Enhanced Email Services

Abstract

An enhanced email service mitigates the shortcomings of conventional email services by enabling encrypted content to be transmitted to an intended recipient regardless of whether the intended recipient has a prior relationship with the sender or has credentials issued from a credential authority. A method is provided for receiving encrypted content and generating a message including the encrypted content as an attachment and a link for enabling decrypted access to the encrypted content. The method may include sending the message to a mailbox of the intended recipient while also storing the message in an organization mailbox to provide for subsequent decryption of the encrypted content. The link may provide decrypted access to the encrypted content to the intended recipient of the message in a variety of ways depending on, for example, whether the recipient views the message through a webmail browser or through a local mail client compatible with the enhanced email service.

Description

[0001] This application is a divisional application of the invention patent application "Enhanced Email Service" with application date of January 5, 2018 and application number 201880006333.1. Background Art

[0002] Currently, there are many different encrypted email services available to enable senders to send encrypted message content to recipients and provide the recipients with the ability to decrypt the content. Many of these mechanisms have specific advantages and disadvantages to using them. For example, while one such mechanism, called Secure Multipurpose Internet Mail Extensions (S / MIME), can enable recipients to receive encrypted content and corresponding keys for decrypting the content, the applicability of S / MIME is limited in terms of potential recipients because the standard requires each sender and recipient to obtain credentials from their respective internal certificate authority (CA) or a public CA before utilizing this capability. Due to this limitation, when sending encrypted content outside an organization, the sender may not be able to confirm whether the recipient will be able to successfully decrypt the content upon receipt because the sender may not be sure whether the recipient has obtained the credentials, or will do so when prompted. This concern can be partially alleviated by limiting potential recipients to individuals within one's own organization (e.g., colleagues with email addresses operating on the same domain) or at least recipients who are known to have obtained credentials from a public CA. Significant disadvantages of S / MIME and other similar encrypted email services include limiting the pool of potential recipients to one's own organization and / or requiring recipients to go through the cumbersome process of obtaining a certificate from a CA before sending encrypted content.

[0003] It is with respect to these and other general considerations that the disclosure herein is presented. Summary of the invention

[0004] This article describes a technology for providing an enhanced email service that mitigates the shortcomings associated with traditional email services by, for example, enabling encrypted content to be transmitted to an intended recipient, regardless of whether the intended recipient has a prior relationship with the sender or has obtained a certificate from a certificate authority (CA). In general, the configuration disclosed herein reduces the obstacles to successfully and reliably sending encrypted message content to any recipient email address. According to aspects of the present disclosure, a method is provided for receiving encrypted content and generating a message based thereon, the message specifying a recipient email address and including the encrypted content as an attachment and a link for enabling decrypted access to the encrypted content. The method may also include: sending the message to the intended recipient's mailbox, while also storing the message in an organization mailbox to enable subsequent decryption of the encrypted content. Depending on, for example, whether the recipient views the message through a webmail browser or through a local mail client compatible with the enhanced email service, the link may be configured to provide decrypted access to the encrypted content to the intended recipient of the message in various ways.

[0005] For ease of illustration, consider the following scenario in which a recipient of a message containing encrypted content views the message through a generic mail module (e.g., webmail) that does not have a security protocol that is compatible with an enhanced email service (e.g., Office 365). In this scenario, a web browser running on the recipient's device may have a webmail module open in a first web domain, where a link is displayed from the first web domain to provide access to the encrypted content. The encrypted content may then be accessed through a web page in a second web domain, where the second web domain exposes an authentication module application program interface (API) of the intended recipient's mail service, e.g., the second domain may expose an OAuth security module corresponding to the first domain. The first web domain may be connected to the recipient's mail service (e.g., Gmail) to authenticate the recipient. TM Webmail service, The first web domain may be associated with an enhanced email service (e.g., a webmail service), and the second web domain may be associated with an enhanced email service (e.g., Office 365). When the recipient provides credentials to the authentication module API and receives a token from the authentication module API, the token may be provided to the enhanced email service. The token may then enable the enhanced email service to decrypt the encrypted content locally on the server side and display it to the recipient in the form of a web page.

[0006] Now consider the following scenario, in which a recipient of the same message containing encrypted content and links views the message through a local mail client, which includes enhanced communication capabilities for an enhanced email service related to the local mail client being able to automatically (e.g., without user interaction) provide an authentication code or token obtained from the recipient's mail service to the enhanced email service. Examples of local mail clients and enhanced email services with compatible security protocols (e.g., enhanced communication capabilities) may include Outlook mail clients and Office 365 services. In this case, the local mail client can process the message by automatically sending a token (obtained from the recipient's mail service at some point) to the enhanced email service, and the enhanced email service can provide a key to the local mail client in response to verifying the validity of the token to enable local decryption of the encrypted content (e.g., decryption by the local mail client). The local mail client can then generate a decrypted version of the content by using the obtained key, and temporarily store the decrypted content in a volatile cache so that it can be seamlessly displayed to the recipient. In other words, the recipient can decrypt and view the content without having to perform manual input to cause a token and key exchange.

[0007] The present disclosure provides a variety of variations on the concepts described above. For example, as described in more detail below, a system may include a local mail service that communicates with an enhanced email service to provide decrypted access to encrypted content to an intended recipient via a universal mail module without storing the encrypted content on the enhanced mail service. In another example, a system may include an enhanced email service that provides decrypted access to encrypted content via an enhanced mail module without storing the encrypted content on the enhanced mail service.

[0008] It should be understood that the subject matter described above can also be implemented as a computer-controlled device, a computer process, a computing system, or an article such as a computer-readable medium. These and various other features will become apparent upon reading the following detailed description and reviewing the associated drawings.

[0009] This summary is provided to introduce in simplified form a selection of concepts that will be further described in the detailed description below. This summary is not intended to identify key features or essential features of the present invention, nor is it intended to limit the scope of protection of the present invention. In addition, the present invention is not limited to addressing any or all disadvantages stated in any part of this disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The detailed description is provided with reference to the accompanying drawings. In the drawings, the leftmost digit of a reference number identifies the drawing in which the reference number first appears. The same reference numbers in different drawings indicate similar or identical items. References to individual items in a plurality of items may use reference numbers with letters in the alphabetical sequence to refer to each individual item. Generic references to the items may use specific reference numbers without the alphabetical sequence.

[0011] Figure 1 An exemplary data flow scenario is shown for a system including an enhanced email service to provide decrypted access to encrypted content to an intended recipient via a general purpose mail module (eg, a web browser accessing a web mail service).

[0012] Figure 2A Shows that it can be Figure 1 Aspects of a user interface (UI) for transmitting instructions on how to obtain decrypted access to encrypted content displayed on a user device in association with a data flow scenario of an encrypted content. The UI displays an email message that includes a link for enabling an intended recipient to provide credentials associated with their email service provider to an enhanced mail service. As with any UI described herein, the exemplary UI can be displayed on a variety of device types such as a desktop computer, a laptop computer, a mobile device, a tablet computer, or a combination of devices.

[0013] Figure 2B Shows that it can be Figure 1 The data stream scene is associated with the display on the user device, in response to the user activation Figure 2A The links displayed in , expose the authentication module associated with the recipient's email service provider to various aspects of the UI of the enhanced mail service.

[0014] Figure 2C Shows that it can be Figure 1 The data flow scene is associated with the display on the user device, in response to the user successfully authenticating himself with respect to the enhanced mail service. As shown in the figure, the UI can display the decrypted content to the user through any appropriate web-based protocol.

[0015] Figure 3 An example data flow scenario of a system is shown in which an enhanced email service provides decrypted access to encrypted content to an intended recipient via an enhanced mail module (e.g., a mail module including enhanced communications compatibility with the enhanced mail service). As shown, the enhanced mail module can provide a token to the enhanced mail service in exchange for an encryption key that can be used to decrypt the encrypted content.

[0016] Figure 4 The enhanced mail module is based on obtaining an encryption key to generate a decrypted version of an email message containing encrypted content, which can be used with Figure 1 The data flow scenario of the embodiment of the present invention relates to various aspects of the UI displayed on the user device in association with the data flow scenario of the embodiment of the present invention. As shown in the figure, the UI can display the decrypted version of the email message through the universal reading pane view of the enhanced mail module.

[0017] Figure 5A An exemplary data flow scenario is shown for a system that includes an enhanced email service to provide an intended recipient with a password that can be used to gain decrypted access to encrypted content of an email message via a universal mail module.

[0018] Figure 5B An exemplary data flow scenario is shown for a system that includes an enhanced email service to provide an intended recipient with a password that can be used to gain decrypted access to encrypted content of an email message via an enhanced mail module.

[0019] Figure 6 Shows that it can be Figure 5A The data flow scene of the embodiment of the present invention is associated with the data flow scene of the present invention, and is displayed on the user's device, enabling the user to enable the enhanced mail service to send the password to the mailbox of the intended recipient. As shown in the figure, the UI can provide the user with the option of logging in to her email service provider (if listed) or requesting a password.

[0020] Fig. 7A An exemplary data flow scenario is shown for a system including a local mail service in communication with an enhanced email service to provide an intended recipient with decrypted access to encrypted content stored in an organization mailbox of the enhanced email service.

[0021] Figure 7B An exemplary data flow scenario is shown for a system including a local mail service in communication with an enhanced email service to provide decrypted access to encrypted content to an intended recipient through a universal mail module without storing the encrypted content on the enhanced mail service.

[0022] Figure 7C Shows something like Figure 7B An exemplary data flow scenario of , except that the enhanced email service provides decrypted access to the encrypted content through the enhanced mail module without storing the encrypted content on the enhanced mail service.

[0023] Figure 8 An exemplary data flow scenario is shown in which an enhanced mail service provides a decrypted version of a message to a recipient mailbox based on the recipient mailbox associated with a predetermined domain.

[0024] Fig. 9 is a flow chart of an illustrative process for selecting between various decryption methods based on whether the universal mail module or the enhanced mail module requests decrypted access.

[0025] Fig.10 Additional details of an exemplary computer architecture for a computer capable of executing the enhanced mail service, and / or enhanced mail module, and / or any program components thereof as described herein are shown. DETAILED DESCRIPTION

[0026] The following detailed description describes techniques for providing an enhanced email service that mitigates the disadvantages associated with traditional email services by, for example, enabling encrypted content to be transmitted to an intended recipient regardless of whether the intended recipient has a prior relationship with the sender or has obtained a certificate from a certificate authority (CA). In general, the configurations disclosed herein reduce the barriers to successfully and reliably sending encrypted message content to any recipient email address.

[0027] According to aspects of the present disclosure, a method is provided for receiving encrypted content and generating a message based thereon, the message specifying a recipient email address and including the encrypted content as an attachment and a link for enabling decrypted access to the decrypted content. The method may also include sending the message to an intended recipient's mailbox while also storing the message in an organization mailbox (and in some instances, in a sender mailbox) to provide for subsequent decryption of the encrypted content. Depending on, for example, whether the recipient is viewing the message through a general mail module (e.g., a webmail browser providing access to a webmail service) or through an enhanced mail module including enhanced compatibility with respect to an enhanced email service (as will be discussed in conjunction with FIG. 5 ), the link may be configured to provide decrypted access to the encrypted content to the intended recipient of the message in various ways.

[0028] For the sake of illustration, refer to Figure 1 Consider a first scenario in which a recipient of a message containing encrypted content is viewing the message through a general mail module (e.g., a webmail service). In this case, a web browser running on the recipient's device may have the webmail service open in a first domain, with a link from the first domain displayed in the email message. The link may provide access to a web page in a second domain that exposes an authentication module application program interface (API) of the intended recipient's webmail service. The first domain may communicate with the recipient's webmail service (e.g., Gmail) to authenticate the recipient. TM Webmail service, The first domain may be associated with an enhanced email service (e.g., Office 365), while the second domain may be associated with an enhanced email service (e.g., Office 365). When the recipient provides credentials to the authentication module API and receives a token from it, the token can be provided to the enhanced email service in the second domain to enable the enhanced email service to locally decrypt the encrypted content on the server side and display it to the recipient in the form of a web page. Figure 1 The discussion of FIG. 2 is based on the consideration of the first scenario. It should be understood that any reference to the terms "first", "second", etc. in the specification is not intended to and should not be interpreted as necessarily corresponding to any reference to the "first", "second", etc. elements of the claims. For example, in the specification, according to the context, such as Figure 1 An item such as domain A of may be referred to as a "first domain" and at the same time referred to as a "second domain" in the claims.

[0029] Now turn to Figure 1 , which will provide details about an illustrative operating environment and some of the software components disclosed herein. Figure 1 is shown for use via a web browser such as Chrome TM Online webmail services (Gmail) accessed through a browser TM A system diagram of various aspects of an exemplary system for providing decrypted access to message content for a universal mail module such as a webmail service. Figure 1 The system 100 shown in FIG. 1 includes an enhanced mail service 102 capable of receiving, generating, sending, routing and / or storing email messages. The enhanced mail service 102 may be one or more computing devices, such as Fig.10 An exemplary computing device architecture is shown in and described in more detail below.

[0030] Figure 1 Enhanced mail service 102 is shown receiving content 134 from sender device 104 and ultimately sending the content 134 to mail service 106, which is addressable by recipient device 108 to access content 134. In this regard, it should be understood that enhanced mail service 102 and / or mail service 106 may each refer to any number of computing devices working individually or in concert that are capable of sending and / or receiving email.

[0031] The enhanced mail service 102 may include functional components, including, but not limited to, a sender mailbox 110 associated with a sender of the content, and an organization mailbox 112 configured with novel functionality as described herein for providing an intended recipient of encrypted content with the ability to obtain decrypted access to the content. It should be understood that the sender mailbox 110 may specifically correspond to the sender and may be accessed based on credentials uniquely corresponding to the sender. For example, the sender mailbox may include data associated with the sender's email account, including, but not limited to, inbox data associated with messages received by the sender's email account, and outbox data associated with messages sent from the sender's email account. In addition, the sender mailbox may be accessed by the sender providing credentials associated with the sender mailbox and / or authenticating a token associated with the sender mailbox.

[0032] As will be described in more detail below, in various embodiments, the organization mailbox 112 can be used to store messages containing encrypted content and / or links that provide decrypted access to the encrypted content 140. In addition, in some embodiments, the organization mailbox 112 can be accessed by using a token provided by the mail service 106 to the recipient device 108 and then ultimately provided by the recipient device 108 to the enhanced mail service 102. In various embodiments, the organization mailbox 112 cannot be accessed by using sender credentials associated with the sender email account and / or the sender mailbox 110. For example, although the sender can take actions that cause the message to be stored in the organization mailbox 112, the stored message can reside in the organization mailbox 112 for subsequent access to the decrypted version of the encrypted content provided to the recipient, rather than for subsequent access by the sender. In some embodiments, the organization mailbox 112 can store multiple messages from multiple different senders. For example, the organization mailbox can contain a first message corresponding to a first sender and intended to provide the first recipient with decrypted access to the encrypted content, while containing a second message corresponding to a second sender and intended to provide the second recipient with decrypted access to different encrypted content. In some embodiments, the organization mailbox 112 may correspond to a particular organization (eg, an engineering firm), and the organization mailbox 112 may contain a plurality of messages sent from various members and / or employees of the particular organization.

[0033] Enhanced mail service 102 may also include an encryption module 114 for encrypting content 134 into encrypted content 140 according to an encryption key, a decryption module 116 for decrypting content according to the encryption key, and a key storage 118 for managing access rights to encryption keys. Encryption module 114 may include any encryption functionality and / or software suitable for encrypting digital content according to an encryption key currently known or subsequently developed. Similarly, decryption module 116 may include any decryption functionality and / or software suitable for decrypting encrypted digital content according to an encryption key (whether currently known or subsequently developed).

[0034] Key storage 118 may include any functions and / or software suitable for managing access rights regarding encryption keys. In some embodiments, one or more functions of encryption module 114, decryption module 116 and / or key storage 118 may be performed by a rights management service platform (e.g., Microsoft's Azure RMS). Finally, in some configurations, enhanced mail service 102 includes at least one application program interface ("API") 120, which discloses an interface through which the devices and services described herein transmit data. By using this data interface and other interfaces, the devices and services described herein can communicate and process data in a manner that implements the functions disclosed herein. For example, as described in detail below, API 120 can enable enhanced email service 102 to receive an HTTPS request 152 containing a token 146 from a recipient device 108, and provide decrypted content 156 via a web page.

[0035] The mail service 106 may include some functional components, including but not limited to an authentication module 122 and a recipient mailbox 124. It should be understood that the recipient mailbox 124 may specifically correspond to the recipient and may be accessed based on credentials uniquely corresponding to the recipient. For example, the recipient mailbox 124 may include data associated with the recipient's recipient email account, including but not limited to inbox data associated with messages received by the recipient email account, and outbox data associated with messages sent from the recipient email account. In addition, the recipient may access the recipient mailbox 124 when providing credentials associated with the recipient to the authentication module 122. For example, in some embodiments, the recipient credentials may include each of a user name and a password provided by the user to the authentication module 122 to exchange a verification token. In some embodiments, the authentication module 122 may be configured to authenticate the recipient based on single-factor authentication (SFA). For example, when providing single-factor authentication evidence (e.g., a single password), the recipient may be granted access to the recipient mailbox corresponding to a specific email address. In some embodiments, the authentication module may be configured to authenticate the recipient based on multi-factor authentication (MFA). For example, a recipient may be granted access to a recipient mailbox corresponding to a particular email address only upon providing multiple factors of authentication evidence (e.g., a password in addition to some other authentication evidence). In some embodiments, authentication module 122 may also be configured to provide cross-domain authentication. For example, as will be described in more detail below, authentication module 122 may enable a recipient to authenticate himself with respect to a domain associated with enhanced mail service 102 using an authentication module operating within a domain associated with mail service 106. For example, authentication module 122 may be configured to deploy one or more open standards (e.g., OAuth 1.0 and / or OAuth 2.0) for user authentication. It should be understood that OAuth is a commonly used mechanism that allows a user to share account information with a third-party website and / or to log in to a third-party website using authentication data associated with an account other than that hosted by the third-party website. In other words, OAuth may provide cross-domain user authentication.

[0036] The sender device 104 may include several functional components, including, but not limited to, a mail module 126, a browser module 128, and / or an encryption module 114 (which is similar to the encryption module described with respect to the enhanced mail service 102). The mail module 126 may include any suitable module for generating, receiving, sending, and / or viewing emails. In some embodiments, the mail module 126 may include a web-based email service accessed through a standard web-based browser. For example, the mail module 126 may include a web-based email service that provides access to the mail service. Webmail account access Google TM ChromeTM Web browser. Therefore, it should be understood that the mail module 126 need not be a dedicated mail client installed locally at the sender device 104. In some embodiments, the mail module 126 may include a web-based email service accessed through a mail client operating locally on the sender device 104. For example, the mail module 126 may include a web-based email service that provides access to Gmail. TM Webmail account access The browser module 128 may include any program suitable for acquiring and presenting information resources obtained from the World Wide Web and / or uploading information to resources accessible via the World Wide Web. In various embodiments, the browser module 128 may also be used to access information provided by web servers and private networks or files and file systems.

[0037] The recipient device 108 may include a number of functional components, including, but not limited to, a universal mail module 130 and / or a browser module 128 (which is similar to the browser module 128 described with respect to the sender device 104). In some embodiments, the universal mail module 130 may include any functional components suitable for communicating with the authentication module 122 of the mail service 106 to authenticate the recipient device with respect to the mail service 106 and ultimately provide access to the recipient mailbox 124 (e.g., enabling the recipient to use a corresponding email address). In some embodiments, the universal mail module 130 may include a web-based email service accessed via a standard web-based browser. For example, the universal mail module may include any functional components that provide access to the recipient mailbox 124. Webmail account access Google TM Chrome TM Web browser. As used herein, a generic mail module is any email module that is configured to access one or more email accounts but lacks certain enhanced communication compatibility with an enhanced mail service (as described below with respect to an enhanced mail module). In other words, a generic mail module is any email module that is not an enhanced mail module as described herein.

[0038] about Figure 1 In the exemplary data flow scenario of FIG. 1 , a sender 132 is shown sending content 134 from a sender device 104 to an enhanced mail service 102 to provide access to the content 134 to a recipient 136 at a recipient device 108. However, for security reasons, it is desirable to send the content 134 to the recipient device 108 in an encrypted format. Therefore, the content 134 may be sent to the mail service 106 within a message 138, wherein the message 138 includes the encrypted content 140 and a link 142 that provides decrypted access to the encrypted content 140.

[0039] It should be understood that the content 134 may be sent to the enhanced email service 120 in a variety of formats. For example, the content 134 may be sent to the enhanced mail service 102 in an unencrypted format or in an encrypted format. In some embodiments, the enhanced mail service 102 receives the content 134 in an unencrypted format and, upon receipt, deploys the encryption module 114 to convert the content 134 into encrypted content 140 according to an encryption key. The enhanced mail module 102 may then store the encryption key in the key storage 118 in association with the recipient email address of the intended recipient 136. For example, the sender 132 may use the mail module 126 on the sender device 104 to generate an initial message 144 (which includes the content 134 in an unencrypted format) and then send the initial message 144 to the enhanced mail service 102. Alternatively, the sender may access a web portal or web page associated with the enhanced mail service 102, such as through the browser module 128, and may upload the content 134 to the enhanced mail service through the web portal page. In some embodiments, enhanced mail service 102 may receive content 134 in an encrypted format from sender device 104. For example, sender 132 may deploy encryption module 114 on sender device 104 to encrypt content 134 to generate encrypted content 140 before sending the content to enhanced mail service 102.

[0040] Upon receiving the encrypted content 140, the enhanced mail service 102 may generate a message 138 that includes the encrypted content 140 and a link 142 for enabling decrypted access to the encrypted content 140. In some embodiments, the encrypted content 140 is included as an attachment within the message 138, and the link 142 may be included within the body of the message 138. The message 138 may then be sent to the recipient mailbox 124 at the mail service 106. For example, the message 138 may specify a recipient email address that corresponds to the recipient mailbox 124, and the enhanced mail service 102 may then send the message 138 to the recipient mailbox 124 via one or more known email transfer protocols. It will then be appreciated that the recipient 136 may access the message 138 using the recipient device 108 when the recipient device 108 is authenticated with respect to the mail service 106 using the authentication module 122. For example, the recipient 136 may provide user credentials to the authentication module 122 through the universal mail module 130 , and then the universal mail module 130 may trigger the mail service 106 to provide the token 146 to the universal mail module 130 .

[0041] After authenticating the recipient device 108, the mail service 106 may then send the message 138 to the universal mail module 130 at the recipient device 108. For example, the message 138 may be sent to an inbox at the universal mail module 130, and the recipient 136 may view the message 138 without encrypting the message 138 and / or its contents. For example, it should be understood that although the encrypted content 140 now resides on the recipient device 108, the recipient 136 still cannot access the encrypted content 140 because it is encrypted.

[0042] In addition to sending the message 138 to the mail service 106, the enhanced mail service 102 may store the message 138 in the organization mailbox 112 to provide the intended recipient 136 with subsequent decrypted access to the encrypted content 140 through activation of the link 142. For example, the link 142 may be displayed within the body of the message 138 to enable the recipient 136 to provide the token 146 to the enhanced mail service 102 by exposing the authentication module 122 of the mail service 106 to the enhanced mail service 102. In some embodiments, the mail service 106 may correspond to domain A 148, and the enhanced mail service 102 may correspond to domain B 150. The link 142 may enable the recipient 136 to reacquire the token 146 from the mail service again, but within domain B 150 corresponding to the enhanced mail service 102. For example, the link 142 may be configured to expose one or more APIs of the authentication module 122 within domain B 150, thereby enabling the recipient device 108 to cache the token 146 with respect to the enhanced mail service 102. It should be understood that acquiring the token 146 within the browser tab associated domain B 150 may be desirable in some cases because various versions of web browsers may cache tokens cautiously with respect to a single web domain. In other words, although the token 146 may have been received at the recipient device with respect to domain A 148, it may be desirable to reacquire the token 146 within the web page returned by the enhanced mail service 102, and wherein upon activating the link 142, the recipient device is driven to cause the recipient device and / or the browser operating thereon to cache the token 146 with respect to the enhanced mail service 102.

[0043] In some embodiments, the universal mail module 130 may generate a request 152 that includes a token 146 associated with a recipient mailbox 124 and / or a corresponding recipient email address, and send the request 152 to the enhanced mail service 102. In some implementations, the request 152 may be an HTTPS request sent via the browser module 128. Upon receiving the request 152, the enhanced mail service 102 may determine whether the token 146 received from the recipient device 108 is authentic for the recipient mailbox 124 and / or the corresponding email address. If it is determined that the token 146 is authentic for the recipient mailbox 124, the enhanced mail service 102 may generate a reply 154 to the request 152 that includes decrypted content 156 (i.e., a decrypted version 156 of the encrypted content 140). The enhanced mail service 102 may access the message 138 within the organization mailbox 112, and more specifically, may access the encrypted content 140 from within the message 138 to decrypt it using the decryption module 116. The enhanced mail service 102 may also access an encryption key corresponding to the encrypted content 140 from the key storage 118. For example, when generating the encrypted content 140 intended for the recipient 136, the enhanced mail service may store an encryption key that may be used to decrypt the encrypted content 140 within the key storage 118 in association with the recipient email address and / or the link 142. Thus, when the link 142 is activated at the recipient device 108 to generate a request 152 to send a token 146 to the enhanced mail service 102, the enhanced mail service may decrypt the encrypted content 140 and provide the decrypted content 156 to the recipient device 108. For example, the enhanced mail service 102 may provide access to a web page that displays the decrypted content 156.

[0044] It should be understood that Figure 1 In the exemplary data flow scenario of , the encrypted content 140 is decrypted on the server side (i.e., at the enhanced mail service 102) instead of being decrypted locally at the recipient device 108. Thus, in various implementations, the encrypted content 140 may be sent to and / or stored on a device that does not ultimately decrypt the encrypted content 140. In other words, in Figure 1 In the example data flow scenario of , the copies of the encrypted content 140 residing on the mail service 106 and the recipient device 108 are not ultimately used to provide decrypted access to the encrypted content 140. However, as will be described with reference to Figure 3 As described in greater detail, the encrypted content 140 may still be transmitted to the recipient device 108 within the message 138 to allow a user with an enhanced mail client (eg, Outlook) to easily decrypt and view the encrypted content.

[0045] Now go to Figure 2A, the figure shows that Figure 1 140 . These aspects may convey instructions to the recipient 136 on how to obtain decrypted access to the encrypted content 140. The UI 202 is displayed in the form of an email message viewed through a web browser that provides access to a web-based email service. The web browser shown has two open tabs, with the first tab being opened to display the email message and the second tab being able to display any other web page. In this hypothetical scenario, the email message is an electronic bank statement generated by Bank XYZ and has been sent to Kat@AcmeEmail.com to provide the recipient with access to the encrypted content 140 (e.g., an encrypted bank account statement). The email message explains to Kat the purpose of the communication, e.g., that her year-end account statement is ready and that, for security reasons, she needs to click on the link shown to log in again using her Acme email account credentials. It should be understood that the link shown, "Click here to read this message," corresponds to a request for information about the encrypted content 140. Figure 1 The link 142 in question. It should also be understood that the attachment to the email (e.g., represented by the paper clip symbol adjacent to the words "Bank Statement from Kat@AcmeEmail.com") corresponds to the email address associated with the bank statement. Figure 1 The encrypted content 140 in question.

[0046] Now go to Figure 2B , when clicking on link 142, recipient 136 may be taken to a web page displaying UI 204 supported and / or hosted by enhanced mail service 102 to expose authentication module 122 of mail service 106 to enhanced mail service 102. For example, in some implementations, clicking on Figure 2A The link 142 displayed within the email message (ie, UI 202) may deploy the OAuth protocol of the mail service 106 to enable the recipient 136 to be authenticated with respect to the enhanced mail service 102. Figure 2B, the web page enables the recipient 136 to enter credentials associated with the recipient's email address corresponding to the recipient mailbox 124. It should be understood that while the user credentials may include a username and password combination, any other type of credentials may be used. For example, in some embodiments, the recipient 136 may be required to enter a time-sensitive code that is sent to a mobile device or read from a security key card. In the scenario shown, the recipient 136 may enter a username and password combination associated with an Acme email account to authenticate the recipient device 108 with respect to the enhanced mail service 102. Then, once the recipient 136 has successfully logged in, the enhanced mail service will obtain the encrypted content 140 from the organization mailbox 112 in addition to the corresponding encryption key from the key store 118 in order to decrypt the encrypted content 140. Now turn to Figure 2C , the decrypted content 156 may then be provided to the recipient device 108 via the HTTPS reply 154 to generate the UI 206. For example, confidential account data associated with the recipient 136 (where the enhanced mail service 102 sends the data to the recipient device 108 in an encrypted format) is displayed to the recipient 136 via the web browser module 128. It should be understood that in implementations where the universal mail module 130 is a web browser for providing access to a web-based mail service, the universal mail module 130 may simply correspond to an "Acme mail tab" and the reply 154 may correspond to another tab that is opened when the recipient device 108 is authenticated.

[0047] about Figure 2B and 2CEach of the foregoing, it should be appreciated that in various implementations, the web page supported by the enhanced mail service 102 may be customized to have visual characteristics corresponding to the sender of the message 138. For example, as shown, the sender of the message 138 is a financial entity, Bank XYZ, which may wish to include a logo and / or business slogan as an additional visual cue to the recipient 136 regarding the source of the message 138. In addition, although supported and / or hosted by an enhanced mail service 102 managed by another business entity, the web page may be configured to display a web address associated with a domain name corresponding to the sender 132, rather than being displayed by a domain associated with the business entity hosting the enhanced mail service 102. For example, as shown, the web page address is displayed in the address bar as "https: / / e-statements.BankXYZ.com / securemessaging / authenticator-portal". In addition, the logo and text in the web page may also be configured so that the label name and other text are displayed as "E-Statements: Bank XYZ", and the business entity hosting the enhanced mail service 102 is not displayed. It should therefore be appreciated that the enhanced mail service 102 may enable the sender 132 to customize various aspects of the web page that is displayed when the recipient 136 activates the link 142 .

[0048] As a pair Figure 1In reviewing the data flow scenario, the enhanced mail service 102 can receive the encrypted content 140 encrypted according to the encryption key, and then can generate a message that includes the encrypted content 140 as an attachment and the link 142. The message 138 can then be stored in each of the sender mailbox 110 and the organization mailbox 112. Although the sender mailbox 110 can be accessed based on the sender credentials, in some embodiments, the sender 132 may not be able to access the organization mailbox 112. Instead, in some configurations, the organization mailbox 112 is configured to provide the recipient 136 with decryption access to the encrypted content by using a token or by using a password. For example, the organization mailbox 112 can be accessed by a recipient based on a token associated with the credentials (e.g., the recipient's email). The message 138 can also be sent to the recipient mailbox 124 and ultimately to the recipient device 108. The recipient 136 can then use it to click on the link 142 to send the HTTPS request 152 to the enhanced mail service 102. The token 146 provided with the HTTPS request 152 can be used as proof to the enhanced mail service 102 that the initiator of the request 152 is the intended recipient 136 of the message 138. The enhanced mail service can then decrypt the encrypted content 140 and send it to the recipient in a format that can be viewed via a web browser. In addition, in this particular data flow scenario, the encrypted content 140 residing on the user device 108 within the message 138 is not ultimately used to provide decrypted access to the content 134, but rather a copy of the content 140 stored in the organization mailbox 112 provides decrypted access.

[0049] However, in some implementations, a copy of the encrypted content 140 sent to the recipient device 108 is used to provide decrypted access to the encrypted content 140. For illustrative purposes, reference is made to Figure 3Consider a second scenario, where in the second scenario, the recipient of the message 138 containing the encrypted content 140 is viewing the message 138 through the enhanced mail module 302, which is configured with enhanced communication capabilities with respect to the enhanced mail service 102. For example, the enhanced mail module 302 can be an Outlook client program and the enhanced mail service 102 can be Office 365. In some configurations, the enhanced mail module 302 can be configured to store the recipient's credentials (e.g., a username and password combination) and automatically authenticate the recipient device 108 with respect to the mail service 106 as needed. In this case, the enhanced mail module 302 can be configured to automatically authenticate the recipient device 108 with the enhanced mail service 102 by sending a request including a token 146 to the enhanced mail service 102. The request can be for an encryption key corresponding to the encrypted content attached to a particular message. In some embodiments, the request including the token 146 can be a get key request, which causes the enhanced mail service 102 to reply by sending an encryption key 312 corresponding to the encrypted content to the enhanced mail module. At the recipient device 108 , the encryption key 312 is then deployed to the decryption module 306 to decrypt the encrypted content 140 to generate the decrypted content 156 , and the decrypted content 156 is automatically displayed to the recipient 136 on a display device.

[0050] Additionally, in some embodiments, the decrypted content is stored in a volatile cache to prevent sensitive material (e.g., decrypted content) from being permanently stored on the device. It should be understood that in such embodiments, the recipient is provided with decrypted access to the content using a copy of the encrypted content 140 resident on the recipient device 108. Consider Figure 3 to Figure 4 The following discussion is based on this first scenario.

[0051] Now go to Figure 3, which illustrates an exemplary data flow scenario of a system 300 in which an enhanced email service 102 provides decrypted access to encrypted content 140 to an intended recipient 136 via an enhanced mail module 302. In various embodiments, the enhanced mail module 302 may be configured to store recipient credentials 304, which the enhanced mail module 302 may use to send a token request to the mail service 106. For example, the enhanced mail module 302 may be a locally operated mail client configured to accept user credentials (e.g., an email address and password combination from the recipient 136). The enhanced mail module 302 may automatically perform any necessary authentication protocols with the mail service 106 and the enhanced mail module 302. The enhanced mail module 302 may also include a decryption module 306 configured to decrypt the encrypted content according to an encryption key. The enhanced mail module 302 may also include a volatile cache 308 for storing a version of the message 138 including the decrypted content 156.

[0052] It should be appreciated that many aspects of this example data flow scenario are similar to those described with respect to Figure 1 146 . However, there are some differences regarding the communication between the enhanced mail module 302 and the enhanced mail service 102. Specifically, as shown, the enhanced mail module 302 can send a get key request 310 containing the token 146 to obtain an encryption key 312 corresponding to the encrypted content 140. Upon receiving the encryption key 312, the enhanced mail module 302 can generate a presentation of the message 138 that automatically displays the decrypted content 156 to the recipient without manual user interaction. Therefore, it can be appreciated that, as opposed to the general mail module 130, by deploying the enhanced mail module 302, the recipient 136 can obtain a better (e.g., more seamless) user experience with respect to obtaining decrypted access to the content.

[0053] As shown, the sender 132 may send content 134 to the enhanced mail service 102, which may then generate encrypted content 140 by deploying the encryption module 114 to generate a message 138 including the encrypted content and a link 142. The enhanced mail service 102 may store a copy of the message 138 in each of the sender mailbox 110 and the organization mailbox 112. The message 138 is sent to the recipient mailbox 124, and the enhanced mail module 302 accesses the recipient mailbox 124 to receive a local copy of the message 138. In some embodiments, the enhanced mail module 302 may be configured to recognize one or more characteristics of the message 138 and respond to the characteristics by automatically obtaining a key 312. For example, the enhanced mail module 302 may recognize and / or activate the link 142 to generate a get key request 310 to send a token 146 to the enhanced mail service 102. Upon receiving the obtain key request 310 (which may uniquely identify the message 138 to enable the enhanced mail service 102 to authenticate the token 146 with respect to the message 138), the enhanced mail service 102 may access the key store 118 to obtain the encryption key 312 corresponding to the encrypted content 140. The enhanced mail service 102 may then send the encryption key 312 to the enhanced mail module 302 and / or its decryption module 306. Upon receiving the encryption key 312, the decryption module 312 may decrypt the copy of the encrypted content 140 that was sent to the recipient device 108 to locally generate a version of the message 138 that includes the decrypted content 156. In some embodiments, the decrypted content 156 may be temporarily stored in the volatile cache 308 so that the decrypted content 156 is not permanently retained on the recipient device 108.

[0054] In some embodiments, the enhanced mail module 302 may automatically generate a token request 314 based on the stored recipient credentials 304 in response to one or more actions, such as executing the enhanced mail module 302 on the recipient device 108. For example, the enhanced mail module 302 may be configured to automatically communicate with the authentication module 122 at the mail service 122 when the user executes the enhanced mail module 302 on the recipient device 108. It should be understood that some existing mail modules may include such functionality. For example, Desktop and other suitable native mobile device email clients. Since the token 146 can be automatically obtained and stored in the enhanced mail module 302, in various embodiments, the enhanced mail client 302 may not need to re-obtain the token 146 from the authentication module in order to generate the obtain key request 310.

[0055] In some embodiments, the enhanced mail module 302 can be configured to prevent messages stored in the volatile cache 308 from having various actions performed on them. For example, the enhanced mail module 302 can deny a request to forward and / or store and / or print a version of the message 138 that includes the decrypted content 156. Furthermore, in some configurations, the system can be configured so that even if the recipient 136 forwards the message 138 to a subsequent recipient, the subsequent recipient of the message will be denied access to view the decrypted content 156.

[0056] It should be understood that Figure 3 In the exemplary data flow scenario of , the encrypted content is decrypted on the device side (i.e., at the recipient device 108) rather than remotely decrypted at the enhanced mail service 102. Thus, the same message 138 that causes the enhanced mail service 102 to send the decrypted content 156 to the recipient device 108 when viewed through the universal mail module 130 may cause the enhanced mail service 102 to send the encryption key 312 to the enhanced mail module 302 to perform local decryption.

[0057] Now go to Figure 4 , the figure shows that Figure 3 4. The data flow scenario of the enhanced mail module 302 is associated with various aspects of the UI 400 displayed on the recipient device 108. These views are based on the enhanced mail module 302 obtaining the encryption key 312 to generate the decrypted content 156 that can be displayed within the message. As shown, the UI 400 can display the decrypted content 156 in the message 138 through the universal reading pane view of the enhanced mail module 302. In some embodiments, the message 138 displaying the decrypted content 156 can be automatically generated and displayed by the enhanced mail module 302 when the recipient 136 selects the message 138 from the message list associated with the inbox of the recipient mailbox 124. For example, the recipient 136 can double-click the message within the inbox view of the enhanced mail module 302 using the cursor 402. In some embodiments, when the user selects a different message from the inbox, the message 138 containing the decrypted content 156 can be automatically deleted from the volatile cache 308.

[0058] Now go to FIG. 5A to FIG. 5B. In some scenarios, the mail service associated with the recipient mailbox 124 may lack certain authentication capabilities. For example, the mail service may lack the ability to generate a token to enable the enhanced mail service 102 to authenticate the recipient device 108 with respect to the recipient mailbox 124. In such examples, various mail service providers may lack an authentication module 122 that generates an authentication token, wherein the authentication token enables the recipient to authenticate herself with the enhanced mail service, such as proving to the enhanced mail service that she is the intended recipient. Therefore, in some data flow scenarios, a password may be used instead of a token.

[0059] about Figure 5A In some embodiments, the recipient mailbox 124 may be hosted by a mail service 502 that does not generate an authentication token as described above. It should be understood that Figure 5A Similar to Figure 1 , except that password 504 is used. The password can be generated at enhanced mail service 102 and transmitted to mail service 502 in password message 508. In addition, password 504 can be sent to enhanced mail service 102 in request 152. The function of password 504 is similar to the function of token 146.

[0060] In an illustrative example, Figure 5A As shown in the data flow scenario of FIG. 1 , a recipient mailbox 124 is accessed from a mail service 502 using the universal mail module 130 to receive a message 138. The universal mail module 130 and / or the browser module 128 may be used to send a password 504 to the enhanced mail service 102. In some embodiments, the link 142 may also be configured to enable the recipient 136 to cause the recipient device 108 to generate a password request 506. The password request 506 is then sent to the enhanced mail service 102 to cause the enhanced mail service to generate a password message 508 for transmission to the recipient mailbox 124. For example, the password request 506 may cause the key store 118 to generate a single-use and / or time-limited password that the recipient 136 may redeem to obtain decrypted access to the encrypted content 140. The universal mail module 130 may obtain the password message 508 from the mail service 502 and display the password message 508 consistent with the message 138 within the user's inbox view of the universal mail module 130. Password message 508 may communicate password 504 to recipient 136 and / or universal mail module 130 to enable generation of request 152. For example, recipient 136 may be prompted to enter password 504 into a field in a graphical UI to generate request 152. Alternatively, password message 508 may include a link to automatically generate an HTTPS request 152 including password 504. Once password 504 is received within request 152, enhanced mail service 102 may generate a request 152 as described above. Figure 1A reply 154 including decrypted content 156 is sent in a similar manner as described.

[0061] Now go to Figure 5B It should be understood that Figure 5B Similar to Figure 3 , except that the password 504 is sent to the enhanced mail service 102 within the get key request 310 instead of the token 146. Figure 5B Similar to Figure 5A , except that the recipient device 108 is executing an enhanced mail module 302 (e.g., Outlook) that is compatible with the enhanced mail service 102 (e.g., Office 365). Figure 5B In the data flow scenario of FIG. 1 , the enhanced mail module 302 is used to access the recipient mailbox 124 from the mail service 502 to receive the message 138, and then the password 504 can be sent to the enhanced mail service using the enhanced mail module 302 and / or the browser module 128. In some embodiments, the enhanced mail module 302 can be configured to automatically generate a password request 506 based on the message 138 and / or the link 142. For example, upon receiving the message 138, the enhanced mail module 302 can identify and / or activate the link 142 to generate and send the password request 506. In some embodiments, the enhanced mail module 302 can be configured to automatically generate a get key request 310 including the password 504 based on the password message 508. For example, the enhanced mail module 302 can be configured to extract the password 504 from the password message 508 to generate the get key request 310. Furthermore, upon receiving the key 312 in response to the get key request 310 , the enhanced mail module 302 can be configured to automatically generate a message 138 containing the decrypted content 156 and store it in the volatile cache 308 .

[0062] In various embodiments, one or more of the aforementioned functions described with respect to the password message 508 and the enhanced mail module 302 may be triggered when the user selects the message 138. For example, when the recipient 136 selects the message 138, the enhanced mail module 302 may automatically generate and send the password request 506 and wait for the password message 508. Then, upon receiving the password message 508, the enhanced mail module may extract the password 504 to generate the get key request 310 to ultimately receive the encryption key 312 and generate the message 138 containing the decrypted content 156.

[0063] Now go to Figure 6 , the figure shows that Figure 5A4 and 5. In some embodiments, the enhanced mail service 102 may be configured to identify the domain associated with the recipient's email address to determine whether to generate UI 600 instead of UI 204. For example, if the recipient's email address corresponds to a domain known to be hosted by the mail service 106 (where the mail service 106 is known to have the ability to generate tokens 146), the enhanced mail service 102 may choose to display UI 204. As a specific example, the enhanced mail service 102 may be configured to display a UI 600 for email addresses associated with certain domains (e.g., Gmail). TM Webmail service and / or In some embodiments, the UI 600 may be displayed when the link 142 is activated. For example, the UI 600 may be displayed when the recipient 136 receives a webmail service (e.g., a webmail service) from a known domain that is known to not have certain authentication capabilities (e.g., known not to deploy OAuth). In addition, if the recipient email address corresponds to a domain that is known not to have certain authentication capabilities (e.g., known not to deploy OAuth), the activation of the link 142 automatically generates a password request 506, or may only provide the recipient with an option (e.g., requesting a password). Alternatively, if the enhanced mail service 102 cannot tell whether the corresponding mail service supports the OAuth protocol based on the recipient email address, the UI 600 may be displayed when the link 142 is activated. For example, many email addresses correspond to the domains of commercial websites, and it cannot be easily determined from the commercial website which email service provider hosts the recipient mailbox 124. As shown, in this scenario, the UI 600 may provide the recipient 136 with various options on how to obtain decrypted access to the encrypted content 140. The first such option may be to log in to the service provider that hosts the recipient mailbox 124. For example, while enhanced mail service 102 may not be able to determine whether the email address of "Kat@domainABC.com" is hosted by the Acme email service that supports a certain security protocol (e.g., OAuth), the option of "Login with Acme" may be provided to recipient 136. Upon clicking "Login with Acme," enhanced mail service 102 may deploy UI 204. A second such option may be to generate a past request 506 for selecting a link titled "Send Me a Password."

[0064] Now go to Fig. 7A, which illustrates an exemplary data flow scenario of a system 700 that includes a local mail service 702 in communication with an enhanced email service 102 to provide a recipient 136 with decrypted access to encrypted content 140 stored in an organization mailbox 112 of the enhanced email service 102. In some embodiments, a sender may send content 134 to the local mail service 702. The local mail service 702 may deploy an encryption module 114 to encrypt the content 134 to generate the encrypted content 140. The local mail service 702 may generate a message 704 including the encrypted content 140, and may send the message 704 to the enhanced mail service 102. The enhanced mail service 102 may then create a message 138 including the encrypted content 140 and a link 142 based on the message 704. It should be understood that the system 700 is similar to the systems 100, 300, and 500, except that the sender mailbox 110 is not stored on the enhanced mail service 102 in the system 700. Therefore, any data flows between one or more of the enhanced mail service 102, mail service 106, mail service 502, and / or recipient device 108 described herein with respect to one or more of the systems 100, 300, and / or 500 may be equally applied to the system 700. Specifically, the recipient device 108 of FIG. 7 may deploy the universal mail module 130 or the enhanced mail module 302 to communicate with the enhanced mail service 102 and ultimately obtain decrypted access to the encrypted content 140.

[0065] In some embodiments, the recipient device 108 may send decryption parameters 706 associated with the ability of the recipient device 108 to locally decrypt content to the enhanced mail service 102. For example, the decryption parameters 706 may indicate whether the recipient device 108 includes a decryption module 116. Based on the decryption parameters 706, the enhanced mail service 102 may then determine whether to send an encryption key to the recipient device or to decrypt the encrypted content on the server side and send the decrypted content to the recipient device 108. In some embodiments where the universal mail module 130 and / or the recipient device 108 include decryption capabilities, the decryption parameters 706 may cause the enhanced mail service 102 to send the key 712 instead of decrypting the content 156.

[0066] In some embodiments, enhanced mail service 102 may be configured to erase message 138 from organization mailbox 112 after providing decrypted access to message 138 to the recipient device. For example, enhanced mail service 102 may provide message 138 only once and / or only a predetermined number of times and / or only during a predetermined time window.

[0067] Now go to Figure 7B, which illustrates an exemplary data flow scenario for a system 720 that includes a local mail service 702 in communication with an enhanced email service 102 to provide decrypted access to encrypted content 140 to an intended recipient 136 via a universal mail module 130 without storing the encrypted content 140 on the enhanced mail service 102. In the system 720, the enhanced mail service 102 may be configured with a data pipeline 722 to route a message 704 to a recipient mailbox 124 through the enhanced mail service 102 without storing the message 704 at the enhanced mail service 102. For example, the enhanced mail service 102 may be configured to delete the message 138 after sending the message 138 to the recipient mailbox 124, such that upon receiving a request for decryption access and / or token 146 from a recipient device 108, the enhanced mail service 102 does not store a copy of the message 138. The recipient device 108 may then deploy the universal mail module 130 to receive a copy of the message 704.

[0068] In such an embodiment, to gain access to the decrypted content 156, the universal mail module 130 may generate an HTTPS request 724 similar to the HTTPS request 152, which includes the encrypted content 140 in addition to the token 146 and / or the password 504. In embodiments where the encrypted content is not stored locally in the enhanced mail service 102 (e.g., in implementations lacking the organization mailbox 112), it may be desirable to send the encrypted content 140 back to the enhanced mail service 102. Upon authentication of the recipient device 108 with respect to the recipient mailbox 124, the enhanced mail service 102 may decrypt the encrypted content 140 to generate the decrypted content 156 that is sent to the recipient device 108 in the HTTPS reply 154. The decrypted content 156 may be displayed on a web browser.

[0069] Now go to Figure 7C , which shows an exemplary data flow scenario of a system 740, which is similar to Figure 7B , except that the enhanced email service 102 provides the recipient 136 with decrypted access to the encrypted content 140 via the enhanced mail module 302 (e.g., Outlook) without storing the encrypted content 140 at the enhanced mail service 102. As shown, in some embodiments, the enhanced email service 102 does not include an organization mailbox. Figure 7C As shown in FIG. 1 , the enhanced mail module 302 can be used with Figure 3The obtain key request 310 including the token 146 is generated in a similar manner as described above. It should be understood that the systems 720 and 740 are similar to the systems 100, 300, and 500, except that the organization mailbox 112 is not used to store the message 138 and / or content 140 on the enhanced mail service 102 in the systems 720 and 740. Therefore, any data flow between one or more of the enhanced mail service 102, mail service 106, mail service 502, and / or recipient devices 108 described herein with respect to one or more of the systems 100, 300, and / or 500 can be equally applied to the systems 720 and / or 740. The main difference between these systems is that when the encrypted content 140 is not stored on the enhanced mail service 102, the enhanced mail service 102 will be used to decrypt the encrypted content 140 only when the encrypted content 140 is sent back to the enhanced mail service 102 along with the token from the recipient device 108.

[0070] Now go to Figure 8 , which illustrates an exemplary data flow scenario of a system 800 in which an enhanced mail service 102 provides a version of a message 138 containing decrypted content 156 to a recipient mailbox 124 based on the recipient mailbox 124 being associated with a predetermined domain 802 (where the predetermined domain 802 corresponds to predetermined domain data 804 stored at the enhanced mail service 102). In some embodiments, the predetermined domain data 804 may list a plurality of domains associated with the enhanced mail service 102. For example, the predetermined domain 802 may include a mail service 806 associated with or supported by the enhanced mail service 102. In some embodiments, the mail service 806 may be configured to follow various rules regarding a message 138 containing and configured to display the decrypted content 156. Exemplary such rules include, but are not limited to, permissions associated with forwarding a version of the message 138 containing the decrypted content 156. Thus, when the recipient 136 attempts to send a forwarded message 808 (which may be a forwarded copy of a version of the message 138 containing the decrypted content 156), the mail service 806 may refrain from forwarding the message as requested by the recipient 136. In some embodiments, the enhanced mail service 102 may be configured to receive transmission restriction data associated with specific content and / or specific organizations, and to allow and / or deny requests for actions associated with the version of the message 138 containing the decrypted content based on the transmission restriction data. For example, the transmission restriction data may allow and / or restrict the recipient 136 from forwarding and / or saving and / or printing the version of the message 138 containing the decrypted content 156.

[0071] In some embodiments, the mail service 806 may be hosted in whole or in part by the enhanced mail service 102. For example, the enhanced mail service 102 may be deployed to a host mailbox associated with a business-owned domain, such that the mail service 806 is a sub-portion of the enhanced mail service 102 configured to provide an email address of the type "username@yourbusinessdomainhere.com". As a specific example, the enhanced mail service 102 may correspond to an email service that provides Microsoft Office 365, and the mail service 806 may be associated with and / or hosted by Microsoft Office 365 to host a recipient mailbox associated with a hypothetical email address "Kat@EngineeringFirm.com", where EngineeringFirm.com is a domain owned by Kat's employer. In some embodiments, the enhanced mail service 102 may be configured to determine whether it hosts a recipient mailbox 124 or is otherwise associated with a recipient mailbox 124. Then, based on determining that the enhanced mail service 102 is hosted or otherwise associated with the recipient mailbox 124, the enhanced mail service 102 may elect to send an unencrypted version of the content 134 to the recipient mailbox 124. For example, the enhanced mail service 102 may elect to send a message 138 that directly displays the decrypted content 156 to the recipient mailbox 134. In contrast, determining that the enhanced mail service 102 does not host the recipient mailbox 124 may cause the enhanced mail service to prohibit sending unencrypted content to the recipient mailbox 124, and instead provide decrypted access, such as with respect to, for example, Figure 1 & Figure 3 As described.

[0072] Fig. 9 is a flow chart of an illustrative process 900 for selecting between various decryption methods based on whether the universal mail module or the enhanced mail module requests decryption access. Figures 1 to 8 900 is described. Process 900 is illustrated as a collection of blocks in a logical flow diagram, wherein the logical flow diagram represents a sequence of operations that can be implemented in hardware, software, or a combination thereof. In the context of software, these blocks represent computer-executable instructions that, when executed by one or more processors, perform the described operations. In general, computer-executable instructions include routines, programs, objects, components, data structures, etc. for performing or implementing specific functions. The order in which the operations are described should not be construed as limiting, and any number of the described blocks may be combined in any order and / or in parallel to implement the process.

[0073] At box 901, the system can receive encrypted content configured according to an encryption key. In some implementations, the encrypted content can be received from a sender device that has been encrypted. For example, the sender device may include an encryption module, and the sender may cause the encryption module to encrypt the content according to the encryption key to generate the encrypted content. The sender device can then send the encrypted content together with the encryption key to an enhanced mail service. In some implementations, the encryption module at the enhanced mail service can encrypt the encrypted content. For example, the sender device can send the content to the enhanced mail service in an unencrypted format. The enhanced mail service can then deploy an encryption module to encrypt the received content according to the encryption key. In some implementations, the enhanced mail service can store the encryption key in a key storage.

[0074] At block 903, the system may generate a message including the encrypted content and a link for enabling decrypted access to the encrypted content. In some implementations, the message may be an email message that includes the encrypted content as an email attachment and also includes a link within the message body of the email message. For example, the encrypted content may appear in the form of an encrypted file attached to the email message. The message may also specify a recipient email address so that the message can be transferred to the recipient mailbox via one or more standard email transfer protocols.

[0075] At block 905, the system may send the message to the intended recipient's mailbox. In some implementations, the recipient mailbox may be operated by a recipient mail service that provides access to the recipient mailbox when the intended recipient provides recipient credentials associated with the recipient's email address. For example, the intended recipient may provide her recipient credentials to the recipient mail service through a web browser portal, and in return, the recipient mail service may return an HTTPS web page to provide access to the recipient mailbox.

[0076] At block 907, the system may receive a request including a token and / or password associated with a recipient's mailbox. Figure 1 As discussed, the recipient device may send an HTTPS request containing the token from the general mail module to the enhanced mail service. Figure 5A As discussed, the recipient device may send an HTTPS request to the enhanced mail service, the HTTPS request including the password received via a password message sent in response to the password request. Figure 3 and 5B As discussed, the recipient device may send a get key request from the enhanced mail module including the token and / or the password received via the password message.

[0077] After receiving a request including a token and / or password, and ultimately verifying the token and / or password with respect to the recipient's mailbox, the system may then proceed to determination blocks 909 and / or 917 .

[0078] At block 909, the system may determine whether a token and / or password has been received from the universal mail module.

[0079] If the system determines that a token and / or password has been received from the universal mail module, process 900 can move from block 909 to block 911, where the system can obtain access to a key store to obtain an encryption key corresponding to the encrypted content. Then, at block 913, the system can deploy a decryption module and encryption key to decrypt the encrypted content into corresponding decrypted content. Finally, the system can generate a reply message for transmission to the universal mail module, wherein the reply message includes the decrypted content.

[0080] At block 915, the system may send a reply message including the decrypted content to the recipient device. In some implementations, the reply message may be sent to the recipient device via an HTTPS reply including the decrypted content. The HTTPS reply may have an encrypted format that is configured to be displayed through a secure web browser module.

[0081] If the system determines that the token and / or password has not been received from the universal mail module, the process 900 can move from block 909 to block 917, where the system can determine whether the token and / or password has been received from the enhanced mail module. If the token and / or password has been received from the enhanced mail module, the process 900 can move from block 917 to block 911(D), where block 911(D) is a copy of block 911. Specifically, at block 911(D), the system can obtain access to the key storage to obtain the encryption key corresponding to the encrypted content. Finally, the system can generate a reply message including the encryption key for transmission to the enhanced mail module.

[0082] Then, at block 919, the system may send a reply message including the encryption key to the recipient device to enable the enhanced mail module to locally decrypt the encrypted content.

[0083] As indicated in box 921, if the system receives a token and / or password associated with a recipient mailbox but determines that a token and / or password has not been received from either the universal mail module and / or the enhanced mail module, process 900 can terminate without the system sending an encryption key or decrypting content.

[0084] Fig.10900 for a computer capable of executing the enhanced mail service 102, and / or the enhanced mail module 302, and / or any of its program components as described herein. Fig.10 The computer architecture 900 shown in the figure shows an architecture for a server computer, or a server computer network, a desktop computer, a laptop computer, a tablet computer, a smart phone, or any other type of computing device suitable for implementing the functions described herein. The computer architecture 900 can be used to perform any aspect of the software components presented herein.

[0085] Fig.10 The computer architecture 1000 shown in FIG. 1 includes a central processing unit 1002 ("CPU"), a system memory 1004 (which includes random access memory 1006 ("RAM") and read-only memory ("ROM") 1008), and a system bus 1010 that couples the memory 1004 to the CPU 1002. A basic input / output system, containing the basic routines that help to transfer information between elements within the computer architecture 1000 (e.g., during startup), is stored in the ROM 1008. The computer architecture 1000 also includes a mass storage device 1012 for storing an operating system 1014, other data, and one or more application programs. The mass storage device 1012 may also include one or more of the enhanced mail service 102 and / or the enhanced mail module 302.

[0086] The mass storage device 1012 is connected to the CPU 1002 through a mass storage controller (not shown) connected to the bus 1010. The mass storage device 1012 and its associated computer readable media provide non-volatile storage for the computer architecture 1000. Although the description of computer readable media contained herein refers to mass storage devices such as solid state drives, hard disks, or CD-ROM drives, it should be understood by those of ordinary skill in the art that computer readable media can be any available computer storage media or communication media that can be accessed by the computer architecture 1000.

[0087] Communication media includes computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and includes any transmission media. The term "modulated data signal" means a signal whose one or more characteristics are changed or set in a manner that encodes information in the signal. By way of example, but not limitation, communication media include wired media such as a wired network or a direct wired connection, and wireless media such as acoustic waves, RF, infrared, and other wireless media. Any combination of the above should also be included within the scope of computer readable media.

[0088] By way of example, and not limitation, computer storage media may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of such data as computer-readable instructions, data structures, program modules, or other data. For example, computer media include, but are not limited to, RAM, ROM, EPROM, EEPROM, flash memory or other solid-state memory technology, CD-ROM, Digital Versatile Disk ("DVD"), HD-DVD, BLU-RAY or other optical storage, cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by the computer architecture 1000. For the purpose of convenience in describing the claims, the phrases "computer storage medium", "computer-readable storage medium" and variations thereof do not, by themselves, include waves, signals and / or other temporary and / or intangible communication media.

[0089] According to various configurations, the computer architecture 1000 can operate in a networked environment using logical connections to remote computers through the network 1050 and / or another network (not shown). The computer architecture 1000 can be connected to the network 1050 via a network interface unit 1016 connected to the bus 1010. It should be understood that the network interface unit 1016 can also be used to connect to other types of networks and remote computer systems. The computer architecture 1000 can also include an input / output controller 1018 for receiving and processing inputs from a computer system including a keyboard, a mouse, or an electronic stylus ( Fig.10 Similarly, the input / output controller 1018 can provide input to a display screen, a printer, or other types of output devices (not shown). Fig.10 It should also be appreciated that the communication architecture may enable the enhanced communication service 102 to communicate with one or more of the sender device 104, the local mail service 702, the mail service 106, the mail service 502, and / or the recipient mail device 108 via a connection to the network 1050 through the network interface unit 1016. It should also be appreciated that the communication architecture may enable the enhanced email module 302 to communicate with one or more of the sender device 104, the local mail service 702, the enhanced mail service 102, the mail service 106, and / or the mail service 502 via a connection to the network 1050 through the network interface unit 1016.

[0090] It should be understood that the software components described herein can be loaded into CPU 1002 and executed, and CPU 1002 and the entire computer architecture 1000 can be converted from a general-purpose computing system to a dedicated computing system that specifically promotes the functions presented herein. CPU 1002 can be composed of any number of transistors or other discrete circuit elements, which can present any number of states individually or collectively. Specifically, CPU 1002 can operate as a finite state machine in response to executable instructions contained in the software modules disclosed herein. These computer executable instructions can transform CPU 1002 by specifying how CPU 1002 switches between states, thereby transforming transistors or other discrete hardware elements that constitute CPU 1002.

[0091] Encoding the software modules provided herein can also transform the physical structure of the computer-readable medium provided herein. In different embodiments of this specification, the specific transformation of the physical structure can depend on various factors. Examples of these factors may include, but are not limited to: the technology used to implement the computer-readable medium, whether the computer-readable medium is characterized as a primary memory or an auxiliary memory, etc. For example, if the computer-readable medium is implemented as a semiconductor-based memory, the software disclosed herein can be encoded on the computer-readable medium by transforming the physical state of the semiconductor memory. For example, the software can transform the state of the transistors, capacitors, or other discrete circuit elements that constitute the semiconductor memory. The software can also transform the physical state of these components to store data thereon.

[0092] For another example, the computer readable medium disclosed herein can be implemented using magnetic technology or optical technology. In such an implementation, when the software provided herein is encoded in a magnetic or optical medium, the software can transform the physical state of the magnetic or optical medium. These transformations can include changing the magnetic properties of a specific location in a given magnetic medium. These transformations can also include changing the physical characteristics or properties of a specific location in a given optical medium to change the optical properties of those locations. Without departing from the scope of protection and spirit of this specification, other transformations of physical media are also possible, and the aforementioned examples are just helpful to promote this discussion.

[0093] Based on the above, it should be understood that many types of physical transformations occur in computer architecture 1000 in order to store and execute the software components presented herein. It should also be understood that computer architecture 1000 may include other types of computing devices, including handheld computers, embedded computer systems, personal digital assistants, and other types of computing devices known to those of ordinary skill in the art. It is also contemplated that computer architecture 1000 does not include Fig.10 All components shown in the Fig.10 Other components explicitly shown in the Fig.10 A completely different architecture than the one shown in .

[0094] Example clauses

[0095] The disclosure presented herein may be considered in light of the following terms.

[0096] Example clause A, a computer-implemented method for providing an enhanced email service, the method comprising: receiving encrypted content configured according to an encryption key; generating a message for specifying a recipient email address, wherein the message includes at least the encrypted content as an attachment, and a link for decrypting the encrypted content based on the encryption key; sending the message to a recipient mailbox operated by a recipient mail service, wherein the recipient mailbox is accessible based on recipient credentials associated with the recipient email address; the enhanced email service stores at least one of the message or an unencrypted version of the message in a sender mailbox corresponding to a sender email address, wherein the sender mailbox is accessible based on sender credentials associated with the sender email address; the enhanced email service stores the message in an organization mailbox, which is addressable from a recipient device by using the link, wherein the organization mailbox is not accessible based on the sender credentials.

[0097] Example clause B, a computer-implemented method according to Example clause A, wherein the organization mailbox and the sender mailbox are hosted by the enhanced email service in a first domain, and wherein the recipient mailbox is hosted by the recipient mail service in the second domain.

[0098] Example clause C, a computer-implemented method according to any one of example clauses A to B, wherein the link is configured to expose an authentication module of the recipient mail service hosted in the second domain so that the recipient device can obtain a token from the recipient mail service for association with the first domain.

[0099] Example clause D, a computer-implemented method according to any one of example clauses A to C, further comprising: receiving authentication data from the recipient mail service; based on the authentication data, determining whether a token received from the recipient device is authentic for the recipient email address; based on determining that the token is authentic for the recipient email address, sending to the recipient device at least one of the following: the encryption key or a reply containing decrypted content generated based on the encrypted content and the key.

[0100] Example clause E, a computer-implemented method according to any one of example clauses A to D, wherein the link enables a mail module operating on the recipient device and providing access to the recipient mailbox to automatically send a token provided by the recipient mail service to the enhanced email service.

[0101] Example clause F, a computer-implemented method according to any one of example clauses A to E, the method further comprising: receiving a request including the token associated with the recipient email address from the mail module; sending the encryption key to the mail module to enable the mail module to decrypt the encrypted content to display a decrypted version of the content.

[0102] Example clause G, a computer-implemented method according to any one of example clauses A to F, wherein the link is available at the recipient device to enable the enhanced email service to send a password message including a volatile password, and the method further includes: receiving a request including the volatile password from the recipient device; and sending at least one of the encryption key or decrypted content to the recipient device.

[0103] Example clause H, a computer-implemented method according to any one of example clauses A to G, wherein receiving the encrypted content comprises: receiving content from a mail module of a sender's device; encrypting the content according to the encryption key to generate the encrypted content.

[0104] Although Example Clauses A to H are described above with reference to methods, it should be understood that in the context of this document, the subject matter of Example Clauses A to H may also be implemented by an apparatus, a system, and / or via a computer-readable storage medium.

[0105] Example Clause I, a system for providing enhanced email services, the system comprising: a processor; a memory in communication with the processor, the memory having computer-readable instructions stored thereon, which, when executed by the processor, causes the processor to perform operations comprising: receiving encrypted content configured according to an encryption key; generating a message comprising a link and the encrypted content configured according to the encryption key, wherein the message specifies a recipient email address; storing the message in an organization mailbox addressable from a recipient device by using the link; storing the encryption key in a key storage, wherein the key storage is configured to provide access to the encryption key by using a token; sending the message to a recipient mailbox corresponding to the recipient email address; receiving the token from the recipient device; and providing decrypted access to the encrypted content to the recipient device upon verifying that the token is authentic for the recipient email address.

[0106] Example clause J, a system according to example clause I, wherein providing the recipient device with decryption access to the encrypted content includes: sending the encryption key to the recipient device so that a decryption module of the recipient device can locally decrypt the encrypted content.

[0107] Example Clause K, a system according to any one of Example Clauses I to J, further comprising: receiving an indication of decryption parameters associated with the recipient device, and wherein providing decrypted access to the encrypted content to the recipient device comprises: determining based on the decryption parameters whether to send the encryption key to the recipient device or to decrypt the encrypted content to generate decrypted content to be sent to the recipient device.

[0108] Example Clause L, a system according to any one of Example Clauses I to K, further comprising: erasing the message from the organization mailbox when providing the recipient device with the decrypted access to the message.

[0109] Example clause M. A system according to any one of example clauses I to L, wherein receiving the encrypted content includes: receiving a sender-initiated message including the encrypted content and the encryption key from a sender mail service, and wherein generating the message includes: extracting the encryption key from the sender-initiated message and generating the link based on the token to provide access to the encryption key.

[0110] Example clause N, a system according to any one of example clauses I to M, wherein the organization mailbox is hosted in a first domain and the recipient mailbox is hosted in a second domain, wherein the link is configured to open a web page that exposes an authentication module associated with the second domain to the first domain to authenticate the recipient device based on the recipient email address.

[0111] Example Clause O, a system according to any one of Example Clauses I to N, further comprising: deleting the message after sending the message to the recipient mailbox and before receiving the token from the recipient device.

[0112] Although Example Clauses I to O are described above with reference to a system, it should be understood that in the context of this document, the subject matter of Example Clauses I to O may also be implemented by a device, via a computer-implemented method, and / or via a computer-readable storage medium.

[0113] Example clause P, a system for transmitting a message, the system comprising: a processor; a memory in communication with the processor, the memory having computer-readable instructions stored thereon, the computer-readable instructions executable by the processor for: receiving encrypted content configured according to an encryption key; generating a message including a link and the encrypted content configured according to the encryption key, wherein the message specifies a recipient email address, wherein the message also specifies a sender email address associated with a sender mail service; at a first time, sending the message to a recipient mailbox corresponding to the recipient email address; storing the encryption key in association with the recipient email address in an organization mailbox of an enhanced email service, wherein the organization mailbox is different from the sender mailbox corresponding to the sender email address; at a second time after the first time, receiving a request for decryption access to the content from a recipient device, the request including a token provided by the mail service, the token being used to verify the authenticity of the request regarding the recipient email address, wherein the encrypted content is not stored in the organization mailbox at the second time.

[0114] Example clause Q, a system according to example clause P, wherein the instructions are further executable by the processor to: receive the encrypted content associated with the request from the recipient device; decrypt the encrypted content based on the encryption key to generate decrypted content; and send the decrypted content to the recipient device.

[0115] Example clause R, a system according to any of example clauses P to Q, wherein the organization mailbox is hosted in a first domain and the recipient mailbox is hosted in a second domain, wherein the request for decrypted access to the content is automatically generated by a mailbox module, which operates locally on the recipient device and is configured to automatically transmit recipient credentials to the mailbox service.

[0116] Example clause S, a system according to any one of example clauses P to R, wherein receiving the encrypted content includes receiving a first message initiated by a sender, wherein the first message initiated by the sender specifies the sender email address and the recipient email address.

[0117] Although example clauses P to S are described above with reference to a system, it should be understood that in the context of this document, the subject matter of example clauses P to S may also be implemented by an apparatus, via a computer-implemented method, and / or via a computer-readable storage medium.

[0118] Example clause T, a computer-implemented method for providing an enhanced email service, the method comprising: receiving, at the enhanced email service, content designated for transmission to a recipient email address corresponding to a recipient mailbox, wherein the enhanced email service is associated with a predetermined domain; determining whether the enhanced email service hosts the recipient mailbox; based on determining that the enhanced email service does host the recipient mailbox, sending an unencrypted version of the content to the recipient mailbox; or based on determining that the enhanced email service does not host the recipient mailbox, sending an encrypted version of the content to the recipient mailbox as an attachment to a message, wherein the message includes a link for implementing decryption of the encrypted version; storing the encrypted version of the content or at least one of the encryption keys in an organization mailbox that can be addressed from a recipient device using the link; receiving a token from the recipient device; and providing the recipient device with decrypted access to the content upon verifying that the token is authentic for the recipient email address.

[0119] Example clause U, a computer-implemented method according to example clause T, wherein, when the enhanced email service hosts the recipient mailbox, the operation also includes: receiving transmission restriction data associated with the content; and based on the transmission restriction data, rejecting a request to forward the unencrypted version of the content from the recipient mailbox.

[0120] Finally, although various configurations are described using language specific to structural features and / or methodological acts, it should be understood that the subject matter set forth in the appended representations is not necessarily limited to the specific features or acts described. Rather, these specific features and acts are disclosed as example forms of implementing the claimed subject matter.

Claims

1. A computer-implemented method comprising: generating a message specifying a recipient address and including a link to the encrypted content; sending the message to a first mailbox accessible based on recipient credentials associated with the recipient address; storing at least one of the encrypted content or the message in a second mailbox; receiving a first request from a recipient device, the first request indicating activation of the link; In response to receiving the first request, sending a password message to the first mailbox, the password message including a password associated with the encrypted content; receiving a second request from the recipient device, the second request including the password; as well as In response to receiving the second request, access to the encrypted content is provided to the recipient device.

2. The computer-implemented method of claim 1 , wherein: The second mailbox is hosted in a first domain, the first domain is different from a second domain, and the first mailbox is hosted in the second domain by a recipient mail service.

3. The computer-implemented method of claim 2, wherein: The link is configured to expose an authentication module of the recipient mail service to enable the recipient device to obtain a token from the recipient mail service.

4. The computer-implemented method of claim 1 , wherein: The second mailbox includes a sender mailbox, and the sender mailbox is associated with a sender address of the message.

5. The computer-implemented method of claim 1 , further comprising: In response to providing the recipient device with access to the encrypted content, causing the message to be erased from the second mailbox.

6. The computer-implemented method of claim 1 , wherein: The link enables a mail module operating on the recipient device that provides access to the first mailbox to automatically send a token provided by the recipient mail service associated with the recipient address to the enhanced mail service associated with the second mailbox.

7. The computer-implemented method of claim 1 , wherein: Providing access to the encrypted content to the recipient device includes sending an encryption key to the recipient device to enable a decryption module to decrypt the encrypted content at the recipient device.

8. The computer-implemented method of claim 1 , wherein: The providing the recipient device with access to the encrypted content includes: Obtain the encrypted content from the second mailbox; decrypting the encrypted content to generate an unencrypted version of the encrypted content; and The unencrypted version of the encrypted content is sent to the recipient device.

9. The computer-implemented method of claim 1 , further comprising: receiving authentication data from a recipient mail service associated with the recipient address; as well as Based on the authentication data, a determination is made as to whether a token received from the recipient device is authentic for the recipient address, wherein providing access to the encrypted content to the recipient device is responsive to a determination that the token is authentic for the recipient address.

10. A communication system comprising: at least one processor; as well as a memory in communication with the at least one processor, the memory having computer readable instructions stored thereon that, when executed by the at least one processor, cause the system to: receiving encrypted content configured according to an encryption key; generating a message including a link for accessing the encrypted content; sending the message to a first mailbox accessible based on recipient credentials associated with a recipient address; receiving a first request from a recipient device, the first request indicating activation of the link; In response to receiving the first request, sending a password message to the first mailbox, the password message including a password associated with the encrypted content; receiving a second request from the recipient device, the second request including the password; as well as In response to receiving the second request, access to the encrypted content is provided to the recipient device.

11. The system according to claim 10, wherein: The computer readable instructions, when executed by the at least one processor, further cause the system to: receiving an indication of decryption parameters associated with the recipient device; and A determination is made based on the decryption parameters whether to send the encryption key to the recipient device.

12. The system according to claim 10, wherein: The computer readable instructions, when executed by the at least one processor, further cause the system to: receiving an indication of decryption parameters associated with the recipient device; and A determination is made based on the decryption parameters whether to send an unencrypted version of the encrypted content to the recipient device.

13. The system according to claim 10, wherein: The computer readable instructions, when executed by the at least one processor, further cause the system to: storing the encrypted content in a second mailbox, The second mailbox is hosted in a first domain, the first domain is different from the second domain, and the first mailbox is hosted in the second domain by a recipient mail service.

14. The system according to claim 13, wherein: The link is configured to expose an authentication module of the recipient mail service to enable the recipient device to obtain a token from the recipient mail service.

15. The system according to claim 10, wherein: The computer readable instructions, when executed by the at least one processor, further cause the system to: At least one of the encrypted content or the message is stored in a sender mailbox associated with a sender address of the message.

16. The system of claim 10, wherein: Providing the recipient device with access to the encrypted content includes sending the encryption key to the recipient device to enable a decryption module to generate an unencrypted version of the encrypted content.

17. A communication system comprising: at least one processor; as well as a memory in communication with the at least one processor, the memory having computer-readable instructions stored thereon, the computer-readable instructions executable by the at least one processor for: generating a message specifying a recipient address and including a link for accessing the encrypted content; sending the message to a recipient mailbox that is accessible based on recipient credentials associated with the recipient address; receiving a first request from a recipient device, the first request indicating activation of the link; In response to receiving the first request, sending a password message to the recipient mailbox, the password message including a password associated with the encrypted content; receiving a second request from the recipient device, the second request including the password; as well as In response to receiving the second request, access to the encrypted content is provided to the recipient device.

18. The system of claim 17, wherein: The computer readable instructions are further executable by the at least one processor to: receiving the encrypted content from the recipient device; decrypting the encrypted content based on the encryption key to generate decrypted content; as well as The decrypted content is sent to the recipient device.

19. The system of claim 17, wherein: The computer readable instructions are further executable by the at least one processor to: storing the message in a second mailbox different from the recipient mailbox; and Upon providing the recipient device with access to the encrypted content, the message is deleted from the second mailbox.

20. The system of claim 19, wherein: The second mailbox is hosted in a first domain, and the recipient mailbox is hosted in a second domain different from the first domain.

Images