Secure E-Mail Channel Using Cloud Authentication and Split Keys

The patent introduces a cloud service as an intermediary that stores encrypted e-mails and manages decryption keys. The cloud service acts as a trusted mediator between sender and recipient, ensuring that encrypted content remains protected throughout the delivery process while simplifying the encryption mechanism for end users.

The patent segments the encryption system into separate components: the e-mail client handles composition and initial encryption, the cloud service handles secure storage and key management, and the recipient's client handles decryption. This segmentation allows each component to focus on a specific security function, improving overall reliability without requiring complex end-to-end encryption at every node.

The cloud service acts as a privacy-protecting intermediary that stores encrypted e-mails on behalf of both the e-mail provider and the users. The provider can route and deliver e-mails through the cloud service without being able to read the contents, while users maintain trust that their data remains encrypted and private throughout the process.

The patent applies different security qualities to different parts of the e-mail system: the e-mail provider handles routing and delivery (productivity function), while the cloud service handles encrypted storage (privacy function). This local quality assignment allows each component to perform its function with appropriate security characteristics.

The cloud service performs preliminary actions by pre-establishing secure storage infrastructure and key management systems before any e-mail communication occurs. When a user sends an encrypted e-mail, the system automatically handles storage and key management without requiring real-time coordination or pre-shared passwords between sender and recipient.

The system enables self-service encryption and decryption capabilities for users. Each user can independently encrypt outgoing e-mails and decrypt incoming ones without needing to coordinate with the other party, while the cloud service automatically manages the secure storage and key distribution in the background.

The patent segments key management by creating separate encryption keys for different e-mails and storing them in isolated encrypted containers in the cloud. Each e-mail has its own decryption key stored separately, so compromise of one key does not affect others. This segmentation maintains ease of decryption for legitimate users while reducing centralized attack vulnerability.

The cloud service implements flexible security controls that provide different access levels: full decryption access for authorized recipients, but only encrypted storage for the e-mail provider and limited access for the cloud service itself. This layered approach enables easy decryption for users while protecting against centralized compromises through controlled access.