Systems and methods for secure multi-party communications using a proxy
AssigneeVisa International Service Association
InventorEric Le Saint
Life of this patent
Estimating the term…
Abstract
Embodiments extend protocols for secure communication between two parties to allow a party to securely communicate with multiple parties using a single message. For example, the sending party can determine a unique shared secret for each recipient and encrypt data for a recipient using a session key generated from the corresponding shared secret. The encrypted data can be combined into a single message, and each recipient can decrypt only the subset of the message that it is authorized to.
Claims18
A method of performing secure communications involving a proxy, the method comprising:
- identifying one or more recipient computers;
- for each of the one or more recipient computers:
- obtaining a first encrypted message portion generated by a first source computer by encrypting a first message portion with a recipient session key, and
- obtaining a second encrypted message portion generated by a second source computer by encrypting a second message portion with the recipient session key;
- identifying a proxy computer;
- generating a proxy session key from a shared secret that is shared with the proxy computer;
- incorporating address information for each of the one or more recipient computers into a message body;
- using the proxy session key to encrypt the message body to obtain an encrypted message body that includes the address information for each of the one or more recipient computers;
- aggregating the encrypted message body, the first encrypted message portion and the second encrypted message portion into an encrypted message;
- and
- sending the encrypted message to the proxy computer, the encrypted message including the encrypted message body and the first and second encrypted message portions.
A method of performing secure communications involving a proxy, the method comprising:
- receiving an encrypted message from a sender, the encrypted message including two or more encrypted message portions and an encrypted message body;
- generating a session key from a shared secret that is shared with the sender;
- decrypting the encrypted message body using the session key to obtain a message body;
- parsing the message body to identify at least two addresses including an address for each encrypted message portion;
- and
- for each encrypted message portion:
- routing the encrypted message portion using a corresponding address, wherein a first encrypted message portion is routed using a first address, a second encrypted message portion is routed using a second address.
Dependencies are inferred from the claim text.