption key directory (8) in response to the inquiry. As long as the encryption key generator (12) generates a gateway key (13), it notifies the sender, which then sends the gateway It encrypts the message using Lee key (13), wherein the transmitting the finally the recipient address via the mail gateway (11) to decrypt the message are disclosed.
[Selection] Figure 1

Description

  The present invention relates to a message transmission method or system according to the superordinate concept (so-called part, preamble part) of claims 1 and 11 and a suitable encryption key generator, in which the sender first goes to the directory service. Query and based on this, the directory service looks up the recipient address in the encryption key directory and is assigned to the recipient address in the encryption key directory as long as the recipient address is included in the encryption key directory. The receiver key is read out and notified to the sender, and then the sender encrypts the message using the receiver key and transmits it to the receiver address.

  Methods or systems of the type described above are widely known. Security issues have become increasingly important in the context of this type of communication due to the dramatic increase in the prevalence of “electronic mail” (so-called “e-mail”) in the last few years. In particular, large companies, government offices, and organizations that have many employees and employees dispersed throughout the country use digital signatures to ensure authentication and integrity, and the confidentiality of information transmitted through the introduction of cryptography. The number of places that guarantee sex is increasing. At that time, various methods with patents, especially public-key-infrastrukture (PKI) managed by the International Telecommunication Union (ITU: www.itu.int) X. “Esmime” (S / MIME: Secure Multipurpose Internet eMail Extension) based on the hierarchical authentication tree created in accordance with the 509 standard, or “Web of Trust” without a hierarchical structure A standard system that guarantees the identification of the certificate owner is introduced by any of the public key system encryption programs OpenPGP.

  In these known methods or systems, in addition to distribution, a directory that allows the encryption key to be queried from various internal data banks for internal recipient addresses and from various other international directories for external communication partners. Services are also provided. In that case, the Lightweight Directory Access Protocol (LDAP) is often used because the Aim certificate can often be queried from a widely used email front end. Provided by a compliant directory service.

  In these known methods or systems, external recipient addresses are basically exchanged because it is impossible to assume the existence of an encryption key (or, if possible, only in exceptional cases). There is no possibility of forcibly encrypting email. Recipient addresses without an encryption key can only process unencrypted e-mail, so unencrypted communication is prohibited and all e-mail exchanges with these recipients are interrupted. .

  If unencrypted communication is permitted within the local area network LAN, the confidentiality of the email is basically guaranteed due to the “openness” that is technically associated with the packet-mediated network. Not: All unencrypted emails-including board-level emails that contain HR and strategic content-join the Internet with little technical effort Anyone who does it can view it.

  In addition to this, when employees use mobile terminals to receive and write e-mails via a so-called push service, new security issues are raised by non-encrypted in-house communications. In a commonly known implementation of such a push service, the push server is embedded inside the LAN as if it were an internal subscriber, and the node computers and mobiles distributed throughout the provider's world. It is designed to mediate e-mail communication by mobile terminals through its own Internet connection to various services of telephone companies.

  There, such a push server accesses all e-mails distributed within the network based on the access rights required to fulfill its responsibilities within the LAN, and passes these through the node computer. Is theoretically possible. Since these node computers are not under the management of the LAN operator, from this point of view, it is impossible to guarantee their security and confidentiality and to perform additional inspection. As a result, at least in theory, the information is afraid of unauthorized hands.

  In addition, if other unsigned communications are allowed inside the LAN, the email may be sent or intercepted using a counterfeit identification code or later modified. All such emails are essentially questioned about authentication and identification. For unsigned emails, it is not only a principle that this is not allowed to be treated as a legal statement of intention—and in addition, where unsigned communications are allowed, It is basically impossible to prevent the hoax from being deliberately run (so-called “moving”) for the purpose of losing trust. In short, if non-encrypted and / or unsigned communication is permitted even in an in-house LAN, the technical management cost and the requirement for the definition of behavioral rules regarding communications (and inspection of compliance with rules) usually increase. It is.

  An object of the present invention is to enable encryption of all messages inside a LAN without imposing restrictions on selection of a communication partner.

This problem is solved by the features of claim 1 for the method and by the features of claim 11 or 24 for the device.
In this application, unless the recipient address is included in the encryption key directory, the encryption key generator generates a gateway key and notifies the sender of the message, and then the sender uses the gateway key to send a message Is encrypted and finally transmitted to the recipient address via a mail gateway (11) that decrypts the message.

  In accordance with the present application, the sender shall respond to such a query from the directory service or from the encryption key generator in response to such a query with an encryption key suitable for encrypting the message, specifically the recipient key or gateway key. Either one is always notified. Therefore, the encryption of a message that is sent out from the LAN by the sender's mail server and is mediated to an arbitrary recipient address can be done by checking whether the recipient key for this recipient address exists in the internal or external encryption key directory. Regardless of whether it is done. In addition, the recipient address for which the recipient key could not be confirmed after receiving the inquiry is also encrypted by the method according to the present invention, in which case the sender uses the gateway key for encryption. , Nevertheless, communication with this recipient address is possible without limitation: a message encrypted with a gateway key is subsequently decrypted and decrypted when it leaves the LAN and reaches the mail gateway. Forwarded to the external recipient address in the form (ie in plain text). From all senders inside the LAN to the mail gateway, by combining with appropriate behavioral rules for e-mail communication, or by other technical measures that prohibit or disable unencrypted transmission of messages inside the LAN. Encryption of all messages mediated via can be guaranteed.

  The method or system according to the present application can be implemented in a similar format with other message push services. Such services are distinguished by communication based on the “store and forward” principle in which the recipient key is not queried by interaction with the recipient. In this case, the concept of “mail gateway” includes such a gateway for push service.

Advantageous development configurations of the subject according to the present application are explained by the features of the dependent claims.
It is advantageous to be able to check the validity of the recipient address before generating the encryption key, because encryption only makes sense if the recipient can read it. is there. To do so, the recipient needs to be provided with an attached private key, or someone else needs to decrypt the email for the recipient. In addition, email addresses must exist and be written correctly.

  It is advantageous if the validity check of the recipient address can be performed by referencing the recipient's email server. On the other hand, if the recipient's directory service, particularly the public directory service, is known, querying it is an alternative. If the sender is not provided with any encryption key for the recipient address, the sender knows that the recipient address does not exist before sending the e-mail. Thus, the sender may not send this email at all, depending on the configuration of the sender's email client. This prevents confidential e-mails from staying in the Internet due to inability to be delivered or being forwarded to an administrator, for example, to remove the problem manually. Administrators usually do not have the right to view the content, but any unencrypted email can view the content at any time.

  It is advantageous that a query to the internal directory service further provides the possibility to obtain meta information about the recipient (real name, status in organizational structure, title, ...). As a result, it is possible to include more information than just the e-mail address in the created certificate. For example, X. The 509 standard corresponds to the normal case where a certificate is issued manually by a public key infrastructure (PKI). The external sender will then be provided with a high-value certificate containing additional, possibly highly informative information. Obviously, meta information that is not desirable should not be disclosed. In addition, it is advantageous to be able to manage the characteristics of the created certificate, such as the length of the encryption key, the expiration date, and the authority for revocation and issuance of the encryption key, based on these meta information. In particular, when the central gateway cooperates with various certificate authorities (CA: Certificate Authority) having authority to generate encryption keys, it is possible to read out the authority responsible for generating the encryption key from these meta information.

  The cryptographic key generator preferably generates a gateway key personalized to the recipient address within the framework of the method or system according to the present application. With such a method or system according to the present invention, a sender within the LAN is widely accepted, allowing only the use of personalized certificates with limited functionality relative to the standard. It is also possible to introduce an e-mail front end (for example, Microsoft's Outlook Microsoft (R) Outlook (R)).

  It is very suitable if the gateway key is assigned to the recipient address in the encryption key directory. In this case, the gateway key is provided from the LAN after the first inquiry is generated, without requiring recalculation for a new inquiry thereafter. Such a method or system, on the other hand, requires less computational effort than a method that does not store the gateway key (though it takes more storage effort, it is not a big deal considering the cost of the storage medium). . On the other hand, it must be ensured that a message encrypted on the sender side using a gate key is still decipherable by the mail gateway even if it enters the mail gateway for the first time a little later in time. . In this regard, the expiration date of the gateway key is preferably limited to several days, for example, one week. The gateway key is preferably stored in a single cache memory that is directly arranged with respect to the encryption key generator.

  In an advantageous embodiment, the encryption key generator generates together with the gateway key a decryption key assigned thereto, and the mail gateway uses the decryption key to decrypt the message. . That is, such a method or system allows the message to be encrypted on the sender side using the public key (here: using the gateway key) and only on the recipient side (here: mail gateway) It uses an asymmetric encryption scheme in which it is decrypted using a secret “private” key known to (here: using a decryption key). In contrast to the symmetric encryption method that can be introduced as an alternative, the same encryption key is used for encryption and decryption, the asymmetric encryption method does not cause damage due to the unintended distribution of the encryption key required for decryption. It becomes difficult to receive.

  It is highly preferred that the gateway key is part of the certificate. Implementing the method according to the present invention, in most cases without an auxiliary program, since it is widely prevalent, especially with esmime certificates, and implemented in all relevant front ends Is possible.

  The message is preferably transmitted from the sender to the recipient address via the mail server. The mail server should then be part of the LAN's internal infrastructure—as is common in large enterprise networks. In this case, the mail gateway is usually arranged between the mail server and the Internet. Alternatively, if each employee obtains his / her email message from an external Simple Mail Transfer Protocol (SMTP) server inside the LAN, the method according to the present invention is It can also be installed without its own mail server.

  It would be advantageous to allow an existing mail gateway to use an encryption key generator to sign e-mail sent to the outside using an encryption key that did not previously exist. Other advantageous embodiments are the subject of separate claims.

Next, the object according to the present application will be described based on examples. The drawings schematically illustrate various implementation aspects of a method or system in accordance with the present invention.
In the in-house LAN 1 connected by a cable, as shown in FIG. 1, the screen work place 2 of the employee 4 and the portable terminal 3 are networked together. The internal certificate authority 5 provides each employee 4 with a personalized cryptographic key 6 for signing an email, for example stored in a hardware token (not shown). The internal certificate authority 5 publishes the public recipient key 7 for encrypting the e-mail addressed to the employee 4 together with the meta information attached to each employee 4 in the internal encryption key directory 8. It has become.

  The communication of the employee 4 with the external partner 9 exiting from the LAN 1 via the Internet 10 is managed by the mail gateway 11. The name "gateway" (in accordance with the Glossary of Open Systems Interconnection (OSI) hierarchical model defined in the International Organization for Standardization standard ISO 7498-1 or German Industrial Standard DIN ISO 7498) Here it is clarified that the format and content of the transmitted data is adapted to the requirements of the occasional recipient at this location-whereas the mail server function is forwarding-only Is. In the case shown here (in cooperation with further components described below), the mail gateway 11 sends an e-mail message that is distributed within the LAN 1-this is encrypted and forwarded to the partner 9 Regardless of whether it was received or signed or encrypted from the other party 9-it is always guaranteed to be signed and encrypted at the same time.

  When an employee wants to write an e-mail addressed to an external partner 9, he / she first selects the recipient address of the partner 9 at his / her front end (not shown). The front end automatically sends a query to the directory service, which in the encryption key local directory 8 first, followed by various (not shown) encryption key externals to encrypt the email. Attempts to verify the recipient key 7 in the directory based on the recipient address. If successful, the confirmed recipient key 7 is transferred to the front end. If the query is successful for the first time in one of the external directories, the confirmed recipient key 7 is temporarily stored in the local directory 8 of the encryption key for future use.

  If neither the local encryption key directory 8 nor the external encryption key directory query is successful, the query is forwarded to the encryption key generator 12 connected to the mail gateway 11 for the recipient address. The public gateway key 13 is generated and transmitted to the front end. At the same time, the encryption key generator 12 generates a “private” decryption key 14 and forwards it to the mail gateway 11. The front end encrypts the electronic mail using the gateway key 13 and transmits it to the mail gateway 11. The mail gateway 11 decrypts the electronic mail based on the decryption key 14 and transfers it to the external partner 9 via the Internet 10 in an unencrypted state.

  The use of the mail gateway 11 makes it possible to sign and encrypt all electronic mail communications within the LAN 1, including the internal mail server 15 and the push server 16 connected thereto as shown in FIG. .

  FIG. 3 shows how the spam and virus scanner 17 is incorporated into the gateway architecture. This is arranged between the internal mail gateway 11 and the second external mail gateway 18. The external mail gateway 18 has access to a further personal key 19 for each employee 4 (in a manner not shown). (The encryption keys 6 and 19 of the employee 4 may be the same.) Based on the encryption key 19, the external mail gateway 18 decrypts the electronic mail communication that is sent to the employee 4 after being encrypted. This is transferred to the spam and virus scanner 17. When this issues a warning for the delivered e-mail, the recipient is automatically notified, including instructions for subsequent procedures. If no warning is issued, an indication to that effect is sent and the e-mail is forwarded to the internal mail gateway 11, which encrypts the e-mail using the recipient's public key and, for example, the internal mail gateway This is signed using 11 decryption keys 14.

  In the same manner, an e-mail delivered from the Internet 10 without a signature or unencrypted is also marked accordingly and encrypted afterwards using the recipient's public key. The signature is made using the decryption key 14 of the internal mail gateway 11. In addition, the mail server 15 is configured not to forward unencrypted or unsigned electronic mail to the recipient, but rather to return an error message to the sender. As described above, when combined with the above-described function of the internal mail gateway 11, especially when combined with the encryption key generator 12, all electronic mail communication distributed through the LAN 1 includes communication via the push service. -Ensure that it is encrypted at the same time it is signed.

  Here again, an advantageous use of the recipient address validity check is described. I would like to add that if the sender and gateway or directory service belong to your organization and you need to be encrypted, e-mail going out, i.e. sent to the Internet or the like. Considered by any recipient.

  The only problem that arises when an external sender tries to send an email to an organization with a gateway and directory service is the recipient inside the organization's domain. Besides that, for email addresses, the real address must be present in the post box.

  For this reason, before generating an encryption key pair, a check is made to determine whether the queried email address is within your domain and whether there is a post box for it. Is advantageous. The former is made possible by the inspection by the appropriate management mechanism. The latter can be checked through a query to an internal user directory or an internal mail server. This guarantees that no encryption key with a non-existent email address will be distributed. For example, the sender can quickly recognize that he / she has mistakenly written the e-mail address. In addition, since it is not necessary to generate a meaningless encryption key, the burden of the encryption key generation service is reduced.

  Besides that, the encryption key and possibly the private key can also be transmitted to an internal directory for archiving. It would be advantageous to have security measures (backup) against data loss of the encryption key and the possibility of decrypting the encrypted version after e-mail. In some cases, it may be an organizational or legal obligation to have the encryption key centrally available for use at any time.

  It should be emphasized that basically it is possible to query multiple internal directory services or email servers.

It is a figure which shows the handling method of an encryption key. It is a figure which shows the installation system of a push server. It is a figure which shows the incorporation system of a virus and spam protection function.

Explanation of symbols

1 LAN
2 Screen workshop 3 Mobile terminal 4 Employee 5 Internal certificate authority 6 Personalized encryption key 7 Receiver key 8 Encryption key directory 9 External partner 10 Internet 11 (Internal) Mail gateway 12 Encryption key generator 13 Gateway key 14 "Private" decryption key 15 Mail server 16 Push server 17 Spam and virus scanner 18 External mail gateway 19 Personal key

Claims (25)

A method of transmitting a message, wherein a sender first queries a directory service, and the directory service searches a recipient address in an encryption key directory (8) based on the inquiry, and stores the address in the encryption key directory (8). As long as the recipient address is included, the recipient key (7) assigned to the recipient address in the encryption key directory (8) is read, and the recipient key is sent to the sender. In a method comprising the steps of notifying and then the sender encrypting the message using the recipient key (7) and forwarding it to the recipient address;
In response to the inquiry, unless the receiver address is included in the encryption key directory (8), a gateway key (13) is generated by the encryption key generator (12) and is sent to the sender. Notification, and then the sender encrypts the message using the gateway key (13) and finally transmits it to the recipient address via a mail gateway (11) that decrypts the message. And the method.   The method of claim 1, wherein the validity of the recipient address is checked.   The method of claim 2, wherein the validity check of the recipient address is performed by a recipient email server.   Method according to claim 2, wherein the validity check of the recipient address is performed by the recipient's directory service, preferably a public directory service.   The method according to any one of claims 2 to 4, wherein additional meta-information is provided after the validity check result of the recipient address is successful.   6. Method according to any one of the preceding claims, characterized in that the cryptographic key generator (12) generates a personalized gateway key (13) for the recipient address. .   The method according to any one of the preceding claims, characterized in that the gateway key (13) is assigned to the recipient address in the encryption key directory (8).   The method according to any one of claims 1 to 7, wherein the encryption key generator (12) generates, together with the gateway key (13), a decryption key (14) assigned thereto, A method wherein the mail gateway (11) decrypts the message using the decryption key (14).   9. A method according to any one of the preceding claims, characterized in that the gateway key (13) is part of a certificate.   10. A method according to any one of the preceding claims, characterized in that the message is transmitted from the sender to the recipient address via a mail server. A message transmission system for carrying out the method according to any one of claims 1 to 10, comprising means for a directory service for receiving a query from a sender, for the directory service In the system in which the means is adapted to search the recipient address by means (8) for the encryption key directory.
A system comprising: an encryption key generator for generating a gateway key based on the query when the recipient address is not included in the encryption key directory.   The system of claim 11, comprising means for checking the validity of the recipient address.   The system of claim 12, wherein the validity of the recipient address is checked at the recipient's email server.   The system of claim 12, wherein the validity of the recipient address is checked with the recipient's public directory server.   15. The system according to any one of claims 12 to 14, wherein additional meta information is provided after the recipient address validity test result is successful.   16. The system according to any one of claims 11 to 15, further comprising means for encrypting the message using the gateway key.   17. The system according to claim 11 or 16, further comprising means for signing the message using the gateway key.   The system according to any one of claims 11 to 17, further comprising a mail gateway for the signature.   The system according to any one of claims 11 to 18, further comprising a mail gateway for decrypting the message.   20. The system according to any one of claims 11 to 19, characterized in that the encryption key generator (12) has generated a personalized gateway key (13) for the recipient address. ,system.   21. The system according to any one of claims 11 to 20, characterized in that the gateway key (13) is assigned to the recipient address in the encryption key directory.   22. The system according to any one of claims 11 to 21, wherein the encryption key generator (12) generates a decryption key (14) assigned thereto together with the gateway key (13), A system wherein the mail gateway (11) decrypts the message using the decryption key (14).   23. System according to any one of claims 11 to 22, characterized in that the gateway key (13) is part of a certificate.   24. To a directory service by a sender, in particular for use in the method according to any one of claims 1 to 10, or for use in a system according to any one of claims 11 to 23. A cryptographic key generator that generates a gateway key based on a query.   25. The encryption key generator according to claim 24, wherein the gateway key is generated when a recipient address queried from the sender is not included in an encryption key directory.

Images