Patent ID: 9438568
Filing Date: 2016-09-06
CPC Classification: H04L

Claim Text:
1. A system for decrypting electronic messages, comprising: a first processor configured to have a front end processing unit and a back end processing unit, wherein the front end processing unit receives or monitors electronic messages that are in-flight from electronic message sources to downstream destinations on a network for encrypted messages, wherein private keys associated with the encrypted messages are not previously provided to or stored in association with the first processor, wherein for each electronic message the front end processing unit extracts a set of user certificate identifiers and corresponding encrypted session keys, wherein the back end processing unit includes a second processor for executing a hardware security model (HSM), the back end processing unit being configured with access rights to retrieve the private keys from a certificate authority, and for each message the back end processing unit securely communicates with the certificate authority to acquire a private key, which is not previously provided to second processor or stored in the HSM, for decrypting a respective encrypted session key, securely stores the acquired private key in the HSM, decrypts the encrypted session key in the HSM using the private key, and sends the unencrypted session key to the front end processing unit, and wherein the front end processing unit decrypts the encrypted messages with the unencrypted session key.