CA2293117A1 - System, apparatus, computer product and method for procuring encryption keys - Google Patents
System, apparatus, computer product and method for procuring encryption keys Download PDFInfo
- Publication number
- CA2293117A1 CA2293117A1 CA 2293117 CA2293117A CA2293117A1 CA 2293117 A1 CA2293117 A1 CA 2293117A1 CA 2293117 CA2293117 CA 2293117 CA 2293117 A CA2293117 A CA 2293117A CA 2293117 A1 CA2293117 A1 CA 2293117A1
- Authority
- CA
- Canada
- Prior art keywords
- terminal
- key
- communication
- exchange
- centre
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Abstract
An encryption computer product and apparatus for providing secure messaging between a first terminal and at least one other remote terminal comprising a communication facility, encryption facility and key procurement facility. A
system for secure messaging between a group of terminals over an interconnected network of computers comprising at least two terminals for sending and receiving messages, each of terminals having a key procurement facility, and key exchange centre. A method for exchanging encryption keys between remote terminals using a key exchange centre which provides the remote terminals with an exchange key and communication key encrypted with such exchange key.
system for secure messaging between a group of terminals over an interconnected network of computers comprising at least two terminals for sending and receiving messages, each of terminals having a key procurement facility, and key exchange centre. A method for exchanging encryption keys between remote terminals using a key exchange centre which provides the remote terminals with an exchange key and communication key encrypted with such exchange key.
Description
Description Field of Invention This invention relates to an improved system for exchanging encryption keys for secure messaging between at least two terminals over an unsecured network.
This invention relates generally to an apparatus for secure messaging between at least two terminals over an unsecured network. This invention still further relates to an improved method for encrypted messaging between a plurality of remote terminals in combination with a key exchange centre.
Background of Invention This invention relates to cryptography, that is the use of secret codes to maintain the privacy of communications exchanged in a medium where communications are susceptible to intrusion or interception. More particularly, the invention relates to a system, apparatus, computer program and method for procuring keys to cryptographic codes for encrypted communications over an unsecured network.
In the business world, substantially instantaneous communication by electric means has replaced posted mail, courier and the like as the most important means of communication. While such electric means of communication, for example, communication by means of terrestrial microwave radio, satellite or long wires, allow communication of large amounts of data at great speed, such electric means are inherently susceptible to intrusion or interception. Thus, the need for the art of encryption.
The advances in digital computing and communication technology have given rise to various encryption technologies which utilize intricate algorithms implemented by computer. The focus of many of those skilled in the art of encryption has been the development of encryption algorithms that are practically undecipherable without possession of the corresponding encryption key, including combination of public encryption keys with private passwords in a private-public encryption model.
This invention relates generally to an apparatus for secure messaging between at least two terminals over an unsecured network. This invention still further relates to an improved method for encrypted messaging between a plurality of remote terminals in combination with a key exchange centre.
Background of Invention This invention relates to cryptography, that is the use of secret codes to maintain the privacy of communications exchanged in a medium where communications are susceptible to intrusion or interception. More particularly, the invention relates to a system, apparatus, computer program and method for procuring keys to cryptographic codes for encrypted communications over an unsecured network.
In the business world, substantially instantaneous communication by electric means has replaced posted mail, courier and the like as the most important means of communication. While such electric means of communication, for example, communication by means of terrestrial microwave radio, satellite or long wires, allow communication of large amounts of data at great speed, such electric means are inherently susceptible to intrusion or interception. Thus, the need for the art of encryption.
The advances in digital computing and communication technology have given rise to various encryption technologies which utilize intricate algorithms implemented by computer. The focus of many of those skilled in the art of encryption has been the development of encryption algorithms that are practically undecipherable without possession of the corresponding encryption key, including combination of public encryption keys with private passwords in a private-public encryption model.
The integrity of any cryptographic system, however, relies on the secure distribution of encryption keys between users of an electric communication network, or generation of such encryption keys at the terminals of the users. Numerous such distribution systems, apparati and method have been provided for.
For example, United States Patent No. 5,016,276, issued on May 14, 1991 to Matumoto et al. , provides for a common cryptokey generation system for generating a common cryptokey to be used in securely communicating text from a first entity to a second entity, the first and second entities being remote from one another and having respective unique first and second entity identifiers, the system comprising:
algorithm generation means for transforming the entity identifiers into a centre algorithm, and for using the centre algorithm to generate first and second algorithms uniquely corresponding to the respective first and second entities; and first and second cryptokey generation means associated with the respective first and second entities and remote from each other for generating the common cryptokey, each of the first and second cryptokey generation means having storage means for storing the respective first and second algorithms and processing means operatively coupled to the storage means for processing the respective first and second algorithms in combination with the respective second and first entity identifiers to generate the common cryptokey.
By way of further example, U.S. Patent No. 4,888,800, which issued to Marshall, Alan D et al. on December 19, 1989, provides for a secure communications system comprising at least 3 terminals and a key distribution centre (KDC), in which users of such terminals are first provided with "User Master Keys" which are installed on said terminals, and then KDC on request by a first terminal provides the first terminal and a second terminal specified by the first terminal with key means, under encryption by key transporting keys each of which is shared by a single terminal and the KDC, for communication between the pair of terminal, characterized in that the key means so provided are used as key transporting keys between the two terminals to exchange data transporting keys which are in turn used by the two terminals for passing data between them. As a result, this invention provides each terminal with two keys, one for encrypting messages from the first terminal to the second and the other for encrypting messages from the second terminal to the first.
For example, United States Patent No. 5,016,276, issued on May 14, 1991 to Matumoto et al. , provides for a common cryptokey generation system for generating a common cryptokey to be used in securely communicating text from a first entity to a second entity, the first and second entities being remote from one another and having respective unique first and second entity identifiers, the system comprising:
algorithm generation means for transforming the entity identifiers into a centre algorithm, and for using the centre algorithm to generate first and second algorithms uniquely corresponding to the respective first and second entities; and first and second cryptokey generation means associated with the respective first and second entities and remote from each other for generating the common cryptokey, each of the first and second cryptokey generation means having storage means for storing the respective first and second algorithms and processing means operatively coupled to the storage means for processing the respective first and second algorithms in combination with the respective second and first entity identifiers to generate the common cryptokey.
By way of further example, U.S. Patent No. 4,888,800, which issued to Marshall, Alan D et al. on December 19, 1989, provides for a secure communications system comprising at least 3 terminals and a key distribution centre (KDC), in which users of such terminals are first provided with "User Master Keys" which are installed on said terminals, and then KDC on request by a first terminal provides the first terminal and a second terminal specified by the first terminal with key means, under encryption by key transporting keys each of which is shared by a single terminal and the KDC, for communication between the pair of terminal, characterized in that the key means so provided are used as key transporting keys between the two terminals to exchange data transporting keys which are in turn used by the two terminals for passing data between them. As a result, this invention provides each terminal with two keys, one for encrypting messages from the first terminal to the second and the other for encrypting messages from the second terminal to the first.
Further, U.S. Patent No. 4,876,716, which issued on October 24, 1989 to Okamoto, provides for a method which comprises the following steps: generating a first random number in a first system; generating first key distribution information in the first system by applying a predetermined first transformation to the first random number on the basis of first secret information known only by the first system;
transmitting the first key distribution information to a second system via a communication channel;
receiving the first key distribution information in the second system; generating a second random number in the second system; generating second key distribution information by applying the predetermined first transformation to the second random number on the basis of second secret information known only by the second system; transmitting the second key distribution information to the first system via the channel; receiving the second key distribution information in the first system; and generating an enciphering key in the first system by applying a predetermined second transformation to the second key distribution information on the basis of the first random number and identification information of the second system which is not secret.
U.S. Patent No. 5,251,258, which was issued on October 5, 1993 to Tanaka, relates to a key distribution method which comprises the following steps: (a) accessing, in the first subsystem, the public file by the second identification information to read the second public information; (b) generating, in the first subsystem, a random number; (c) generating, in the first subsystem, a first cipher key by applying a first predetermined transformation on the second public information and the second identification information on the basis of first and second constants and the random number; (d) generating, in the first subsystem, a key distribution code by applying a second predetermined transformation on the first public information and a third constant on the basis of the first constant, the first secret information, and the random number; (e) transmitting, as distribution information, the key distribution code and the first identification information from the first subsystem to the second subsystem via the communication channel; (f) receiving, in the second subsystem, the distribution information from the first subsystem;
and (g) generating, in the second subsystem, a second cipher key by applying a third predetermined transformation on the key distribution code and the first identification information on the basis of the first and the second constants and the second secret information, the second cipher key being equal to the first cipher key.
transmitting the first key distribution information to a second system via a communication channel;
receiving the first key distribution information in the second system; generating a second random number in the second system; generating second key distribution information by applying the predetermined first transformation to the second random number on the basis of second secret information known only by the second system; transmitting the second key distribution information to the first system via the channel; receiving the second key distribution information in the first system; and generating an enciphering key in the first system by applying a predetermined second transformation to the second key distribution information on the basis of the first random number and identification information of the second system which is not secret.
U.S. Patent No. 5,251,258, which was issued on October 5, 1993 to Tanaka, relates to a key distribution method which comprises the following steps: (a) accessing, in the first subsystem, the public file by the second identification information to read the second public information; (b) generating, in the first subsystem, a random number; (c) generating, in the first subsystem, a first cipher key by applying a first predetermined transformation on the second public information and the second identification information on the basis of first and second constants and the random number; (d) generating, in the first subsystem, a key distribution code by applying a second predetermined transformation on the first public information and a third constant on the basis of the first constant, the first secret information, and the random number; (e) transmitting, as distribution information, the key distribution code and the first identification information from the first subsystem to the second subsystem via the communication channel; (f) receiving, in the second subsystem, the distribution information from the first subsystem;
and (g) generating, in the second subsystem, a second cipher key by applying a third predetermined transformation on the key distribution code and the first identification information on the basis of the first and the second constants and the second secret information, the second cipher key being equal to the first cipher key.
By way of even further example, U.S. Patent No. 5,812,671, which issued on September 22, 1998 to Ross, Jr. provides for a system that parties have network access to a network secure communications gateway which stores the current encryption/decryption algorithms and keys for parties registered with the network secure communications gateway. For party A to send an encrypted message to party B, party A encrypts the message using party A's secret key and encryption algorithm, copies of which are stored at the network gateway Party A sends the encrypted message, addressed to party B, initially to the gateway. The gateway decrypts the message, using party A's secret key and algorithm, and then encrypts the decrypted message using party B's secret key and algorithm. Finally, the gateway forwards the re-encrypted message to party B, where B decodes it using B's secret key and algorithm. The secure communications gateway periodically changes client keys (or algorithms and keys) to provide additional system security.
Lastly, United States Patent No. 5,253,294 which was issued on October 12, to Maurer, provides for a secure transmission system having a transmitting terminal for encrypting and transmitting a message signal and a receiving terminal for receiving and decrypting said message signal, said transmitting terminal comprising: message encryption means for encrypting a message signal according to a predetermined algorithm and a key, first key library means containing a number of possible key elements in excess of the number of elements in said key, and first key selection means for selecting said key from said first key library according to a key index available to both said transmitting and said receiving terminals, said receiving terminal comprising, second key library means similar to said first key library means, second key selection means for selecting said key according to said key index, and message decryption means for decrypting said encrypted message signal with the use of said key.
Numerous known cryptographic systems contemplate generation of an encryption key known only to a defined group of terminals by use of secret password which is exchanged between the users of such terminals by a communication method that is perceived to be secure such as telephone or mail. The risk, however, is that if such password were to become known by an intruder, then the intruder would be able to decrypt messages intercepted by the intruder. It is therefore preferable in a cryptographic system that the encryption key be available to the group of terminals but that the means for generating such encryption key (password or the like) not be readily known.
Alternatively, many cryptographic systems provide for a constant intermediary in all communications between the defined group of terminals to ensure secure communications between such terminals. The need for an intermediary hardware/middleware infrastructure results from the fact that many of the known cryptographic systems do not provide for secure transmission of an encryption key, but rather provide for secure channels created by such intermediary. In a cryptographic system which exchanges a large volume of messages, such a hardware/middleware infrastructure will by necessity be complicated and expensive to assemble, implement and maintain.
Other known cryptographic systems provide for a communication network available to a large number of users using the same encryption key. Because of the significant incentive for deciphering a key allowing access to messages exchanged between a large number of users, such cryptographic systems present means for simultaneously updating such encryption key for all of its users. Such a cryptographic system, however, again requires a complicated and expensive hardware/middleware infrastructure. From a security point of view, it is more desirable to provide for a cryptographic system wherein an encryption key is specific to only a group of users that intend to exchange encrypted messages, and wherein such group of users can update their encryption key easily at will.
There are known cryptographic systems which ultimately provide for one communication key used to encrypt and decrypt messages as between at least two terminals directly. However, in all of such known cryptographic systems, there are disadvantages. One type of such cryptographic system requires that each terminal have means for generating an encryption key using its own identification data as well as identification data relating to the other terminal provided securely from a key distribution centre. Such a system is not desirable because the cost of providing a key generating means capable of generating an encryption key of the requisite strength at each terminal is prohibitive; and the generation of such an encryption key is dependent on having received all of the applicable identification data which results in delay and additional steps required before secure messaging can begin.
In other such systems which provide a communication key to encrypt and decrypt messages as between at least two terminals, initial secure communication with a key exchange centre is established using a "User Master Key" or the like which is distributed physically and not electronically to the users of such terminals. Such an additional step is impractical from the perspective of the encryption provider where there is a large number of keys to provide. From the user's perspective the resultant delay is intolerable in the context of near instantaneous electronic communication.
Summary of the Invention One aspect of the invention is an encryption computer program product for providing secure messaging between a first terminal and at least one other remote terminal comprising: communication means for communicating with said remote terminal and a key exchange centre; encryption means for encrypting and decrypting messages exchanged between said first terminal and remote terminal, and decrypting messages received from said key exchange centre; and key procurement means for obtaining an encryption key from said key exchange centre wherein said communication means, encryption means and key procurement means are operably associated to securely obtain from said key exchange centre a key for encrypting and decrypting messages as between said first terminal and remote terminal.
A further aspect of this invention is an apparatus operably associated with a first terminal for secure messaging between said first terminal and at least one other remote terminal comprising: communication means for communicating with said remote terminal and a key exchange centre; encryption means for encrypting and decrypting messages exchanged between said first terminal and remote terminal, and decrypting messages received from said key exchange centre; and key procurement means for obtaining an encryption key from said key exchange centre wherein said communication means, encryption means and key procurement means are operably associated to securely obtain _7_ from said key exchange centre a key for encrypting and decrypting messages as between said first terminal and remote terminal.
A still further aspect of this invention is an apparatus operably associated with a first terminal for secure messaging between said first terminal and at least one other remote terminal comprising: an identifier corresponding to said first terminal;
communication means for communicating with said remote terminal and key exchange centre; encryption means for encrypting and decrypting messages exchanged between said first terminal and remote terminal, and for decrypting messages received from said key exchange centre; initiating means; memory; key procurement operably associated with said encryption means and memory, said key procurement means further comprising: a registration means operably associated with said communication means for presenting said identifier to said key exchange centre thereby initiating said key exchange centre to generate on a pseudorandom basis an exchange key for decrypting communications between said first terminal and key exchange centre, and to transmit said exchange key to said first terminal; and key requesting means operably associated with said communication means for requesting said key exchange centre to: generate a communication key for encrypting and decrypting communications between said first terminal and remote terminal, and to transmit said communication key to said first terminal on an encrypted basis using said exchange key; wherein said key procurement means saves said exchange key and communication key in said memory; wherein said initiation means: initiates said registration means if said first terminal has not been registered, and initiates said requesting means if encrypted communication between said first terminal and remote terminal is requested at either of said first terminal or remote terminal; and wherein said memory, encryption means, communication means, initiation means are operably associated to exchange encrypted messages as between said first terminal and remote terminal.
A still further aspect of this invention is a system for secure messaging between a group of terminals over an interconnected network of computers comprising:
at least two terminals for sending and receiving messages, each of said terminals further comprising a terminal communication means, encryption means operably associated with said terminal communication means for exchanging messages on an encrypted basis, key _8_ procurement means operably associated with said terminal communication means, and memory; and key exchange centre further comprising: exchange communication means responsive to said terminal communication means, exchange key generating means, communication key generating means; wherein said key exchange centre is responsive to said key procurement means to make each of said terminals known to said key exchange centre; generate an exchange key corresponding to each of said terminals for decrypting messages exchanged between said terminals and key exchange centre; transmit said exchange key to said terminals; encrypt a communication key generated by said communication key generating means with said exchange key and transmit same to said each of said terminals; and wherein said key procurement means is operably associated with said memory to store said exchange key and communication key in said memory;
and wherein said terminal communication means, encryption means and memory present means for encrypted communications between said group of terminals.
In accordance with a further aspect of the invention, a method for exchanging encryption keys between remote terminals using a key exchange centre, wherein identification data identifies Terminal #l, Terminal #2 and Terminal #n:
presenting said identification data to said key exchange centre on a secure basis which identification data is validated by said key exchange centre using said identification data;
generating a plurality of exchange keys at said key exchange centre corresponding to each of said Terminal #1, Terminal #2 and Terminal #n for decrypting encrypted data received from said key exchange centre by each of said Terminal #1, Terminal #2 and Terminal #n;
presenting a communication key request at said key exchange centre for Terminal #1 to communicate with said Terminal #2 and Terminal #n on an encrypted basis;
generating a communication key at said exchange centre for Terminal #1 to communicate with Terminal #2 and Terminal #n on an encrypted basis; encrypting said communication key at said exchange centre with each of said exchange keys corresponding to Terminal #1, Terminal #2 and Terminal #n; and transmitting said encrypted communication key from said key exchange centre to each of said Terminal #1, Terminal #2 and Terminal #n.
The objects of the invention disclosed herein are as follows: the invention provides for a simple but effective method for generating a strong encryption key and making such key available to a group of users desiring to exchange encrypted communications, so that such key is available only to such users and resident on the users' terminals but not dependent solely on a password that might be easily divulged, whether intentionally or accidentally. The invention disclosed herein also provides for a simple and secure system of distributing such an encryption key to a group of users. Lastly, the invention disclosed herein provides for a computer program for use in association with a microprocessor, which program provides all the utilities necessary within a terminal for procuring an encryption key from a key exchange centre for secured communications with at least one other terminal with no requirement additional to an e-mail address, i.e.
without the need for physical delivery of a "User Master Key" or the like, and using the minimum number of steps. In this way the invention disclosed herein, does not relate to encryption key exchange or distribution but rather encryption key procurement.
Brief Description of Drawings Fig. 1 is a system flowchart of the system described herein.
Fig. 2 is a program function flowchart of depicting the functionality bestowed on a microprocessor by the computer program provided for herein.
Fig. 3 is a program resources flowchart of the computer program provided for herein.
In the drawings, preferred embodiments of the invention are illustrated by way of example. It is to be expressly understood that the description and drawings are only for the purpose of illustration and as an aid to understanding and are not intended as a definition of the limits of the invention.
Best Mode for Carrying Out the Invention In the description which follows, like parts are marked throughout the specification and the drawings with the same respective reference numerals.
The drawings are not necessarily to scale and in some instances proportions may have been exaggerated in order to more clearly depict certain features of the invention.
It should also be understood that the invention disclosed relates in part to the operation of a microprocessor bestowed by a computer program for procuring an encryption key and facilitating communication on an encrypted basis. Many of these operations are described herein in general terms only, using ordinary terminology to describe the same. The design and implementation of these operations into a computer program such as the one disclosed, however, is known to programmers with ordinary skill in creating programs for operating systems such as Microsoft Windows or UNIX, in a variety of computer languages including C++, HTML and the like.
Referring to Fig. 1, the present invention provides for a system for secure messaging between a group of computer terminals Terminal #l, Terminal #2, Terminal #n (where "n" signifies that the number of terminals is not finite), a communication medium 8 ~e.g. Internet or Intranet, or Internet with Intranet intermediary) and a key exchange centre 10. Each of said Terminals #1, #2, #n (each of which may also comprise an Intranet server with a further associated group of terminals) comprises a microprocessor 12. Microprocessor 12 is associated with hardware/middleware 14 and memory 16, as is customary in any terminal with computing capability whether a personal computer, network computer or apparatus with embedded computing capability.
Microprocessor 12 is further associated with a communication device and utility 18 for communicating over communication medium 8 such as a modem connected to a telephone line, satellite network dish or the like, and associated computer programs such as a dial-up utility, browser and e-mail software.
Each such microprocessor 12 is further associated with computer program 20 which bestow on microprocessor 12 the features described herein, in particular the resources shown in Fig. 2, namely key procurement facility 22, encryption facility 24 for encrypting and decrypting communications and related communication facility 26 which in association with communication device and utility 18, establishes communication with key exchange centre 10.
In the preferred embodiment disclosed herein, encryption facility 24 utilizes the public domain "BLOWFISH" encryption technology, however, an encryption algorithm of similar bit-length can equally be used.
In operation, as shown in Figs. 1 and 2, the computer program 20 described herein is installed on Terminal #1 whereby microprocessor 12 creates in memory 16 a data structure which corresponds to a password book 30, in a manner known to those skilled in the art, for holding data files corresponding to communication keys for secure messaging with Terminals #2 and #n. In addition, upon installing computer program 20, microprocessor 12 initiates the key procurement routine. In running the key procurement routine, as shown in Fig. 3, Terminal #1 obtains from installed memory presented by computer program 20 the Universal Resource Locator of key exchange centre 10.
Then, the key procurement facility 22 engages communication facility 26 which, in turn, searches for communication device and utility 18. The microprocessor 12, in combination with the key procurement facility 22, establishes secure communication with the key exchange centre 10, which secure communication method is supported by the key exchange centre 10.
The preferred embodiment disclosed herein utilizes for encryption, as between the key exchange centre 10 and each of Terminal #1, #2, #n a browser resident on each of such terminals which provides a security protocol layered beneath an application protocol, which security protocol is implemented through a "Secure Sockets Layer"
library which is bound to the browser application. The modules of this library emulate the "sockets"
application program interface which is supported by most major operating systems including UNIX and Microsoft Windows. For further discussion of a "Secure Sockets Layer" interfaces generally, see "Internetworking with TCT/IP", vol. 1, by Douglas E.
Comer, Prentice-Hall, and U.S. Patent No. 5,825,890.
The security of the key exchange centre 10 itself can be provided for in a variety of means well-known to those skilled in the art. For example, a secure server identification can be obtained from VeriSign, Inc. and similar organizations.
In addition, the server on which key exchange centre 10 is resident can be physically kept at a secure location with the appropriate security systems and physical access restrictions. More importantly, any data structures containing sensitive information within the secure server can be encrypted, for example, by using triple "DES" encryption with a private key in compiled code that can only be executed on the secure server's router system.
Many additional security features could be added to the secure server in the manner well-known to those skilled in the art.
As best shown in Fig. 3, microprocessor 12 in operation with key procurement facility 22 establishes communication with the key exchange centre 10 which presents to Terminal #1 a secure web page, by means of the communication facility 32 of the key exchange centre 10 (depicted in Fig. 1). This secure web page asks for the e-mail address of User #1 which is by definition unique to the user. Once the requisite information has been provided by the first terminal user, s/he is asked to engage a "SEND" icon, or equivalent, for validating the e-mail address (as a valid e-mail address).
If an e-mail address is incorrectly entered, then the invention described herein provides for an "ERROR" message inviting User #1 to attempt input of its e-mail address again.
By clicking on the "SEND" icon, the key exchange centre automatically sends a pre-formatted confirming e-mail to the e-mail address provided in the secure web page to ensure that it is not a third party knowing the e-mail address of User #1 that is requesting the communication key. When, and only when, this e-mail is received back from User #1, will the validation of Terminal #1 be complete.
If the information provided is validated as described above, exchange microprocessor 34 creates a data file 36 in exchange memory 38 that pertains to User #1 which contains his/her e-mail address, as well as such additional identification data as may be desirable (address, etc.).
As shown in Fig. 1, the key exchange centre 10 further comprises a pseudorandom key generator 39. In response to User's #1's e-mail address being provided and validated as described above, key generator 39 generates an exchange key 40 for decrypting any messages transmitted by the key exchange centre 10 to Terminal #l. Exchange microprocessor 34 stores Terminal #1's exchange key in Terminal #1 data file 36. Exchange microprocessor 34 makes exchange key 40 available to User #1 on the secure page. Exchange key 40 can then be "copied" and "pasted" into password book 30 or, alternatively, as is the case in the preferred embodiment of the microprocessor 12 provided for herein, the field containing exchange key 40 in the secure page, if found by microprocessor 12, is automatically copied into password book 30 in a manner well-known to those skilled in the art. Exchange key 40 cannot be derived by any third party because it is random.
The exchange key generator 39 of the key exchange centre 10 can be provided in numerous ways known by those skilled in the art. For example, the key exchange centre can be provided with a long shift register with pseudorandom number generator, and associated input and output.
Once Terminal #1 has procured its exchange key 40, the registration function of 10 the key procurement means, as depicted in Fig. 2 will have been fulfilled.
Any communications from key exchange centre 10 to Terminal #1 are now encrypted by exchange centre encryption facility 44 using exchange key 40 and decrypted by Terminal #1 also using encryption facility 24 in combination with exchange key 40.
In operation, User #1 who has now obtained his/her exchange key 40 will have established the e-mail addresses of Users #2, #n. The key procurement facility 22 in combination with communication facility 26 provides means for accessing the secure page again. This further accessing of the secure web page can be initiated by a variety of means. For example, when the computer program 20 provided for herein is installed, an interface is presented wherein there is a menu or toolbar providing an "OBTAIN
KEY" function or equivalent. Selecting this "OBTAIN KEY" function will initiate microprocessor 12 to engage communication facility 26, and thereby initiate communication device and utility 18 of the terminal. The secure page is thereby accessed.
The secure page will ask for User #1's e-mail address which exchange microprocessor 34 will recognize in combination with a search function associated with microprocessor 34 and exchange memory 38. User #1 is then asked to indicate the e-mail addresses of User #2, #n. Once these e-mail addresses are provided and a "SEND"
icon or equivalent is engaged by User #1, and such e-mail addresses have been validated as described above, communication key generator 42 is engaged by exchange microprocessor 34 and communication key 46 for encrypting and decrypting messages as between User #1, #2, #n is generated, in a manner well-known to those skilled in the art. Exchange microprocessor 34 then engages the key exchange centre encryption means 44 and communication key 46 is encrypted using exchange key 40. Communication key 46 is then transmitted to Terminal #1, for example, as an encrypted attachment to an e-mail.
In a manner well-known to those skilled in the art, when User #1 "clicks" on this attachment, the computer program 20 provided for herein is engaged by microprocessor 12, and microprocessor 12 retrieves exchange key 40 from password book 30 and, in combination with encryption facility 24, communication key 46 is decrypted and stored in password book 30.
The preferred embodiment of the invention disclosed herein also provides for alternative means for procuring communication key 46. For example, computer program provided for herein can be associated with communication device and utility 18 15 resident on Terminal #1 whereby when a user generates an e-mail and then "clicks on"
an "ENCRYPT-DECRYPT" icon disposed on a toolbar, computer program 20 in combination with microprocessor 12 searches and correlates the contents of password book 30 to match the contents of the "RECIPIENT" or equivalent field of the e-mail generated and determine if there is a matching communication key 46 in password book 20 16. As, in our example, User #1 may not have yet obtained communication key 46, when User #1 selects the "ENCRYPT-DECRYPT" icon, no corresponding communication key 46 will be correlated to the "RECIPIENT" field of the e-mail.
Computer program 20 in these circumstances, in combination with microprocessor 12 and communication facility 26 engages the communication device and utility 18 of Terminal #1 (if same has not yet been engaged), and thereby obtains the secure page in the manner described above. Whichever solution is adopted, the key procurement facility procures communication key 46.
It should also be understood that, as best shown in Fig. 3, the operation of the system disclosed herein has been described until now as a two-step process:
(1) wherein key procurement facility of the invention obtains the secure web page to register User #1 and obtain an exchange key; and (2) wherein the key procurement facility of the invention obtains a communication key which is decrypted using the exchange key.
However, without any additional modification to the system provided for herein, the communication key can be obtained in a one-step process, i.e. in one session, as shown in Fig. 3:
wherein the key procurement facility obtains and stores in memory 16 both the exchange key and the encrypted communication key, upon return of the validating preformatted e mail referred to above.
In order to exchange messages with Terminals #2, #n, communication key 46 will also have to be obtained by Users #2, #n. Whether during STEP 1 or STEP 2 referred to in Fig. 3, User #1 will provide to the key exchange centre 10 the e-mail addresses of such Users #2, #n. Upon receipt of such e-mail addresses, exchange microprocessor 34 will initiate a search utility to determine whether exchange memory 38 has data files relating to the e-mail addresses of User #2, #n, in which case, in the preferred embodiment of the invention described herein, a random exchange key 40 corresponding to User #2, #n will have been previously generated. If such exchange keys already exist, then communication key 46 will be sent as an attachment of an e-mail encrypted with such individual exchange keys 40. When such e-mails are received, provided that the computer program 20 described herein is installed on such other Terminal #2, #n, the attachment will be decrypted and stored in password book 30 of Terminal #2, #n, as described above.
Alternatively, if Terminal #2, #n do not yet possess their own exchange key 40, an e-mail will be sent to User #2, #n bearing the location of the secure web page, thus initiating such Terminal #2, #n to register with the key exchange centre 10, as described above. User #2, #n will obtain the secure web page provided that the computer program is installed on Terminal #2, #n and the e-mail addresses provided to the secure web page are validated as provided above. User #2, #n then obtain communication key 46 in the manner described above, and shown in Fig. 3 in particular.
It should be understood that the security achieved as between Terminal #1, #2, #n and the key exchange centre 10 as for herein is not immune to interception.
However, any interception of the exchange key 40 between the key exchange centre 10 and Terminal #1, #2, #n will result in a break in the negotiation of the secure "Secure Sockets Layer" connection between the key exchange centre 10 and such terminal, which will be detected by the key exchange centre 10 in which case an "ERROR"
message or equivalent will be issued by the key exchange centre 10 and Terminal #1, #2, #n will be invited to access the secure web page again (e.g. by pressing the "RELOAD"
button on a browser, for example) thereby initiating the generation of another exchange key 40.
The preferred embodiment of the system described herein is dependent on each of Terminal #1, #2, #n having a microprocessor associated with the computer program described above. However, many of the advantages of the system, apparatus, computer product and method disclosed herein may be achieved by using computer products having the essential features of the computer product described herein but also, in addition, a different interface or additional features not described herein. By way of example, the system provided for herein can be easily provided by a ordinary person skilled in the art with functionality for adding new users to a pre-established group of users having a common communication key by providing an "ADD NEW GROUP MEMBER"
command on the secure web page which allows User #1 to request that User #3 be added, in which case, for example, key exchange centre sends a "NEW GROUP MEMBER
CONSENT" e-mail which might require that existing group members (i.e. various Users sharing one communication key) type "YES" or "NO" in the body of their e-mail response, and where when each group member has provided consent in this way, or in a similar manner, then User #3 is registered with the key exchange centre as described above, if User #3 is not yet registered, and presented with the communication key on an encrypted basis. In addition, the key exchange centre can be provided with means for generating hierarchies of communication keys wherein higher-level communication keys can decrypt communications of all lower-level communication keys used by lower-level groups, in a manner well-known to those skilled in the art.
It should be noted that the invention disclosed herein can be easily adapted for use in communication networks of any kind, including digital telephone systems, data packets transfers in LANs and the like. In addition, the computer program disclosed herein can be adapted to a variety of operating environments or programming platforms, and could be embedded on a variety of hardware, middleware or other device. Furthermore, the system, apparatus, computer program and method described herein can be used to exchange any type of computer file on an encrypted basis, with some modifications known to those skilled in the art, including but not limited to graphic files, sounds files, spreadsheet files and the like.
In addition, the computer program disclosed herein can be sold off-the-shelf or downloaded over the Internet, in a manner well-known to those skilled in the art. One of the advantages of the invention disclosed herein is that when the computer program is purchased over the Internet by a user, it should be understood that the exchange key and communication key can also be obtained all as part of one step, as described above.
Various embodiments of the invention have now been described in detail. Since changes in and/or additions to the above-described best mode may be made without departing from the nature, spirit or scope of the invention, the invention is not to be limited to said details.
Lastly, United States Patent No. 5,253,294 which was issued on October 12, to Maurer, provides for a secure transmission system having a transmitting terminal for encrypting and transmitting a message signal and a receiving terminal for receiving and decrypting said message signal, said transmitting terminal comprising: message encryption means for encrypting a message signal according to a predetermined algorithm and a key, first key library means containing a number of possible key elements in excess of the number of elements in said key, and first key selection means for selecting said key from said first key library according to a key index available to both said transmitting and said receiving terminals, said receiving terminal comprising, second key library means similar to said first key library means, second key selection means for selecting said key according to said key index, and message decryption means for decrypting said encrypted message signal with the use of said key.
Numerous known cryptographic systems contemplate generation of an encryption key known only to a defined group of terminals by use of secret password which is exchanged between the users of such terminals by a communication method that is perceived to be secure such as telephone or mail. The risk, however, is that if such password were to become known by an intruder, then the intruder would be able to decrypt messages intercepted by the intruder. It is therefore preferable in a cryptographic system that the encryption key be available to the group of terminals but that the means for generating such encryption key (password or the like) not be readily known.
Alternatively, many cryptographic systems provide for a constant intermediary in all communications between the defined group of terminals to ensure secure communications between such terminals. The need for an intermediary hardware/middleware infrastructure results from the fact that many of the known cryptographic systems do not provide for secure transmission of an encryption key, but rather provide for secure channels created by such intermediary. In a cryptographic system which exchanges a large volume of messages, such a hardware/middleware infrastructure will by necessity be complicated and expensive to assemble, implement and maintain.
Other known cryptographic systems provide for a communication network available to a large number of users using the same encryption key. Because of the significant incentive for deciphering a key allowing access to messages exchanged between a large number of users, such cryptographic systems present means for simultaneously updating such encryption key for all of its users. Such a cryptographic system, however, again requires a complicated and expensive hardware/middleware infrastructure. From a security point of view, it is more desirable to provide for a cryptographic system wherein an encryption key is specific to only a group of users that intend to exchange encrypted messages, and wherein such group of users can update their encryption key easily at will.
There are known cryptographic systems which ultimately provide for one communication key used to encrypt and decrypt messages as between at least two terminals directly. However, in all of such known cryptographic systems, there are disadvantages. One type of such cryptographic system requires that each terminal have means for generating an encryption key using its own identification data as well as identification data relating to the other terminal provided securely from a key distribution centre. Such a system is not desirable because the cost of providing a key generating means capable of generating an encryption key of the requisite strength at each terminal is prohibitive; and the generation of such an encryption key is dependent on having received all of the applicable identification data which results in delay and additional steps required before secure messaging can begin.
In other such systems which provide a communication key to encrypt and decrypt messages as between at least two terminals, initial secure communication with a key exchange centre is established using a "User Master Key" or the like which is distributed physically and not electronically to the users of such terminals. Such an additional step is impractical from the perspective of the encryption provider where there is a large number of keys to provide. From the user's perspective the resultant delay is intolerable in the context of near instantaneous electronic communication.
Summary of the Invention One aspect of the invention is an encryption computer program product for providing secure messaging between a first terminal and at least one other remote terminal comprising: communication means for communicating with said remote terminal and a key exchange centre; encryption means for encrypting and decrypting messages exchanged between said first terminal and remote terminal, and decrypting messages received from said key exchange centre; and key procurement means for obtaining an encryption key from said key exchange centre wherein said communication means, encryption means and key procurement means are operably associated to securely obtain from said key exchange centre a key for encrypting and decrypting messages as between said first terminal and remote terminal.
A further aspect of this invention is an apparatus operably associated with a first terminal for secure messaging between said first terminal and at least one other remote terminal comprising: communication means for communicating with said remote terminal and a key exchange centre; encryption means for encrypting and decrypting messages exchanged between said first terminal and remote terminal, and decrypting messages received from said key exchange centre; and key procurement means for obtaining an encryption key from said key exchange centre wherein said communication means, encryption means and key procurement means are operably associated to securely obtain _7_ from said key exchange centre a key for encrypting and decrypting messages as between said first terminal and remote terminal.
A still further aspect of this invention is an apparatus operably associated with a first terminal for secure messaging between said first terminal and at least one other remote terminal comprising: an identifier corresponding to said first terminal;
communication means for communicating with said remote terminal and key exchange centre; encryption means for encrypting and decrypting messages exchanged between said first terminal and remote terminal, and for decrypting messages received from said key exchange centre; initiating means; memory; key procurement operably associated with said encryption means and memory, said key procurement means further comprising: a registration means operably associated with said communication means for presenting said identifier to said key exchange centre thereby initiating said key exchange centre to generate on a pseudorandom basis an exchange key for decrypting communications between said first terminal and key exchange centre, and to transmit said exchange key to said first terminal; and key requesting means operably associated with said communication means for requesting said key exchange centre to: generate a communication key for encrypting and decrypting communications between said first terminal and remote terminal, and to transmit said communication key to said first terminal on an encrypted basis using said exchange key; wherein said key procurement means saves said exchange key and communication key in said memory; wherein said initiation means: initiates said registration means if said first terminal has not been registered, and initiates said requesting means if encrypted communication between said first terminal and remote terminal is requested at either of said first terminal or remote terminal; and wherein said memory, encryption means, communication means, initiation means are operably associated to exchange encrypted messages as between said first terminal and remote terminal.
A still further aspect of this invention is a system for secure messaging between a group of terminals over an interconnected network of computers comprising:
at least two terminals for sending and receiving messages, each of said terminals further comprising a terminal communication means, encryption means operably associated with said terminal communication means for exchanging messages on an encrypted basis, key _8_ procurement means operably associated with said terminal communication means, and memory; and key exchange centre further comprising: exchange communication means responsive to said terminal communication means, exchange key generating means, communication key generating means; wherein said key exchange centre is responsive to said key procurement means to make each of said terminals known to said key exchange centre; generate an exchange key corresponding to each of said terminals for decrypting messages exchanged between said terminals and key exchange centre; transmit said exchange key to said terminals; encrypt a communication key generated by said communication key generating means with said exchange key and transmit same to said each of said terminals; and wherein said key procurement means is operably associated with said memory to store said exchange key and communication key in said memory;
and wherein said terminal communication means, encryption means and memory present means for encrypted communications between said group of terminals.
In accordance with a further aspect of the invention, a method for exchanging encryption keys between remote terminals using a key exchange centre, wherein identification data identifies Terminal #l, Terminal #2 and Terminal #n:
presenting said identification data to said key exchange centre on a secure basis which identification data is validated by said key exchange centre using said identification data;
generating a plurality of exchange keys at said key exchange centre corresponding to each of said Terminal #1, Terminal #2 and Terminal #n for decrypting encrypted data received from said key exchange centre by each of said Terminal #1, Terminal #2 and Terminal #n;
presenting a communication key request at said key exchange centre for Terminal #1 to communicate with said Terminal #2 and Terminal #n on an encrypted basis;
generating a communication key at said exchange centre for Terminal #1 to communicate with Terminal #2 and Terminal #n on an encrypted basis; encrypting said communication key at said exchange centre with each of said exchange keys corresponding to Terminal #1, Terminal #2 and Terminal #n; and transmitting said encrypted communication key from said key exchange centre to each of said Terminal #1, Terminal #2 and Terminal #n.
The objects of the invention disclosed herein are as follows: the invention provides for a simple but effective method for generating a strong encryption key and making such key available to a group of users desiring to exchange encrypted communications, so that such key is available only to such users and resident on the users' terminals but not dependent solely on a password that might be easily divulged, whether intentionally or accidentally. The invention disclosed herein also provides for a simple and secure system of distributing such an encryption key to a group of users. Lastly, the invention disclosed herein provides for a computer program for use in association with a microprocessor, which program provides all the utilities necessary within a terminal for procuring an encryption key from a key exchange centre for secured communications with at least one other terminal with no requirement additional to an e-mail address, i.e.
without the need for physical delivery of a "User Master Key" or the like, and using the minimum number of steps. In this way the invention disclosed herein, does not relate to encryption key exchange or distribution but rather encryption key procurement.
Brief Description of Drawings Fig. 1 is a system flowchart of the system described herein.
Fig. 2 is a program function flowchart of depicting the functionality bestowed on a microprocessor by the computer program provided for herein.
Fig. 3 is a program resources flowchart of the computer program provided for herein.
In the drawings, preferred embodiments of the invention are illustrated by way of example. It is to be expressly understood that the description and drawings are only for the purpose of illustration and as an aid to understanding and are not intended as a definition of the limits of the invention.
Best Mode for Carrying Out the Invention In the description which follows, like parts are marked throughout the specification and the drawings with the same respective reference numerals.
The drawings are not necessarily to scale and in some instances proportions may have been exaggerated in order to more clearly depict certain features of the invention.
It should also be understood that the invention disclosed relates in part to the operation of a microprocessor bestowed by a computer program for procuring an encryption key and facilitating communication on an encrypted basis. Many of these operations are described herein in general terms only, using ordinary terminology to describe the same. The design and implementation of these operations into a computer program such as the one disclosed, however, is known to programmers with ordinary skill in creating programs for operating systems such as Microsoft Windows or UNIX, in a variety of computer languages including C++, HTML and the like.
Referring to Fig. 1, the present invention provides for a system for secure messaging between a group of computer terminals Terminal #l, Terminal #2, Terminal #n (where "n" signifies that the number of terminals is not finite), a communication medium 8 ~e.g. Internet or Intranet, or Internet with Intranet intermediary) and a key exchange centre 10. Each of said Terminals #1, #2, #n (each of which may also comprise an Intranet server with a further associated group of terminals) comprises a microprocessor 12. Microprocessor 12 is associated with hardware/middleware 14 and memory 16, as is customary in any terminal with computing capability whether a personal computer, network computer or apparatus with embedded computing capability.
Microprocessor 12 is further associated with a communication device and utility 18 for communicating over communication medium 8 such as a modem connected to a telephone line, satellite network dish or the like, and associated computer programs such as a dial-up utility, browser and e-mail software.
Each such microprocessor 12 is further associated with computer program 20 which bestow on microprocessor 12 the features described herein, in particular the resources shown in Fig. 2, namely key procurement facility 22, encryption facility 24 for encrypting and decrypting communications and related communication facility 26 which in association with communication device and utility 18, establishes communication with key exchange centre 10.
In the preferred embodiment disclosed herein, encryption facility 24 utilizes the public domain "BLOWFISH" encryption technology, however, an encryption algorithm of similar bit-length can equally be used.
In operation, as shown in Figs. 1 and 2, the computer program 20 described herein is installed on Terminal #1 whereby microprocessor 12 creates in memory 16 a data structure which corresponds to a password book 30, in a manner known to those skilled in the art, for holding data files corresponding to communication keys for secure messaging with Terminals #2 and #n. In addition, upon installing computer program 20, microprocessor 12 initiates the key procurement routine. In running the key procurement routine, as shown in Fig. 3, Terminal #1 obtains from installed memory presented by computer program 20 the Universal Resource Locator of key exchange centre 10.
Then, the key procurement facility 22 engages communication facility 26 which, in turn, searches for communication device and utility 18. The microprocessor 12, in combination with the key procurement facility 22, establishes secure communication with the key exchange centre 10, which secure communication method is supported by the key exchange centre 10.
The preferred embodiment disclosed herein utilizes for encryption, as between the key exchange centre 10 and each of Terminal #1, #2, #n a browser resident on each of such terminals which provides a security protocol layered beneath an application protocol, which security protocol is implemented through a "Secure Sockets Layer"
library which is bound to the browser application. The modules of this library emulate the "sockets"
application program interface which is supported by most major operating systems including UNIX and Microsoft Windows. For further discussion of a "Secure Sockets Layer" interfaces generally, see "Internetworking with TCT/IP", vol. 1, by Douglas E.
Comer, Prentice-Hall, and U.S. Patent No. 5,825,890.
The security of the key exchange centre 10 itself can be provided for in a variety of means well-known to those skilled in the art. For example, a secure server identification can be obtained from VeriSign, Inc. and similar organizations.
In addition, the server on which key exchange centre 10 is resident can be physically kept at a secure location with the appropriate security systems and physical access restrictions. More importantly, any data structures containing sensitive information within the secure server can be encrypted, for example, by using triple "DES" encryption with a private key in compiled code that can only be executed on the secure server's router system.
Many additional security features could be added to the secure server in the manner well-known to those skilled in the art.
As best shown in Fig. 3, microprocessor 12 in operation with key procurement facility 22 establishes communication with the key exchange centre 10 which presents to Terminal #1 a secure web page, by means of the communication facility 32 of the key exchange centre 10 (depicted in Fig. 1). This secure web page asks for the e-mail address of User #1 which is by definition unique to the user. Once the requisite information has been provided by the first terminal user, s/he is asked to engage a "SEND" icon, or equivalent, for validating the e-mail address (as a valid e-mail address).
If an e-mail address is incorrectly entered, then the invention described herein provides for an "ERROR" message inviting User #1 to attempt input of its e-mail address again.
By clicking on the "SEND" icon, the key exchange centre automatically sends a pre-formatted confirming e-mail to the e-mail address provided in the secure web page to ensure that it is not a third party knowing the e-mail address of User #1 that is requesting the communication key. When, and only when, this e-mail is received back from User #1, will the validation of Terminal #1 be complete.
If the information provided is validated as described above, exchange microprocessor 34 creates a data file 36 in exchange memory 38 that pertains to User #1 which contains his/her e-mail address, as well as such additional identification data as may be desirable (address, etc.).
As shown in Fig. 1, the key exchange centre 10 further comprises a pseudorandom key generator 39. In response to User's #1's e-mail address being provided and validated as described above, key generator 39 generates an exchange key 40 for decrypting any messages transmitted by the key exchange centre 10 to Terminal #l. Exchange microprocessor 34 stores Terminal #1's exchange key in Terminal #1 data file 36. Exchange microprocessor 34 makes exchange key 40 available to User #1 on the secure page. Exchange key 40 can then be "copied" and "pasted" into password book 30 or, alternatively, as is the case in the preferred embodiment of the microprocessor 12 provided for herein, the field containing exchange key 40 in the secure page, if found by microprocessor 12, is automatically copied into password book 30 in a manner well-known to those skilled in the art. Exchange key 40 cannot be derived by any third party because it is random.
The exchange key generator 39 of the key exchange centre 10 can be provided in numerous ways known by those skilled in the art. For example, the key exchange centre can be provided with a long shift register with pseudorandom number generator, and associated input and output.
Once Terminal #1 has procured its exchange key 40, the registration function of 10 the key procurement means, as depicted in Fig. 2 will have been fulfilled.
Any communications from key exchange centre 10 to Terminal #1 are now encrypted by exchange centre encryption facility 44 using exchange key 40 and decrypted by Terminal #1 also using encryption facility 24 in combination with exchange key 40.
In operation, User #1 who has now obtained his/her exchange key 40 will have established the e-mail addresses of Users #2, #n. The key procurement facility 22 in combination with communication facility 26 provides means for accessing the secure page again. This further accessing of the secure web page can be initiated by a variety of means. For example, when the computer program 20 provided for herein is installed, an interface is presented wherein there is a menu or toolbar providing an "OBTAIN
KEY" function or equivalent. Selecting this "OBTAIN KEY" function will initiate microprocessor 12 to engage communication facility 26, and thereby initiate communication device and utility 18 of the terminal. The secure page is thereby accessed.
The secure page will ask for User #1's e-mail address which exchange microprocessor 34 will recognize in combination with a search function associated with microprocessor 34 and exchange memory 38. User #1 is then asked to indicate the e-mail addresses of User #2, #n. Once these e-mail addresses are provided and a "SEND"
icon or equivalent is engaged by User #1, and such e-mail addresses have been validated as described above, communication key generator 42 is engaged by exchange microprocessor 34 and communication key 46 for encrypting and decrypting messages as between User #1, #2, #n is generated, in a manner well-known to those skilled in the art. Exchange microprocessor 34 then engages the key exchange centre encryption means 44 and communication key 46 is encrypted using exchange key 40. Communication key 46 is then transmitted to Terminal #1, for example, as an encrypted attachment to an e-mail.
In a manner well-known to those skilled in the art, when User #1 "clicks" on this attachment, the computer program 20 provided for herein is engaged by microprocessor 12, and microprocessor 12 retrieves exchange key 40 from password book 30 and, in combination with encryption facility 24, communication key 46 is decrypted and stored in password book 30.
The preferred embodiment of the invention disclosed herein also provides for alternative means for procuring communication key 46. For example, computer program provided for herein can be associated with communication device and utility 18 15 resident on Terminal #1 whereby when a user generates an e-mail and then "clicks on"
an "ENCRYPT-DECRYPT" icon disposed on a toolbar, computer program 20 in combination with microprocessor 12 searches and correlates the contents of password book 30 to match the contents of the "RECIPIENT" or equivalent field of the e-mail generated and determine if there is a matching communication key 46 in password book 20 16. As, in our example, User #1 may not have yet obtained communication key 46, when User #1 selects the "ENCRYPT-DECRYPT" icon, no corresponding communication key 46 will be correlated to the "RECIPIENT" field of the e-mail.
Computer program 20 in these circumstances, in combination with microprocessor 12 and communication facility 26 engages the communication device and utility 18 of Terminal #1 (if same has not yet been engaged), and thereby obtains the secure page in the manner described above. Whichever solution is adopted, the key procurement facility procures communication key 46.
It should also be understood that, as best shown in Fig. 3, the operation of the system disclosed herein has been described until now as a two-step process:
(1) wherein key procurement facility of the invention obtains the secure web page to register User #1 and obtain an exchange key; and (2) wherein the key procurement facility of the invention obtains a communication key which is decrypted using the exchange key.
However, without any additional modification to the system provided for herein, the communication key can be obtained in a one-step process, i.e. in one session, as shown in Fig. 3:
wherein the key procurement facility obtains and stores in memory 16 both the exchange key and the encrypted communication key, upon return of the validating preformatted e mail referred to above.
In order to exchange messages with Terminals #2, #n, communication key 46 will also have to be obtained by Users #2, #n. Whether during STEP 1 or STEP 2 referred to in Fig. 3, User #1 will provide to the key exchange centre 10 the e-mail addresses of such Users #2, #n. Upon receipt of such e-mail addresses, exchange microprocessor 34 will initiate a search utility to determine whether exchange memory 38 has data files relating to the e-mail addresses of User #2, #n, in which case, in the preferred embodiment of the invention described herein, a random exchange key 40 corresponding to User #2, #n will have been previously generated. If such exchange keys already exist, then communication key 46 will be sent as an attachment of an e-mail encrypted with such individual exchange keys 40. When such e-mails are received, provided that the computer program 20 described herein is installed on such other Terminal #2, #n, the attachment will be decrypted and stored in password book 30 of Terminal #2, #n, as described above.
Alternatively, if Terminal #2, #n do not yet possess their own exchange key 40, an e-mail will be sent to User #2, #n bearing the location of the secure web page, thus initiating such Terminal #2, #n to register with the key exchange centre 10, as described above. User #2, #n will obtain the secure web page provided that the computer program is installed on Terminal #2, #n and the e-mail addresses provided to the secure web page are validated as provided above. User #2, #n then obtain communication key 46 in the manner described above, and shown in Fig. 3 in particular.
It should be understood that the security achieved as between Terminal #1, #2, #n and the key exchange centre 10 as for herein is not immune to interception.
However, any interception of the exchange key 40 between the key exchange centre 10 and Terminal #1, #2, #n will result in a break in the negotiation of the secure "Secure Sockets Layer" connection between the key exchange centre 10 and such terminal, which will be detected by the key exchange centre 10 in which case an "ERROR"
message or equivalent will be issued by the key exchange centre 10 and Terminal #1, #2, #n will be invited to access the secure web page again (e.g. by pressing the "RELOAD"
button on a browser, for example) thereby initiating the generation of another exchange key 40.
The preferred embodiment of the system described herein is dependent on each of Terminal #1, #2, #n having a microprocessor associated with the computer program described above. However, many of the advantages of the system, apparatus, computer product and method disclosed herein may be achieved by using computer products having the essential features of the computer product described herein but also, in addition, a different interface or additional features not described herein. By way of example, the system provided for herein can be easily provided by a ordinary person skilled in the art with functionality for adding new users to a pre-established group of users having a common communication key by providing an "ADD NEW GROUP MEMBER"
command on the secure web page which allows User #1 to request that User #3 be added, in which case, for example, key exchange centre sends a "NEW GROUP MEMBER
CONSENT" e-mail which might require that existing group members (i.e. various Users sharing one communication key) type "YES" or "NO" in the body of their e-mail response, and where when each group member has provided consent in this way, or in a similar manner, then User #3 is registered with the key exchange centre as described above, if User #3 is not yet registered, and presented with the communication key on an encrypted basis. In addition, the key exchange centre can be provided with means for generating hierarchies of communication keys wherein higher-level communication keys can decrypt communications of all lower-level communication keys used by lower-level groups, in a manner well-known to those skilled in the art.
It should be noted that the invention disclosed herein can be easily adapted for use in communication networks of any kind, including digital telephone systems, data packets transfers in LANs and the like. In addition, the computer program disclosed herein can be adapted to a variety of operating environments or programming platforms, and could be embedded on a variety of hardware, middleware or other device. Furthermore, the system, apparatus, computer program and method described herein can be used to exchange any type of computer file on an encrypted basis, with some modifications known to those skilled in the art, including but not limited to graphic files, sounds files, spreadsheet files and the like.
In addition, the computer program disclosed herein can be sold off-the-shelf or downloaded over the Internet, in a manner well-known to those skilled in the art. One of the advantages of the invention disclosed herein is that when the computer program is purchased over the Internet by a user, it should be understood that the exchange key and communication key can also be obtained all as part of one step, as described above.
Various embodiments of the invention have now been described in detail. Since changes in and/or additions to the above-described best mode may be made without departing from the nature, spirit or scope of the invention, the invention is not to be limited to said details.
Claims (20)
1. An encryption computer product for providing secure messaging between a first terminal and at least one other remote terminal comprising:
(a) communication means for communicating with said remote terminal and a key exchange centre;
(b) encryption means for encrypting and decrypting messages exchanged between said first terminal and remote terminal, and decrypting messages received from said key exchange centre; and (c) key procurement means for obtaining an encryption key from said key exchange centre wherein said communication means, encryption means and key procurement means are operably associated to securely obtain from said key exchange centre a key for encrypting and decrypting messages as between said first terminal and remote terminal.
(a) communication means for communicating with said remote terminal and a key exchange centre;
(b) encryption means for encrypting and decrypting messages exchanged between said first terminal and remote terminal, and decrypting messages received from said key exchange centre; and (c) key procurement means for obtaining an encryption key from said key exchange centre wherein said communication means, encryption means and key procurement means are operably associated to securely obtain from said key exchange centre a key for encrypting and decrypting messages as between said first terminal and remote terminal.
2. An apparatus operably associated with a first terminal for secure messaging between said first terminal and at least one other remote terminal comprising:
(a) communication means for communicating with said remote terminal and a key exchange centre;
(b) encryption means for encrypting and decrypting messages exchanged between said first terminal and remote terminal, and decrypting messages received from said key exchange centre; and (c) key procurement means for obtaining an encryption key from said key exchange centre wherein said communication means, encryption means and key procurement means are operably associated to securely obtain from said key exchange centre a key for encrypting and decrypting messages as between said first terminal and remote terminal.
(a) communication means for communicating with said remote terminal and a key exchange centre;
(b) encryption means for encrypting and decrypting messages exchanged between said first terminal and remote terminal, and decrypting messages received from said key exchange centre; and (c) key procurement means for obtaining an encryption key from said key exchange centre wherein said communication means, encryption means and key procurement means are operably associated to securely obtain from said key exchange centre a key for encrypting and decrypting messages as between said first terminal and remote terminal.
3. An apparatus as claimed in claim 2 further comprising an identifier corresponding to said first terminal, and wherein said key procurement means further comprises:
(a) a registration means operably associated with said communication means for presenting said identifier to said key exchange centre thereby initiating said key exchange centre to:
(i) generate an exchange key for decrypting communications between said first terminal and key exchange centre; and further to (ii) transmit said exchange key to said first terminal; and (b) key requesting means presenting means for requesting said key exchange centre to:
(i) generate a communication key for encrypting and decrypting communications between said first terminal and remote terminal;
and to (ii) transmit said communication key to said first terminal on an encrypted basis using said exchange key.
(a) a registration means operably associated with said communication means for presenting said identifier to said key exchange centre thereby initiating said key exchange centre to:
(i) generate an exchange key for decrypting communications between said first terminal and key exchange centre; and further to (ii) transmit said exchange key to said first terminal; and (b) key requesting means presenting means for requesting said key exchange centre to:
(i) generate a communication key for encrypting and decrypting communications between said first terminal and remote terminal;
and to (ii) transmit said communication key to said first terminal on an encrypted basis using said exchange key.
4. An apparatus as claimed in claim 3 further comprising an initiation means which:
(a) initiates said registration means if said first terminal has not been registered; and (b) initiates said requesting means if encrypted communication between said first terminal and remote terminal is requested at either of said first terminal or remote terminal.
(a) initiates said registration means if said first terminal has not been registered; and (b) initiates said requesting means if encrypted communication between said first terminal and remote terminal is requested at either of said first terminal or remote terminal.
5. An apparatus as claimed in claim 4 further comprising a memory operably associated with said key procurement means for obtaining said exchange key and communication key and storing same in said memory, wherein:
(a) said memory and encryption means are operably associated for decrypting said communication key; and (b) said memory, communication means and encryption means are further operably associated for encrypting and decrypting messages as between said first terminal and remote terminal.
(a) said memory and encryption means are operably associated for decrypting said communication key; and (b) said memory, communication means and encryption means are further operably associated for encrypting and decrypting messages as between said first terminal and remote terminal.
6. An apparatus as claimed in claim 3, wherein said exchange key is generated by said key exchange centre on a substantially random basis.
7. An apparatus as claimed in claim 6, wherein said communication means comprises a communication facility that presents means for communicating with a dial-up facility, browser and e-mail utility resident on said first terminal.
8. An apparatus as claimed in claim 7, wherein said communication means presents means for communication with said key exchange centre using Secure Sockets Layer encryption.
9. An apparatus operably associated with a first terminal for secure messaging between said first terminal and at least one other remote terminal comprising:
(a) an identifier corresponding to said first terminal;
(b) communication means for communicating with said remote terminal and key exchange centre;
(c) encryption means for encrypting and decrypting messages exchanged between said first terminal and remote terminal, and for decrypting messages received from said key exchange centre;
(d) initiating means;
(e) memory;
(f) key procurement operably associated with said encryption means and memory, said key procurement means further comprising:
(i) a registration means operably associated with said communication means for presenting said identifier to said key exchange centre thereby initiating said key exchange centre to:
(A) generate on a substantially random basis an exchange key for decrypting communications between said first terminal and key exchange centre; and to (B) transmit said exchange key to said first terminal; and (ii) key requesting means operably associated with said communication means for requesting said key exchange centre to:
(A) generate a communication key for encrypting and decrypting communications between said first terminal and remote terminal; and to (B) transmit said communication key to said first terminal on an encrypted basis using said exchange key;
wherein said key procurement means saves said exchange key and communication key in said memory;
wherein said initiation means:
(i) initiates said registration means if said first terminal has not been registered; and (ii) initiates said requesting means if encrypted communication between said first terminal and remote terminal is requested at either of said first terminal or remote terminal; and wherein said memory, encryption means, communication means, initiation means are operably associated to exchange encrypted messages as between said first terminal and remote terminal.
(a) an identifier corresponding to said first terminal;
(b) communication means for communicating with said remote terminal and key exchange centre;
(c) encryption means for encrypting and decrypting messages exchanged between said first terminal and remote terminal, and for decrypting messages received from said key exchange centre;
(d) initiating means;
(e) memory;
(f) key procurement operably associated with said encryption means and memory, said key procurement means further comprising:
(i) a registration means operably associated with said communication means for presenting said identifier to said key exchange centre thereby initiating said key exchange centre to:
(A) generate on a substantially random basis an exchange key for decrypting communications between said first terminal and key exchange centre; and to (B) transmit said exchange key to said first terminal; and (ii) key requesting means operably associated with said communication means for requesting said key exchange centre to:
(A) generate a communication key for encrypting and decrypting communications between said first terminal and remote terminal; and to (B) transmit said communication key to said first terminal on an encrypted basis using said exchange key;
wherein said key procurement means saves said exchange key and communication key in said memory;
wherein said initiation means:
(i) initiates said registration means if said first terminal has not been registered; and (ii) initiates said requesting means if encrypted communication between said first terminal and remote terminal is requested at either of said first terminal or remote terminal; and wherein said memory, encryption means, communication means, initiation means are operably associated to exchange encrypted messages as between said first terminal and remote terminal.
10. An apparatus as claimed in claim 9 wherein said communication means is operably associated with a dial-up facility, browser and e-mail utility resident on said first terminal.
11. An apparatus as claimed in claim 10, wherein said communication means in combination with a dial-up facility and browser resident on said first terminal presents means for communicating with said key exchange centre using "Secure Sockets Layer"
encryption.
encryption.
12. A system for secure messaging between a group of terminals over an interconnected network of computers comprising:
(a) at least two terminals for sending and receiving messages, each of said terminals further comprising:
(i) a terminal communication means;
(ii) encryption means operably associated with said terminal communication means for exchanging messages on an encrypted basis;
(iii) key procurement means operably associated with said terminal communication means; and (iv) memory; and (b) key exchange centre comprising:
(i) exchange communication means responsive to said terminal communication means;
(ii) exchange key generating means;
(iii) communication key generating means wherein said key exchange centre is responsive to said key procurement means to:
(i) make each of said terminals known to said key exchange centre;
(ii) generate an exchange key corresponding to each of said terminals for decrypting messages exchanged between said terminals and key exchange centre;
(iii) transmit said exchange key to said terminals;
(iv) encrypt a communication key generated by said communication key generating means with said exchange key and transmit same to said each of said terminals; and wherein said key procurement means is operably associated with said memory to store said exchange key and communication key in said memory;
and wherein said terminal communication means, encryption means and memory present means for encrypted communications between said group of terminals.
(a) at least two terminals for sending and receiving messages, each of said terminals further comprising:
(i) a terminal communication means;
(ii) encryption means operably associated with said terminal communication means for exchanging messages on an encrypted basis;
(iii) key procurement means operably associated with said terminal communication means; and (iv) memory; and (b) key exchange centre comprising:
(i) exchange communication means responsive to said terminal communication means;
(ii) exchange key generating means;
(iii) communication key generating means wherein said key exchange centre is responsive to said key procurement means to:
(i) make each of said terminals known to said key exchange centre;
(ii) generate an exchange key corresponding to each of said terminals for decrypting messages exchanged between said terminals and key exchange centre;
(iii) transmit said exchange key to said terminals;
(iv) encrypt a communication key generated by said communication key generating means with said exchange key and transmit same to said each of said terminals; and wherein said key procurement means is operably associated with said memory to store said exchange key and communication key in said memory;
and wherein said terminal communication means, encryption means and memory present means for encrypted communications between said group of terminals.
13. The system as claimed in claim 12, wherein each of said group of terminals further comprises an identifier corresponding to each of said terminals and wherein said key procurement means further comprises:
(a) a registration means operably associated with said terminal communication means for presenting said identifier to said key exchange centre thereby making each of said terminals known to said key exchange centre whereby:
(i) said exchange key generating means generates said exchange key;
(ii) said exchange communication means transmits said exchange key to each of said terminals; and (iii) said exchange key is stored in said memory; and (b) key requesting means operably associated with each of said terminal communication means presenting means for:
(i) requesting said communication key generating means to generate said communication key;
(ii) requesting said exchange communication means to transmit said communication key to each of said terminals;
(iii) storing said communication key in said memory.
(a) a registration means operably associated with said terminal communication means for presenting said identifier to said key exchange centre thereby making each of said terminals known to said key exchange centre whereby:
(i) said exchange key generating means generates said exchange key;
(ii) said exchange communication means transmits said exchange key to each of said terminals; and (iii) said exchange key is stored in said memory; and (b) key requesting means operably associated with each of said terminal communication means presenting means for:
(i) requesting said communication key generating means to generate said communication key;
(ii) requesting said exchange communication means to transmit said communication key to each of said terminals;
(iii) storing said communication key in said memory.
14. The system as claimed in claim 13 wherein each of said terminals further comprises an initiation means which:
(a) initiates said registration means when one of said terminals has not been registered; and (b) initiates said requesting means when one of said terminals has not obtained said communication key and encrypted communication between said group of terminals is requested at either of said group of terminals.
(a) initiates said registration means when one of said terminals has not been registered; and (b) initiates said requesting means when one of said terminals has not obtained said communication key and encrypted communication between said group of terminals is requested at either of said group of terminals.
15. The system as claimed in claim 12 wherein:
(a) said exchange key generator is a pseudorandom key generator; and (b) said terminal communication means comprises a communication facility that presents means for communicating with a dial-up facility, browser and e-mail utility resident on each of said terminals.
(a) said exchange key generator is a pseudorandom key generator; and (b) said terminal communication means comprises a communication facility that presents means for communicating with a dial-up facility, browser and e-mail utility resident on each of said terminals.
16. The system as claimed in claim 15 wherein said terminal communication means and exchange communication means present means for communication between each of said terminals and said key exchange centre using "Secure Sockets Layer"
encryption.
encryption.
17. A method for exchanging encryption keys between remote terminals using a key exchange centre, wherein identification data identifies Terminal #1, Terminal #2 and Terminal #n:
(a) presenting said identification data to said key exchange centre on a secure basis which identification data is validated by said key exchange centre using said identification data;
(b) generating a plurality of exchange keys at said key exchange centre corresponding to each of said Terminal #1, Terminal #2 and Terminal #n for decrypting encrypted data received from said key exchange centre by each of said Terminal #1, Terminal #2 and Terminal #n;
(c) presenting a communication key request at said key exchange centre for Terminal #1 to communicate with said Terminal #2 and Terminal #n on an encrypted basis;
(d) generating a communication key at said exchange centre for Terminal #1 to communicate with Terminal #2 and Terminal #n on an encrypted basis;
(e) encrypting said communication key at said exchange centre with each of said exchange keys corresponding to Terminal #1, Terminal #2 and Terminal #n;
(f) transmitting said encrypted communication key from said key exchange centre to each of said Terminal #1, Terminal #2 and Terminal #n.
(a) presenting said identification data to said key exchange centre on a secure basis which identification data is validated by said key exchange centre using said identification data;
(b) generating a plurality of exchange keys at said key exchange centre corresponding to each of said Terminal #1, Terminal #2 and Terminal #n for decrypting encrypted data received from said key exchange centre by each of said Terminal #1, Terminal #2 and Terminal #n;
(c) presenting a communication key request at said key exchange centre for Terminal #1 to communicate with said Terminal #2 and Terminal #n on an encrypted basis;
(d) generating a communication key at said exchange centre for Terminal #1 to communicate with Terminal #2 and Terminal #n on an encrypted basis;
(e) encrypting said communication key at said exchange centre with each of said exchange keys corresponding to Terminal #1, Terminal #2 and Terminal #n;
(f) transmitting said encrypted communication key from said key exchange centre to each of said Terminal #1, Terminal #2 and Terminal #n.
18. A method as claimed in claim 17, further comprising the steps of:
(a) requesting said identification data from said Terminal #2 or Terminal #n when the identification data of said Terminal #2 or Terminal #n has not been presented to said key exchange centre and Terminal #1 has presented said identification data to said key exchange centre; and (b) soliciting a communication key request from said Terminal #2 or Terminal #n when said Terminal #3 or Terminal #n has not yet present a communication key request and a communication key has already been transmitted to Terminal #1.
(a) requesting said identification data from said Terminal #2 or Terminal #n when the identification data of said Terminal #2 or Terminal #n has not been presented to said key exchange centre and Terminal #1 has presented said identification data to said key exchange centre; and (b) soliciting a communication key request from said Terminal #2 or Terminal #n when said Terminal #3 or Terminal #n has not yet present a communication key request and a communication key has already been transmitted to Terminal #1.
19. A method for encrypted messaging between a plurality of remote terminals in combination with a key exchange centre, wherein identification data provided by Terminal #l, Terminal #2 makes Terminal #1, Terminal #2 and Terminal #n known to said key exchange centre, which comprises the steps of:
(a) initiating a key procurement means and communication means resident at each of said Terminal #1, Terminal 2 and Terminal #n for presenting said identification data to said key exchange centre;
(b) validating said identification data at said key exchange centre and generating in response a plurality of exchange keys corresponding to each of said Terminal #1, Terminal #2 or Terminal #n for decrypting messages received at said terminals from said key exchange centre;
(c) obtaining said exchange key from said key exchange centre at said Terminal #1, Terminal #2 and Terminal #n and storing same in a memory resident on each of said terminals;
(d) requesting generation of a communication key at said key exchange centre for encrypting and decrypting messages as between Terminal #1, Terminal #2 and Terminal #n;
(e) encrypting said communication key at said key exchange centre with each of said plurality of exchange keys;
(f) obtaining said communication key at each of said Terminal # 1, Terminal #2 and Terminal #n and decrypting said communication key using said corresponding exchange keys;
(g) storing said communication key in said memory resident on each of said terminal;
(h) encrypting and decrypting messages as between said Terminal #l, Terminal #2 and Terminal #n using said communication key.
(a) initiating a key procurement means and communication means resident at each of said Terminal #1, Terminal 2 and Terminal #n for presenting said identification data to said key exchange centre;
(b) validating said identification data at said key exchange centre and generating in response a plurality of exchange keys corresponding to each of said Terminal #1, Terminal #2 or Terminal #n for decrypting messages received at said terminals from said key exchange centre;
(c) obtaining said exchange key from said key exchange centre at said Terminal #1, Terminal #2 and Terminal #n and storing same in a memory resident on each of said terminals;
(d) requesting generation of a communication key at said key exchange centre for encrypting and decrypting messages as between Terminal #1, Terminal #2 and Terminal #n;
(e) encrypting said communication key at said key exchange centre with each of said plurality of exchange keys;
(f) obtaining said communication key at each of said Terminal # 1, Terminal #2 and Terminal #n and decrypting said communication key using said corresponding exchange keys;
(g) storing said communication key in said memory resident on each of said terminal;
(h) encrypting and decrypting messages as between said Terminal #l, Terminal #2 and Terminal #n using said communication key.
20. The method as claimed in claim 19, wherein said method further comprises the steps of:
(a) requesting said identification data from said Terminal #2 or Terminal #n when the identification data of said Terminal #2 or Terminal #n has not been presented to said key exchange centre and Terminal #1 has presented said identification data to said key exchange centre; and (b) soliciting a communication key request from said Terminal #2 or Terminal #n when said Terminal #2 or Terminal #n has not yet presented a communication key request and a communication key has already been transmitted to Terminal # 1.
(a) requesting said identification data from said Terminal #2 or Terminal #n when the identification data of said Terminal #2 or Terminal #n has not been presented to said key exchange centre and Terminal #1 has presented said identification data to said key exchange centre; and (b) soliciting a communication key request from said Terminal #2 or Terminal #n when said Terminal #2 or Terminal #n has not yet presented a communication key request and a communication key has already been transmitted to Terminal # 1.
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| US22036298A | 1998-12-24 | 1998-12-24 | |
| US09/220,362 | 1998-12-24 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CA2293117A1 true CA2293117A1 (en) | 2000-06-24 |
Family
ID=31886606
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CA 2293117 Abandoned CA2293117A1 (en) | 1998-12-24 | 1999-12-23 | System, apparatus, computer product and method for procuring encryption keys |
Country Status (1)
| Country | Link |
|---|---|
| CA (1) | CA2293117A1 (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114866374A (en) * | 2022-05-11 | 2022-08-05 | 青岛海信日立空调系统有限公司 | Intelligent home gateway equipment and intelligent home system |
-
1999
- 1999-12-23 CA CA 2293117 patent/CA2293117A1/en not_active Abandoned
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114866374A (en) * | 2022-05-11 | 2022-08-05 | 青岛海信日立空调系统有限公司 | Intelligent home gateway equipment and intelligent home system |
| CN114866374B (en) * | 2022-05-11 | 2024-01-16 | 青岛海信日立空调系统有限公司 | Intelligent home gateway equipment and intelligent home system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Kohl et al. | The evolution of the Kerberos authentication service | |
| CA2394451C (en) | System, method and computer product for delivery and receipt of s/mime-encrypted data | |
| US5638446A (en) | Method for the secure distribution of electronic files in a distributed environment | |
| US6169805B1 (en) | System and method of operation for providing user's security on-demand over insecure networks | |
| US8156190B2 (en) | Generating PKI email accounts on a web-based email system | |
| CA2527718C (en) | System, method and computer product for sending encrypted messages to recipients where the sender does not possess the credentials of the recipient | |
| US6651166B1 (en) | Sender driven certification enrollment system | |
| US6499108B1 (en) | Secure electronic mail system | |
| US6061448A (en) | Method and system for dynamic server document encryption | |
| JP5204090B2 (en) | Communication network, e-mail registration server, network device, method, and computer program | |
| US20020199119A1 (en) | Security services system and method | |
| US20020019932A1 (en) | Cryptographically secure network | |
| US20070022291A1 (en) | Sending digitally signed emails via a web-based email system | |
| EP0906677A2 (en) | Cryptographic communication system | |
| EP1147637A1 (en) | Seamless integration of application programs with security key infrastructure | |
| US6990582B2 (en) | Authentication method in an agent system | |
| KR20010072206A (en) | Method and apparatus for secure distribution of public/private key pairs | |
| EP1415431A2 (en) | Encryption system that dynamically locates keys | |
| Yialelis et al. | A Security Framework Supporting Domain Based Access Control in Distributed Systems. | |
| US20070022292A1 (en) | Receiving encrypted emails via a web-based email system | |
| CA2386502A1 (en) | A method for non-repudiation using a trusted third party | |
| WO2000046952A1 (en) | Method for sending secure email via standard browser | |
| CA2293117A1 (en) | System, apparatus, computer product and method for procuring encryption keys | |
| Anderson et al. | A basis for secure communication in large distributed systems | |
| WO2002009346A1 (en) | A ubiquitous e-mail encryption component |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| FZDE | Dead |