Central Email Encryption System with Recipient Enrollment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing end-to-end email encryption solutions are inefficient for companies as they require repetitive certificate retrieval, lack central control for virus scanning and content checking, and do not allow delegation rules, especially when recipients lack available encryption keys.
Innovation Solution
A method for establishing a secure email communication channel where an encryption system sends an enrolment message to recipients, allowing them to choose how to secure emails, either by providing a public key, generating a new key, or accessing via a webmail interface, without sharing private keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If end-to-end email encryption is implemented with certificate exchange between senders and recipients, then email security is improved, but the process becomes time-consuming when multiple senders need to retrieve the same recipient's certificate
Solution Approach 1:
The patent introduces a central encryption system acting as an intermediary that stores and manages recipient certificates. Instead of direct peer-to-peer certificate exchange, senders request certificates through the central system, which provides them upon authentication. This mediator approach maintains security while eliminating repeated certificate retrieval operations.
Solution Approach 2:
The central encryption system pre-stores recipient certificates in a secure database before they are needed. When a sender needs to encrypt an email, the certificate is already available in the system, eliminating the need for real-time certificate exchange or generation between parties.
2Reliability
If end-to-end encryption is used, then email confidentiality is improved, but central virus scanning and content checking become impossible
Solution Approach 1:
The system divides the email handling process into two distinct stages: (1) scanning and content checking performed by the mail relay on unencrypted emails, and (2) encryption performed by the encryption system on approved emails. This segmentation allows both virus scanning and confidentiality to coexist by operating at different stages of the email workflow.
Solution Approach 2:
The mail relay acts as an intermediary between the sender and the encryption system, performing security scans on plaintext emails before they reach the encryption stage. This intermediate scanning point enables centralized security control while preserving end-to-end encryption for the actual email transmission.
3Reliability
If end-to-end encryption with recipient certificates is implemented, then email security is improved, but delegation rules in the company email server cannot be defined
Solution Approach 1:
The central encryption system acts as a mediator that intercepts encrypted emails before they reach the final recipient. It can read the encrypted content, apply delegation rules, and forward the email to authorized delegates who can then access and decrypt it using their own certificates. This maintains security while enabling delegation.
Solution Approach 2:
The encryption and decryption operations are extracted from the email server's core functionality and placed in the dedicated central encryption system. This separation allows the email server to handle delegation rules independently while the encryption system manages cryptographic operations, enabling both features to work together.
4Ease of operation
If the encryption system stores recipient public keys centrally, then certificate management is simplified, but security is compromised if the recipient does not have their certificate readily available or accepts the request
Solution Approach 1:
The central encryption system serves as a controlled intermediary that only releases recipient certificates after verifying the sender's authentication credentials and authorization. This mediator role maintains centralized certificate management while ensuring that certificate access is secured through proper authentication and authorization checks.
Data Source
AI summary
A method for establishing a secure e-mail communication channel between a sender (10) and a recipient (5), wherein:1) said sender sends an e-mail addressed to said recipient over an e-mail encryption system (16),2) said encryption system (16) verifies in a database (160) of recipients if a public key of said recipient is available,3) if said public key of said recipient is available, said encryption system encrypts said e-mail with said public key, and forwards the encrypted e-mail to the recipient (5),4) if, on the other hand, said public key of said recipient is not available in said database (160), said encryption system sends instead enrolment message (1220) to said recipient, said enrolment message containing an invitation for said recipient to choose among one of the following options:i) access to said email over a secured web mail interface, orii) sends a reply to said encryption system from which said public key can be extracted, orii) initiate generation of a public key on the recipient's side.