System and method for securely transmitting non-PKI encrypted messages
An embodiment of an automatic key delivery system is described, An automatic key delivery system comprises the following operations. Herein, a first token is generated and provided to a first network device. Thereafter, a first key value pair, including the first token and a first key segment of a cryptographic key, is received by a first relay server and a second key value pair, including the first token and a second key segment of the cryptographic key, is received from a second relay server. In response, a second token to be provided to the first relay server and the second relay server. Thereafter, the first and second key segment are returned from the first and second relay servers based on usage of the second token as a lookup in order to recover the cryptographic key for decryption of an encrypted content from the first network device.
1. A system comprising:
a token data store; and
one or more processors programmed by executable instructions to:
receive a first token request;
generate, in response to the first token request, a first token for return to a sending network device;
receive a token reassignment request;
generate, in response to the token reassignment request, a second token associated with the first token as a token pair, wherein the token pair is associated with an entry of a data structure stored in the token data store;
receive a second token request comprising the first token; and
access, in response to the second token request, one or more entries of the data structure stored in the token data store using the first token to obtain the second token for return to a receiving network device.
2. The system of claim 1 , wherein the one or more processors are further programmed by the executable instructions to, in response to obtaining the second token, delete the entry of the data structure stored in the token data store.
3. The system of claim 1 , wherein the one or more processors are further programmed by the executable instructions to provide the second token to the receiving network device for retrieval of a different cryptographic key segment from each of a plurality of storage locations within a cloud network.
4. The system of claim 3 , wherein a collection of each cryptographic key segment retrieved from the plurality of storage locations forms a cryptographic key to decrypt encrypted content from the sending network device.
5. The system of claim 4 , wherein the cryptographic key comprises a one-time pad.
6. The system of claim 3 , wherein the plurality of storage locations within the cloud network comprises a plurality of relay servers deployed within a public cloud network.
7. The system of claim 6 , further comprising the plurality of relay servers,
wherein a first relay server of the plurality of relay servers is configured to:
receive a first cryptographic key segment from the sending network device;
pseudo-randomly select a second relay server from the plurality of relay servers; and
send the first cryptographic key segment to the second relay server; and
wherein a third relay server of the plurality of relay servers is configured to:
receive a second cryptographic key segment from the sending network device;
pseudo-randomly select a fourth relay server from the plurality of relay servers; and
send the second cryptographic key segment to the fourth relay server.
8. The system of claim 7 , wherein the first relay server is further configured to remove the first cryptographic key segment from a data store of the first relay server in response to sending the first cryptographic key segment to the second relay server.
9. The system of claim 7 , further comprising the plurality of relay servers,
wherein the second relay server is configured to:
receive a first cryptographic key segment request from the receiving network device, wherein the first cryptographic key segment request comprises the second token; and
return a first cryptographic key segment to the receiving network device; and
wherein the fourth relay server is configured to:
receive a second cryptographic key segment request from the receiving network device, wherein the second cryptographic key segment request comprises the second token; and
return a second cryptographic key segment to the receiving network device.
10. The system of claim 9 , wherein the second relay server is further configured to remove the first cryptographic key segment from a data store of the second relay server in response to returning the first cryptographic key segment to the receiving network device.
11. The system of claim 1 , wherein the one or more processors are further programmed by the executable instructions to maintain and increase a count value associated with a subscriber requesting the first token.
12. A computer-implemented method comprising:
under control of a computing system comprising one or more computer processors configured to execute specific instructions,
receiving a first token request;
generating, in response to the first token request, a first token for return to a sending network device;
receiving a token reassignment request;
generating, in response to the token reassignment request, a second token associated with the first token as a token pair, wherein the token pair is associated with an entry of a data structure stored in a token data store of the computing system;
receiving a second token request comprising the first token; and
accessing, in response to the second token request, one or more entries of the data structure stored in the token data store using the first token to obtain the second token for return to a receiving network device.
13. The computer-implemented method of claim 12 , further comprising:
in response to obtaining the second token, deleting the entry of the data structure stored in the token data store.
14. The computer-implemented method of claim 12 , further comprising:
providing the second token to the receiving network device for retrieval of a different cryptographic key segment from each of a plurality of storage locations within a cloud network.
15. The computer-implemented method of claim 12 , further comprising:
receiving, by a first relay server of a plurality of relay servers of the computing system, a first cryptographic key segment from the sending network device;
pseudo-randomly selecting, by the first relay server, a second relay server of the plurality of relay servers; and
sending the first cryptographic key segment to the second relay server.
16. The computer-implemented method of claim 15 , further comprising removing, by the first relay server, the first cryptographic key segment from a data store of the first relay server in response to sending the first cryptographic key segment to the second relay server.
17. The computer-implemented method of claim 15 , further comprising:
receiving, by the second relay server, the first cryptographic key segment from the first relay server;
storing the first cryptographic key segment in a data store of the second relay server; and
associating the first cryptographic key segment with the second token.
18. The computer-implemented method of claim 15 , further comprising:
receiving, by the second relay server, a first cryptographic key segment request from the receiving network device, wherein the first cryptographic key segment request comprises the second token; and
returning the first cryptographic key segment to the receiving network device.
19. The computer-implemented method of claim 18 , further comprising:
removing, by the second relay server, the first cryptographic key segment from a data store of the second relay server in response to returning the first cryptographic key segment to the receiving network device.
20. The computer-implemented method of claim 12 , further comprising maintaining and increasing a count value associated with a subscriber requesting the first token.