# US 10,484,397 B2 · Automatic electronic mail (email) encryption by email servers

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,484,397 B2
- Document ID: US10484397B2
- Status: Granted
- Kind: B2
- Application number: 15/640,387
- Filed: 2017-06-30
- Published: 2019-01-03
- Granted: 2019-11-19
- Earliest claimed: 2017-06-30
- Assignees: Fortinet, Inc.
- Applicants: Fortinet, Inc.
- Inventors: Axelle Apvrille
- Web page: https://patentgrep.com/patent/US10484397B2

## CPC

- H04L 63/123: {received data contents, e.g. message integrity}
- H04L 63/0272: {Virtual private networks}
- H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)}
- H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)}
- H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- H04L 51/08: Annexed information, e.g. attachments
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Systems and methods for automated email encryption between email servers are provided. According to one embodiment, an email, originated by a sender using a client device coupled with a private network and directed to a recipient, is received by an email server associated with the private network. A key server is queried for public keys of the recipient and the sender. When the recipient's public key is returned by the key server, it is used to encrypt the email message; otherwise, no encryption is performed. When the sender's public key does not exist on the key server, the email server automatically generates a temporary key pair for the sender on the fly and without requiring intervention on the part of the sender. Finally, both the email message and the public key of the sender are transmitted by the email server to the recipient.

## Claims

### Claim 1

A method comprising:
receiving, by an electronic mail (email) server associated with a private network, from a client device coupled with the private network, a first email message originated by a local sender using the client device and directed to a remote recipient, wherein the local sender is a first user of a plurality of users associated with the private network and wherein the remote recipient is not a user associated with the private network;
querying, by the email server, one or more key servers for a public key of the remote recipient;
when the public key of the remote recipient is returned by the one or more key servers, then using the public key of the remote recipient by the email server to encrypt the first email message;
when the public key of the remote recipient does not exist, then foregoing encryption of the first email message;
querying, by the email server, the one or more key servers for a public key of the local sender;
when the public key of the local sender does not exist on the one or more key servers, then automatically generating, by the email server, a temporary key pair for the local sender on the fly and without requiring intervention on the part of the local sender, wherein the temporary key pair for the local sender includes the public key of the local sender and a private key of the local sender; and
transmitting, by the email server, both the email message and the public key of the local sender to the remote recipient.

### Claim 2 (depends on 1)

The method of claim 1, wherein the temporary key pair comprises a Pretty Good Privacy (PGP) key pair or a GNU Privacy Guard (GPG) key pair.

### Claim 3 (depends on 1)

The method of claim 1, wherein said transmitting, by the email server, both the first email message and the public key of the local sender to the remote recipient comprises including the public key of the local sender as an attachment to the first email message.

### Claim 4 (depends on 1)

The method of claim 1, further comprising storing, by the email server, the private key of the local sender within a secured storage area accessible by the email server.

### Claim 5 (depends on 4)

The method of claim 4, wherein the secured storage area is selected from any or a combination of a secured random access memory (RAM) and an encrypted disk.

### Claim 6 (depends on 4)

The method of claim 4, wherein the private key of the local sender is protected by an authentication process.

### Claim 7 (depends on 6)

The method of claim 6, wherein the authentication process comprises a biometric authentication.

### Claim 8 (depends on 1)

The method of claim 1, further comprising prior to said transmitting, by the email server, both the email and the public key of the local sender to the remote recipient, digitally signing, by the email server, the first email message.

### Claim 9 (depends on 1)

The method of claim 1, further comprising:
receiving, by the email server, a second email message from a remote sender and directed to a local recipient, wherein the local recipient is a second user of the plurality of users;
extracting, by the email server, a public key of the remote sender from an attachment associated with the second email message;
storing, by the email server, the public key of the remote sender for future use; and
when the email message is encrypted with a public key of the local recipient, then prior to delivery of the email message to the local recipient, decrypting the email message, by the email server, with a private key of the local recipient.

### Claim 10

An electronic mail (email) server associated with a private network, the email server comprising:
a non-transitory storage device having embodied therein instructions representing one or more routines; and
one or more processors coupled to the non-transitory storage device and operable to execute the one or more routines to perform a method comprising:
receiving from a client device coupled with the private network a first email message originated by a local sender using the client device and directed to a remote recipient, wherein the local sender is a first user of a plurality of users associated with the private network and wherein the remote recipient is not a user associated with the private network;
querying one or more key servers for a public key of the remote recipient;
when the public key of the remote recipient is returned by the one or more key servers, then using the public key of the remote recipient to encrypt the first email message;
when the public key of the remote recipient does not exist, then foregoing encryption of the first email message;
querying the one or more key servers for a public key of the local sender;
when the public key of the local sender does not exist on the one or more key servers, then automatically generating a temporary key pair for the local sender on the fly and without requiring intervention on the part of the local sender, wherein the temporary key pair for the local sender includes the public key of the local sender and a private key of the local sender; and
transmitting both the email message and the public key of the local sender to the remote recipient.

### Claim 11 (depends on 10)

The email server of claim 10, wherein the temporary key pair comprises a Pretty Good Privacy (PGP) key pair or a GNU Privacy Guard (GPG) key pair.

### Claim 12 (depends on 10)

The email server of claim 10, wherein said transmitting both the first email message and the public key of the local sender to the remote recipient comprises including the public key of the local sender as an attachment to the first email message.

### Claim 13 (depends on 10)

The email server of claim 10, wherein the method further comprises storing the private key of the local sender within a secured storage area accessible by the email server.

### Claim 14 (depends on 13)

The email server of claim 13, wherein the secured storage area is selected from any or a combination of a secured random access memory (RAM) and an encrypted disk.

### Claim 15 (depends on 13)

The email server of claim 13, wherein the private key of the local sender is protected by an authentication process.

### Claim 16 (depends on 15)

The email server of claim 15, wherein the authentication process comprises a biometric authentication.

### Claim 17 (depends on 10)

The email server of claim 10, wherein the method further comprises prior to said transmitting both the email and the public key of the local sender to the remote recipient, digitally signing the first email message.

### Claim 18 (depends on 10)

The email server of claim 10, wherein the method further comprises:
receiving a second email message from a remote sender and directed to a local recipient, wherein the local recipient is a second user of the plurality of users;
extracting a public key of the remote sender from an attachment associated with the second email message;
storing the public key of the remote sender for future use; and
when the email message is encrypted with a public key of the local recipient, then prior to delivery of the email message to the local recipient, decrypting the email message with a private key of the local recipient.

### Claim 19 (depends on 1)

The method of claim 1, wherein each key of the temporary key pair comprises a 2048-bit key.

### Claim 20 (depends on 10)

The email server of claim 10, wherein each key of the temporary key pair comprises a 2048-bit key.