Limiting receiver access to secure read-only communications over a network by preventing access to source-formatted plaintext

[00002] This invention relates to methods and apparatus for securing communications over a network, and more particularly to a method and apparatus for limiting receiver access to the communication.

[00003] With the increased use of computer networks to carry communications there is an increasing need for securing communications. For example, it is well known for a sender to encrypt an e-mail communication, which the receiver then decrypts. It also is known to provide a secure communication channel in which server computers encrypt all data along the channel regardless of the efforts of the sender to encrypt or not encrypt the communication.

[00004] In these known secured communication methods the end user receives either an encrypted or unencrypted message. If encrypted, the user has some manner of decrypting the communication. For example, the user typically has possession of a decryption key. Once the message is received the user stores and accesses the encrypted, unencrypted and/or decrypted message at their desire. These known methods assume that either the receiver is trustworthy, or that the receiver is the one who would be harmed by free disclosure of the information (rather than the sender or some other party). For example, in public key cryptography the receiver can decrypt the message as many times as desired and store the message in an unencrypted form. Thus, the receiver gets control of the received information. As the applications for network communications grow, there are many types of transactions to be handled over a network. In some it may be preferable not to assume the receiver will maintain the security of confidential information. Accordingly, there is a need to provide security which limits the receiver's access to received communications.

[00005] According to the invention, receiver access to a secure communication is determined by the sender. The sender defines an access parameter, such as a number of times a message can be decrypted, an expiration time/date of message access, and/or a contingent event that triggers expiration of the message access.

[00006] According to a preferred embodiment, there is a send configuration module, a key management module, and a receiver module for controlling the security of a message. The send configuration module defines the encryption method, encryption key length, and the control parameter(s). The key management module serves to implement the send configuration parameters during a communication. The receiver module receives and, when permitted, decrypts the message. In an alternative embodiment the sender creates the key and registers the key with the key management module.

[00007] According to an aspect of the invention, the receiver module receives and stores an encrypted message. The receiver module then contacts the key management module and requests a decryption key. The key management module returns the decryption key or a message indicating a denial to send the decryption key. Upon being requested for the decryption key, the key management module tests the control parameter(s) specified by the send configuration module to determine whether a decryption is to be permitted. If permitted, then the decryption key is sent. Otherwise, the ‘denied’ message is sent.

[00008] According to another aspect of the invention, once the message is decrypted by the receiver module, the message is displayed in a bit-mapped window. Specifically, the message is decrypted into a source format. The source format then is converted to a bit-mapped display format. The decryption key and the source material are immediately deleted. Thus, the receiver does not retain possession of the decryption key or of a source format of the message. Only pixel information is present in the remaining bit-mapped display format. The message now is not amenable to easy translation back into a source format. The use of a bit-mapped format serves as a deterrent to copying, storing, manipulating or forwarding the decrypted message. In some embodiments the receiver module prevents the bit-mapped display image of the message from being printed or copied.

[00009] One advantage of the invention is that confidential information can be sent to a receiver with the sender maintaining some control over the receiver's access to the information. For example, the sender can limit the receiver to one view of the information, or to a limited number of views. The sender can additionally or alternatively limit the viewing to a specific time period. The sender additionally or alternatively can limit the viewing to the presence or absence of a specific contingency.

[00010] These and other aspects and advantages of the invention will be better understood by reference to the following detailed description taken in conjunction with the accompanying drawings.

[heading-00015] Host Network Environment

[00016] FIG. 1 shows a wide area network 10 formed by a plurality of network server computers 12 which are interlinked. Each network server computer 12 stores documents accessible to other network server computers 12 and to client computers 14 and networks 16 which link into the wide area network 10. The configuration of the wide area network 10 may change over time as client computers 14 and one or more networks 16 connect and disconnect from the network 10. For example, when a client computer 14 and a network 16 are connected with the network servers computers 12, the wide area network includes such client computer 14 and network 16. As used herein the term computer includes any device or machine capable of accepting data, applying prescribed processes to the data, and supplying results of the processes.

[00017] The wide area network 10 stores information which is accessible to the network server computers 12, remote networks 16 and client computers 14. The information is accessible as documents. The term document as used herein, includes files (as per the Windows operating system usage), documents (as per the MacOS operating system usage), pages (as per the web phraseology usage), and other records, entries or terminology used to describe a unit of a data base, a unit of a file system or a unit of another data collection type, whether or not such units are related or relational.

[00018] The network server computers 12 are formed by main frame computers minicomputers, and/or microcomputers having one or more processors each. The server computers 12 are linked together by wired and/or wireless transfer media, such as conductive wire, fiber optic cable, and/or microwave transmission media, satellite transmission media or other conductive, optic or electromagnetic wave transmission media. The client computers 14 access a network server computer 12 by a similar wired or a wireless transfer medium. For example, a client computer 14 may link into the wide area network 10 using a modem and the standard telephone communication network. Alternative carrier systems such as cable and satellite communication systems also may be used to link into the wide area network 10. Still other private or time-shared carrier systems may be used. In one embodiment the wide area network is a global information network, such as the internet. In another embodiment the wide area network is a private intranet using similar protocols as the internet, but with added security measures and restricted access controls. In still other embodiments the wide area network is a private, or semi-private network using proprietary communication protocols.

[00019] The client computer 14 is any end user computer, and may also be a mainframe computer, minicomputer or microcomputer having one or more microprocessors. The remote network 16 may be a local area network, a network added into the wide area network through an independent service provider (ISP) for the internet, or another group of computers interconnected by wired or wireless transfer media having a configuration which is either fixed or changing over time. Client computers 14 may link into and access the wide area network 10 independently or through a remote network 16.

[heading-00020] Computer System

[00021] The functions of the present invention preferably are performed by programmed digital computers of the type which are well known in the art, an example of which is shown in FIG. 2. A computer system 20 has a display monitor 22, a keyboard 24, a pointing/clicking device 26, a processor 28, random access memory (RAM) 30, a non-volatile storage device such as a hard disk drive 32, a communication or network interface 34 (e.g., modem; ethernet adapter), and a transportable storage media drive 36 which reads transportable storage media 38. In addition other miscellaneous storage devices 40, such as a floppy disk drive, CD-ROM drive, zip drive, bemoulli drive or other magnetic, optical or other storage media, may be included. The various components interface and exchange data and commands through one or more busses 42. The computer system 20 receives information by entry through the keyboard 24, pointing/clicking device 26, the network interface 34 or another input device or input port. The computer system 20 may be any of the types well known in the art, such as a mainframe computer, minicomputer, or microcomputer and may serve as a network server computer 12, remote network 16 computer or a client computer 14. The computer system 20 may even be configured as a workstation, personal computer, network server, or a reduced-feature network terminal device.

[heading-00022] Method for Securing Communication

[00023] Referring to FIG. 3, the computer network 10 is functionally configured to host a send configuration software module 50, a key management software module 52 and a receiver software module 54 according to an embodiment of this invention. The send configuration module 50 is hosted by a computer 20, such as a client computer 14 or a server computer 12. The receiver module 54 is hosted by a different computer 20, such as another client computer 14 or server computer 12. Also, the key management module 52 is hosted by a computer 20, such as a client computer 14 or a server computer 12. In some embodiments any one or more of these computers are part of the remote network 16.

[00024] The communication paths 56, 58, 60, 62 between the send configuration module 50, key management module 52 and receiver module 54 are implemented by the wide area network 10 and/or remote network 16. In an alternative embodiment the key management module and the send configuration module are hosted by a common computer. In such embodiment the communication 56 between the send configuration module and the key management module is a local data operation within the common computer. The communications 56, 58, 60 and 62 are performed either on a secured communication channel or an unsecured communication channel. In addition, the send configuration module sends an encrypted message 64 to the receiver module 54.

[00025] Referring to FIG. 4, a flow chart 70 of the communication process includes several steps. When a user decides to send a message to a receiver, the sender determines the encryption method to be used, the key length for the encryption/decryption and the access parameters. Any known or proprietary encryption methods are used in varying embodiments. In a preferred embodiment a key-based encryption method is used. The key is maintained, however, by the key management module 52. The sender determines the degree or sophistication of the encryption by specifying a key length. Alternatively, the sender module creates the key then registers the key with the key management module. The sender also specifies the receiver's access privileges. Specifically, the sender defines one or access parameters, such as an expiration date/time, a maximum number of times the message is permitted to be decrypted, a time period during which the message can be decrypted, or some contingency which is to occur or not occur for the decryption to be permitted.

[00026] At step 72, the send configuration module 50 sends one or more configuration parameter(s) 65 along communication 56 to the key management module 52. One parameter is a key parameter. In one embodiment the key parameter defines a key length. The key management module generates a key having a length equal to the key length parameter value and returns the key to the sender for the sender to encrypt the message 64. In another embodiment the sender generates the key and sends it to the key management module as the key parameter. The key received or generated by the key management module is the decryption key for decrypting the secured message 64.

[00027] In some embodiments, the sender sends a message identification code to the key management module as one of the configuration parameters. In another embodiment the key management module instead generates the message identification code and returns it to the send configuration module as a configuration parameter.

[00028] In various embodiments additional parameters may include one or more access parameters. In some embodiments one or more access parameters are transmitted by the sender to the key management module. The one or more access parameters are used by the key management module to determine whether the receiver is permitted to decrypt the message. In other embodiments the key management module instead uses a default access parameter(s), so that the access parameter(s) need not be transmitted by the sender or the key management module as part of the configuration parameters.

[00029] The key management module 52 receives the configuration parameter(s) and initializes a key management operation for a sender-receiver communication 58. For the embodiment where a key length parameter is received, at step 74, the key management module 52 derives an encryption key and returns the values 67 to the send configuration module 50 along the communication path 56. Where the configuration parameter includes the key, the key is registered with the key management module by being stored.

[00030] Where the configuration parameters include a message identification code, such code is associated with the generated or registered key. Where the configuration parameters do not include the message identification code, the code is generated by the key management module. The code is associated with the generated or registered key, and also transmitted to the send configuration module (at step 74).

[00031] Where the configuration parameters include one or more access parameters, the access parameters are stored for processing reviver requests for a decryption key. Such access parameters are associated with the corresponding message identification code, (e.g., as generated by the sender configuration module or the key management module).

[00032] The send configuration module having the encryption key and the message identification code, (each one being returned from the key management module or generated by send configuration module), at step 76 encrypts a desired message using the encryption key. At step 78 the sender transmits the encrypted message and the message identification code to the receiver along communication path 58 as the message 64.

[00033] The receiver receives and stores the message 64 at step 80. The receiver does not have the decryption key for decrypting the message. When the user decides to view the message, the receiver module 54 is invoked to send a request 66 at step 82 to the key management module for the decryption key. Included with the request is the message identification code. The key management module 52 uses the message identification code to identify the access parameters and decryption key corresponding to such message code at step 84. The key management module 52 in some embodiments is at a default address on the network 10. In another embodiment the key management module address is specified in the message 64, with the message code and the encrypted message.

[00034] At step 86 the key management module 52 tests the access parameters (e.g., either default values or parameters registered by the send configuration module for the corresponding message identification code). When the access parameter is an expiration date and time, the current date time as defined by the computer hosting the key management module 52 is compared to the expiration date and time. When the access parameter defines a number of times the message is permitted to be decrypted, the key management module 52 tests a count which it maintains of the number of times a decryption key for the corresponding message has been given out. When the access parameter is a time period, the current time is compared to the time period. When the access parameter is for some other contingency, the contingency is evaluated. Examples of contingencies include but are not limited to: non-payment of funds, non receipt of subsequent messages. In another exemplary embodiment a contingency parameter is used to implement a subscription mechanism such as for the sale or license of data. The key management module 52 implements the access parameters and promptly destroys decryption keys for messages that have expired or are otherwise no longer permitted to be accessed by the receiver.

[00035] The testing at step 86 results in a decision at step 88 either allowing a decryption or disallowing a decryption. If a decryption is not allowed, then at step 90, the key management module 52 transmits a response 68 along communication path 62 to the receiver indicating that the decryption request has been denied. Accordingly, the decryption key is not sent to the receiver module 54. If a decryption is allowed at decision step 88, then at step 92 the decryption key is sent to the receiver along communication path 62 as the response 68.

[00036] If the decryption request 66 is denied, the receiver is unable to decrypt the message short of cracking the encryption algorithm. If the decryption request 66 is granted, then at step 94 the receiver module 54 uses the decryption key in the response 68 to decrypt the message 64. The result of the decryption is a source format of the decrypted message which is stored in a temporary RAM storage area. The received decryption key also is stored in temporary RAM storage. Exemplary source formats include ascii text, a word processor format, HTML, PDF, GIF, rich text format or some proprietary or standard text, non-text or combined text and non-text format. At step 96, the decrypted message now is translated into a display format permitting a user at the receiver computer to view the message. For example, a display format is commonly a bit-map of pixel values in RGB or another standard display format.

[00037] Note that the receiver computer has the decrypted source of the message and the decryption key, along with the display-formatted message. All are stored in a temporary RAM storage area. The display formatted message is not amenable to translation and typically is not retained long after the display buffers are erased (such as by displaying other information). To provide a meaningful restriction to the receiver's access, the decrypted source format of the message and the decryption key are deleted at step 98. In a preferred embodiment the deletion of the decryption key occurs immediately after decrypting the message 64. The deletion of the source format occurs immediately after translation into the display format. The bit-mapped display format is deleted or overwritten once displayed.

[00038] The brief time period in which the decryption key resides on the receiver computer is a recognized period of vulnerability where concern for sabotaging this security method is concerned. Accordingly, in some embodiments interrupts at the receiver computer are denied during the time period between receipt of the decryption key and deletion of the decryption key. In some embodiments the denial of interrupts lasts from receipt of the decryption key until deletion of both the decryption key and the source format of the decrypted message. This has the unfortunate side effect of locking up the machine during all of this time, but will provide a maximum level of security, because there is only a single moment of vulnerability between the time that the decryption key is received and interrupts are disabled.

[00039] In another embodiment, additional methods are implemented to resist sabotage of this method. To minimize the possibility of intercepting the decryption key layers of encryption are implemented, where the specific algorithm and key length, message id, etc. are wrapped inside another message. Now multiple sets of keys would have to compromised. Thus, the chance of interception are reduced.

[heading-00040] Meritorious and Advantageous Effects

[00041] One advantage of the invention is that confidential information can be sent to a receiver with the sender maintaining some control over the receiver's access to the information. For example, the sender can limit the receiver to one view of the information, or to a limited number of views. The sender can additionally or alternatively limit the viewing to a specific time period. The sender additionally or alternatively can limit the viewing to the presence or absence of a specific contingency.

[00042] Although a preferred embodiment of the invention has been illustrated and described, various alternatives, modifications and equivalents may be used. For example, in various embodiments the decryption key is or is not the same key as the encryption key. Also, in various embodiments the decryption key is or is not available to the sender. Therefore, the foregoing description should not be taken as limiting the scope of the inventions which are defined by the appended claims.