Stateless Server-Based Encryption Associated with a Distribution List

Patent metadata

Field	Value
Publication number	US-2016248745-A1
Application number	US-201514631653-A
Country	US
Kind code	A1
Filing date	Feb 25, 2015
Priority date	Feb 25, 2015
Publication date	Aug 25, 2016
Grant date	—

Abstract

An example method of decrypting electronic messages includes receiving, by an authentication module of a decryptor device, authentication requests from a plurality of destination clients. The method also includes receiving, by a decryption module of the decryptor device, encrypted electronic messages from the plurality of destination clients. The encrypted electronic messages are derived from a common electronic message sent by a common source client. The method further includes authenticating, based on an authentication table, the plurality of destination clients. The authentication table stores user credentials that are used to authenticate destination clients. The method also includes for each encrypted electronic message received from an authenticated destination client of the plurality of destination clients, decrypting the encrypted electronic message using a common private key and providing the decrypted electronic message to the authenticated destination client. The private key is stored at the decryptor device.

First claim

What is claimed is:

1 . A method of decrypting electronic messages, comprising:
receiving, by an authentication module of a decryptor device, authentication requests from a plurality of destination clients; receiving, by a decryption module of the decryptor device, encrypted electronic messages from the plurality of destination clients, the encrypted electronic messages being derived from a common electronic message sent by a common source client; authenticating, based on an authentication table, the plurality of destination clients, the authentication table storing user credentials that are used to authenticate destination clients; and for each encrypted electronic message received from an authenticated destination client of the plurality of destination clients:
decrypting the encrypted electronic message using a common private key stored at the decryptor device; and
providing the decrypted electronic message to the authenticated destination client.

2 . The method of claim 1 , further including:
receiving, by the decryptor module, an identifier of a public key, the identifier being from a destination client; and retrieving, based on the identifier, the private key to decrypt the encrypted electronic message.

3 . The method of claim 1 , further including:
generating, by the decryptor module, the private key; and generating, by the decryptor module, a public key that is paired with the private key.

4 . The method of claim 1 , wherein one or more destination clients of the plurality of destination clients is identified in a distribution list stored at a message relay server.

5 . The method of claim 1 , wherein the receiving encrypted electronic messages includes receiving a first encrypted electronic message and a second encrypted electronic message, and wherein the decrypting the encrypted electronic message includes decrypting each of the first and encrypted electronic messages using the private key.

6 . The method of claim 5 , wherein a payload of the first and second encrypted electronic messages is the same.

7 . The method of claim 1 , further including:
for each encrypted electronic message received from an unauthenticated destination client of the plurality of destination clients, discarding the encrypted electronic message received from the unauthenticated destination client.

8 . The method of claim 1 , further including:
for each encrypted electronic message received from an unauthenticated destination client of the plurality of destination clients, sending a message indicating that the authentication failed to the unauthenticated destination client.

9 . The method of claim 1 , further including:
receiving, by a destination client of the plurality of destination clients, an encrypted electronic message from a message relay server; sending, by the destination client, an authentication request to the decryptor device; and in response to being authenticated by the decryptor device, receiving the decrypted electronic message.

10 . The method of claim 9 , further including:
sending, by the destination client, the encrypted electronic message to the decryptor device for decryption.

11 . A system for decrypting electronic messages, comprising:
an authentication module that receives authentication requests from a plurality of destination clients and authenticates, based on an authentication table, the plurality of destination clients, wherein the authentication table stores user credentials that are used to authenticate destination clients; and a decryptor module that receives encrypted electronic messages from the plurality of destination clients, wherein for each encrypted electronic message received from an authenticated destination client, the decryptor module decrypts the encrypted electronic message using a common private key and provides the decrypted electronic message to the authenticated destination client, wherein the authentication module and decryption module are executable in a decryptor device at which the private key is stored, and the encrypted electronic messages are derived from a common electronic message sent by a common source client.

12 . The system of claim 11 , wherein a destination client of the plurality of destination clients receives an encrypted electronic message from a message relay server.

13 . The system of claim 12 , wherein the message relay server stores a distribution list identifying one or more destination clients of the plurality of destination clients.

14 . The system of claim 13 , wherein a source client encrypts an electronic message using a public key and sends the encrypted message to a message relay server for delivery to one or more of the plurality of destination clients, wherein the public key is paired with the private key.

15 . The system of claim 11 , wherein the decryptor module receives a first encrypted electronic message from a first destination client and receives a second encrypted electronic message from a second destination client, and a payload of the first and second encrypted electronic messages is the same.

16 . The system of claim 11 , wherein the decryptor module decrypts each of the first and second encrypted electronic messages using the private key.

17 . A machine-readable medium comprising a plurality of machine-readable instructions that when executed by one or more processors is adapted to cause the one or more processors to perform a method comprising:
receiving, by an authentication module of a decryptor device, authentication requests from a plurality of destination clients; receiving, by a decryption module of the decryptor device, encrypted electronic messages from the plurality of destination clients, the encrypted electronic messages being derived from a common electronic message sent by a common source client; authenticating, based on an authentication table, the plurality of destination clients, the authentication table storing user credentials that are used to authenticate destination clients; and for each encrypted electronic message received from an authenticated destination client of the plurality of destination clients:
decrypting the encrypted electronic message using a common private key stored at the decryptor device; and
providing the decrypted electronic message to the authenticated destination client.

18 . The machine-readable medium of claim 17 , wherein the receiving encrypted electronic messages includes receiving a first encrypted electronic message and a second encrypted electronic message, and wherein the decrypting the encrypted electronic message includes decrypting each of the first and encrypted electronic messages using the private key.

19 . The machine-readable medium of claim 17 , wherein a payload of the first and second encrypted electronic messages is the same.

20 . The machine-readable medium of claim 17 , the method further including:
for each encrypted electronic message received from an unauthenticated destination client of the plurality of destination clients, discarding the encrypted electronic message received from the unauthenticated destination client.

Assignees

• Red Hat Israel Ltd

Inventors

• Tsirkin Michael

Classifications

• H04L63/0442

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title

• H04L63/0471

  applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title