Abstract: A computer readable medium storing executable code to generate an identity-based encryption key includes executable code to specify a master key, receive an identity-based string and execute a function that processes the master key and the identity-based string to produce a seed. The seed is then used to produce an identity-based encryption key interoperable with a deployed public key cryptosystem.

Abstract: This present invention provides users with secure transparent electronic communication, allowing them to send and receive encrypted and/or signed messages with little or no user involvement. In various embodiments, the present invention provides a user with e-mail security via automated hierarchical techniques for transparently sending and receiving secure messages, and lowers the burden on administrators. Such a system can also manage cryptographic keys and certificates for the users, and creates such keys and certificates for the users when necessary. A server according to the present invention can intercept unsecured messages from a user, automatically transform those messages into secured messages, and transmit those secure messages to the intended recipients. The server can also automatically transform messages after the recipient sends a digital identity to the server and downloads the software necessary for transforming the secured messages back into readable messages (i.e.

Abstract: A computer readable storage medium includes executable instructions to identify when a security policy cannot be applied by a supported secure email machine to a received email message and thus the email message is routed to an auxiliary secure email machine. Secure email policies are applied to the email message at the auxiliary secure email machine. The email message is then routed from the auxiliary secure email machine to the supported secure email machine.

Abstract: A computer readable storage medium includes executable instructions to identify sub-string repetition in a pass phrase. A sub-string index is generated. The number of bits required to represent each character in the pass phrase is determined. An entropy value is assigned to each character in the pass phrase. A total entropy value for the pass phrase is computed to provide an indication of pass phrase quality.

Abstract: A computer readable storage medium includes executable instructions to encrypt a file with a file encryption key to produce an encrypted file. The file encryption key is encrypted with a directory encryption key to produce an encrypted file encryption key. The directory encryption key is encrypted with a public key of a user within a group to produce an encrypted directory encryption key.

Abstract: The invention includes a computer readable medium storing executable instructions to enroll a user with a secure email support facility. The computer readable medium includes executable instructions to send an enrollment message, supply a registration response, and confirm the registration response. An authentication email is also sent. A client identifies the authentication email. Authentication information within the authentication email is decrypted. The authentication information is used to authenticate the client and subsequently obtain access to a secure email support facility.

Abstract: A cryptosystem is described which automatically provides an extra “message recovery” recipient(s) when an encrypted message is generated in the system. The system is typically configured such that the extra recipient or “message recovery agent” (MRA)—an entity which itself has a public key (i.e., a MRA public key)—is automatically added, under appropriate circumstances, as a valid recipient for an encrypted message created by a user. In a corporate setting, for example, the message recovery agent is the “corporate” message recovery agent designated for that company (firm, organization, or other group) and the user is an employee (or member) of that company (or group). In operation, the system embeds a pointer (or other reference mechanism) to the MRA public key into the public key of the user or employee, so that encrypted messages sent to the company's employees from outside users (e.g., those individuals who are not employees of the company) can nevertheless still be recovered by the company.

Abstract: One embodiment of the present invention provides a system for managing public keys through a server that stores associations between public keys and email addresses. This system operates by receiving a client public key from a client, and then storing the client public key in a database at the server. The system then allows other clients to lookup the client public key in the database. The system also periodically sends a verification request from the server to the client asking if the client public key remains valid. If an affirmative response to the verification request is not received, the system removes the client public key from the database.

Abstract: One embodiment of the present invention provides a system for managing public keys through a server that stores associations between public keys and email addresses. This system operates by receiving a first message from a client containing a request for approval of a client public key along with the client public key. In response this request for approval, the system sends a second message to the client containing a request for identity confirmation that includes the client public key. If a third message is received from the client containing an affirmative response to the request for identity confirmation, the system stores an association between a client email address and the client public key in a database. This allows other clients to look up the client public key in the database.

Abstract: One embodiment of the present invention provides a system that facilitates secure transmission of an email message to anonymous recipients without divulging the identities of the anonymous recipients. This system constructs an email message by identifying recipients of the email message. These recipients can include known recipients, who can be identified by examining the email message, and anonymous recipients, who cannot be identified by examining the email message. The system also generates a session key for the email message, and encrypts a body of the email message with the session key. The system also creates a recipient block for the email message that contains an entry for each recipient of the email message. Each entry in this recipient block contains the session key encrypted with a public key associated with the recipient to form an encrypted session key, so that only a corresponding private key held by the recipient can be used to decrypt the encrypted session key.

Abstract: One embodiment of the present invention provides a system that facilitates encrypting and decrypting a data item. The system operates by encrypting a data item with a session key using a symmetric encryption mechanism to produce an encrypted data item. Next, the system splits the session key into a plurality of shares so that the session key can be reconstituted from a predefined number of shares. The system also receives a plurality of responses from the user (which may be responses to questions), and encrypts the plurality of shares with the plurality of responses using the symmetric encryption mechanism to generate a plurality of encrypted shares. The plurality of encrypted shares are stored for later retrieval. In one embodiment of the present invention, the system decrypts the data item by, receiving a plurality of new responses from the user, and attempting to decrypt the plurality of encrypted shares with the plurality of new responses.