System and method for email and file decryption without direct access to required decryption key
AssigneeZeva Inc.
InventorIssam Andoni
Life of this patent
Estimating the term…
Abstract
Exemplary systems and methods are directed to decrypting electronic messages in a network. The system includes a processor configured to receive or monitor message sources for encrypted messages, where private keys associated with the encrypted messages are not previously provided to the system. For each message, extract a set of user certificate identifiers and corresponding encrypted session keys, securely communicate with private key provider to decrypt the encrypted session key with an acquired private key, and decrypt the message with the unencrypted session key.
Claims19
A system for decrypting electronic messages, comprising:
- a first processor configured to have a front end processing unit and a back end processing unit,
- wherein the front end processing unit receives or monitors electronic messages that are in-flight from electronic message sources to downstream destinations on a network for encrypted messages, wherein private keys associated with the encrypted messages are not previously provided to or stored in association with the first processor,
- wherein for each electronic message the front end processing unit extracts a set of user certificate identifiers and corresponding encrypted session keys,
- wherein the back end processing unit includes a second processor for executing a hardware security model (HSM), the back end processing unit being configured with access rights to retrieve the private keys from a certificate authority, and for each message the back end processing unit securely communicates with the certificate authority to acquire a private key, which is not previously provided to second processor or stored in the HSM, for decrypting a respective encrypted session key, securely stores the acquired private key in the HSM, decrypts the encrypted session key in the HSM using the private key, and sends the unencrypted session key to the front end processing unit, and
- wherein the front end processing unit decrypts the encrypted messages with the unencrypted session key.
A method for decrypting electronic messages in a system having at least one computing device connected to a network, the method comprising:
- retrieving, via a back end processing unit of the at least one computing device, private keys from a certificate authority, wherein the back end processing unit is configured with access rights to retrieve the private keys;
- executing, via a processor of the at least one computing device, a hardware security model (HSM);
- receiving or monitoring, via a front end processing unit of the at least one computing device, a network for encrypted messages that are in-flight from at least one message source to a recipient on the network, wherein private keys associated with the encrypted messages are not previously provided to the system;
- and
- for each received message:
- extracting, via the front end processing unit, a set of user certificate identifiers and corresponding encrypted session keys;
- via the back end processing unit:
- securely communicating with a private key provider to obtain a private key, which is not previously provided to or stored in association with the back end processing unit, for decrypting a respective encrypted session key;
- securely storing the obtained private key in the HSM;
- decrypting the encrypted session key in the HSM using the private key;
- and
- sending the unencrypted session key to the front end processing unit;
- and
- decrypting, via the front-end processing unit, the encrypted messages with the unencrypted session key.
A non-transitory computer readable medium for executing a method for decrypting electronic messages in a network, the medium having program code recorded thereon such that when placed in communicable contact with at least one processor, the at least one processor is configured to have a front end processing unit and a back end processing unit and the at least one processor performs the steps of:
- monitoring, via the front end processing unit, the network for encrypted messages that are in-flight from at least one electronic message source to a recipient, wherein private keys associated with the encrypted messages of the message source are not previously provided to the at least one processor;
- and
- for each received message:
- extracting, via the front end processing unit, a set of user certificate identifiers and corresponding encrypted session keys;
- the back end processing unit is configured with access rights to retrieve private keys from a key management server and for executing a hardware security model (HSM), wherein the retrieved private keys are not previously provided to or stored in association with the back end processing unit, for the back end processing unit the at least one processor:
- sending user certificate identifiers to the key management server to obtain a private key for decrypting a respective encrypted session key;
- and
- securely storing the obtained private key in the HSM;
- decrypting the encrypted session key in the HSM using the private key;
- and
- sending the unencrypted session key to the front end processing unit,
- wherein, via the front end processing unit, the at least one processor decrypts the encrypted messages with the unencrypted session key.
Dependencies are inferred from the claim text.