Object level encryption system including encryption key management system

1. A method for providing key exchange in a communications network using a symmetrical encryption algorithm key, comprising:

a. providing a transmitter having a selected transmission key KTx;

b. generating at the transmitter a random symmetric session key K(session);

c. encrypting a data object with the session key K(session) to provide protected data;

d. selecting at the transmitter a desired RxID corresponding to an authorized receiver;

e. establishing RxID as a public identity variable;

f. selecting message security policy variables;

g. providing a data structure comprising the desired RxID, the message security policy variables, and session key;

h. encrypting the data structure with the transmitter key to provide an encrypted data structure;

i. adding to the encrypted data structure a public ID of the transmitter in plaintext to provide a transmission package including a Header-Tx comprising the desired RxID;

j. sending the transmission package to a receiver;

k. providing a data structure Header-Rx including an actual RxID identifying the receiver;

l encrypting Header-Rx with a receiver key KRx;

m. storing KRx and KTx at a security server;

n. sending Header-Tx and Header-Rx to the security server,

o. selecting KTx as stored at the security server and using KTx to decrypt Header-Tx and accessing desired RxID;

p. comparing desired RxID to actual RxID;

q. registering successful authentication if the desired RxID and the actual RxID match;

r. in response to successful authentication sending session key K(session) to the receiver; and

s. decrypting the protected data at the receiver using K(session).

2. A method for secure network communication comprising:

providing a first encryption key KTx and a second encryption key KRx for a transmitter and a receiver respectively;

storing a copy of the first encryption key KTx and a copy of the second encryption key KRx in an encrypted database in a server, placing each copy in a location accessible by an address corresponding to an identity of a respective transmitter or receiver;

forming in the transmitter a data structure comprising a header in which a session encryption key K (session), receiver ID, and security information are encrypted by KTx and a secured data object in which data is encrypted with K (session);

forming a transmitted packet comprising the header and the secure data object;

transmitting the transmitted packet to a receiver;

forming in the receiver a receiver transmitter header and a received secure object data;

forming in the receiver a receiver header comprising a header in which a session encryption key K (session), receiver ID, and security information are encrypted by KRx and a receiver secured data object in which data is encrypted with K (session);

comparing the receiver header and the received transmitter header and producing a signal indicative of authentication or failure of authentication, failure comprising determining that a variable is missing, incomplete, or discrepant from a correct receiver's identity; and

in response to a signal indicative of authentication, accessing the receiver key KRx from the encrypted hardware memory, to permit use of K (session) to decrypt the receiver secure data object.

3. A method according to claim 2 wherein the security information comprises message security variables and reaction response codes and further comprising the step of accessing a reaction response code in response to a signal indicative of failure of authentication.

4. A method according to claim 3 wherein the step of providing reaction response codes comprises providing selectable commands each corresponding to a level of response to the failure of authentication.

5. A method according to claim 3 wherein the step of providing reaction response codes comprises providing commands indicative of respective selectable actions.

6. A method according to claim 4 wherein the step of providing reaction response codes further comprises providing commands indicative of respective selectable actions and wherein one said action comprises transmitting data other than the secured data to a transmitter providing incorrect authentication information.

7. A method according to claim 6 comprising assigning a group of clients for authentication as a single entity.

8. A method for secure network communications utilizing object level encryption comprising:

encrypting data at a transmitter with a session encryption key to provide secure object data;

providing a transmitter header comprising a combination of the session encryption key, identity of a target receiver, and message security variables all encrypted with a transmitter encryption key;

forming a packet comprising the header and the secure object data;

transmitting the packet to the target receiver;

creating at the receiver a received transmitter header indicative of the transmitted header and a received transmitter secure object data;

providing at the target receiver a receiver heading comprising receiver identity and receiver security variables encrypted with a receiver encryption key;

verifying correspondence of security variables in said received transmitter heading and said receiver transmitter heading;

in response to verification, utilizing the receiver identity provided in the transmitter header to access a stored receiver encryption key; and

providing the receiver encryption key for use by the receiver for decrypting the received secure data.

9. A method according to claim 8 wherein the step of providing the receiver encryption key for decrypting received secure data comprises accessing the receiver security key and utilizing the receiver encryption key to decrypt a data structure comprising the session security key and security variables, and decrypting the received transmitter secure object data.

10. A method according to claim 9 further comprising providing reaction codes and accessing a reaction code in response to the failure of authentication.

11. A method according to claim 10 further comprising controlling a data package after the data package has been delivered to a receiver by assigning a data ID number to the transmitter header, associating a code with the data ID number, sending a command from the transmitter to the server to revoke the message and storing the command at the server to command failure of authentication in response to a request to authenticate a data package corresponding to the data ID number.

12. A method according to claim 11 wherein security codes comprise selective variables indicative of values and names of parameters associated with the transmitter.