Private routing system

Abstract

A method comprises: receiving (103), at a device (1) of a first user, first cryptographic information and second cryptographic information; and transmitting (109) the message to the private routing system (21). The first cryptographic information includes a recipient identifier encrypted with a cryptographic key associated with the private routing system. The message includes the recipient identifier encrypted with the cryptographic key and fourth cryptographic information that has been determined based on the second cryptographic information. The method further comprises: decrypting (113) the recipient identifier at the private routing system; identifying (115), at the private routing system, a second user based on the decrypted recipient identifier; verifying (117) the fourth password information; and forwarding (119) the message to the device (11) of the second user based on the verification result of the fourth cryptographic information.

Description

Technical Field

[0001] The present invention relates to a method of routing messages via a privacy routing system.

[0002] The invention further relates to a first user device, a second user device and a private routing system for use in such a method.

[0003] The invention also relates to a computer program product enabling a first user device, a second user device and a privacy routing system to perform the steps of this method. Background Art

[0004] Communication identifiers are a privacy pain point. If a user shares an email address or phone number with a transaction counterparty, that counterparty may continue to harass the user via email or phone calls for a long time thereafter. Worse, a transaction counterparty can share a user's communication identifiers with third parties, who can use them for spam, phishing, and other privacy violations. Furthermore, transaction counterparties and third parties can be associated using the user's contact information, which allows them to combine data about the user in a way that may be disadvantageous to the user. IP addresses also make it easy to associate because ISPs rarely rotate IP addresses.

[0005] Gmail offers a basic solution to the spam problem. Gmail supports "mission-specific" email addresses, which can be created simply by adding a "+". For example, the email address johnsmith@gmail.com would be enhanced to johnsmith+news@gmail.com when registered on an untrusted site. This makes it easy to filter out mail sent to that specific address, for example, mail from untrusted sources. While this solution is effective for dumb spam, it does nothing to prevent more sophisticated associations or spam, as the semantics of the "+" can be easily circumvented. Furthermore, the solution requires a lot of work and management from the user.

[0006] Another solution to prevent spam is to use decentralized identifiers (DIDs), a W3C proposal ( https: / / w3c.github.io / did-core / ). Blog "Self-sovereign Identity - The Good, the Bad and the Ugly" https: / / blockchain.tno.nl / blog / self-sovereign-identity-the-good-the-bad-and-the- ugly / ”) discloses that a web store can publish a public DID / DID Document (DDO) to receive encrypted and signed communications from its customers, which citizens can use to negotiate a DID pair with this web store, which will enable both parties to establish a private, secure and authenticated communication channel with the other party at a later point in time, effectively making login obsolete.

[0007] The blog further discloses that spam can be prevented by segmenting all communications via DID pairs. If a service provider starts sending spam to a user via a previously established DID pair, the user can instruct their user agent application to ignore the spam so that the service provider can no longer contact the user. However, this solution requires direct communication between the user and the web store, which reduces privacy because it allows the web store to perform privacy-invading message correlation. Summary of the invention

[0008] A first object of the present invention is to provide a method which can be used to route incoming messages to the appropriate device while enabling the user to block spam without allowing third parties to correlate messages addressed to the same recipient.

[0009] A second object of the present invention is to provide a privacy routing system that can route incoming messages to appropriate devices while enabling users to block spam without allowing third parties to correlate messages sent to the same recipient.

[0010] In a first aspect of the invention, a method for routing a message via a privacy routing system includes: receiving first cryptographic information and second cryptographic information at a device of a first user, the first cryptographic information including a recipient identifier encrypted with a cryptographic key associated with the privacy routing system, the recipient identifier being associated with a second user; and transmitting a message from the device of the first user to the privacy routing system, the message including third cryptographic information and fourth cryptographic information, the third cryptographic information including a recipient identifier encrypted with a cryptographic key associated with the privacy routing system, the fourth cryptographic information having been determined based on the second cryptographic information. Optionally, the encrypted recipient identifier is re-randomized before being included in the message as (part of) the third cryptographic information.

[0011] The method further includes: decrypting the recipient identifier in the third cryptographic information at the privacy routing system using the cryptographic key or another cryptographic key corresponding to the cryptographic key; identifying the second user based on the decrypted recipient identifier at the privacy routing system; verifying the fourth cryptographic information; and forwarding the message from the privacy routing system to the device of the second user based on the verification result of the fourth cryptographic information.

[0012] This approach enables a privacy routing system or a second user's device to create different encrypted recipient identifiers for different first users (i.e., different senders; also referred to as Alice) using a certain kind of cryptographic system (e.g., a randomizable cryptographic system). This prevents third parties (including colluding Alices) from being able to correlate messages sent to the same recipient. However, the first user may (also) be able to re-randomize the encrypted recipient identifier, as some cryptographic systems allow the first user to perform such re-randomization. Such re-randomization will help improve the privacy of the first user, as third parties will not be able to correlate messages originating from the same sender. However, such re-randomization makes it impossible for the privacy routing system to block messages / spam from certain senders based on the encrypted recipient identifier.

[0013] Since the recipient identifier is the same for all first users, the recipient identifier cannot be used to block messages / spam from certain first users. By transmitting the second cryptographic information to the first user's device, the fourth cryptographic information received from the first user's device can be used to determine whether a message from the first user should be forwarded, the fourth cryptographic information being determined by the first user's device based on the second cryptographic information. In this way, the second user can block spam without allowing a third party to associate messages sent to the same recipient.

[0014] The cryptographic information may include a cryptographic key, data encrypted with the cryptographic key, and / or other cryptographic information. The third cryptographic information may be the same as the first cryptographic information, but may also be alternatively different, for example including a re-randomization of the received encrypted recipient identifier. If the third cryptographic information is different from the first cryptographic information, the third cryptographic information should at least be derived from the first cryptographic information. Similarly, the fourth cryptographic information may be the same as the second cryptographic information, but may also be alternatively different. For example, the cryptographic key associated with the privacy routing system may be a public key. The privacy routing system does not include devices of the first user and the second user.

[0015] Verifying the fourth cryptographic information may include decrypting the fourth cryptographic information or attempting to decrypt the fourth cryptographic information, or may include verifying the fourth cryptographic information in a different manner, such as by checking a revocation token included in the fourth cryptographic information.

[0016] In a second aspect of the present invention, a first user device for use in the above method includes at least one processor, which is configured to: receive first cryptographic information and second cryptographic information, the first cryptographic information including a recipient identifier encrypted with a cryptographic key associated with a privacy routing system, the recipient identifier being associated with a second user; include the recipient identifier encrypted with a cryptographic key associated with the privacy routing system in third cryptographic information; determine fourth cryptographic information based on the second cryptographic information; and transmit a message of the second user to the privacy routing system, the message including the third cryptographic information and the fourth cryptographic information.

[0017] The at least one processor of the first user device may be configured to determine the fourth cryptographic information by re-randomizing the second cryptographic information and / or to determine the third cryptographic information by re-randomizing the first cryptographic information. By causing the first user device to re-randomize the second cryptographic information before determining the fourth cryptographic information based on the second cryptographic information of each new message, a third party may be prevented from associating different messages from the same first user. Preferably, the first user device then also re-randomizes the first cryptographic information before determining the third cryptographic information based on the first cryptographic information. For example, Paillier encryption may be used.

[0018] The second cryptographic information may include one or more predefined values ​​encrypted with a sender-specific cryptographic information item associated with the second user and specific to the first user, and the fourth cryptographic information may include the second cryptographic information or a randomization of the second cryptographic information. In this case, the one or more predefined values ​​do not need to be known by the first user's device. They only need to be known by the privacy routing system and the second user's device. The privacy routing system and / or the second user's device use the one or more predefined values ​​to determine whether they are able to decrypt the fourth cryptographic information. The one or more predefined values ​​may include a fixed value, such as "1", or may be based on the rest of the message content, for example as a checksum.

[0019] The sender-specific cryptographic information item is created by the device of the second user relative to the first user. The sender-specific cryptographic information item associated with the second user is stored in one or more memories that can be accessed by one or more devices of the second user. When the second user wants to block a message from the first user, the device of the second user marks the sender-specific cryptographic information item specific to the first user as a blocked sender-specific cryptographic information item and transmits it to the privacy routing system, which associates it with the second user. Therefore, the privacy routing system only receives sender-specific cryptographic information items specific to the blocked first user, and therefore if the first user is not blocked, messages from the same first user cannot be associated to the second user. For example, the sender-specific cryptographic information item associated with the second user and specific to the first user can be a cryptographic key.

[0020] Alternatively, for example, the second cryptographic information may include a public key associated with the second user and specific to the first user, and the fourth cryptographic information may include one or more predefined values ​​encrypted with the public key. In this case, the one or more predefined values ​​are known not only to the privacy routing system and the second user's device, but also to the first user's device. The one or more predefined values ​​may also be known to other devices and may even be public. For example, the one or more predefined values ​​may be standardized.

[0021] Furthermore, in this case, the public key and the corresponding private key are created by the second user's device relative to the first user. The private key is a sender-specific cryptographic item and can be processed in the same manner as described above. Like the private key, the corresponding public key associated with the second user is also stored in one or more memories that can be accessed by one or more devices of the second user.

[0022] In a third aspect of the invention, a second user device for use in the above method includes at least one processor, the at least one processor being configured to: transmit first cryptographic information and second cryptographic information to a first user's device, the first cryptographic information including a recipient identifier encrypted with a cryptographic key associated with a privacy routing system, the recipient identifier being associated with the second user; and receive a message from the first user's device via the privacy routing system. The first cryptographic information and the second cryptographic information may form or be included in a "business card" provided to the first user, the business card being typically provided directly, such as as a scannable QR code or presented via NFC communication, but optionally also provided via the privacy routing system.

[0023] The second cryptographic information may include a sender identifier encrypted with a cryptographic key or with a second cryptographic information key associated with a privacy routing system to allow the privacy routing system to discard messages based on the sender identifier. The recipient identifier and the sender identifier may be jointly encrypted in a composite cryptographic information, a first portion of the composite cryptographic information corresponding to the first cryptographic information, and a second portion of the composite cryptographic information corresponding to the second cryptographic information. Thus, only one encryption operation needs to be performed with respect to the recipient identifier and the sender identifier.

[0024] Alternatively, the message may include fourth cryptographic information determined based on the second cryptographic information, and at least one processor of the second user device may be configured to: obtain one or more unblocked sender-specific cryptographic information items from the memory; attempt to decrypt the fourth cryptographic information using the one or more unblocked sender-specific cryptographic information items; discard the message if the attempt to decrypt the fourth cryptographic information does not produce one or more predefined values ​​and / or the attempt is unsuccessful; and present the message to the user via a user interface if the attempt to decrypt the fourth cryptographic information produces the one or more predefined values.

[0025] Thus, the privacy routing system itself is more difficult to perform privacy-invading message associations because the privacy routing system does not process any sender identifiers and only decrypts one or more predefined values ​​when transmitted by the blocked sender (e.g., using the blocked sender-specific cryptographic information items received from the user's device). As described above, the sender-specific cryptographic information items (e.g., keys) are typically created by the second user's device and stored in one or more memories accessible to one or more devices of the second user.

[0026] As described above, the privacy routing system and the second user's device use the one or more (blocked) sender-specific cryptographic information items to determine whether they can decrypt the fourth cryptographic information. The one or more predefined values ​​generated by successful decryption may include a fixed value, such as "1", or may be based on the rest of the message content, for example as a checksum. The second user device (i.e., the second user's device) itself also blocks / discards the message because the blocked sender may transmit the fourth cryptographic information that is not determined based on the second cryptographic information, and the privacy routing system will not be able to decrypt the fourth cryptographic information. Since the second user device has the unblocked sender-specific cryptographic information items (the privacy routing system does not), it can block / discard these messages from these malicious senders.

[0027] The message may further include a sender identifier encrypted with a cryptographic key associated with the second user, which is forwarded to the second user's device by the privacy routing system. In this case, the second user's device may first decrypt the sender identifier and then obtain only the unblocked sender-specific cryptographic information items associated with the sender identifier. If no unblocked sender-specific cryptographic information items are associated with the sender identifier, the message is discarded. If the message does not include an encrypted sender identifier, all unblocked sender-specific cryptographic information items may be obtained from the memory. The second user's device may then attempt to decrypt the fourth cryptographic information with each of the unblocked sender-specific cryptographic information items, for example sequentially. The sender identifier is not encrypted with the public key of the privacy routing system to prevent the privacy routing system itself from making privacy-invading message associations.

[0028] At least one processor of the second user device may be configured to receive an encrypted recipient identifier from the privacy routing system, the recipient identifier encrypted with a cryptographic key associated with the privacy routing system, and to create the first cryptographic information by copying or re-randomizing the encrypted recipient identifier of the first user. By re-randomizing the encrypted recipient identifier, the same recipient identifier may be used for multiple senders / first users while still allowing different cryptographic information to be transmitted to the senders / first users, thereby preventing a third party from being able to perform any privacy-invading message associations.

[0029] At least one processor of the second user device may be configured to transmit the first cryptographic information and the second cryptographic information to devices of multiple users, including the first user. This enables blocking messages from the group as a whole and can save the second user's time and energy. For example, the user group may share the same sender identifier and / or the same sender-specific cryptographic key.

[0030] In a fourth aspect of the present invention, a privacy routing system for routing messages includes at least one processor, which is configured to: receive a message from a device of a first user, the message including third cryptographic information and fourth cryptographic information, the third cryptographic information including a recipient identifier encrypted with a cryptographic key associated with the privacy routing system; decrypt the recipient identifier in the third cryptographic information with the cryptographic key or with another cryptographic key corresponding to the cryptographic key; identify a second user based on the decrypted recipient identifier; verify the fourth cryptographic information; and forward the message to the device of the second user based on the verification result of the fourth cryptographic information.

[0031] At least one processor of the privacy routing system may be configured to receive a forwarding policy from a device of the second user, and further forward the message to the device of the second user based on the forwarding policy. By allowing the second user to define a forwarding policy, the number of unwanted messages presented to the second user may be reduced as much as possible. For example, a forwarding policy may include whitelisting, blacklisting, a combination thereof, a time-based policy, or even more complex policies. Examples of time-based forwarding policies include only delivering messages from colleagues of the second user between 9.00 and 18.00, exclusively delivering messages from close family members of the second user during sleeping hours, and temporarily forwarding all messages intended for the second user to other people during the second user's vacation.

[0032] The fourth cryptographic information may include a sender identifier encrypted with a cryptographic key or with a second cryptographic item associated with the privacy routing system, and at least one processor of the privacy routing system may be configured to: verify the fourth cryptographic information by decrypting the fourth cryptographic information with the cryptographic key, with a second cryptographic key, with an additional cryptographic key, with another cryptographic key corresponding to the cryptographic key, or with a second additional cryptographic key corresponding to the second cryptographic key, and forward the message to the device of the second user based on whether the sender identifier is included in the sender identifier list. This generally allows the privacy routing system to block all messages from a certain sender, but has the disadvantage that the privacy routing system itself may be able to perform privacy-invading message associations. The sender identifier may be blocked for only one user of the privacy routing system or for all users of the privacy routing system. The cryptographic key used to encrypt the sender identifier may be the same as or different from the cryptographic key used to encrypt the recipient identifier.

[0033] The fourth cryptographic information may include a revocation token generated by the device of the first user, and the at least one processor of the privacy routing system may be configured to: obtain a cryptographic accumulator; verify the fourth cryptographic information by checking the revocation token with the cryptographic accumulator; and forward the message to the device of the second user based on whether the revocation token is determined to be valid. By using the cryptographic accumulator, the contents of the whitelist and / or blacklist can be kept confidential.

[0034] At least one processor of the privacy routing system can be configured to: obtain multiple blocked sender-specific cryptographic information items from a memory based on a decrypted recipient identifier; verify the fourth cryptographic information by attempting to decrypt the fourth cryptographic information with the multiple blocked sender-specific cryptographic information items; discard the message if the attempt to decrypt the fourth cryptographic information produces one or more predefined values ​​and / or the attempt is successful; and forward the message to a device of a second user if the attempt to decrypt the fourth cryptographic information does not produce the one or more predefined values ​​or the attempt is unsuccessful.

[0035] In this way, since the privacy routing system does not process any sender identifiers and is only able to decrypt one or more predefined values ​​transmitted by the blocked sender, it is more difficult for the privacy routing system itself to perform privacy-invading message association. However, the second user's device itself then typically also needs to block / discard the message because the blocked sender may transmit fourth cryptographic information that is not determined based on the second cryptographic information, and the privacy routing system will not be able to decrypt and therefore forward the fourth cryptographic information. The one or more predefined values ​​may include a fixed value, such as "1", or may be based on the rest of the message content, for example as a checksum. If the one or more predefined values ​​are determined based on the message content, such a check performed at the second user's device can replace traditional message verification procedures, such as a checksum-based message integrity check performed periodically.

[0036] At least one processor of the privacy routing system can be configured to generate recipient identifiers, for example to ensure that each recipient identifier is unique on the privacy routing system (which does not include the first user's device and the second user's device). The privacy routing system can encrypt the recipient identifiers itself or cause the second user's device to encrypt the recipient identifiers, for example, depending on whether the complexity of the user's device or the complexity of the privacy routing system should be minimized. If the privacy routing system encrypts the recipient identifiers, the second user's device re-randomizes the encrypted recipient identifiers.

[0037] In addition, a computer program for executing the method described herein and a non-transitory computer-readable storage medium storing the computer program are provided.For example, the computer program can be downloaded from or uploaded to an existing device, or stored when manufacturing these systems.

[0038] In a fifth aspect of the present invention, a computer program product includes instructions that, when executed by a privacy routing system, cause the privacy routing system to perform the following steps: receiving a message from a first user's device, the message including third cryptographic information and fourth cryptographic information, the third cryptographic information including a recipient identifier encrypted with a cryptographic key associated with the privacy routing system; decrypting the recipient identifier in the third cryptographic information with the cryptographic key or with another cryptographic key corresponding to the cryptographic key; identifying a second user based on the decrypted recipient identifier; verifying the fourth cryptographic information; and forwarding the message to the second user's device based on the verification result of the fourth cryptographic information. The computer program product may be stored on a non-transitory computer-readable storage medium.

[0039] In a sixth aspect of the present invention, a computer program product includes instructions that, when executed by a first user device, cause the first user device to perform the following steps: receiving first cryptographic information and second cryptographic information, the first cryptographic information including a recipient identifier encrypted with a cryptographic key associated with a privacy routing system, the recipient identifier being associated with a second user; including the recipient identifier encrypted with a cryptographic key associated with the privacy routing system in third cryptographic information; determining fourth cryptographic information based on the second cryptographic information; and transmitting a message of the second user to the privacy routing system, the message including the third cryptographic information and the fourth cryptographic information. The computer program product may be stored on a non-transitory computer-readable storage medium.

[0040] In a seventh aspect of the present invention, a computer program product includes instructions that, when executed by a second user device, cause the second user device to perform the following steps: transmit first cryptographic information and second cryptographic information to a first user's device, the first cryptographic information including a recipient identifier encrypted with a cryptographic key associated with a privacy routing system, the recipient identifier being associated with the second user; and receive a message from the first user's device via the privacy routing system. The computer program product may be stored on a non-transitory computer-readable storage medium.

[0041] As will be appreciated by those skilled in the art, aspects of the present invention may be implemented as devices, methods or computer program products. Therefore, aspects of the present invention may take the form of complete hardware embodiments, complete software embodiments (including firmware, resident software, microcode, etc.) or embodiments of combined software and hardware aspects that may generally all be referred to as "circuit", "module" or "system" herein. The functions described in this disclosure may be implemented as algorithms executed by a processor / microprocessor of a computer. In addition, aspects of the present invention may also take the form of a computer program product implemented in one or more computer-readable media, the computer-readable medium having a computer-readable program code embodied thereon (e.g., stored).

[0042] Any combination of one or more computer-readable media can be used.Computer-readable media can be computer-readable signal media or computer-readable storage media.Computer-readable storage media can be, for example, but not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing.More specific examples of computer-readable storage media can include, but are not limited to, the following: electrical connections with one or more wires, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.In the context of the present invention, computer-readable storage media can be any tangible medium that can contain or store programs used by or in combination with instruction execution systems, devices or equipment.

[0043] A computer-readable signal medium may include a propagated data signal having a computer-readable program code embodied therein (e.g., in baseband or as part of a carrier wave). Such a propagated signal may take any of a variety of forms, including but not limited to electromagnetic, optical, or any suitable combination thereof. A computer-readable signal medium may be any computer-readable medium that is not a computer-readable storage medium and that can communicate, propagate, or convey a program (for use by or in connection with an instruction execution system, device, or apparatus).

[0044] Can use any suitable medium transmission to be embodied in the program code on computer readable medium, this medium includes but is not limited to any suitable combination of wireless, wired, optical fiber, cable, RF etc. or aforementioned.The computer program code for performing the operation of each aspect of the present invention can be written in any combination of one or more programming languages, and these one or more programming languages ​​include such as Java (TM), Smalltalk, C++ and such as conventional process programming languages ​​such as " C " programming language or similar programming languages.Program code can be performed on the user's computer completely, also can be partly performed on the user's computer (as independent software package), can also be partly performed on the user's computer and partly performed on the remote computer, or can be performed completely on the remote computer or server.In the latter scenario, the remote computer can be connected to the user's computer through any type of network, and this network includes local area network (LAN) or wide area network (WAN), or can be connected to an external computer (for example, by using the Internet of Internet Service Provider).

[0045] Aspects of the present invention are described below with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to an embodiment of the present invention. It will be understood that each frame of the flowchart and / or block diagram and the combination of frames in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable data processing device, particularly a microprocessor or a central processing unit (CPU), to produce a machine so that instructions executed via a processor of a computer, other programmable data processing device or other device create a device for implementing the function / action specified in one or more frames of the flowchart and / or block diagram.

[0046] These computer program instructions may also be stored in a computer-readable medium, which can instruct a computer, other programmable data processing device, or other equipment to function in a particular manner, so that the instructions stored in the computer-readable medium produce a manufactured article including instructions, which implement the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0047] The computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable apparatus provide a process for implementing the functions / actions specified in the flowchart and / or one or more block diagram blocks.

[0048] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functions and operations of possible implementations of devices, methods and computer program products according to various embodiments of the present invention. In this regard, each box in the flowchart or block diagram may represent a module, a fragment or a code portion, which includes one or more executable instructions for implementing (multiple) specific logical functions.

[0049] It should also be noted that in certain alternative implementations, the functions indicated in the blocks may not occur in the order indicated in the figures. For example, two blocks shown in succession may actually be executed substantially simultaneously, or may sometimes be executed in reverse order, depending on the functions involved. It will also be noted that each block of the block diagram and / or flow chart and combinations of blocks in the block diagram and / or flow chart may be implemented by a dedicated hardware-based system or a combination of dedicated hardware and computer instructions that performs a particular function or action. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] These and other aspects of the invention will become apparent and will be further elucidated by way of example with reference to the accompanying drawings, in which:

[0051] Figure 1 is a flow chart of a first embodiment of a method for routing messages via a privacy routing system;

[0052] Figure 2 is a flow chart of a second embodiment of a method for routing messages via a privacy routing system;

[0053] Figure 3 is a flow chart of a first portion of a third embodiment of a method of routing messages via a privacy routing system;

[0054] Figure 4 is a flow chart of a second portion of a third embodiment of a method of routing messages via a privacy routing system;

[0055] Figure 5 is a flow chart of a first portion of a fourth embodiment of a method of routing messages via a privacy routing system;

[0056] Figure 6 is a flow chart of a second portion of a fourth embodiment of a method for routing messages via a privacy routing system;

[0057] Figure 7 is a flow chart of a third portion of a fourth embodiment of a method for routing messages via a privacy routing system;

[0058] Figure 8 is a flow chart of a fourth portion of a fourth embodiment of a method of routing messages via a privacy routing system;

[0059] Fig. 9 is a flow chart of a fifth portion of a fourth embodiment of a method for routing messages via a privacy routing system;

[0060] Fig.10 is a block diagram of an embodiment of a messaging system including an embodiment of a privacy routing system and a first user device and a second user device; and

[0061] Fig.11 is a block diagram of an exemplary data processing system for executing the steps of the method of the present invention.

[0062] Corresponding elements in the drawings are denoted by the same reference numerals. DETAILED DESCRIPTION

[0063] Figure 1 A first embodiment of a method for routing messages via a privacy routing system 21 is shown in FIG. Step 101 includes a device 11 of a second user (also referred to as Bob) transmitting first cryptographic information and second cryptographic information to a device 1 of a first user (also referred to as Alice). The first cryptographic information includes a recipient identifier encrypted with a cryptographic key associated with the privacy routing system. The recipient identifier is associated with the second user.

[0064] The recipient identifier may be received from the privacy routing system before executing step 101 ( Figure 1 ). The received recipient identifier may have been encrypted with a cryptographic key associated with the privacy routing system 21. In this case, the first cryptographic information may be created by re-randomizing the received encrypted recipient identifier of the first user. Alternatively, the device 11 itself may encrypt the received recipient identifier with a cryptographic key associated with the privacy routing system.

[0065] For example, the recipient identifier may be an email address of the second user. Alternatively, for example, if the privacy routing system 21 is part of a mobile communications network (e.g., a 4G or 5G network), the recipient identifier of the second user may be the MS-ISDN number of the second user, the IMEI of the second user's device, or an identifier derived from a SIM key hierarchy on the second user's device. A combination of these identifiers may alternatively be used as the recipient identifier. Alternatively or additionally, other identifiers may be used as the recipient identifier.

[0066] The cryptographic key may be a symmetric key or an asymmetric key. If the cryptographic key is an asymmetric key, it may be a public key, and the recipient identifier encrypted with the cryptographic key (i.e., public key) may then be decrypted with a corresponding additional cryptographic key (i.e., private key). For example, one or more of the following public key cryptosystems may be used: El Gamal, RSA, Paillier. The (multiple) public key cryptosystems used may be based on cyclic modulo arrays, elliptic curve groups, or other cyclic groups. The re-randomization properties of such public key cryptosystems may be used to randomize encrypted identifiers, so that messages transmitted using the same encrypted identifier cannot be associated. The Cramer-Shoup double-chain encryption scheme may be used to provide non-scalable re-randomization.

[0067] Well-known key agreement protocols (such as Diffie-Helman) may be used to ensure that the second user's device 11 possesses the cryptographic keys associated with the privacy routing system 21. Alternatively, the cryptographic keys may be pre-provisioned in the device 11 so that the cryptographic keys (e.g., symmetric keys) do not have to be transferred from the privacy routing system 21 to the device 11. If the privacy routing system 21 is part of a mobile communication network, the cryptographic keys may be provided to the device 11 via a SIM card.

[0068] If the privacy routing system 21 is part of a mobile communication network, one of the symmetric key encryption algorithms listed by the mobile communication network can be used, such as GEA4, GEA5, UEA1, UEA2 (TS 35.215), EEA1, EEA2, EEA3 (TS33.401), NEA1, NEA2, NEA3 (TS 33.501). Example base algorithms are SNOW 3G, AES, ZUC, SNOW V.

[0069] The cryptographic information may include a cryptographic key, data encrypted with the cryptographic key, and / or other cryptographic information. The first cryptographic information and the second cryptographic information may be transmitted to the devices of multiple users, i.e., to device 1 and the devices of other users. This enables messages from the group to be blocked as a whole, and can save the time and energy of the second user. For example, a user group may share the same sender identifier and / or the same sender-specific cryptographic key. In an alternative embodiment, step 101 is performed by or via the privacy routing system 21. In another alternative embodiment, the first cryptographic information and the second cryptographic information are shared by means other than transmission.

[0070] The information transmitted by device 11 to device 1 in step 101 may also include an identifier of privacy routing system 21, so that device 11 (and optionally other devices of the first user) knows that the second user's message should be routed via privacy routing system 21. This information may have been previously received by device 11 from privacy routing system 21.

[0071] Step 103 includes device 1 receiving the first cryptographic information and the second cryptographic information. Step 105 includes device 1 including the recipient identifier encrypted with the cryptographic key associated with the privacy routing system in the third cryptographic information. Step 107 includes determining fourth cryptographic information based on the second cryptographic information. Step 109 includes transmitting a message from the first user's device 1 to the privacy routing system 21. The message includes the third cryptographic information determined in step 105 and the fourth cryptographic information determined in step 107.

[0072] The third cryptographic information may be the same as the first cryptographic information, but may alternatively be different, for example comprising a re-randomization of the received encrypted recipient identifier. If the third cryptographic information is different from the first cryptographic information, the third cryptographic information should be derived from at least the first cryptographic information. Similarly, the fourth cryptographic information may be the same as the second cryptographic information, but may alternatively be different. For example, step 107 may comprise determining the fourth cryptographic information by re-randomizing the second cryptographic information.

[0073] The body of the message may be encrypted using end-to-end encryption to ensure that the body of the message remains private to the first user and the second user, and / or may be digitally signed to assure the second user that there is no middleman. The digital signature should assure the second user that the second user is communicating with the same first user, but the second user need not be able to identify the first user. Encrypted and / or authenticated communications may also be used between device 1 and the privacy routing system 21 and between device 11 and the privacy routing system 21. Information about which techniques should be used for encryption and authentication may be provided by the privacy routing system 21 to devices 1 and 11.

[0074] Step 111 includes the privacy routing system 21 receiving a message from the first user's device 1. Step 113 includes the privacy routing system 21 decrypting the recipient identifier in the third cryptographic information with the cryptographic key or with another cryptographic key corresponding to the cryptographic key. If the cryptographic key is a symmetric key, the recipient identifier is decrypted with the cryptographic key. If the cryptographic key is an asymmetric key, the cryptographic key may be a public key, and the recipient identifier is then decrypted with the corresponding private key.

[0075] Step 115 includes the privacy routing system 21 identifying the second user based on the recipient identifier decrypted in step 113. Step 115 may include determining the current address of the second user. Step 117 includes the privacy routing system 21 verifying the fourth cryptographic information. In an alternative embodiment, the privacy routing system 21 requests the device 11 of the second user to verify the fourth cryptographic information, and in response, receives information from the device 11 indicating the verification result of the fourth cryptographic information.

[0076] Step 119 includes the privacy routing system 21 forwarding the message from the privacy routing system 21 to the second user's device 11 based on the verification result of the fourth cryptographic information of step 117. Step 121 includes the second user's device 11 receiving the message from the first user's device 1 via the privacy routing system 21. Figure 1 In an embodiment, the message (ie, at least its body) is forwarded in step 119 to the same device of the second user that transmitted the first cryptographic information and the second cryptographic information in step 101. In an alternative embodiment, the message may be forwarded in step 119 to another device of the second user.

[0077] Typically, the second user's device 11 performs step 101 at least once for each first user with whom the second user wants to communicate, and performs step 121 for each message not discarded by the privacy routing system 21. Typically, the first user's device 1 performs step 103 at least once for each second user with whom the first user wants to communicate, and performs step 109 for each message the first user wants to send. The first user's device 1 performs steps 105 and 107 at least once after each execution of step 103, and may perform steps 105 and 107 before each execution of step 109 (to perform re-randomization) to provide even further unlinkability. The privacy routing system 21 performs steps 111-119 for each message transmitted by the first user.

[0078] Figure 1 Devices 1 and 11 in the method may also switch roles, ie, device 1 may be able to perform steps 101 and 121 and device 11 may be able to perform steps 103-109 to allow the second user to send a message to the first user.

[0079] Figure 2 A second embodiment of a method for routing messages via a privacy routing system is shown in FIG. Figure 2 The steps of the method are performed by the privacy routing system 21 and the first user device 1 and the second user device 11, as described in detail in relation to Figure 1 as described.

[0080] Step 140 includes the privacy routing system 21 generating a cryptographic key K associated with the privacy routing system 21 (e.g., a symmetric key or a public key) and optionally another cryptographic key corresponding to the cryptographic key (e.g., a private key corresponding to the aforementioned public key). Since the cryptographic key is not specific to the second user (or the first user), step 140 only needs to be performed once, although it may be performed again in the case of a key update (also called key rotation).

[0081] Step 141 includes the privacy routing system 21 generating a recipient identifier R_ID for the second user. Step 141 is typically performed when an account is created for the second user in the privacy routing system. Each generated recipient identifier is unique on the privacy routing system 21. Step 143 includes the privacy routing system 21 transmitting the recipient identifier R_ID to the device 11 of the second user, the recipient identifier being encrypted using the cryptographic key K 21 Encrypted or unencrypted. Figure 2 In the embodiment of the present invention, the cryptographic key K 21 It is also transmitted in step 143. In an alternative embodiment, the privacy routing system 21 shares the cryptographic key K in a different manner. 21Step 145 comprises the second user's device 11 receiving the recipient identifier R_ID and the cryptographic key K 21 Steps 141 - 145 are typically performed for each recipient / user of the privacy routing system 21 .

[0082] Step 147 includes the second user's device 11 generating a sender identifier S_ID for the first user. The sender identifier S_ID is unique to the first user specific to the second user, but the first user does not need to know the sender identifier S_ID. In an alternative embodiment, the sender identifier S_ID is generated by the privacy routing system 21. The second user's device 11 may be able to generate a new sender identifier for the first user and a new associated forwarding strategy when needed (e.g., when establishing a new communication relationship with the first user for a different role).

[0083] Optionally, after device 11 has performed step 147, device 11 may transmit the (updated) forwarding policy to privacy routing system 21. By allowing the second user to define the forwarding policy, the number of undesirable messages presented to the second user may be minimized. For example, the second user (Bob) may be able to update its forwarding policy with the privacy routing system and have the privacy routing system block messages from the first user (Alice). The second user may perform this action, for example, when a business transaction between the second user and the first user has terminated, when the first user is about to start spamming the second user, when the second user discovers that the first user has shared an encrypted combination with an unauthorized third party, or for other reasons.

[0084] For example, the forwarding policy may include whitelisting, blacklisting, a combination thereof, a time-based policy, or even more complex policies. Examples of more complex policies are "this sender identifier is whitelisted by default" or "only forward messages from sender identifiers in this group if: the message is the first message, or the message is within two weeks from the forwarding of the first message for this sender identifier". Examples of time-based forwarding policies include only delivering messages from colleagues of the second user between 9.00 and 18.00, exclusively delivering messages from close family members of the second user during sleeping hours, and temporarily forwarding all messages of the second user to other people during the second user's vacation.

[0085] For example, the protocol used by the second device to configure its forwarding strategy and / or sender identifier may be HTTP, HTTPS, RADIUS, DIAMETER, SIP, DHCP, or DIDcomm. For example, XML, JSON, JSON-LD, JWT, JWE, SDP, binary, text, or ASN1 may be used to encode the data transmitted in these configuration messages.

[0086] Step 149 includes using the cryptographic key K received in step 145 21 The sender identifier is encrypted. If the recipient identifier R_ID received in step 145 was not received in encrypted form, the recipient identifier R_ID is also encrypted with the cryptographic key K 21 The recipient identifier and the sender identifier may then be jointly encrypted in the composite cryptographic information. In an alternative embodiment, the recipient identifier R_ID and the sender identifier S_ID are encrypted with different cryptographic keys associated with the private routing system 21. The device 11 of the second user may perform steps 149 and 151 once per first user, or multiple times per first user to provide even further unlinkability.

[0087] exist Figure 2 In the embodiment, Figure 1 Step 101 is implemented by step 151. Step 151 includes the second user's device 11 transmitting the first cryptographic information and the second cryptographic information to the first user's device 1, preferably directly but optionally via the privacy routing system 21. Figure 1 As in the embodiment of , the first cryptographic information includes an encrypted recipient identifier R_ID. Figure 2 In an embodiment of the present invention, the second cryptographic information includes the encrypted sender identifier S_ID. If the recipient identifier and the sender identifier are jointly encrypted in step 149, the composite cryptographic information is transmitted in step 151. The first part of the composite cryptographic information corresponds to the first cryptographic information, and the second part of the composite cryptographic information corresponds to the second cryptographic information.

[0088] exist Figure 2 In the embodiment, Figure 1 Step 103 is implemented by step 153, and Figure 1 Step 109 is implemented by step 155. Step 153 includes device 1 receiving the first password information and the second password information. Figure 2 In an embodiment of the present invention, the second cryptographic information includes an encrypted sender identifier S_ID. Step 105 includes device 1 including the recipient identifier encrypted with a cryptographic key associated with the privacy routing system in the third cryptographic information. Step 107 includes determining fourth cryptographic information based on the second cryptographic information. Step 155 includes transmitting a message from the first user's device 1 to the privacy routing system 21. The message includes the third cryptographic information determined in step 105 and the fourth cryptographic information determined in step 107. Figure 2 In an embodiment of the present invention, the fourth cryptographic information comprises an encrypted sender identifier S_ID.

[0089] exist Figure 2 In the embodiment, Figure 1Step 111 of the present invention is implemented by step 157. Step 157 includes the privacy routing system 21 receiving a message from the device 1 of the first user. Step 113 includes the privacy routing system 21 decrypting the recipient identifier R_ID in the third cryptographic information with the cryptographic key or with another cryptographic key corresponding to the cryptographic key. Step 115 includes the privacy routing system 21 identifying the second user based on the recipient identifier decrypted in step 113.

[0090] exist Figure 2 In the embodiment, Figure 1 Step 117 is implemented by step 159. Step 159 includes the privacy routing system 21 decrypting the fourth cryptographic information with the cryptographic key or with the additional cryptographic key. In the above alternative embodiment where the sender identifier is encrypted with a second cryptographic key associated with the privacy routing system, step 159 includes the privacy routing system 21 decrypting the fourth cryptographic information with the second cryptographic key or with a second additional cryptographic key corresponding to the second cryptographic key.

[0091] Step 161 includes checking whether the sender identifier S_ID decrypted in step 159 is included in a sender identifier list. For example, the sender identifier list may be part of the received forwarding policy or may be determined based on the received forwarding policy. The sender identifier list may be a list of blocked sender identifiers or a list of allowed (unblocked) sender identifiers. An anonymous delivery list or a blocking list may be implemented based on sender identifiers using zero-knowledge set membership proofs or cryptographic accumulators, as described with respect to Figures 5 to 9 Will be described.

[0092] exist Figure 2 In an embodiment, a list of sender identifiers associated with the recipient identifier decrypted in step 113 is obtained. Therefore, the list of sender identifiers is specific to the second user. In an alternative embodiment, alternatively or additionally, a list of sender identifiers applicable to all users of the privacy routing system 21 is used. In this alternative embodiment, the sender identifier S_ID can be generated by the privacy routing system 21 (so that each generated sender identifier is unique on the privacy routing system) rather than by the device 11 of the second user, as described with respect to step 147.

[0093] If it is determined in step 161 that the first user is blocked, step 163 is performed. Step 163 includes discarding the message. If it is determined in step 161 that the first user is allowed (ie, not blocked), step 119 is performed. Figure 2In the embodiment of , step 119 is implemented by step 165. Step 165 includes the privacy routing system 21 forwarding the message from the privacy routing system 21 to the second user's device 11. If the privacy routing system 21 receives a forwarding policy from the second user's device 11, the privacy routing system 21 may further forward the message to the second user's device 11 based on the forwarding policy.

[0094] Step 121 includes the second user's device 11 receiving a message from the first user's device 1 via the privacy routing system 21. Figure 2 In the embodiment of the embodiment, step 121 is implemented by step 167. In step 167, only the body of the message is forwarded; the receiver identifier R_ID and the sender identifier S_ID are not forwarded. In an alternative embodiment, in addition to the body of the message, the sender identifier S_ID can also be forwarded.

[0095] Figure 3 and Figure 4 A third embodiment of a method for routing messages via a privacy routing system is shown in FIG. Figure 3 and Figure 4 The steps of the method are performed by the privacy routing system 21 and the first user device 1 and the second user device 11, as described in detail in relation to Figure 1 as described.

[0096] Figure 3 Step 141 of the embodiment includes the privacy routing system 21 generating a recipient identifier R_ID of the second user. Step 141 is typically performed when an account is created for the second user in the privacy routing system. Each generated recipient identifier is unique on the privacy routing system. Step 193 includes the privacy routing system 21 transmitting the recipient identifier R_ID to the device 11 of the second user, the recipient identifier being generated using the cryptographic key K 21 Encrypted or unencrypted. Step 195 comprises the second user's device 11 receiving the recipient identifier R_ID.

[0097] Step 201 includes the second user's device 11 creating a sender-specific cryptographic information item for each sender / first user with whom the second user wishes to communicate and storing it in a memory. For example, the sender-specific cryptographic information item may include a private key and a corresponding public key for each sender. Figure 3 In the embodiment of , each sender is considered allowed / unblocked until it is blocked in step 203. Figure 3 In the embodiment, step 203 is shown as being optionally performed directly after step 201, but in general, step 203 may be performed at any time after step 201. The sender-specific cryptographic information item may be unblocked. Alternatively, a new sender-specific cryptographic information item may be created for the same first user.

[0098] Step 205 comprises the device 11 of the second user transmitting the blocked sender-specific cryptographic information item (i.e., the cryptographic information item associated with the blocked sender / first user) to the privacy routing system 21. Step 207 comprises the privacy routing system 21 receiving the blocked sender-specific cryptographic information item and storing it in a memory associated with the receiver identifier R_ID of the second user. Thus, the privacy routing system only receives sender-specific cryptographic information items that are specific to the blocked user, and therefore cannot associate messages from the same sender if the sender is not blocked. Steps 201-207 may be performed multiple times at different times.

[0099] Then, the method Figure 4 Continue in Figure 3 and Figure 4 In the embodiment, Figure 1 Step 101 by Figure 4 The step 209 shown in FIG. 209 includes the second user's device 11 transmitting the first password information and the second password information to the first user's device 1. Figure 1 As in the embodiment of , the first cryptographic information includes an encrypted recipient identifier R_ID. Figure 3 and Figure 4 In an embodiment of the present invention, the second cryptographic information includes a sender-specific cryptographic key (eg, a public key PUBK ) associated with the second user and specific to the first user. 11 ) or includes a public key associated with the second user and specific to the first user (e.g., a public key PUBK 11 ).

[0100] The one or more predefined values ​​may include fixed values, such as "1", or may be based on the rest of the message content, such as a checksum. Figure 3 and Figure 4 In a variation of the embodiment, the second password information includes different password information. The second user's device 11 needs to ensure that the first user's device 1 is capable of transmitting one or more encrypted and randomized predefined values. This can be achieved in various ways. In addition to the above two methods, a third method includes device 11 transmitting (multiple) encrypted predefined values ​​E and a randomization factor R to device 1, after which device 1 is able to randomize (multiple) encrypted predefined values ​​by optionally calculating E*R^n of a random value n in a finite field specified by the second user's device 11 or the privacy routing system 21. The third method is based on the Paillier encryption scheme.

[0101] exist Figure 3 and Figure 4 In the embodiment, Figure 1Step 103 is implemented by step 211, and Figure 1 Step 109 is implemented by step 215. Step 211 comprises device 1 receiving the first cryptographic information and the second cryptographic information. Step 105 comprises device 1 including the recipient identifier encrypted with the cryptographic key associated with the privacy routing system in the third cryptographic information.

[0102] Step 107 includes determining fourth cryptographic information based on the second cryptographic information. The fourth cryptographic information may be the same as the second cryptographic information, but may alternatively be different. For example, step 107 may include determining the fourth cryptographic information by re-randomizing the second cryptographic information. Alternatively, for example, step 107 may include determining the fourth cryptographic information by using the public key PUBK received as the second cryptographic information or as part of the second cryptographic information in step 211 11 One or more predefined values ​​(eg, "1") are encrypted to determine fourth cryptographic information.

[0103] Step 215 includes transmitting a message from the first user's device 1 to the privacy routing system 21. The message includes the third cryptographic information determined in step 105 and the fourth cryptographic information determined in step 107. Figure 3 and Figure 4 In the embodiment of the present invention, the fourth cryptographic information includes a public key PUBK 11 The encrypted one or more predefined values, for example, the encrypted one or more predefined values ​​received in step 211, a re-randomization of the encrypted one or more predefined values ​​received in step 211, or the public key PUBK received in step 103 by the device 1 itself in step 107 11 One or more predefined values ​​that are encrypted.

[0104] exist Figure 3 and Figure 4 In the embodiment, Figure 1 Step 111 is implemented by step 217. Step 217 includes the privacy routing system 21 receiving a message from the device 1 of the first user. Step 113 includes the privacy routing system 21 decrypting the recipient identifier R_ID in the third cryptographic information with the cryptographic key or with another cryptographic key corresponding to the cryptographic key. Step 115 includes the privacy routing system 21 identifying the second user based on the recipient identifier decrypted in step 113. Figure 3 and Figure 4 In an embodiment of the present invention, step 115 includes sub-step 219. Step 219 includes obtaining a plurality of blocked sender-specific cryptographic information items received from the memory in step 207 based on the recipient identifier decrypted in step 113.

[0105] exist Figure 3 and Figure 4In the embodiment, Figure 1 Step 117 is implemented by step 221. Step 221 includes attempting to decrypt the fourth cryptographic information with the plurality of blocked sender-specific cryptographic information items to obtain one or more predefined values. The privacy routing system 21 uses the one or more predefined values ​​for the second user's device 11 to determine whether they can decrypt the fourth cryptographic information. For example, the one or more predefined values ​​can be standardized.

[0106] Step 223 includes determining whether the attempt to decrypt the fourth cryptographic information produces one or more predefined values. If it is determined in step 223 that the attempt to decrypt the fourth cryptographic information produces one or more predefined values, step 225 is performed. Step 225 includes discarding the message. If it is determined in step 223 that the attempt to decrypt the fourth cryptographic information does not produce one or more predefined values, step 119 is performed.

[0107] In an alternative embodiment, step 223 includes determining whether the attempt to decrypt the fourth cryptographic information is successful, and if it is determined in step 223 that the attempt to decrypt the fourth cryptographic information is successful, then executing step 225, and if it is determined in step 223 that the attempt to decrypt the fourth cryptographic information is unsuccessful, then executing step 119. This alternative embodiment is beneficial when the cryptographic method indicates that the decryption is successful, but not all cryptographic methods do so.

[0108] exist Figure 3 and Figure 4 In the embodiment of the present invention, step 119 is implemented by step 227. Step 227 includes the privacy routing system 21 forwarding the message from the privacy routing system 21 to the second user's device 11. In addition to the body of the message, the forwarded message includes fourth cryptographic information, that is, a public key PUBK 11 One or more predefined values ​​to be encrypted. Figure 3 and Figure 4 In the embodiment, Figure 1 Step 121 is implemented by step 229. Step 229 includes the second user's device 11 receiving the message, that is, the body of the message and the public key PUBK 11 One or more predefined values ​​that are encrypted.

[0109] Step 231 comprises the second user's device 11 obtaining from a memory one or more unblocked sender-specific cryptographic information items, which were stored in the memory in step 201. Figure 3 and Figure 4In the embodiment of the present invention, in step 231, the sender-specific cryptographic information items not marked as blocked in step 203 are obtained. Step 233 comprises the device 11 of the second user attempting to decrypt the fourth cryptographic information with one or more unblocked sender-specific cryptographic information items obtained in step 231 to obtain one or more predefined values ​​(e.g., "1") or a checksum value based on the message content. Figure 3 and Figure 4 In the embodiment of , all unblocked sender-specific cryptographic information items are obtained from the memory. Then, the device 11 of the second user attempts to decrypt the fourth cryptographic information with each of the unblocked sender-specific cryptographic information items, for example sequentially.

[0110] Step 235 includes determining whether the attempt to decrypt the fourth cryptographic information produces one or more predefined values. If it is determined in step 235 that the attempt to decrypt the fourth cryptographic information does not produce one or more predefined values, step 237 is performed. Step 237 includes the device 11 of the second user discarding the message. If it is determined in step 223 that the attempt to decrypt the fourth cryptographic information produces one or more predefined values, step 239 is performed. Step 239 includes the device 11 of the second user presenting (the body of) the message to the user via the user interface.

[0111] In the above-mentioned alternative embodiment, step 235 includes determining whether the attempt to decrypt the fourth password information is successful. If it is determined in step 235 that the attempt to decrypt the fourth password information is unsuccessful, step 237 is executed; if it is determined in step 235 that the attempt to decrypt the fourth password information is successful, step 239 is executed.

[0112] Therefore, the second user's device 11 itself also blocks / discards the message because the blocked sender may transmit a fourth cryptographic information that is not determined based on the second cryptographic information, and the privacy routing system will not be able to decrypt the fourth cryptographic information. Alternatively, if the checksum value is used as a predefined value, the message that is destroyed in transmission will have an incorrect checksum value. Since the second user device has an unblocked sender-specific cryptographic information item (which the privacy routing system does not have), it can block / discard these malicious or damaged messages. In another embodiment, steps 235 and 237 are omitted and step 239 is performed even if decrypting the fourth cryptographic information does not produce one or more predefined values. However, this may mean that some of the messages presented to the user may be malicious or damaged messages.

[0113] exist Figure 3 and Figure 4In the embodiment of the present invention, the device 11 of the second user does not transmit the sender identifier to the device 1 of the first user, and the message transmitted by the device 1 of the first user in step 215 therefore also does not include the sender identifier. In an alternative embodiment, the device 11 of the second user transmits the sender identifier encrypted with a cryptographic key associated with the second user to the device 1 of the second user, for example as part of the message body. In this alternative embodiment, the message transmitted by the device 1 of the first user in step 215 also includes the encrypted sender identifier, and the encrypted sender identifier is also forwarded to the device 11 in step 227.

[0114] In this alternative embodiment, the second user's device 11 may first decrypt the sender identifier and then obtain only the unblocked sender-specific cryptographic information items associated with the sender identifier. If no unblocked sender-specific cryptographic information items are associated with the sender identifier, the message is discarded. The sender identifier is not encrypted with the public key of the privacy routing system 21 to prevent the privacy routing system 21 itself from performing privacy-invading message associations.

[0115] Figures 5 to 9 A fourth embodiment of a method for routing messages via a privacy routing system is shown in FIG. Figures 5 to 9 The steps of the method are performed by the privacy routing system 21 and the first user device 1 and the second user device 11, as described in detail in relation to Figure 1 In the fourth embodiment, a cryptographic accumulator is used. The cryptographic accumulator can be based on an asymmetric accumulator: Merkle tree, bilinear map construction and modular exponentiation (RSA accumulator), or based on a symmetric accumulator: Bloom filter, Cuckoo filter.

[0116] Specifically, in this fourth embodiment, an anonymous revocation component (ARC) is used with a connection algorithm based on a negative dynamic cryptographic accumulator (ACCN) to allow a second user to put a first user into (and if necessary, release it again) a blacklist. In addition, the first user is allowed to anonymously prove to the privacy routing system 21 with a zero-knowledge proof (ZKP) that the first user is not on the second user's blacklist. The ARC and connection based on ACCN are described in the paper "Accumulators with Applications to Anonymity-Preserving Revocation" by Baldimtsi, Camenisch, Dubovitskaya, Lysyanskaya, Reyzin, Samelin, Yakoubov, presented at the 2017 IEEE European Symposium on Security and Privacy.

[0117] The system described in this paper requires a Revocation Authority (RA) that helps issuers add new users to the system, maintains the necessary Revocation Information (RI), and changes the revocation status of users in the system. Figures 5 to 9 In a fourth embodiment, these RA functions are split between the device 11 and the privacy routing system 21. Revocation in ARC is accomplished via a special value: a revocation handle (rh). The revocation handle can be embedded in a revocable object (e.g., a message that a first user wants to send to a second user via the privacy routing system 21). The rh is bound to the revocable object via a signature.

[0118] Figure 5 A new second user is shown being added to the privacy routing system 21 . Figure 5 Step 141 of the embodiment includes the privacy routing system 21 generating a recipient identifier R_ID of the second user. Each generated recipient identifier is unique on the privacy routing system. Step 193 includes the privacy routing system 21 transmitting the recipient identifier R_ID to the device 11 of the second user, the recipient identifier being encrypted with the cryptographic key K 21 Encrypted or unencrypted. Step 195 comprises the second user's device 11 receiving the recipient identifier R_ID.

[0119] Step 251 includes the second user's device 11 running the SPGen algorithm described in the above-mentioned paper "Accumulators for Anonymity Preservation Revocation". The SPGen algorithm has the following inputs and outputs:

[0120] a. Input:

[0121] i. Global system parameters spar g (Group description, ZKP parameters, etc.)

[0122] b. Output:

[0123] i. Undo the system parameter spar r =(spar g , RS), where RS specifies the set of supported undo handles.

[0124] Step 253 includes the second user's device 11 running the RKGen algorithm described in the above-mentioned paper "Accumulators for Anonymity Preserving Revocation". The RKGen algorithm has the following inputs and outputs:

[0125] a. Input:

[0126] i. Undo system parameters (spar r )

[0127] b. Output:

[0128] i. Revoke public key (rpk),

[0129] ii. Revocation key (rsk) = (

[0130] 1. Signature key (sgk),

[0131] 2. Secret key (sk),

[0132] 3. Auxiliary maintenance information of accumulator (m)

[0133] ),

[0134] iii. and revocation information (RI) = (

[0135] 1. Accumulator value (a),

[0136] 2. List of all update messages (M),

[0137] 3. The signature on RI (σ), )

[0139] Step 255 includes the device 11 of the second user transmitting the rpk and RI obtained in step 253 to the privacy routing system 21. Step 257 includes the privacy routing system 21 receiving the rpk and RI and storing them in a memory associated with the recipient identifier R_ID of the second user. Figures 5 to 9 In the embodiment of the present invention, the SPGen algorithm is executed by the second user's device 11. In an alternative embodiment, the SPGen algorithm is executed by the privacy routing system 21, which then spar r Transmitted to the device 11 of the second user.

[0140] Figure 6 Shows that in the implementation Figure 5After the method, the new first user can communicate with the second user. Step 261 includes the second user's device 11 running the connection algorithm described in the above-mentioned paper "Accumulator applied to anonymity preservation revocation". The connection algorithm has the following inputs and outputs:

[0141] a. Input:

[0142] i. Revocation key (rsk)

[0143] ii. Revoke public key (rpk)

[0144] iii. Revocation Information (RI)

[0145] iv. Optionally the first user's revocation handle (rh'), provided that the first user has been blacklisted. If the first user connects for the first time, the input rh' is ⊥, and the algorithm picks a new rh.

[0146] b. Output:

[0147] i. Witness to the revocation handle (w rh ) and the revocation handle (rh).

[0148] In step 261, the first user connects for the first time and therefore inputs rh' as ​​⊥. Step 263 comprises the second user's device 11 transmitting (securely) the first cryptographic information and the second cryptographic information to the first user's device 1. Figure 1 As in the embodiment of the present invention, the first cryptographic information includes an encrypted recipient identifier R_ID (E 21 (R_ID)). Figures 5 to 9 In the embodiment of the present invention, the second cryptographic information includes the revocation handle (rh) and the witness (wh) of the revocation handle obtained in step 261. rh ) and in Figure 5 The revocation public key (rpk) obtained in step 253.

[0149] exist Figures 5 to 9 In the embodiment, Figure 1 Step 103 is implemented by step 265. Step 265 includes device 1 receiving the first cryptographic information and the second cryptographic information transmitted in step 263.

[0150] Figure 7 Shows that in the implementation Figure 5 and Figure 6 After the method, the first user sends a message to the second user. Step 267 includes the first user's device 1 transmitting a request for the RI associated with the second user from the privacy routing system 21. As described above, the RI includes the accumulator value and other information necessary to generate the latest revocation token rt. The request includes the first cryptographic information, i.e., the encrypted recipient identifier.

[0151] Step 269 includes the privacy routing system 21 receiving the request. Step 271 includes the privacy routing system 21 transmitting the RI associated with the second user to the first user's device 1. Step 273 includes the first user's device 1 receiving the requested RI.

[0152] Step 105 comprises the device 1 including the encrypted recipient identifier as received in step 265 in the third cryptographic information. Step 107 comprises determining fourth cryptographic information based on the second cryptographic information. Figures 5 to 9 In the embodiment of , step 107 is implemented by steps 281 and 283. Step 281 includes generating the first user's commitment (C) to rh and the decommitment value (o). For each new revocation token rt, the first user generates a new commitment to rh in order to avoid making the first user's token associable.

[0153] Step 283 includes the first user's device 1 running the RevTokenGen algorithm described in the above-mentioned paper "Accumulator for Anonymity Preserving Revocation". The RevTokenGen algorithm has the following inputs and outputs:

[0154] a. Input:

[0155] i. The first user's revocation handle (rh); receiving in step 265

[0156] ii. The first user's commitment to rh (C); generated in step 281

[0157] iii. Release commitment value (o); generated in step 281

[0158] iv. Revocation Information (RI); received in step 273

[0159] v. The first user's witness to rh (w rh ); receiving in step 265

[0160] vi. Revocation public key (rpk); receive in step 265

[0161] b. Output:

[0162] i. The first user's revocation token (rt), which is the ZKP whose revocation handle has not been revoked.

[0163] exist Figures 5 to 9 In an embodiment, each time the first user sends a message to the second user, the first user's device 1 generates a new revocation token (and generates a different commitment). This ensures the uncorrelability between different messages sent by the first user. In an alternative embodiment, new revocation tokens are generated less frequently.

[0164] Step 285 includes determining whether a valid token was generated in step 283. This is done by having the first user run the RevTokenVer algorithm on his or her own revocation token. If the revocation token is valid, then step 287 is performed next. Step 287 includes transmitting a message from the first user's device 1 to the privacy routing system 21. The message includes the third cryptographic information determined in step 105 and the fourth cryptographic information determined in step 107. The third cryptographic information includes a recipient identifier ( E21 (R_ID)). Figures 5 to 9 In the embodiment of , the fourth cryptographic information includes the revocation token (rt) generated by device 1 in step 283, and further includes the first user's commitment to rh I generated in step 281.

[0165] exist Figures 5 to 9 In the embodiment, Figure 1 Step 111 is implemented by step 289. Step 289 includes the privacy routing system 21 receiving the message as transmitted in step 287 from the device 1 of the first user. Step 113 includes the privacy routing system 21 decrypting the recipient identifier R_ID in the third cryptographic information with the cryptographic key or with another cryptographic key corresponding to the cryptographic key. Step 115 includes the privacy routing system 21 identifying the second user based on the recipient identifier decrypted in step 113.

[0166] exist Figure 2 In the embodiment, Figure 1 Step 117 is implemented by step 291. Step 291 includes the privacy routing system 21 using Figure 7 The cryptographic accumulator (i.e., RI) associated with the identified second user received in step 273 is used to verify the revocation token (rt) received in step 289. Specifically, step 291 includes the privacy routing system 21 running the RevTokenVer algorithm described in the above-mentioned paper "Accumulators Applied to Anonymity Preservation Revocation". The RevTokenVer algorithm has the following inputs and outputs:

[0167] a. Input:

[0168] i. The first user's revocation token (rt); received in step 289

[0169] ii. The first user's commitment to rh (C); receiving in step 289

[0170] iii. Revocation Information (RI); received in step 257

[0171] iv. Revocation public key (rpk); receiving in step 257

[0172] b. Output:

[0173] i.0 or 1. If 0: the revoked token is invalid. If 1: the revoked token is valid.

[0174] Step 293 includes checking whether the revocation token was determined to be valid in step 291. If the revocation token is invalid, then step 163 is performed. Step 163 includes discarding the message. If the revocation token is valid, then step 119 is performed. Figures 5 to 9 In the embodiment of , step 119 is implemented by step 165. Step 165 includes the privacy routing system 21 forwarding the message from the privacy routing system 21 to the second user's device 11. Step 121 includes the second user's device 11 receiving the message from the first user's device 1 via the privacy routing system 21. Figures 5 to 9 In the embodiment of the present invention, step 121 is implemented by step 167. In step 167, only the body of the message is received.

[0175] Figure 8 Shows that in the implementation Figure 5 and Figure 6 After the method, the second user adds the first user to the blacklist. Step 401 includes the second user's device 11 running the revocation algorithm described in the above paper "Accumulator for Anonymity Preservation Revocation". The revocation algorithm has the following inputs and outputs:

[0176] a. Input:

[0177] i. The revocation handle (rh) of the first user that the second user wants to blacklist (and therefore wants to add to the accumulator)

[0178] ii.Revocation key (rsk)

[0179] iii. Revocation Information (RI)

[0180] b. Output:

[0181] ii. Updated revocation information (RI) = (

[0182] 1. The updated accumulator value (a),

[0183] 2. An updated list of all update messages (M),

[0184] 3. New signature (σ), )

[0186] Step 403 includes the second user's device 11 transmitting the updated revocation information (RI) to the privacy routing system 21. Step 405 includes the privacy routing system 21 receiving the updated revocation information. Figure 8After executing the method Figure 7 When executing Figure 7 At step 285, the token generated in step 283 will be determined to be invalid.

[0187] Fig. 9 FIG. 1 shows a first user transmitting a request to be removed from a second user's blacklist. Figures 5 to 7 The step 411 includes the first user's device 1 transmitting a request to remove the first user from the blacklist to the privacy routing system 21. The first user previously received a revocation handle (rh) in step 265 and included the revocation handle in the request. The request further includes third cryptographic information, i.e., an encrypted recipient identifier.

[0188] Step 413 includes the privacy routing system 21 receiving the request, and step 415 includes the privacy routing system 21 forwarding the request to the second user's device 11 without the third cryptographic information. The privacy routing system 21 and the second user may have agreed on a maximum number of join-while-still-revoked-requests that will be forwarded by the privacy routing system to the second user's device. Step 417 includes the second user's device 11 receiving the forwarded request. Step 419 includes the second user's device 11 determining whether to remove the first user from the blacklist as requested by the first user.

[0189] If the second user agrees to remove the first user from the second user's blacklist, then step 421 is performed next. Step 421 includes the second user's device 11 running the connection algorithm again. The connection algorithm has been described above with respect to step 261. At this point, there is an existing revocation handle for the first user, which has been received in step 417. This revocation handle is provided to the algorithm as input (rh'). Then, step 423 includes the second user's device 11 (securely) transmitting the new revocation handle (rh) obtained in step 421 and the new witness to the revocation handle (w rh ).

[0190] Step 425 includes device 1 receiving the new revocation handle (rh) and the new witness to the revocation handle (wh) transmitted in step 423. rh ). Steps 423 and 425 are similar to Figure 6 Steps 263 and 265 are identical to those of step 425, except that the encrypted recipient identifier and revocation public key (rpk) need not be transmitted, as these have not changed. Figure 7 Performed in the same manner as described.

[0191] exist Figures 5 to 9 In an embodiment, ARC is implemented together with a connection algorithm based on a negative cryptographic dynamic accumulator ACCN to allow a second user to put a first user into a blacklist (and, if necessary, put him out again). In an alternative embodiment, ARC is implemented together with a connection algorithm based on a positive cryptographic dynamic accumulator ACCP to allow a second user to put a first user into a whitelist (and, if necessary, put him out again). In this alternative embodiment, the device 1 of the first user will run the RevTokenGen algorithm to obtain a revocation token proving that the first user is on the whitelist (rather than not on the blacklist).

[0192] Instead of using a dynamic accumulator, an additive accumulator can be used in case of blacklisting. This disables the possibility of reconnecting after being blocked, but makes the communication slightly faster. Instead of using a dynamic accumulator, a subtractive accumulator can be used in case of whitelisting. However, this means that the first person cannot establish communication with the second person if he is not on the initial whitelist of the second person. The connection protocol is then no longer used.

[0193] Fig.10 An embodiment of a messaging system 31 is shown in FIG. 1 , which includes a privacy routing system 21, a first user's device 1, and a second user's device 11. The first user device 1 and the second user device 11 may include one or more mobile devices (e.g., mobile phones) and / or one or more fixed devices (e.g., desktop PCs).

[0194] The privacy routing system 21 includes a receiver 23, a transmitter 24, a processor 25, and a memory 27. The processor 25 is configured to receive a message from the first user's device 1 via the receiver 23. The message includes third cryptographic information and fourth cryptographic information. The third cryptographic information includes a recipient identifier encrypted with a cryptographic key associated with the privacy routing system 21.

[0195] The processor 25 is further configured to decrypt the recipient identifier in the third cryptographic information using the cryptographic key or using another cryptographic key corresponding to the cryptographic key, identify the second user based on the decrypted recipient identifier, verify the fourth cryptographic information, and forward the message to the second user's device 11 via the transmitter 24 based on the verification result of the fourth cryptographic information.

[0196] The second user device 11 includes a receiver 13, a transmitter 14, a processor 15, and a memory 17. The processor 15 is configured to transmit first cryptographic information and second cryptographic information to the first user's device 1 via the transmitter 14. The first cryptographic information includes a recipient identifier encrypted with a cryptographic key associated with the privacy routing system 21. The recipient identifier is associated with the second user. The processor 15 is further configured to receive a message from the first user's device 1 via the receiver 13 via the privacy routing system 21.

[0197] The first user device 1 comprises a receiver 3, a transmitter 4, a processor 5 and a memory 7. The processor 5 is configured to receive first cryptographic information and second cryptographic information via the receiver 3. The first cryptographic information comprises a recipient identifier encrypted with a cryptographic key associated with the privacy routing system 21. The recipient identifier is associated with the second user.

[0198] The processor 5 is further configured to include the recipient identifier encrypted with the cryptographic key associated with the privacy routing system in the third cryptographic information, determine the fourth cryptographic information based on the second cryptographic information, and transmit the message of the second user to the privacy routing system 21 via the transmitter 4. The message includes the third cryptographic information and the fourth cryptographic information.

[0199] In a first embodiment of the messaging system 31, the processor 5 of the user device 1 is configured to execute Figure 2 In steps 153, 105, 107 and 155, the processor 25 of the privacy routing system 21 is configured to perform Figure 2 The processor 15 of the user equipment 11 is configured to execute steps 140, 141, 143, 157, 113, 115, 159, 161, 163 and 165. Figure 2 Steps 145, 147, 149, 151 and 167.

[0200] In a second embodiment of the messaging system 31, the processor 5 of the user device 1 is configured to execute Figure 3 and Figure 4 In steps 211, 105, 107 and 215, the processor 25 of the privacy routing system 21 is configured to execute Figure 3 and Figure 4 Steps 141, 193, 207, 217, 113, 115 (including sub-step 219), 221, 223, 225 and 227 of the embodiment, and the processor 15 of the user equipment 11 is configured to perform Figure 3 and Figure 4 Steps 195, 201, 203, 205, 209, 229, 231, 233, 235, 237 and 239.

[0201] In a third embodiment of the messaging system 31, the processor 5 of the user device 1 is configured to execute Figures 5 to 9 The processor 25 of the privacy routing system 21 is configured to perform steps 265, 267, 273, 105, 281, 283, 285, 287, 411 and 425. Figures 5 to 9 The processor 15 of the user device 11 is configured to execute steps 141, 193, 257, 269, 271, 289, 113, 115, 291, 293, 163, 165, 405, 413 and 415. Figures 5 to 9 Steps 195, 251, 253, 255, 261, 263, 167, 401, 403, 417, 419, 421 and 423.

[0202] Optionally, the user device 1 is configured not only to transmit messages but also to receive messages. In this case, the processor 5 of the user device 1 can be configured in the same manner as described above with respect to the processor 15 of the user device 11. Optionally, the user device 11 is configured not only to receive messages but also to transmit messages. In this case, the processor 15 of the user device 11 can be configured in the same manner as described above with respect to the processor 5 of the user device 1. Therefore, the processor 5 of the user device 1 and the processor 15 of the user device 11 can be configured in the same manner.

[0203] exist Fig.10 In the illustrated embodiment, the privacy routing system 21 includes a processor 25. In an alternative embodiment, the privacy routing system 21 includes multiple processors. For example, the processor can be a general-purpose processor (e.g., an Intel or AMD processor) or a dedicated processor. For example, the processor can include multiple cores. For example, the processor can run a Unix-based operating system or a Windows operating system. For example, the memory 27 can include a solid-state memory (e.g., one or more solid-state disks (SSDs) made of flash memory) or one or more hard disks.

[0204] The receiver 23 and the transmitter 24 can use one or more communication technologies (wired or wireless) to communicate with other devices on the Internet. The receiver and the transmitter can be combined into a transceiver. The privacy routing system 21 can include other components typical for a network server, such as a power supply.

[0205] exist Fig.10In the illustrated embodiment, user devices 1 and 11 include a processor 5 and a processor 15, respectively. In alternative embodiments, one or more of user devices 1 and 11 include multiple processors. Processors 5 and 15 may be general-purpose processors (e.g., ARM, Qualcomm, AMD, or Intel processors) or dedicated processors. For example, processors 5 and 15 may run Google Android, Apple iOS, Unix-based operating systems, or Windows as operating systems.

[0206] The receivers 3 and 13 and transmitters 4 and 14 of the user devices 1 and 11, respectively, can communicate with other devices on the Internet via access points / base stations using one or more wired or wireless communication technologies (such as Ethernet, Wi-Fi, LTE and / or 5G New Radio). The receiver and transmitter of the user device can be combined into a transceiver. The user devices 1 and 11 may include other components typical for user devices, such as a display and / or a microphone.

[0207] Fig.11 Describes the demonstration that can be performed as reference Figures 1 to 9 A block diagram of an exemplary data processing system for the described methods.

[0208] like Fig.11 As shown, data processing system 300 may include at least one processor 302 coupled to memory element 304 via system bus 306. Therefore, the data processing system may store program code in memory element 304. Further, processor 302 may execute program code accessed from memory element 304 via system bus 306. In one aspect, the data processing system may be implemented as a computer suitable for storing and / or executing program code. However, it should be understood that data processing system 300 may be implemented in the form of any system including a processor and a memory capable of performing the functions described in this specification.

[0209] Memory element 304 may include one or more physical memory devices, such as local memory 308 and one or more mass storage devices 310. Local memory may refer to random access memory or other (multiple) non-persistent memory devices commonly used during the actual execution of program code. Mass storage devices may be implemented as hard drives or other persistent data storage devices. Processing system 300 may also include one or more cache memories (not shown) that provide temporary storage of at least some program code to reduce the number of times program code must be retrieved from mass storage device 310 during execution.

[0210] Input / output (I / O) devices, depicted as input device 312 and output device 314, may optionally be coupled to the data processing system. Examples of input devices may include, but are not limited to, a keyboard, a pointing device such as a mouse, etc. Examples of output devices may include, but are not limited to, a monitor or display, speakers, etc. Input devices and / or output devices may be coupled to the data processing system directly or through intervening I / O controllers.

[0211] In an embodiment, the input device and the output device may be implemented as a combined input / output device (in Fig.11 312 and output device 314). An example of such a combined device is a touch-sensitive display, sometimes referred to as a "touch screen display" or simply a "touch screen." In such an embodiment, input to the device can be provided by movement of a physical object (e.g., a stylus or a user's finger) on or near the touch screen display.

[0212] Network adapter 316 may also be coupled to data processing system 300 to enable it to couple to other systems, computer systems, remote network devices, and / or remote storage devices through intervening private or public networks. Network adapters may include data receivers for receiving data transmitted by the systems, devices, and / or networks to data processing system 300, and data transmitters for transmitting data from data processing system 300 to the systems, devices, and / or networks. Modems, cable modems, and Ethernet cards are examples of different types of network adapters that may be used with data processing system 300.

[0213] like Fig.11 As depicted, memory element 304 may store application programs 318. In various embodiments, application programs 318 may be stored in local memory 308, one or more mass storage devices 310, or separate from local memory and mass storage devices. It should be understood that data processing system 300 may further execute an operating system (OS) that may facilitate the execution of application programs 318. Fig.11 318). Application 318 implemented in the form of executable program code may be executed by data processing system 300 (eg, by processor 302). In response to executing the application, data processing system 300 may be configured to perform one or more operations or method steps described herein.

[0214] Various embodiments of the present invention may be implemented as a program product for use with a computer system, wherein the (multiple) programs of the program product define the functions of the embodiments (including the methods described herein). In one embodiment, the (multiple) programs may be contained on various non-transient computer-readable storage media, wherein, as used herein, the expression "non-transient computer-readable storage medium" includes all computer-readable media, with the only exception of temporarily propagated signals. In another embodiment, the (multiple) programs may be contained on various transient computer-readable storage media. Illustrative computer-readable storage media include, but are not limited to: (i) non-writable storage media on which information is permanently stored (e.g., a read-only memory device within a computer, such as a CD-ROM disk, a ROM chip, or any type of solid-state non-volatile semiconductor memory readable by a CD-ROM drive); and (ii) writable storage media on which variable information is stored (e.g., a flash memory, a floppy disk within a floppy disk drive, or a hard disk drive, or any type of solid-state random access semiconductor memory). The computer program may run on the processor 302 described herein.

[0215] The terms used herein are for the purpose of describing specific embodiments only and are not intended to limit the present invention. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that when the terms "comprises" and / or "comprising" are used in this specification, they specify the presence of stated features, integers, steps, operations, elements and / or parts, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, parts and / or groups thereof.

[0216] The corresponding structures, materials, actions, and equivalents of all means or step-plus-function elements in the following claims are intended to include any structure, material, or action that performs a function in combination with other claimed elements that are explicitly claimed. The description of the embodiments of the present invention has been presented for illustrative purposes, but the description is not intended to be exhaustive or to limit the implementation to the disclosed form. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope of the present invention. The selection and description of the embodiments are intended to best explain the principles of the present invention and some practical applications, and when suitable for the specific purpose contemplated, enable others of ordinary skill in the art to understand the present invention for various embodiments with various modifications.

Claims

1. A method for routing a message via a privacy routing system, the method comprising: - receiving (103) at a device of the first user first cryptographic information and second cryptographic information, the first cryptographic information comprising a recipient identifier encrypted with a cryptographic key associated with the private routing system, the recipient identifier being associated with the second user; - transmitting (109) a message from the first user's device to the privacy routing system, the message comprising third cryptographic information and fourth cryptographic information, the third cryptographic information comprising the recipient identifier encrypted with the cryptographic key associated with the privacy routing system, the fourth cryptographic information having been determined based on the second cryptographic information; - decrypting the recipient identifier in the third cryptographic information at the privacy routing system using the cryptographic key or using another cryptographic key corresponding to the cryptographic key (113); - identifying (115) the second user at the privacy routing system based on the decrypted recipient identifier; - verifying (117) the fourth cryptographic information; as well as - forwarding (119) the message from the privacy routing system to the device of the second user based on the verification result of the fourth cryptographic information.

2. A first user equipment (1) for use in the method according to claim 1, the first user equipment (1) comprising at least one processor (5), the at least one processor being configured to: - receiving first cryptographic information and second cryptographic information, the first cryptographic information comprising a recipient identifier encrypted with a cryptographic key associated with the privacy routing system, the recipient identifier being associated with a second user, - including in third cryptographic information the recipient identifier encrypted with the cryptographic key associated with the private routing system, - determining fourth cryptographic information based on the second cryptographic information, and - transmitting a message of the second user to the privacy routing system, the message comprising the third cryptographic information and the fourth cryptographic information.

3. The first user equipment (1) according to claim 2, wherein: The at least one processor (5) is configured to determine the fourth cryptographic information by re-randomizing the second cryptographic information, and / or to determine the third cryptographic information by re-randomizing the first cryptographic information.

4. The first user equipment (1) according to claim 2 or 3, wherein: The second cryptographic information includes one or more predefined values ​​encrypted with a sender-specific cryptographic key associated with the second user and specific to the first user, and the fourth cryptographic information includes the second cryptographic information or a randomization of the second cryptographic information.

5. The first user equipment (1) according to claim 2, wherein: The second cryptographic information includes a public key associated with the second user and specific to the first user, and the fourth cryptographic information includes one or more predefined values ​​encrypted with the public key.

6. A second user equipment (11) for use in the method according to claim 1, the second user equipment (11) comprising at least one processor (15), the at least one processor being configured to: - transmitting first cryptographic information and second cryptographic information to a device of the first user, the first cryptographic information comprising a recipient identifier encrypted with a cryptographic key associated with the privacy routing system, the recipient identifier being associated with the second user, and -Receiving a message from the first user's device via the privacy routing system.

7. The second user equipment (11) according to claim 6, wherein: The message includes fourth cryptographic information determined based on the second cryptographic information, and the at least one processor (15) is configured to: - obtaining one or more unblocked sender-specific cryptographic information items from a memory, - attempting to decrypt the fourth cryptographic information using the one or more unblocked sender-specific cryptographic information items, - if an attempt to decrypt the fourth cryptographic information does not produce the one or more predefined values, discarding the message, and - If the attempt to decrypt the fourth cryptographic information produces one or more predefined values ​​and / or the attempt is successful, presenting the message to the user via the user interface.

8. The second user equipment (11) according to claim 6 or 7, wherein: The at least one processor (15) is configured to: - receiving an encrypted recipient identifier from the privacy routing system, the recipient identifier encrypted with a cryptographic key associated with the privacy routing system, and - Creating the first cryptographic information by copying or re-randomizing the encrypted recipient identifier of the first user.

9. The second user equipment (11) according to any one of claims 6 to 8, wherein: The at least one processor (15) is configured to transmit the first cryptographic information and the second cryptographic information to devices of a plurality of users, the plurality of users including the first user.

10. A privacy routing system (21) for routing messages, the privacy routing system (21) comprising at least one processor (25), the at least one processor being configured to: - receiving a message from a device of the first user, the message comprising third cryptographic information and fourth cryptographic information, the third cryptographic information comprising a recipient identifier encrypted with a cryptographic key associated with the private routing system, - decrypting the recipient identifier in the third cryptographic information using the cryptographic key or using another cryptographic key corresponding to the cryptographic key, - identifying the second user based on the decrypted recipient identifier, - verifying the fourth cryptographic information, and - forwarding the message to the device of the second user based on the verification result of the fourth cryptographic information.

11. The privacy routing system (21) as claimed in claim 10, wherein: The fourth cryptographic information includes a sender identifier encrypted with the cryptographic key or with a second cryptographic key associated with the privacy routing system, and the at least one processor (25) is configured to: verify the fourth cryptographic information by decrypting the fourth cryptographic information with the cryptographic key, with the second cryptographic key, with the additional cryptographic key, with another cryptographic key corresponding to the cryptographic key, or with a second additional cryptographic key corresponding to the second cryptographic key, and forward the message to the device of the second user based on whether the sender identifier is included in the sender identifier list.

12. The privacy routing system (21) as claimed in claim 10, wherein: The at least one processor (25) is configured to: - obtaining from a memory a plurality of blocked sender-specific cryptographic information items based on the decrypted recipient identifier, - verifying the fourth cryptographic information by attempting to decrypt the fourth cryptographic information using the plurality of blocked sender-specific cryptographic information items, - if an attempt to decrypt the fourth cryptographic information produces one or more predefined values ​​and / or the attempt is successful, discarding the message, and - If the attempt to decrypt the fourth cryptographic information does not produce the one or more predefined values ​​or the attempt is unsuccessful, forwarding the message to the device of the second user.

13. The privacy routing system (21) as claimed in claim 10, wherein: The fourth cryptographic information includes a revocation token generated by a device of the first user, and the at least one processor (25) is configured to: - get the password accumulator, - verifying the fourth cryptographic information by checking the revocation token with the cryptographic accumulator, and - forwarding the message to the second user's device based on whether the revocation token is determined to be valid.

14. The privacy routing system (21) according to any one of claims 9 to 13, wherein: The at least one processor (25) is configured to receive a forwarding policy from the second user's device and to forward the message to the second user's device further based on the forwarding policy.

15. A messaging system (31), comprising the privacy routing system (21) according to claim 10, the first user device (1) according to claim 2, and the second user device (11) according to claim 6.

16. A computer program product comprising instructions which, when executed by a privacy routing system, cause the privacy routing system to perform the following steps: - receiving a message from a device of the first user, the message comprising third cryptographic information and fourth cryptographic information, the third cryptographic information comprising a recipient identifier encrypted with a cryptographic key associated with the privacy routing system; - decrypting the recipient identifier in the third cryptographic information using the cryptographic key or using another cryptographic key corresponding to the cryptographic key; - identifying the second user based on the decrypted recipient identifier; - verifying the fourth password information; as well as - forwarding the message to the device of the second user based on the verification result of the fourth cryptographic information.

17. A computer program product, the computer program product comprising instructions which, when executed by a first user device, cause the first user device to perform the following steps: - receiving first cryptographic information and second cryptographic information, the first cryptographic information comprising a recipient identifier encrypted with a cryptographic key associated with the privacy routing system according to claim 10, the recipient identifier being associated with a second user; - including the recipient identifier encrypted with the cryptographic key associated with the privacy routing system in third cryptographic information; - determining fourth cryptographic information based on the second cryptographic information; and - transmitting a message of the second user to the privacy routing system, the message comprising the third cryptographic information and the fourth cryptographic information.

18. A computer program product, the computer program product comprising instructions which, when executed by a second user device, cause the second user device to perform the following steps: - transmitting first cryptographic information and second cryptographic information to a device of the first user, the first cryptographic information comprising a recipient identifier encrypted with a cryptographic key associated with the privacy routing system, the recipient identifier being associated with the second user; and - Receiving a message from the first user's device via the privacy routing system according to claim 10.

Images