Approach for managing access to messages using encryption key management policies
Controlling access to disseminated messages includes implementing one or more key management policies that specify how various encryption keys are maintained and in particular, when encryption keys are made inaccessible. Deleting a particular key renders inaccessible all copies of messages, known or unknown, associated with the particular key, regardless of the location of the associated messages. A message may be directly or indirectly associated with a deleted key. Any number of levels of indirection are possible and either situation makes the message unrecoverable. The approach is applicable to any type of data in any format and the invention is not limited to any type of data or any type of data format.
1. A computer-implemented method for obtaining, at a recipient client, original message text from a policy-encrypted message transmitted by a sending client, the computer-implemented method comprising:
extracting from the policy-encrypted message a user ID that uniquely identifies a user associated with the sending client, an encrypted message key formed by encrypting a message key with at least a combination of a user recovery key and a user key, and a user key descriptor, the user key being formed from the user key descriptor and a server long term key;
retrieving a server recovery key;
computing the user recovery key using at least the user ID and the server recovery key;
decrypting the encrypted message key using at least the combination of the user key and the user recovery key to recover the message key; and
providing to the recipient client the message key for decrypting, an encrypted message contained in the policy-encrypted message and obtaining the original message text.
2. The computer-implemented method as recited in claim 1 , wherein the combination of the user key and the user recovery key is an ‘XOR’ of the user key and the user recover key.
3. The computer-implemented method as recited in claim 1 , wherein computing the user recovery key includes hashing at least the user ID and the server recovery key.
4. The computer-implemented method as recited in claim 1 , wherein one or more of the extracting, retrieving, computing, decrypting, and providing steps are performed at a policy server.
5. The computer-implemented method as recited in claim 1 , wherein the server recovery key is generated from a random number generator.
6. The computer-implemented method as recited in claim 1 , further comprising indicating to the recipient client that the original message text is unrecoverable if the server recovery key is not available.
7. A computer-implemented method for obtaining, at a recipient client, original message text from a policy-encrypted message transmitted by a sending client, the computer-implemented method comprising:
extracting from the policy-encrypted message a message expiration date and time, and a user ID that uniquely identifies a user associated with the sending client;
checking a current time against the message expiration date and time to determine whether or not the message has expired; and
if message has not expired, then:
extracting from the policy-encrypted message the encrypted message key and server recovery ID, the encrypted message key formed by encrypting a message key with at least a combination of a user recovery key and a user key;
retrieving a server recovery key using the server recovery key ID;
computing the user recovery key using at least the user ID and the server recovery key;
decrypting the encrypted message key using at least the combination of the user key and the user recovery key to recover the message key; and
providing to the recipient client the message key for decrypting, an encrypted message contained in the policy-encrypted message and obtaining the original message text.
8. The computer-implemented method as recited in claim 7 , wherein one or more of the extracting steps, the checking step, the retrieving step, the computing step, the decrypting step and the providing step are performed at a policy server.
9. The computer-implemented method as recited in claim 8 , wherein the server long term key is generated from a random number generator.
10. A computer-implemented method for obtaining, at a recipient client, original message text from a policy-encrypted message transmitted by a sending client, the computer-implemented method comprising:
extracting from the policy-encrypted message a key validity period, a creation date and time, and a user ID that uniquely identifies a user associated with the sending client;
checking creation date and time against the key validity period to determine whether or not the message was created outside key validity period; and
if message was created within the key validity period, then:
extracting from the policy-encrypted message the encrypted message key and server recovery ID, the encrypted message key formed by encrypting a message key with at least a combination of a user recovery key and a user key;
retrieving a server recovery key using the server recovery key ID;
computing the user recovery key using at least the user ID and the server recovery key;
decrypting the encrypted message key using at least the combination of the user key and the user recovery key to recover the message key; and
providing to the recipient client the message key for decrypting, an encrypted message contained in the policy-encrypted message and obtaining the original message text.
11. The non-transitory computer-readable storage medium as recited in claim 10 , wherein one or more of the extracting steps, the checking step, the retrieving step, the computing step, the decrypting step, and the providing step are performed at a policy server.
12. A computer-implemented method for obtaining, at a recipient client, original message text from a policy-encrypted message transmitted by a sending client, the computer-implemented method comprising:
extracting from the policy-encrypted message a user ID that uniquely identifies a user associated with the sending client;
obtaining metadata and a message signature, the metadata and message signature having been extracted from the policy-encrypted message;
computing a message signature from a hash of the message metadata and a user key;
comparing the computed message signature to a message signature to determine whether or not the signatures match; and
if the signatures match, then:
extracting from the policy-encrypted message the encrypted message key and server recovery ID, the encrypted message key formed by encrypting a message key with at least a combination of a user recovery key and the user key;
retrieving a server recovery key using the server recovery key ID;
computing the user recovery key using at least the user ID and the server recovery key;
decrypting the encrypted message key using at least the combination of the user key and the user recovery key to recover the message key; and
providing to the recipient client the message key for decrypting, an encrypted message contained in the policy-encrypted message and obtaining the original message text.
13. The non-transitory computer-readable storage medium as recited in claim 12 , wherein one or more of the extracting steps, the obtaining step, the computing steps, the comparing step, the retrieving step, the decrypting step, and the providing step are performed at a policy server.
14. The non-transitory computer-readable storage medium as recited in claim 13 , wherein the server long term key is generated from a random number generator.
15. A computer-implemented method for obtaining, at a recipient client, original message text from a policy-encrypted message transmitted by a sending client, the computer-implemented method comprising:
extracting from the policy-encrypted message a user ID that uniquely identifies a user associated with the sending client, an encrypted message key formed by encrypting a message key with at least a combination of a user recovery key and a user key, and a server recovery key ID; and
if the server recovery key ID corresponds to an available server recovery key, then:
retrieving a server recovery key using the server recovery key ID;
computing the user recovery key using at least the user ID and the server recovery key;
decrypting the encrypted message key using at least the combination of the user key and the user recovery key to recover the message key; and
providing to the recipient client the message key for decrypting, an encrypted message contained in the policy-encrypted message and obtaining the original message text.
16. The method of claim 15 , wherein one or more of the extracting step, the retrieving step, the computing step, the decrypting step, and the providing step are performed at a policy server.
17. A non-transitory computer-readable storage medium storing instructions for obtaining, at a recipient client, original message text from a policy-encrypted message transmitted by a sending client, wherein the instructions, when processed by one or more processors, cause:
extracting from the policy-encrypted message a user ID that uniquely identifies a user associated with the sending client, an encrypted message key formed by encrypting a message key with at least a combination of a user recovery key and a user key, and a user key descriptor, the user key being formed from the user key descriptor and a server long term key;
retrieving a server recovery key;
computing the user recovery key using at least the user ID and the server recovery key;
decrypting the encrypted message key using at least the combination of the user key and the user recovery key to recover the message key; and
providing to the recipient client the message key for decrypting, an encrypted message contained in the policy-encrypted message and obtaining the original message text.
18. The non-transitory computer-readable storage medium as recited in claim 17 , wherein the combination of the user key and the user recovery key is an ‘XOR’ of the user key and the user recover key.
19. The non-transitory computer-readable storage medium as recited in claim 17 , wherein the user recovery key is formed by hashing at least the user ID and the server recovery key.
20. The non-transitory computer-readable storage medium as recited in claim 17 , wherein the server recovery key is generated from a random number generator.
21. The non-transitory computer-readable storage medium as recited in claim 17 , further storing additional instructions which, when processed by the one or more processors causes indicating to the recipient client that the original message text is unrecoverable if the server recovery key is not available.
22. The non-transitory computable-readable medium of claim 17 , wherein one or more of the extracting step, the retrieving step, the computing step, the decrypting step, and the providing step are performed at a policy server.
23. A non-transitory computer-readable storage medium storing instructions for obtaining, at a recipient client, original message text from a policy-encrypted message transmitted by a sending client, wherein the instructions, when processed by one or more processors, cause:
extracting from the policy-encrypted message a message expiration date and time, and a user ID that uniquely identifies a user associated with the sending client;
checking a current time against the message expiration date and time to determine whether or not the message has expired; and
if message has not expired, then:
extracting from the policy-encrypted message the encrypted message key and server recovery ID, the encrypted message key formed by encrypting a message key with at least a combination of a user recovery key and a user key;
retrieving a server recovery key using the server recovery key ID;
computing the user recovery key using at least the user ID and the server recovery key;
decrypting the encrypted message key using at least the combination of the user key and the user recovery key to recover the message key; and
providing to the recipient client the message key for decrypting, an encrypted message contained in the policy-encrypted message and obtaining the original message text.
24. The non-transitory computable-readable medium of claim 23 , wherein one or more of the extracting steps, the checking step, the retrieving step, the computing step, the decrypting step, and the providing step are performed at a policy server.
25. A non-transitory computer-readable storage medium storing instructions for obtaining, at a recipient client, original message text from a policy-encrypted message transmitted by a sending client, wherein the instructions, when processed by one or more processors, cause:
extracting from the policy-encrypted message a key validity period, a creation date and time, and a user ID that uniquely identifies a user associated with the sending client;
checking creation date and time against the key validity period to determine whether or not the message was created outside key validity period; and
if message was created within the key validity period, then:
extracting from the policy-encrypted message the encrypted message key and server recovery ID, the encrypted message key formed by encrypting a message key with at least a combination of a user recovery key and a user key;
retrieving a server recovery key using the server recovery key ID;
computing the user recovery key using at least the user ID and the server recovery key;
decrypting the encrypted message key using at least the combination of the user key and the user recovery key to recover the message key; and
providing to the recipient client the message key for decrypting, an encrypted message contained in the policy-encrypted message and obtaining the original message text.
26. The non-transitory computable-readable medium of claim 25 , wherein one or more of the extracting steps, the checking step, the retrieving step, the computing step, the decrypting step, and the providing step are performed at a policy server.
27. A non-transitory computer-readable storage medium storing instructions for obtaining, at a recipient client, original message text from a policy-encrypted message transmitted by a sending client, wherein the instructions, when processed by one or more processors, cause:
extracting from the policy-encrypted message a user ID that uniquely identifies a user associated with the sending client;
obtaining metadata and a message signature, the metadata and message signature having been extracted from the policy-encrypted message;
computing a message signature from a hash of the message metadata and a user key;
comparing the computed message signature to a message signature to determine whether or not the signatures match; and
if the signatures match, then:
extracting from the policy-encrypted message the encrypted message key and server recovery ID, the encrypted message key formed by encrypting a message key with at least a combination of a user recovery key and the user key;
retrieving a server recovery key using the server recovery key ID;
computing the user recovery key using at least the user ID and the server recovery key;
decrypting the encrypted message key using at least the combination of the user key and the user recovery key to recover the message key; and
providing to the recipient client the message key for decrypting, an encrypted message contained in the policy-encrypted message and obtaining the original message text.
28. The non-transitory computable-readable medium of claim 27 , wherein one or more of the extracting steps, the obtaining step, the computing steps, the comparing step, the retrieving step, the decrypting step, and the providing step are performed at a policy server.
29. A non-transitory computer-readable storage medium storing instructions for obtaining, at a recipient client, original message text from a policy-encrypted message transmitted by a sending client, wherein the instructions, when processed by one or more processors, cause:
extracting from the policy-encrypted message a user ID that uniquely identifies a user associated with the sending client, an encrypted message key formed by encrypting a message key with at least a combination of a user recovery key and a user key, and a server recovery key ID; and
if the server recovery key ID corresponds to an available server recovery key, then:
retrieving a server recovery key using the server recovery key ID;
computing the user recovery key using at least the user ID and the server recovery key;
decrypting the encrypted message key using at least the combination of the user key and the user recovery key to recover the message key; and
providing to the recipient client the message key for decrypting, an encrypted message contained in the policy-encrypted message and obtaining the original message text.
30. The non-transitory computable-readable medium of claim 29 , wherein one or more of the extracting step, the retrieving step, the computing step, the decrypting step, and the providing step are performed at a policy server.