Automated scalable identity-proofing and authentication process
A process of confirming an originator of an electronic mail (email) includes receiving a request for verification of the identity of an alleged originator of the email, which may be sent from the actual originator of the email or a recipient of the email. The alleged originator of the email may be determined, e.g., by parsing the email to determine the name of the sender in the email. Verification is obtained from a biometric-enabled client that is associated with the sender, whether the email was in fact sent by the sender, as well as confirmation of the identity of the sender based on a previously stored identity-proofed biometric.
1 . A method for decrypting an encrypted electronic mail (email) performed by a verification server, the method comprising:
obtaining a decryption key for the encrypted email after verification of an identity of an originator of an email that is encrypted to generate the encrypted email;
obtaining an identifier of the encrypted email from a receiver of the encrypted email;
obtaining verification of an identity of the receiver of the encrypted email based on an identity-proofed biometric associated with the receiver; and
providing the decryption key for the encrypted email to the receiver in response to the verification of the identity of the receiver.
2 . The method of claim 1 , further comprising obtaining verification of the identity of the originator of the email by receiving an indication of verification of the identity of the originator of the email from a biometric-enabled client associated with the originator of the email.
3 . The method of claim 1 , further comprising obtaining verification of the identity of the originator of the email, comprising:
receiving measured biometrics from a biometric-enabled client associated with the originator of the email; and
verifying the identity of the originator of the email based on the measured biometrics.
4 . The method of claim 1 , further comprising:
generating an encryption key in response to verification of the identity of the originator of the email; and
transmitting the encryption key to a client associated with the originator of the email, wherein the client associated with the originator of the email encrypts the email based on the encryption key to generate the encrypted email.
5 . The method of claim 1 , wherein a client associated with the encrypted originator of the email encrypts the email to generate the email, and wherein obtaining the decryption key for the encrypted email comprises receiving the decryption key from the client associated with the originator of the email.
6 . The method of claim 1 , wherein the identifier of the encrypted email comprises the encrypted email or a token identifying the encrypted email.
7 . The method of claim 1 , wherein obtaining verification of the identity of the receiver of the encrypted email comprises receiving an indication of verification of the identity of the receiver of the encrypted email from a biometric-enabled client associated with the receiver of the encrypted email.
8 . The method of claim 1 , wherein the decryption key is one of a plurality of decryption keys for the encrypted email, each decryption key is associated with a specific receiver of the encrypted email, the method further comprising:
obtaining separate verification of the identity of each receiver of the encrypted email; and
providing an associated decryption key for the encrypted email to respective receiver in response to the verification of the identity of the respective receiver.
9 . The method of claim 1 , wherein the identity-proofed biometric associated with the receiver is a biometric associated with an identity of the receiver that is authenticated by one or more associates of the receiver.
10 . A verification server configured for decrypting an encrypted electronic mail (email), the verification server comprising:
at least one memory; and
a processing system comprising one or more processors coupled to and the at least one memory, the processing system configured to:
obtain a decryption key for the encrypted email after verification of an identity of an originator of an email that is encrypted to generate the encrypted email;
obtain an identifier of the encrypted email from a receiver of the encrypted email;
obtain verification of an identity of the receiver of the encrypted email based on an identity-proofed biometric associated with the receiver; and
provide the decryption key for the encrypted email to the receiver in response to the verification of the identity of the receiver.
11 . The verification server of claim 10 , wherein the processing system is further configured to obtain verification of the identity of the originator of the email by being configured to receive an indication of verification of the identity of the originator of the email from a biometric-enabled client associated with the originator of the email.
12 . The verification server of claim 10 , wherein the processing system is further configured to obtain verification of the identity of the originator of the email, by being configured to:
receive measured biometrics from a biometric-enabled client associated with the originator of the email; and
verify the identity of the originator of the email based on the measured biometrics.
13 . The verification server of claim 10 , wherein the processing system is further configured to:
generate an encryption key in response to verification of the identity of the originator of the email; and
transmit the encryption key to a client associated with the originator of the email, wherein the client associated with the originator of the email encrypts the email based on the encryption key to generate the encrypted email.
14 . The verification server of claim 10 , wherein a client associated with the originator of the email encrypts the email to generate the encrypted email, and wherein the processing system is configured to obtain the decryption key for the encrypted email by being configured to receive the decryption key from the client associated with the originator of the encrypted email.
15 . The verification server of claim 10 , wherein the identifier of the email comprises the encrypted email or a token identifying the encrypted email.
16 . The verification server of claim 10 , wherein the processing system is configured to obtain verification of the identity of the receiver of the encrypted email by being configured to receive an indication of verification of the identity of the receiver of the encrypted email from a biometric-enabled client associated with the receiver of the encrypted email.
17 . The verification server of claim 10 , wherein the decryption key is one of a plurality of decryption keys for the encrypted email, each decryption key is associated with a specific receiver of the encrypted email, wherein the processing system is further configured to:
obtain separate verification of the identity of each receiver of the encrypted email; and
provide an associated decryption key for the encrypted email to respective receiver in response to the verification of the identity of the respective receiver.
18 . The verification server of claim 10 , wherein the identity-proofed biometric associated with the receiver is a biometric associated with an identity of the receiver that is authenticated by one or more associates of the receiver.
19 . A method for decrypting an encrypted electronic mail (email) performed by a biometric-enabled client associated with a receiver of the encrypted email, the method comprising:
receiving the encrypted email;
transmitting, to a verification server, an identifier of the encrypted email;
transmitting, to the verification server, verification of an identity of the receiver of the encrypted email based on an identity-proofed biometric associated with the receiver;
receiving, from the verification server, a decryption key for the encrypted email after transmitting the verification of the identity of the receiver;
decrypting the encrypted email using the decryption key; and
displaying the encrypted email after decrypting using the decryption key.
20 . The method of claim 19 , wherein the identifier of the encrypted email comprises the encrypted email or a token identifying the encrypted email.
21 . The method of claim 19 , wherein the receiver of the encrypted email is associated with an email address included in a recipient list in the encrypted email, and wherein the decryption key for the encrypted email is received from the verification server in response to the verification of the identity of the receiver of the encrypted email transmitted to the verification server and the receiver of the encrypted email being associated with the email address included in the recipient list in the encrypted email.
22 . The method of claim 19 , wherein the decryption key is associated with only the receiver of the encrypted email, wherein other receivers of the encrypted email cannot decrypt the encrypted email with the decryption key.
23 . The method of claim 19 , wherein the identity-proofed biometric associated with the receiver is a biometric associated with an identity of the receiver that is authenticated by one or more associates of the receiver.
24 . A biometric-enabled client associated with a receiver of an encrypted electronic mail (email) and configured to decrypt the encrypted email, the biometric-enabled client comprising:
at least one memory; and
a processing system comprising one or more processors coupled to and the at least one memory, the processing system configured to:
receive an encrypted email;
transmit, to a verification server, an identifier of the encrypted email;
transmit, to the verification server, verification of an identity of the receiver of the encrypted email based on an identity-proofed biometric associated with the receiver;
receive, from the verification server, a decryption key for the encrypted email after transmitting the verification of the identity of the receiver;
decrypt the encrypted email using the decryption key; and
display the encrypted email after decrypting using the decryption key.
25 . The biometric-enabled client of claim 24 , wherein the identifier of the encrypted email comprises the encrypted email or a token identifying the encrypted email.
26 . The biometric-enabled client of claim 24 , wherein the receiver of the encrypted email is associated with an email address included in a recipient list in the encrypted email, and wherein the decryption key for the encrypted email is received from the verification server in response to the verification of the identity of the receiver of the encrypted email transmitted to the verification server and the receiver of the encrypted email being associated with the email address included in the recipient list in the encrypted email.
27 . The biometric-enabled client of claim 24 , wherein the decryption key is associated with only the receiver of the encrypted email, wherein other receivers of the encrypted email cannot decrypt the encrypted email with the decryption key.
28 . The biometric-enabled client of claim 24 , wherein the identity-proofed biometric associated with the receiver is a biometric associated with an identity of the receiver that is authenticated by one or more associates of the receiver.