TWI618026B - Mail decryption system and method based on document serial number - Google Patents

Abstract

The invention relates to a mail decryption system and method, which mainly comprises a mail decryption method implemented according to a change of a certificate serial number through a receiver end platform, which mainly obtains a password message in an encrypted mail sent by a sender side. The recipient information in the grammar information is compared with the instant credential information obtained from the secure carrier of the recipient to confirm whether the recipient voucher is renewed after the mail is sent. If the voucher is renewed, the present invention may be updated. The recipient information is used to obtain the private key to decrypt the encrypted mail. Through the invention, the problem that the recipient cannot decrypt the encrypted mail after the extension of the voucher can be effectively solved.

Description

Mail decryption system and method based on certificate serial number

The present invention relates to a mail decryption system and method, and more particularly to a system and method for decrypting an encrypted mail of a voucher based on a voucher serial number.

Under the public key infrastructure (PKI) architecture of the prior art, the vouchers obtained by various user identities may have different validity periods according to different usage scenarios; and in order to ensure the availability of vouchers, the normal situation The owner of the voucher will need to submit a voucher renewal application to the Certificate Authority (CA) before the voucher for its use expires. After the voucher extension period, the voucher serial number will be different from the voucher voucher, but the key pair of the old and new voucher will remain unchanged, and the corresponding information will be stored in various security vehicles for access.

However, under the current mechanism, the voucher owner can only decrypt the encrypted mail encrypted with the new voucher applied for after the voucher is renewed. If the encrypted mail received before the voucher renewal is cancelled, the reason is that The voucher serial number is different, and the client's mail system cannot access the private key for decryption. For the general mail recipient, only the security vehicle corresponding to the user is not replaced on the surface, but it can only be used to decrypt the encrypted mail received after the certificate is extended, and the mail before the extension cannot be used. Decrypted, can't To understand the deeper reasons, the recipient of the mail may question the validity of the voucher without thinking about it. In view of the large number of business correspondences in the world today, and not all users have the habit of quickly receiving letters, this kind of inability to open encrypted mail is a problem, and researchers in related fields have tried to improve this problem, but There are still security concerns in the proposed method.

In order to solve the above problems, the present invention provides a mail decryption system and method based on a voucher serial number, the main purpose of which is to make a change in the voucher extension, etc., after the mail is sent, how to use the present invention to collect In the case that the voucher used to encrypt the e-mail is extended and the voucher number has changed, the e-mail can still be decrypted smoothly to obtain the content thereof. The method for decrypting the e-mail based on the voucher number of the present invention is implemented in A recipient-side platform of a sender-side platform communication link configured to perform at least the following steps: 1. Receiving an encrypted message, wherein the encrypted message is via the sender-side platform It is encrypted by a public key of a recipient's voucher and then sent by a mail user agent. The format of the encrypted mail (PKCS#7) is in accordance with the Cryptographic Message Syntax (CMS) specification. (Standard); 2. Analyze the encrypted mail to retrieve the Enveloped Data in the CMS information in the encrypted mail, and then self-package the file. Obtaining a receiver identifier to confirm a recipient information type, and obtaining a first document serial number and credential information about the recipient credential in the recipient information; 3. accessing the recipient end through the receiver end platform Safety vehicle to self-seeking Obtaining a second voucher serial number and a body key identifier in the information of the former recipient voucher; 4. comparing the first voucher serial number and the second voucher serial number and the two voucher serial numbers through the e-mail receiver platform Corresponding public key, to confirm whether the recipient's voucher has been renewed, if the e-mail receiver platform is different from the first voucher serial number and the second voucher serial number, but the two voucher serial numbers are the same as the public key, Confirming that the recipient voucher has been renewed after the encrypted mail is sent; 5. launching a recipient information update module through the receiver platform to update the first voucher number in the recipient information in the encrypted mail The subject key identifier after the extension of the voucher, that is, the recipient information in the Enveloped Data of the Cryptographic Message Syntax specification; and 6. updated by the receiver platform The recipient information accesses the current recipient-side security vehicle to obtain the private key corresponding to the recipient's voucher after the extension, and then decrypts the encrypted email to obtain the content.

Corresponding to the mail decryption method based on the voucher serial number of the present invention, there is a mail decryption system based on the voucher serial number, which is configured to be disposed in a recipient end platform in the e-mail delivery network, comprising: 1. a voucher information access module configured to receive and parse the encrypted mail, wherein the encrypted mail is in the instant recipient's voucher by the sender end platform The public key is encrypted and sent. The voucher information access module is configured to retrieve the encapsulation file in the Cryptographic Message Syntax (CMS) of the encrypted e-mail, and obtain the receiver identifier from the package file, and confirm the recipient information. Type, the credential information access The module further obtains a first voucher number in the recipient information about the recipient voucher, and the credential information access module can further access the recipient end security vehicle to obtain the current recipient voucher. a second voucher serial number and a body key identifier; 2. a voucher query module, which is in communication with the voucher information access module and a voucher database, and the voucher information access module queries through the voucher The module inputs the first document serial number to obtain information about the recipient voucher; 3. a voucher information analysis module, which is in communication with the voucher information access module, configured to access the voucher information The first voucher serial number obtained by the module and the second voucher serial number to confirm whether the recipient voucher has been renewed; and 4. a recipient information update module, and the credential information analysis module is communicatively connected to The first voucher number in the recipient information in the encrypted mail is updated to the subject key identifier after the voucher extension, that is, in the Enveloped Data of the Cryptographic Message Syntax specification. The recipient information is such that the updated encrypted email can be decrypted by the voucher information access module to obtain the private key corresponding to the extended recipient's voucher.

1‧‧‧Mail decryption system

11‧‧‧Voucher Information Access Module

12‧‧‧Voucher Inquiry Module

13‧‧‧Voucher Information Analysis Module

14‧‧‧Recipient Information Update Module

21‧‧‧Sender browser

22‧‧‧Sender-side mail agent

31‧‧‧Recipient browser

32‧‧‧Recipient-side mail agent

33‧‧‧Receiver safety carrier

41‧‧‧ Public Key Database

42‧‧‧Voucher database

S11~S17‧‧‧ method steps

FIG. 1 is a first schematic diagram of an architecture of a mail decryption system based on a certificate serial number according to the present invention.

2 is a second schematic diagram of an architecture of a mail decryption system based on a certificate serial number according to the present invention.

3 is a flow chart showing the steps of a method for decrypting a mail based on a voucher number according to the present invention.

The present invention will be further described with reference to the embodiments in the following. Referring first to FIG. 1 , an embodiment is disclosed as a mail decryption system 1 based on a certificate serial number. The architecture of the mail decryption system 1 is shown in the figure. It consists of a communication link between a voucher information access module 11, a voucher query module 12, a voucher information analysis module 13 and a recipient information update module 14. In the present embodiment, the format of the encrypted mail received by the mail decryption system 1 conforms to the PKCS #7 cryptographic message syntax (CMS) specification.

The mail decryption system 1 includes a voucher information access module 11 whose main function is to parse the encrypted mail to retrieve the Enveloped Data in the cryptographic message grammar message. In addition, the voucher information access module 11 More secure access to the client's security vehicle to retrieve the client's credential information.

The mail decryption system 1 includes a voucher query module 12, which is in communication with the voucher information access module 11, and provides an interface for accessing a voucher database, and inputting the voucher data by using the voucher serial number as an input value. The library, in turn, obtains the voucher corresponding to the voucher number, or obtains the subject key identifier of the public key in the corresponding voucher.

The mail decryption system 1 includes a voucher information analysis module 13 which is in communication with the voucher information access module 11 for analyzing and comparing the voucher information obtained from the client security vehicle and the self-voucher query. The voucher information obtained by the module 12 is the first voucher serial number and the second voucher serial number obtained by the voucher information access module as described in the foregoing disclosure, to confirm whether the voucher's voucher is It has been changed by extension.

Receiver information update module 14, the recipient information update module 14 is in communication with the credential information access module 11, and the recipient information update module can encrypt the PKCS #7 in the encrypted mail after the confirmation voucher is extended. Recipient information update in the Enveloped Data in the cryptographic message syntax message.

Through the combination of the above modules, the mail decryption system 1 of the present invention can decrypt the encrypted mail in the certificate serial number change by the voucher extension to obtain the content information.

Please refer to FIG. 2 again, which is a second schematic diagram of the system architecture of the present invention. As shown in the figure, another preferred embodiment of the present invention is shown. The mail decryption system 1 includes a voucher information access module 11, a voucher query module 12, and a voucher information analysis module 13 as in the architecture of FIG. And the receiver information update module 14, the function description of each module is the same as the corresponding module in FIG. 1, and the encrypted mail format conforms to the PKCS #7 CMS Standard specification. In addition, the architecture of the embodiment further includes a sender browser 21, a sender mail agent 22, a recipient browser 31, a recipient mail agent 32, and a recipient end. The secure carrier 33, the public key database 41, and the voucher database 42. The sender-side browser 21 and the public key database 41 are linked to the sender-side mail agent 22, and the sender-side mail agent 22 is linked to the recipient-side mail agent 32, the recipient side. The mail agent 32 can transmit the mail to the voucher information access module 11 in the mail decryption system 1 of the present invention, and the recipient security device 33 is also connected to the voucher information access module 11. The voucher database 42 is coupled to the voucher query module 12 of the mail decryption system 1 of the present invention, and the recipient browser 31 is coupled to the recipient information update module 14.

The information transfer and operation process of each module in the system architecture in Figure 2 is as follows:

1. The mail sender uses the mail from the sender's browser 21, which uses the mail The public key of the recipient's voucher extension is used to encrypt the mail to be sent, and the public key of the corresponding voucher can be obtained by accessing the public key database 41. After the mail sender sends the encrypted mail through the sender-side mail agent 22, the mail recipient submits an application for the voucher renewal to the certificate center (CA). In general, the voucher rollover will not affect the key pair of the original voucher, but the voucher serial number will change.

2. After a certain amount of time, the mail recipient attempts to receive the encrypted mail transmitted via the recipient's mail agent 32 by operating the recipient's browser 31, but at this time the mail recipient's credentials have been renewed.

3. Because the recipient of the mail only wants to decrypt the encrypted mail received before the voucher extension, the recipient information in the encrypted mail package (Enveloped Data) is still the certificate of the pre-extension certificate. The serial number, rather than the new voucher number after the extension, in which case the recipient's private key in the recipient's secure carrier 33 cannot be accessed to decrypt the encrypted message.

4. Through the implementation of the present invention, the mail recipient can analyze the encrypted mail sent before the voucher extension through the voucher information access module 11, extract the package file in the CMS message, find the receiver identifier, and then judge Whether the recipient information is the certificate serial number type, and then further obtain the certificate serial number value.

5. The mail recipient can read the instant credential information in the secure carrier 33 of the recipient through the credential information access module 11, and the extracted credential information includes the voucher serial number and the subject key identifier.

The voucher information access module 11 passes the voucher number extracted from the encrypted e-mail to the voucher query module 12, and accesses the voucher database 42 via the voucher query module 12 to obtain a voucher corresponding to the voucher serial number. This The certificate is the voucher for the recipient to implement the voucher extension.

7. The voucher information analysis module 13 analyzes and compares the voucher information in the recipient security device 33 with the voucher information used by the mail sender to encrypt the mail, and determines whether the recipient information update needs to be initiated according to the analysis result. Module 14.

8. When the analysis result is that the voucher numbers of the voucher before and after the extension are inconsistent, but the public keys of the two are the same, it is judged that the situation needs to be updated, that is, the recipient information in the encrypted mail must be updated, and the voucher serial number is changed to the main body. Key identifier.

9. Since the recipient of the email has performed the recipient information update through the recipient information update module 14, the current encrypted email information is sufficient to access the private key corresponding to the post-expansion voucher from the recipient-side secure carrier 33. Decrypt encrypted messages encrypted by pre-deployment credentials.

3 is a flow chart of the steps of the method for decrypting the mail based on the voucher number of the present invention. The method of the present invention mainly comprises the following steps: (step S11) encrypting the mail, (step S12) the encrypted mail content. Parsing, (step S13) accessing the client security vehicle, (step S14) accessing the voucher query module, (step S15) analyzing the voucher information, (step S16) updating the recipient information of the encrypted mail, (step S17) Decrypt the encrypted message. Corresponding to the system of the present invention, the purpose of the method is to solve the problem that the new voucher public key of the received encrypted mail is consistent with the public key previously used for the encrypted mail, but the voucher serial number is different, and the decryption cannot be performed. The details are as follows:

1. Step S11: Encrypted mail: The mail sender uses the public key of the pre-extension certificate to generate an encrypted mail and sends it. In the future, the mail recipient may have a voucher renewal request due to the receipt of the voucher expiration notice, so the voucher center is presented to the voucher center. Voucher extension application.

2. Step S12: Analysis of the encrypted mail content: the mail receiver platform obtains the encrypted mail, and analyzes the content thereof, and takes out the receiver information in the CMS information, and further analyzes whether the recipient information is the certificate serial number type. If yes, the value of the certificate number is obtained.

3. Step S13: Accessing the client security vehicle: The recipient platform accesses the credentials in the client security vehicle, or the principal key identifier of the public key in the credentials.

4. Step S14: Accessing the voucher query module: accessing the voucher query module according to the voucher serial number in the recipient information of the encrypted mail to obtain the voucher used when sending the encrypted mail.

5. Step S15: Analyze the voucher information: analyze the voucher used by the sender to encrypt the mail and the voucher in the client security vehicle, and compare whether the voucher number is inconsistent but the public key is consistent. If this is the case, the representative The recipient's voucher has been renewed after the mail has been sent, so the recipient information update module needs to be activated.

6. Step S16: Update the recipient information of the encrypted mail: change the certificate serial number value in the recipient information of the CMS of the encrypted mail, and change it to the subject key identifier of the corresponding public key.

7. Step S17, decrypting the encrypted mail: After step S16, the mail receiver platform can access the recipient security vehicle to obtain the private key corresponding to the voucher after the voucher extension, and the private key can be used to decrypt Encrypted mail encrypted with old credentials, so that the recipient can get the content.

The present invention has the following advantages when compared to the prior art:

1. The present invention enables the recipient of the mail to normally decrypt the encrypted mail encrypted by the pre-deployment credential after the recipient's voucher is renewed.

2. The system (or platform) of the present invention can parse encrypted mail PKCS #7 CMS messages and instant voucher messages to determine if the voucher has been renewed.

3. The present invention does not change the existing workflow when encrypting and decrypting mail, or has an impact on the existing Public Key Infrastructure (PKI) architecture, without incurring additional security concerns.

In summary, the present invention is innovative in terms of technical ideas, and also has various functions that are not in the prior art, and has fully complied with the statutory invention patent requirements of novelty and progressiveness, and has filed a patent application according to law, and invites you to approve the invention. The patent application was inspired to invent, and it was a matter of feeling.

Claims (6)

A mail decryption method based on a voucher serial number, which is configured to be executed by a receiver end platform communicatively coupled with a sender end platform, comprising the steps of: receiving a recipient by the sender end platform An encrypted mail sent by the public key of the voucher after being encrypted; parsing to extract the package file in the cryptographic message syntax information of the encrypted mail, obtaining the recipient identifier from the package file, to confirm the recipient information of the encrypted mail, and Obtaining a first voucher serial number and voucher information corresponding to the recipient voucher from the recipient information; accessing a recipient security device to obtain an instant second voucher serial number in the recipient voucher information And a public key identifier of the public key; a public key corresponding to the first voucher serial number and the second voucher serial number and the two voucher serial numbers respectively to confirm whether the recipient voucher has been sent after the encrypted mail is sent Expanding a recipient information update module to update the first voucher number in the recipient information in the encrypted mail to the subject key identifier after the voucher extension; and The recipient through recipient terminal information access security vehicle, obtaining the extension of the document recipient to decrypt the private key corresponding to the encrypted message. The method for decrypting a mail based on a document serial number according to claim 1, wherein if the mail receiver platform is different from the first document serial number and the second document serial number, but the two document serial numbers correspond to the public key, Then confirm that the recipient's voucher has been renewed after the encrypted mail has been sent. The method for decrypting a mail based on a voucher serial number according to claim 1, wherein the encrypted mail is transmitted by the sender end platform through a mail user The agent sends it. A mail decryption system based on a voucher serial number, configured to be configured on a recipient end platform in an e-mail delivery network, comprising at least: a voucher information access module for receiving and parsing a sender The encrypted platform sent by the end platform is encrypted by a public key of the recipient's voucher, and the voucher information access module is configured to take out the package file in the cryptographic message grammar information of the encrypted mail, and then self-package the file. Obtaining a receiver identifier to confirm a recipient information type, to obtain a first document serial number of the recipient information in the recipient information, and the credential information access module can further access the recipient security payload Having a second voucher serial number and a body key identifier in the current recipient voucher; a voucher query module, communicating with the voucher information access module and a voucher database, the credential information The access module receives the first voucher number through the voucher query module to obtain information about the voucher's voucher; a voucher information analysis module is communicably connected to the credential information access module. Comparing the first voucher serial number obtained by the voucher information access module with the second voucher serial number to confirm whether the recipient voucher has been renewed; a recipient information update module communicating with the voucher information analysis module Connecting to update the first voucher number in the recipient information in the encrypted mail to the subject key identifier after the voucher extension, so that the encrypted mail can obtain the post-expansion via the voucher information access module The private key corresponding to the recipient's voucher is decrypted. The document decryption system based on the voucher serial number of claim 4, wherein if the mail recipient platform is different from the first voucher serial number and the second voucher serial number, but the two corresponding public keys are the same, It can be confirmed that the recipient's voucher has been renewed after the encrypted mail has been sent. For example, the document number-based mail decryption system of claim 4, wherein the encrypted mail is sent by the sender-side platform through a mail user agent.