Source: http://www.google.com/patents/US8019081?dq=%235,519,867
Timestamp: 2014-08-31 10:48:29
Document Index: 355458474

Matched Legal Cases: ['application No. 2005204223', 'Application No. 04103998', 'application No. 200510095984', 'Application No. 02817741', 'application No. 04104240', 'application No. 10', 'Application No. 02754007', 'Application No. 02752898', 'Application No. 02752898', 'Application No. 02752898', 'Application No. 02754007', 'Application No. 02754007', 'Application No. 08154580', 'Application No. 05826460', 'Application No. 05826460', 'Application No. 05826460', 'application No. 200505340', 'Application No. 02819798', 'Application No. 200810009944', 'Application No. 2003', 'Application No. 2005', 'Application No. 2006', 'Application No. 10', 'Application No. 02819798', 'Application No. 2', 'Application No. 2005', 'Application No. 2003', 'Application No. 02817741', 'Application No. 2', 'Application No. 2', 'Application No. 2', 'Application No. 2', 'Application No. 2', 'art 3', 'art 3', 'Application No. 02817741', 'Application No. 02817741', 'Application No. 02819798', 'Application No. 200810009944', 'application No. 200505624']

Patent US8019081 - System and method for processing encoded messages - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign in<nobr>Advanced Patent Search</nobr>PatentsSystems and methods for processing encoded messages at a message receiver. A received encoded message is decoded and stored in a memory. The stored decoded message can subsequently be displayed or otherwise processed without repeating the decoding operations. Decoding operations may include signature...http://www.google.com/patents/US8019081?utm_source=gb-gplus-sharePatent US8019081 - System and method for processing encoded messagesAdvanced Patent SearchPublication numberUS8019081 B2Publication typeGrantApplication numberUS 10/486,406PCT numberPCT/CA2002/001225Publication dateSep 13, 2011Filing dateAug 6, 2002Priority dateAug 6, 2001Also published asCA2456839A1, CA2456839C, CN1565112A, CN100380895C, CN101232504A, CN101232504B, DE60229645D1, EP1417814A2, EP1417814B1, US8661267, US20040202327, US20110320807, WO2003015367A2, WO2003015367A3Publication number10486406, 486406, PCT/2002/1225, PCT/CA/2/001225, PCT/CA/2/01225, PCT/CA/2002/001225, PCT/CA/2002/01225, PCT/CA2/001225, PCT/CA2/01225, PCT/CA2001225, PCT/CA2002/001225, PCT/CA2002/01225, PCT/CA2002001225, PCT/CA200201225, PCT/CA201225, US 8019081 B2, US 8019081B2, US-B2-8019081, US8019081 B2, US8019081B2InventorsHerbert A. Little, Michael S. BrownOriginal AssigneeResearch In Motion LimitedExport CitationBiBTeX, EndNote, RefManPatent Citations (119), Non-Patent Citations (125), Referenced by (1), Classifications (30), Legal Events (2) External Links: USPTO, USPTO Assignment, EspacenetSystem and method for processing encoded messagesUS 8019081 B2Abstract Systems and methods for processing encoded messages at a message receiver. A received encoded message is decoded and stored in a memory. The stored decoded message can subsequently be displayed or otherwise processed without repeating the decoding operations. Decoding operations may include signature verification, decryption, other types of decoding, or some combination thereof.
decoding the encoded message content portion; and
storing the decoded message content portion to random access memory (RAM);
wherein the stored decoded message content portion is provided in response to a subsequent message open request with respect to the encoded message;
wherein the decoded message content portion is removed from the random access memory (RAM) after a preselected time has elapsed;
wherein the received message content portion that has been encoded is retained at the wireless mobile communication device in an encoded state;
wherein the received message content portion that has been encoded is redecoded upon receipt of a further message open request after the decoded message content portion has been removed from the random access memory (RAM).
11. The method of claim 1, wherein the encoded message comprises an encrypted session key, wherein the encrypted session key is used to decrypt the encoded message content portion, said method further comprising the steps of:
retrieving the decrypted session key from the memory and using the stored decrypted session key to decrypt the encrypted message content portion where the encrypted session key has been decrypted and stored to the memory.
12. The method of claim 11, wherein the steps of decrypting and storing with respect to the session key are performed where the encrypted session key has not been decrypted and stored to the memory.
13. The method of claim 1, wherein certificate information of a user of the wireless mobile communication device is transferred to the wireless mobile communication device through a wireless mobile communication device information transfer means.
29. The method of claim 1, wherein the encoded message content portion was encoded using a session key and encryption algorithm, and wherein a public key cryptographic algorithm was used to encrypt the session key to generate the encrypted session key.
35. The method of claim 1, wherein the preselected time is selected by the user.
36. The method of claim 1, wherein the decoded message content portion is removed from the memory based upon a characteristic associated with the encoded message.
37. The method of claim 36, wherein the decoded message content portion is removed from the memory based upon electrical power being removed from the wireless mobile communication device.
38. The method of claim 36, wherein the characteristic comprises the identity of a sender of the encoded message.
39. The method of claim 38, wherein the identity of the sender of the encoded message comprises an e-mail address of the sender.
40. The method of claim 1, wherein the decoded message content portion is removed from the memory based upon a sensitivity level associated with the encoded message.
41. The method of claim 40, wherein the sensitivity level is determined based upon a subject line contained within the encoded message.
42. The method of claim 40, wherein the sensitivity level is determined based upon the message content portion.
43. The method of claim 1, further comprising the step of:
setting a disabling flag so that the decoded message content portion is not continuously stored in the memory for use in additional accesses of the message content portion.
45. The method of claim 1, wherein the decoded message content portion is stored to a volatile memory of the wireless mobile communication device.
46. The method of claim 1, wherein the decoded message content portion is stored to a volatile and non-persistent memory of the wireless mobile communication device.
47. The method of claim 1, wherein the encoded message content portion was encoded using an encrypted session key, wherein a user of the wireless mobile communication device enters security information in order to have the encrypted session key decrypted.
48. The method of claim 47, wherein the security information comprises a password.
49. An apparatus for processing encoded messages at a wireless mobile communication device, comprising:
means for decoding the encoded message content portion; and
means for storing the decoded message content portion to random access memory (RAM);
wherein the stored decoded message content portion is provided in response to subsequent message open requests with respect to the encoded message;
50. Computer software stored on a non-transitory computer readable memory, the computer software comprising program code for carrying out a method that processes an encoded message at a wireless mobile communication device when the encoded message is accessed, said encoded message containing at least one encrypted session key and an encoded message content portion, said method comprising the steps of:
decoding the encoded message content portion;
storing the decoded message content portion to random access memory (RAM); and
retrieving the decoded message content portion from the random access memory (RAM) in response to subsequent message open requests with respect to the encoded message;
wherein the encoded message content portion is retained at the wireless mobile communication device in an encoded state;
wherein the encoded message content portion is redecoded upon receipt of a further message open request after the decoded message content portion has been removed from the random access memory (RAM).
51. An apparatus on a wireless mobile communication device for handling multiple accesses to an encoded message, wherein the encoded message contains encoded content and further includes accessing information that is transmitted to the wireless mobile communication device, the apparatus comprising:
a storage software module that stores a decoded version of the encoded content as well as the accessing information in random access memory (RAM) which is volatile and non-persistent, wherein the accessing information allows access to the decoded content; and
an accessing software module that retrieves from the random access memory (RAM) the accessing information and the decoded content in response to subsequent message open requests with respect to the encoded message
wherein the decoded content is removed from the random access memory (RAM) after a preselected time has elapsed;
wherein the encoded content is retained at the wireless mobile communication device in an encoded state;
wherein the encoded content is redecoded upon receipt of a further message open request after the decoded content has been removed from the random access memory (RAM).
52. The apparatus of claim 51, wherein the accessing information comprises a session key to access the encoded content.
53. The apparatus of claim 51, wherein the encoded message further comprises a digital signature, wherein the storage software module stores, in the memory, verification information about the digital signature, and wherein the accessing software module retrieves from the memory the verification information when the content is accessed multiple times.
54. The apparatus of claim 53, further comprising a data structure stored in the memory for containing the accessing information.
55. The apparatus of claim 54, wherein the wireless mobile communication device receives a plurality of encoded messages, and wherein the data structure associates which accessing information is associated with which message.
56. The apparatus of claim 55, wherein the data structure associates which verification information is associated with which message.
57. The method of claim 1, wherein a subsequent message open request results in at least the second occurrence of displaying the decoded message content portion.
58. The method of claim 1, wherein the subsequent message open request causes a message open operation that results in accessing the stored decoded message content portion.
59. The method of claim 1, wherein said decoded message content portion is stored temporarily in said memory.
60. The apparatus of claim 51, wherein said decoded message content portion is stored temporarily in said memory. Description
CROSS-REFERENCE TO RELATED APPLICATION This application claims priority to U.S. provisional application Ser. No. 60/310,330 (entitled �System and Method for Processing Encoded Messages� filed Aug. 6, 2001). By this reference, the full disclosure, including the drawings, of U.S. provisional application Ser. No. 60/310,330 is incorporated herein.
In many known secure message exchange schemes, signatures, encryption, or both are commonly used to ensure the integrity and confidentiality of information being transferred from a sender to a recipient. In an e-mail system for example, the sender of an e-mail message could either sign the message, encrypt the message or both sign and encrypt the message. These actions may be performed using such standards as Secure Multipurpose Internet Mail Extensions (S/MIME), Pretty Good Privacy� (PGP�), OpenPGP and many other secure e-mail standards.
When an encrypted message is received, it must be decrypted before being displayed or otherwise processed. Decryption is a processor-intensive operation which, on a wireless mobile communication device (�mobile device�) with limited processing resources, tends to take a relatively long time, on the order of several seconds. Such time delays may be unacceptable for many mobile device users. Even if the message is not encrypted, it may be encoded in such a way that some processing may be required before displaying the message to the user. Two examples of such an encoding would be the Base-64 encoding commonly used to transfer binary data embedded in email messages on the Internet, and the ASN.1 encoding required by many Internet and security standards. The decoding step may also cause a time delay that is unacceptable for many mobile device users.
SUMMARY A method for processing messages at a message receiver may include the steps of receiving an encoded message, decoding the received message, and storing the decoded message to memory, wherein the stored decoded message is used for subsequent processing of the received message.
BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is an overview of an example communication system in which a mobile device may be used.
FIG. 2 is a block diagram of a further example communication system including multiple networks and multiple mobile devices.
FIG. 3 illustrates an example system for transferring messages that were encoded by encryption and possibly signing using S/MIME or similar techniques.
FIG. 3 a shows a general encoded message format.
FIG. 4 is a flow diagram representing a method for initial processing of an encoded message.
FIG. 5 is a flow diagram of a message processing method for previously decoded messages.
FIGS. 6 and 7 are block diagrams depicting processing of messages involving a mobile device.
FIG. 8 is a block diagram showing an example communication system.
FIG. 9 is a block diagram of an alternative example communication system.
DETAILED DESCRIPTION OF THE DRAWINGS FIG. 1 is an overview of an example communication system in which a mobile device may be used. One skilled in the art will appreciate that there may be hundreds of different topologies, but the system shown in FIG. 1 helps demonstrate the operation of the encoded message processing systems and methods described in the present application. There may also be many message senders and recipients. The system shown in FIG. 1 is for illustrative purposes only, and shows perhaps the most prevalent Internet e-mail environment where security is not generally used.
FIG. 1 shows an e-mail sender 10, the Internet 20, a message server system 40, a wireless gateway 85, wireless infrastructure 90, a wireless network 105 and a mobile device 100.
The message server 40 may be implemented on a network computer within the firewall of a corporation, a computer within an ISP or ASP system or the like, and acts as the main interface for e-mail exchange over the Internet 20. Although other messaging systems might not require a message server system 40, a mobile device 100 configured for receiving and possibly sending e-mail will normally be associated with an account on a message server. Two common message servers are Microsoft Exchange� and Lotus Domino�. These products are often used in conjunction with Internet mail routers that route and deliver mail. These intermediate components are not shown in FIG. 1, as they do not directly play a role in the encoded message processing described below. Message servers such as server 40 typically extend beyond just e-mail sending and receiving; they also include dynamic database storage engines that have predefined database formats for data like calendars, to-do lists, task lists, e-mail and documentation.
As shown in FIG. 1, a composed e-mail message 15 is sent by the e-mail sender 10, located somewhere on the Internet 20. This message 15 is normally fully in the clear and uses traditional Simple Mail Transfer Protocol (SMTP), RFC822 headers and Multipurpose Internet Mail Extension (MIME) body parts to define the format of the mail message. These techniques are all well known to those skilled in the art. The message 15 arrives to the message server 40 and is normally stored in a message store. Most known messaging systems support a so-called �pull� message access scheme, wherein a mobile device 100 requests that stored messages be forwarded by the message server 40 to the mobile device 100. Some systems provide for automatic routing of such messages which are addressed using a specific e-mail address associated with the mobile device 100. Messages may be addressed to a message server account associated with a host system such as a home computer or office computer which belongs to the user of a mobile device 100 and redirected from the message server 40 to the mobile device 100 as they are received.
Regardless of the specific mechanism controlling the forwarding of messages to a mobile device 100, the message 15, or possibly a translated or reformatted version thereof, is sent to the wireless gateway 85. The wireless infrastructure 90 includes a series of connections to wireless network 105. These connections could be Integrated Services Digital Network (ISDN), Frame Relay or T1 connections using the TCP/IP protocol used throughout the Internet. The wireless network 105 may include different types of networks, such as (1) data-centric wireless networks, (2) voice-centric wireless networks and (3) dual-mode networks that can support both voice and data communications over the same physical base stations. The newest of these combined dual-mode networks include, but are not limited to (1) modern Code Division Multiple Access (CDMA) networks, (2) the Groupe Special Mobile or the Global System for Mobile Communications (GSM) and the General Packet Radio Service (GPRS) network, and (3) the future third-generation (3G) networks like Enhanced Data-rates for Global Evolution (EDGE) and Universal Mobile Telecommunications Systems (UMTS). GPRS is a data overlay on the very popular GSM wireless network, operating in virtually every country in Europe. Some older examples of data-centric network include the Mobitex� Radio Network, and the DataTAC� Radio Network. Examples of older voice-centric data networks include Personal Communication Systems (PCS) networks like GSM and TDMA systems that have been available in North America and world-wide for nearly 10 years.
FIG. 2 is a block diagram of a further example communication system including multiple networks and multiple mobile devices. The system of FIG. 2 is substantially similar to the FIG. 1 system, but includes a host system 30, a redirection program 45, a mobile device cradle 65, a wireless virtual private network (VPN) router 75, an additional wireless network 110 and multiple mobile devices 100. As described above in conjunction with FIG. 1, FIG. 2 represents an overview of a sample network topology. Although the encoded message processing systems and methods described herein may be applied to networks having many different topologies, the network of FIG. 2 is useful in understanding an automatic e-mail redirection system mentioned briefly above.
The central host system 30 will typically be a corporate office or other LAN, but may instead be a home office computer or some other private system where mail messages are being exchanged. Within the host system 30 is the message server 40, running on some computer within the firewall of the host system 30, that acts as the main interface for the host system 30 to exchange e-mail with the Internet 20. In the system of FIG. 2, the redirection program 45 enables redirection of data items from the server 40 to a mobile device 100. Although the redirection program 45 is shown to reside on the same machine as the message server 40 for ease of presentation, there is no requirement that it must reside on the message server 40. The redirection program 45 and the message server 40 are designed to co-operate and interact to allow the pushing of information to mobile devices 100. In this installation, the redirection program 45 takes confidential and non-confidential corporate information for a specific user and redirects it out through the corporate firewall to mobile devices 100. A more detailed description of the redirection software 45 may be found in the commonly assigned U.S. Pat. No. 6,219,694 (�the '694 Patent�), entitled �System and Method for Pushing Information From A Host System To A Mobile Data Communication Device Having A Shared Electronic Address�, and issued to the assignee of the instant application on Apr. 17, 2001, and U.S. patent application Ser. No. 09/401,868, Ser. No. 09/545,963, Ser. No. 09/528,495, Ser. No. 09/545,962, and Ser. No. 09/649,755, all of which are hereby incorporated into the present application by reference. This push technique may use a wireless friendly encoding, compression and encryption technique to deliver all information to a mobile device, thus effectively extending the security firewall to include each mobile device 100 associated with the host system 30.
As shown in FIG. 2, there may be many alternative paths for getting information to the mobile device 100. One method for loading information onto the mobile device 100 is through a port 50, using a device cradle 65. This method tends to be useful for bulk information updates often performed at initialization of a mobile device 100 with the host system 30 or a computer 35 within the host system 30. The other main method for data exchange is over-the-air using wireless networks to deliver the information. As shown in FIG. 2, this may be accomplished through a wireless VPN router 75 or through a traditional Internet connection 95 to a wireless gateway 85 and a wireless infrastructure 90, as described above. The concept of a wireless VPN router 75 is new in the wireless industry and implies that a VPN connection could be established directly through a specific wireless network 110 to a mobile device 100. The possibility of using a wireless VPN router 75 has only recently been available and could be used when the new Internet Protocol (IP) Version 6 (IPV6) arrives into IP based wireless networks. This new protocol will provide enough IP addresses to dedicate an IP address to every mobile device 100 and thus make it possible to push information to a mobile device 100 at any time. A principal advantage of using this wireless VPN router 75 is that it could be an off-the-shelf VPN component, thus it would not require a separate wireless gateway 85 and wireless infrastructure 90 to be used. A VPN connection may be a Transmission Control Protocol (TCP)/IP or User Datagram Protocol (UDP)/IP connection to deliver the messages directly to the mobile device 100. If a wireless VPN 75 is not available then a link 95 to the Internet 20 is the most common connection mechanism available and has been described above.
In the automatic redirection system of FIG. 2, a composed e-mail message 15 leaving the e-mail sender 10 arrives to the message server 40 and is redirected by the redirection program 45 to the mobile device 100. As this redirection takes place, the message 15 is re-enveloped, as indicated at 80, and a possibly proprietary compression and encryption algorithm can then be applied to the original message 15. In this way, messages being read on the mobile device 100 are no less secure than if they were read on a desktop workstation such as 35 within the firewall of the host system 30. All messages exchanged between the redirection program 45 and the mobile device 100 may use this message repackaging technique. Another goal of this outer envelope is to maintain the addressing information of the original message except the sender's and the receiver's address. This allows reply messages to reach the appropriate destination, and also allows the �from� field to reflect the mobile user's desktop address. Using the user's e-mail address from the mobile device 100 allows the received message to appear as though the message originated from the user's desktop system 35 rather than the mobile device 100.
Turning back to the port 50 and cradle 65 connectivity to the mobile device 100, this connection path offers many advantages for enabling one-time data exchange of large items. For those skilled in the art of personal digital assistants (PDAs) and synchronization, the most common data exchanged over this link is Personal Information Management (PIM) data 55. When exchanged for the first time this data tends to be large in quantity, bulky in nature and requires a large bandwidth to get loaded onto the mobile device 100 where it can be used on the road. This serial link may also be used for other purposes, including setting up a private security key 210 such as an S/MIME or PGP specific private key, the digital Certificate (Cert) of the user and their Certificate Revocation Lists (CRLs) 60. The private key may be exchanged so that the desktop 35 and mobile device 100 share at least one personality and one method for accessing all mail. The Cert and CRLs are normally exchanged because they represent a large part of S/MIME, PGP and other public key security methods. A certificate chain is a Cert along with a number of other Certs required to verify that the original Cert is authentic. The receiver of the message is able to verify that each Cert in the chain was signed by the next Cert in the chain, until a Cert is found that was signed by a root Cert from a trusted source, perhaps from a large Public Key Server (PKS) associated with a Certificate Authority (CA) such as Verisign or Entrust for example, both prominent companies in the area of public key cryptography. Once such a root Cert is found, a signature can be verified and trusted, since both the sender and receiver trust the source of the root Cert.
Encoded e-mail messages generated using the S/MIME and PGP techniques normally include encrypted information, and/or a digital signature of the message contents. In signed S/MIME operations, the sender takes a digest of a message and signs the digest using the sender's private key. A digest may be a check-sum, CRC or other non-reversible operation such as a hash on the message. The digest, the digest signature, the Cert of the sender, and any chained Certs and CRLs may all be appended to the outgoing message. The receiver of this signed message also takes a digest of the message, then retrieves the sender's public key, checks the Cert and CRLs to ensure that the Cert is valid and trusted, and verifies the digest signature. Finally, the two digests are compared to see if they match. If the message content has been changed, then the digests will be different or the digest signature will not be verified. A digital signature does not prevent anyone from seeing the contents of the message, but does ensure the message has not been tampered with and is from the actual person as indicated on the �From� field of the message.
In encrypted S/MIME message operations, a one-time session key is generated and used for each message, and is never re-used for other messages. The session key is then further encrypted using the receiver's public key. If the message is addressed to more than one receiver, the same session key is encrypted using the public key of each receiver. Only when all receivers have an encoded session key is the message then sent to each receiver. Since the e-mail retains only one form, all encrypted session keys are sent to every receiver, even though they cannot use these other session keys. Each receiver then locates its own session key, possibly based on a generated recipient information summary of the receivers that may be attached to the message, and decrypts the session key using its private key. Once the session key is decrypted, it is then used to decrypt the message body. The S/MIME recipient information or �RecipientInfo� attachment can also specify a particular encryption scheme that is to be used to decrypt the message. This information is normally placed in the header of the S/MIME message.
FIG. 3 illustrates receipt of the entire message on each mobile device 100. Before the message is sent to a mobile device 100, the signature or encryption sections of the message may instead be re-organized and only the necessary portions sent to each mobile device 100, as described in detail in U.S. patent applications, Ser. No. 60/297,681, titled �An Advanced System and Method for Compressing Secure E-Mail for Exchange with a Mobile Data Communication Device�, filed on Jun. 12, 2001, and Ser. No. 60/365,535, titled �Advanced System And Method For Compressing Secure E-Mail For Exchange With A Mobile Data Communication Device�, filed on Mar. 20, 2002, both assigned to the assignee of the present application and incorporated in their entirety herein by reference. These earlier applications disclose several schemes for rearranging secure messages and limiting the amount of information sent to a mobile device. For example, in accordance with one scheme described in the above applications, the message server system determines the appropriate session key for each mobile device and sends only that encrypted session key with the message to the mobile device. The above applications also disclose techniques for limiting signature-related information that is to be sent to a mobile device with an encrypted and signed message. For example, a message server may verify digital signature in a signed message and send the mobile device the result of the verification.
FIG. 3 a shows a general encoded message format, and is useful in illustrating a system utilizing temporary message storage. An encoded message 350 will generally include a header portion 352, an encoded body portion 354, and possibly one or more encoded message attachments 356, and one or more encrypted session keys 358. Such a message may also include a digital signature and related information 360 such as CRLs and Certs. As described above, encoded messages such as 350 may include encrypted messages, signed messages, encrypted and signed messages, or otherwise encoded messages.
Those skilled in the art will appreciate that the header portion typically includes addressing information such as �To�, �From� and �CC� addresses as well as possibly message length, indicators, sender encryption and digital signature scheme identifiers when necessary, and the like. Actual message content will normally include a message body or data portion 354 and possibly one or more file attachments 356, which may be encrypted by the sender using a session key. If a session key was used, it is typically encrypted for each intended recipient and included in the message, as, shown at 358. Depending upon the particular message transport mechanism used to send the message to a receiver such as a mobile device 100, the message may include only the specific encrypted session key for that recipient or all session keys. If the message is signed, a digital signature and signature-related information 360 are included. Where the message is signed before encryption, according to a variant of S/MIME for example, the digital signature may also be encrypted.
The format shown in FIG. 3 a is for illustrative purposes only. Encoded messages may have many other formats. For example, as described above, the processing systems and techniques described herein are applicable to signed or unsigned, encrypted or unencrypted, and otherwise encoded messages, such that a received message may not necessarily include the portions related to encryption and/or signing. In addition, the particular message components may appear in a different order than shown in FIG. 3 a. Depending upon the message scheme used, a message may include fewer, additional, or different message sections or components.
The temporary storage area in which the decoded message is stored is preferably in a volatile and non-persistent store. The decoded message may, for example, be stored for only a particular period of time, which may preferably be set by a user. A single message storage time period may be set and applied to all messages, although more customized settings are also contemplated. Particularly sensitive messages that normally arrive from certain senders or from senders whose e-mail addresses have the same domain name, for example, may have a specific relatively short decoded message storage period, whereas decoded versions of encoded e-mails received from other senders, perhaps personal contacts, may be stored for a longer period of time. Alternatively, a user may be prompted for a storage time period each time a message is opened or closed. The decoded message storage feature might also be disabled for certain messages or messages received from certain senders. Message storage operations may possibly be automatically controlled by detection of specific predetermined keywords in a message. For example, the text �Top Secret� in an e-mail subject line may be detected by the mobile device when the e-mail is decoded and prevent the decoded message from being stored or delete the decoded message from storage if it had already been stored.
FIG. 4 is a flow diagram representing a method for initial processing of an encoded message. At step 402, a received encoded message is accessed for the first time. If the received message was signed by the sender after being encrypted, as determined at step 404, then the mobile device will attempt to verify the digital signature. If the digital signature is properly verified at step 406, for example by determining a match between digests as described above, processing continues at step 409. Otherwise, the user will typically be given an indication that the signature verification failed, at step 408. Depending upon the particular signature scheme implemented or perhaps in response to a user selection to end processing, a message might not be further processed if the digital signature cannot be verified, and processing ends at step 418. However, in certain circumstances, the user may wish to proceed to view or otherwise process the message, even though the digests do not match and thus the message content may have been altered after the sender signed the message.
FIG. 4 illustrated temporary storage of a decoded message, and FIG. 5 is a flow diagram of a message processing method for previously decoded messages. With reference to FIG. 5, step 502 represents an operation of accessing a message that has previously been decoded. New messages are processed as described above and shown in FIG. 4. Since the message being accessed in step 502 has previously been decoded, if a digital signature is appended to the message, it may have already been verified. If not, or if the digital signature should be verified again, for example where a new CRL has been loaded onto the mobile device, a positive determination is made at step 504. At step 506, digital signature verification operations are performed. Steps 508 and 510 operate substantially as described above in reference to the digital signature verification steps 406 and 408 in FIG. 4. Where the digital signature is not be verified, processing may either end at step 511 or continue at step 512.
FIG. 7 depicts a message access data structure 620 for use when the decoded message may be accessed multiple times. In this example, several messages' decoded content is stored in the message access data structure 620, such as a first decoded message 710 and a second decoded message 720. If the decoded contents of the first message are accessed multiple times as shown at 700, then the mobile device 614 uses an accessing software module 702 to retrieve the first message's decoded content 710 from memory 618. The retrieved information 710 is provided for use by the user of the mobile device or by a software application that requested the content, for example.
The corporate LAN 806 is an illustrative example of a central, server-based messaging system that has been enabled for wireless communications. The corporate LAN 806 may be referred to as a �host system�, in that it hosts both a data store 817 with mailboxes 819 for messages, as well as possibly further data stores (not shown) for other data items, that may be sent to or received from mobile devices 816 and 818, and the wireless connector system 828, the wireless VPN router 832, or possibly other components enabling communications between the corporate LAN 806 and one or more mobile devices 816 and 818. In more general terms, a host system may be one or more computers at, with or in association with which a wireless connector system is operating. The corporate LAN 806 is one preferred embodiment of a host system, in which the host system is a server computer running within a corporate network environment operating behind and protected by at least one security communications firewall 808. Other possible central host systems include ISP, ASP and other service provider or mail systems. Although the desktop computer system 824 and interface/connector 826 may be located outside such host systems, wireless communication operations may be similar to those described below.
Message servers such as 820 normally maintain a plurality of mailboxes 819 in one or more data stores such as 817 for each user having an account on the server. The data store 817 includes mailboxes 819 for a number of (�n�) user accounts. Messages received by the message server 820 that identify a user, a user account, a mailbox, or possibly another address associated with a user, account or mailbox 819 as a message recipient will typically be stored in the corresponding mailbox 819. If a message is addressed to multiple recipients or a distribution list, then copies of the same message may be stored to more than one mailbox 819. Alternatively, the message server 820 may store a single copy of such a message in a data store accessible to all of the users having an account on the message server, and store a pointer or other identifier in each recipient's mailbox 819. In typical messaging systems, each user may then access his or her mailbox 819 and its contents using a messaging client such as Microsoft Outlook or Lotus Notes, which normally operates on a PC, such as the desktop computer system 822, connected in the LAN 806. Although only one desktop computer system 822 is shown in FIG. 8, those skilled in the art will appreciate that a LAN will typically contain many desktop, notebook and laptop computer systems. Each messaging client normally accesses a mailbox 819 through the message server 820, although in some systems, a messaging client may enable direct access to the data store 817 and a mailbox 819 stored thereon by the desktop computer system 822. Messages may also be downloaded from the data store 817 to a local data store (not shown) on the desktop computer system 822.
Within the corporate LAN 806, the wireless connector system 828 operates in conjunction with the message server 820. The wireless connector system 828 may reside on the same computer system as the message server 820, or may instead be implemented on a different computer system. Software implementing the wireless connector system 828 may also be partially or entirely integrated with the message server 820. The wireless connector system 828 and the message server 820 are preferably designed to cooperate and interact to allow the pushing of information to mobile devices 816, 818. In such an installation, the wireless connector system 828 is preferably configured to send information that is stored in one or more data stores associated with the corporate LAN 806 to one or more mobile devices 816, 818, through the corporate firewall 808 and via the WAN 804 and one of the wireless networks 812, 814. For example, a user that has an account and associated mailbox 819 in the data store 817 may also have a mobile device, such as 816. As described above, messages received by the message server 820 that identify a user, account or mailbox 819 are stored to a corresponding mailbox 819 by the message server 820. If a user has a mobile device, such as 816, messages received by the message server 820 and stored to the user's mailbox 819 are preferably detected by the wireless connector system 828 and sent to the user's mobile device 816. This type of functionality represents a �push� message sending technique. The wireless connector system 828 may instead employ a �pull� technique, in which items stored in a mailbox 819 are sent to a mobile device 816, 818 responsive to a request or access operation made using the mobile device, or some combination of both techniques.
As shown in FIG. 8, there are several paths for exchanging information with a mobile device 816, 818 from the corporate LAN 806. One possible information transfer path is through the physical connection 824 such as a serial port, using an interface or connector 826. This path may be useful for example for bulk information updates often performed at initialization of a mobile device 816, 818 or periodically when a user of a mobile device 816, 818 is working at a computer system in the LAN 806, such as the computer system 822. For example, as described above, PIM data is commonly exchanged over such a connection, for example a serial port connected to an appropriate interface or connector 826 such as a cradle in or upon which a mobile device 816, 818 may be placed. The physical connection 824 may also be used to transfer other information from a desktop computer system 822 to a mobile device 816, 818, including private security keys (�private keys�) such as private encryption or signature keys associated with the desktop computer system 822, or other relatively bulky information such as Certs and CRLs, used in some secure messaging schemes such as S/MIME and PGP.
In known �synchronization� type wireless messaging systems, a physical path has also been used to transfer messages from mailboxes 819 associated with a message server 820 to mobile devices 816 and 818.
Another goal of using an outer envelope is to maintain at least some of the addressing information in the original e-mail message 833. Although the outer envelope used to route information to mobile devices 816, 818 is addressed using a network address of one or more mobile devices, the outer envelope preferably encapsulates the entire original e-mail message 833, including at least one address field, possibly in compressed and/or encrypted form. This allows original �To�, �From� and �CC� addresses of the e-mail message 833 to be displayed when the outer envelope is removed and the message is displayed on a mobile device 816 or 818. The repackaging also allows reply messages to be delivered to addressed recipients, with the �From� field reflecting an address of the mobile device user's account or mailbox on the host system, when the outer envelope of a repackaged outgoing message sent from a mobile device is removed by the wireless connector system 828. Using the user's account or mailbox address from the mobile device 816 or 818 allows a message sent from a mobile device to appear as though the message originated from the user's mailbox 819 or account at the host system rather than the mobile device.
FIG. 9 is a block diagram of an alternative exemplary communication system, in which wireless communications are enabled by a component associated with an operator of a wireless network. As shown in FIG. 9, the system includes a computer system 802, WAN 804, a corporate LAN 807 located behind a security firewall 808, network operator infrastructure 840, a wireless network 811, and mobile devices 813 and 815. The computer system 802, WAN 804, security firewall 808, message server 820, data store 817, mailboxes 819, and VPN router 835 are substantially the same as the similarly-labelled components in FIG. 8. However, since the VPN router 835 communicates with the network operator infrastructure 840, it need not necessarily be a wireless VPN router in the system of FIG. 9. The network operator infrastructure 840 enables wireless information exchange between the LAN 807 and mobile devices 813, 815, respectively associated with the computer systems 842 and 852 and configured to operate within the wireless network 811. In the LAN 807, a plurality of desktop computer systems 842, 852 are shown, each having a physical connection 846, 856 to an interface or connector 848, 858. A wireless connector system 844, 854 is operating on or in conjunction with each computer system 842, 852.
FIG. 10 is a block diagram of another alternative communication system. The system includes a computer system 802, WAN 804, a corporate LAN 809 located behind a security firewall 808, an access gateway 880, data store 882, wireless networks 884 and 886, and mobile devices 888 and 890. In the LAN 809, the computer system 802, WAN 804, security firewall 808, message server 820, data store 817, mailboxes 819, desktop computer system 822, physical connection 824, interface or connector 826 and VPN router 835 are substantially the same as the corresponding components described above. The access gateway 880 and data store 882 provide mobile devices 888 and 890 with access to data items stored at the LAN 809. In FIG. 10, a wireless connector system 878 operates on or in conjunction with the message server 820, although a wireless connector system may instead operate on or in conjunction with one or more desktop computer systems in the LAN 809.
FIG. 11 is a block diagram of an example mobile device. The mobile device 100 is a dual-mode mobile device and includes a transceiver 1111, a microprocessor 1138, a display 1122, Flash memory 1124, random access memory (RAM) 1126, one or more auxiliary input/output (I/O) devices 1128, a serial port 1130, a keyboard 1132, a speaker 1134, a microphone 1136, a short-range wireless communications sub-system 1140, and may also include other device sub-systems 1142.
Depending upon the type of network or networks 1119, the access requirements for the mobile device 100 may also vary. For example, in the Mobitex and DataTAC data networks, mobile devices are registered on the network using a unique identification number associated with each mobile device. In GPRS data networks, however, network access is associated with a subscriber or user of a mobile device. A GPRS device typically requires a subscriber identity module (�SIM�), which is required in order to operate a mobile device on a GPRS network. Local or non-network communication functions (if any) may be operable, without the SIM device, but a mobile device will be unable to carry out any functions involving communications over the data network 1119, other than any legally required operations, such as �911� emergency calling.
The microprocessor 1138 preferably manages and controls the overall operation of the mobile device 100. Many types of microprocessors or microcontrollers could be used here, or, alternatively, a single DSP 1120 could be used to carry out the functions of the microprocessor 1138. Low-level communication functions, including at least data and voice communications, are performed through the DSP 1120 in the transceiver 1111. Other, high-level communication applications, such as a voice communication application 1124A, and a data communication application 1124B may be stored in the Flash memory 1124 for execution by the microprocessor 1138. For example, the voice communication module 1124A may provide a high-level user interface operable to transmit and receive voice calls between the mobile device 100 and a plurality of other voice or dual-mode devices via the network 1119. Similarly, the data communication module 1124B may provide a high-level user interface operable for sending and receiving data, such as e-mail messages, files, organizer information, short text messages, etc., between the mobile device 100 and a plurality of other data devices via the networks 1119. The microprocessor 1138 also interacts with other device subsystems, such as the display 1122, Flash memory 1124, RAM 1126, auxiliary input/output (I/O) subsystems 1128, serial port 1130, keyboard 1132, speaker 1134, microphone 1136, a short-range communications subsystem 1140 and any other device subsystems generally designated as 1142.
Some of the subsystems shown in FIG. 11 perform communication-related functions, whereas other subsystems may provide �resident� or on-device functions. Notably, some subsystems, such as keyboard 1132 and display 1122 may be used for both communication-related functions, such as entering a text message for transmission over a data communication network, and device-resident functions such as a calculator or task list or other PDA type functions.
An exemplary application module 1124N that may be loaded onto the mobile device 100 is a personal information manager (PIM) application providing PDA functionality, such as calendar events, appointments, and task items. This module 1124N may also interact with the voice communication module 1124A for managing phone calls, voice mails, etc., and may also interact with the data communication module for managing e-mail communications and other data transmissions. Alternatively, all of the functionality of the voice communication module 1124A and the data communication module 1124B may be integrated into the PIM module.
A short-range communications subsystem 1140 may also be included in the mobile device 100. For example, the subsystem 1140 may include an infrared device and associated circuits and components, or a short-range RF communication module such as a Bluetooth� module or an 802.11 module to provide for communication with similarly-enabled systems and devices. Those skilled in the art will appreciate that �Bluetooth� and �802.11� refer to sets of specifications, available from the Institute of Electrical and Electronics Engineers, relating to wireless personal area networks and wireless local area networks, respectively.
Patent CitationsCited PatentFiling datePublication dateApplicantTitleUS4028500Apr 21, 1975Jun 7, 1977Martin Marietta CorporationMobile unit supervisory control sequencer and methodUS5410602Sep 27, 1993Apr 25, 1995Motorola, Inc.Method for key management of point-to-point communicationsUS5457748Nov 30, 1992Oct 10, 1995Motorola, Inc.Method and apparatus for improved security within encrypted communication devicesUS5623546 *Jun 23, 1995Apr 22, 1997Motorola, Inc.Encryption method and system for portable dataUS5666530Dec 2, 1992Sep 9, 1997Compaq Computer CorporationSystem for automatic synchronization of common file between portable computer and host computer via communication channel selected from a plurality of usable channels there betweenUS5710922Dec 18, 1995Jan 20, 1998Apple Computer, Inc.Method for synchronizing and archiving information between computer systemsUS5727202Oct 18, 1995Mar 10, 1998Palm Computing, Inc.Method and apparatus for synchronizing information on two different computer systemsUS5778068 *Feb 13, 1995Jul 7, 1998Eta Technologies CorporationIn a processing deviceUS5778346May 17, 1996Jul 7, 1998Starfish Software, Inc.System and methods for appointment reconcilationUS5812671Jul 17, 1996Sep 22, 1998Xante CorporationCryptographic communication systemUS5870030 *Apr 4, 1996Feb 9, 1999Motorola, Inc.Advertiser pays information and messaging system and apparatusUS5956707Feb 13, 1997Sep 21, 1999Chu; Wesley W.Database system with query relaxation using type abstraction hierarchy (TAH) as query condition relaxation structureUS5991399 *Dec 18, 1997Nov 23, 1999Intel CorporationMethod for securely distributing a conditional use private key to a trusted entity on a remote systemUS6000000May 4, 1998Dec 7, 19993Com CorporationExtendible method and apparatus for synchronizing multiple files on two different computer systemsUS6061448Apr 1, 1997May 9, 2000Tumbleweed Communications Corp.Method and system for dynamic server document encryptionUS6073237Nov 6, 1997Jun 6, 2000Cybercash, Inc.Tamper resistant method and apparatusUS6081601Jan 27, 1998Jun 27, 2000Nokia Telecommunications OyMethod of implementing connection security in a wireless networkUS6084969 *Dec 31, 1997Jul 4, 2000V-One CorporationKey encryption system and method, pager unit, and pager proxy for a two-way alphanumeric pager networkUS6085323Apr 14, 1997Jul 4, 2000Kabushiki Kaisha ToshibaInformation processing system having function of securely protecting confidential informationUS6108788Dec 8, 1997Aug 22, 2000Entrust Technologies LimitedCertificate management system and method for a communication security systemUS6119228Aug 22, 1997Sep 12, 2000Compaq Computer CorporationMethod for securely communicating remote control commands in a computer networkUS6125369Oct 27, 1997Sep 26, 2000Microsoft CorporationContinuous object sychronization between object stores on different computersUS6209098Sep 21, 1998Mar 27, 2001Intel CorporationCircuit and method for ensuring interconnect security with a multi-chip integrated circuit packageUS6219694May 29, 1998Apr 17, 2001Research In Motion LimitedSystem and method for pushing information from a host system to a mobile data communication device having a shared electronic addressUS6229894Jul 14, 1997May 8, 2001Entrust Technologies, Ltd.Method and apparatus for access to user-specific encryption informationUS6230186 *Apr 28, 1998May 8, 2001Rhoda YakerPrivate electronic message systemUS6231985May 18, 1999May 15, 2001Ashland Inc.Heat and radio frequency-curable two-pack soy protein-based polyurethane adhesive compositionsUS6266420Oct 8, 1998Jul 24, 2001Entrust Technologies LimitedMethod and apparatus for secure group communicationsUS6266775Aug 24, 1998Jul 24, 2001Nec CorporationMethod and apparatus for displaying information and information recording medium having information displaying meansUS6289105Jul 26, 1996Sep 11, 2001Kabushiki Kaisha ToshibaMethod and apparatus for encrypting and transferring electronic mailsUS6301658Sep 9, 1998Oct 9, 2001Secure Computing CorporationMethod and system for authenticating digital certificates issued by an authentication hierarchyUS6313732 *Sep 18, 1998Nov 6, 2001Motorola, Inc.Advertiser pays information and messaging system, apparatus and methodUS6348972 *Aug 4, 1999Feb 19, 2002Tokyo Shibaura Electric CoNetwork print system for allowing a printer or printers to select a hostUS6389455Sep 22, 1998May 14, 2002Richard C. FuiszMethod and apparatus for bouncing electronic messagesUS6531985Aug 14, 2000Mar 11, 20033Com CorporationIntegrated laptop antenna using two or more antennasUS6564320Jun 30, 1998May 13, 2003Verisign, Inc.Local hosting of digital certificate servicesUS6661927Jul 27, 2000Dec 9, 2003Motorola, Inc.System and method for efficiently encoding an image by prioritizing groups of spatially correlated coefficients based on an activity measureUS6732144Nov 16, 2000May 4, 2004Kabushiki Kaisha ToshibaCommunication method for data synchronization processing and electronic device thereforUS6745024 *Jan 10, 2000Jun 1, 2004Qualcomm IncorporatedSystem and method for preparing and sending an electronic mail communication using a wireless communications deviceUS6779115Feb 18, 2000Aug 17, 2004Digital5, Inc.Portable device using a smart card to receive and decrypt digital dataUS6819766Mar 22, 2000Nov 16, 2004International Business Machines CorporationMethod and system for managing keys for encrypted dataUS6829357Dec 14, 1999Dec 7, 2004Trw Inc.Communication system having a transmitter and a receiver that engage in reduced size encrypted data communicationUS6904521Feb 16, 2001Jun 7, 2005Networks Associates Technology, Inc.Non-repudiation of e-mail messagesUS6918038Nov 16, 1999Jul 12, 2005Angel Secure Networks, Inc.System and method for installing an auditable secure networkUS6925568 *Jul 12, 2000Aug 2, 2005Sonera OyjMethod and system for the processing of messages in a telecommunication systemUS6931532Oct 21, 1999Aug 16, 2005International Business Machines CorporationSelective data encryption using style sheet processingUS6983367Mar 9, 2001Jan 3, 2006Sony CorporationInformation providing apparatus and method, information processing apparatus and method, and program storage mediumUS6993137Dec 16, 2002Jan 31, 2006Entriq, Inc.Method and system to securely distribute content via a networkUS6996720Jun 27, 2000Feb 7, 2006Microsoft CorporationSystem and method for accessing protected content in a rights-management architectureUS7003667Oct 4, 1999Feb 21, 2006Canon Kabushiki KaishaTargeted secure printingUS7020708Jun 19, 2001Mar 28, 2006Cingular Wireless Ii, LlcAircraft data servicesUS7028186 *Feb 11, 2000Apr 11, 2006Nokia, Inc.Key management methods for wireless LANsUS7032240Feb 14, 2000Apr 18, 2006Pace Anti-Piracy, Inc.Portable authorization device for authorizing use of protected information and associated methodUS7113927 *Oct 6, 1999Sep 26, 2006Victor Company Of Japan, LimitedData distribution system, data distribution method, portable terminal with data receiving capability, portable terminal with data transmitting/receiving capability, recording medium onto which data content is recorded, encoding apparatus, and decoding apparatusUS7127604Jul 9, 2002Oct 24, 2006Texas Instruments IncorporatedChanging a codec or MAC size without affecting the encryption key in PacketCable communicationUS7171552Dec 18, 2003Jan 30, 2007Cisco Technology, Inc.Encrypting information in a communications networkUS7228418Apr 7, 2000Jun 5, 2007France TelecomAuthentication and signature method for messages using reduced size of binary units of information content and corresponding systemsUS7254712Jun 12, 2002Aug 7, 2007Research In Motion LimitedSystem and method for compressing secure e-mail for exchange with a mobile data communication deviceUS7299502Feb 14, 2001Nov 20, 2007Hewlett-Packard Development Company, L.P.System and method for providing customized secure access to shared documentsUS7529374Feb 3, 2003May 5, 2009F-Secure OyjMethod and apparatus for encrypting dataUS7546453Jun 12, 2002Jun 9, 2009Research In Motion LimitedCertificate management and transfer system and methodUS7653815Jun 12, 2002Jan 26, 2010Research In Motion LimitedSystem and method for processing encoded messages for exchange with a mobile data communication deviceUS7657736Jul 11, 2007Feb 2, 2010Research In Motion LimitedSystem and method for compressing secure e-mail for exchange with a mobile data communication deviceUS7827406Mar 25, 2005Nov 2, 2010Research In Motion LimitedSystem and method for processing encoded messages for exchange with a mobile data communication deviceUS20010011308Oct 20, 1998Aug 2, 2001Ted H. ClarkHandheld computer synchronized with a host computerUS20010046307Apr 30, 1998Nov 29, 2001Hewlett-Packard CompanyMethod and apparatus for digital watermarking of imagesUS20010050990Dec 27, 1999Dec 13, 2001Frank Wells SudiaMethod for initiating a stream-oriented encrypted communicationUS20020007453May 22, 2001Jan 17, 2002Nemovicher C. KerrySecured electronic mail system and methodUS20020032861Jul 16, 2001Mar 14, 2002Nec CorporationSystem and method for executing and assuring security of electronic mail for users, and storage medium storing program to cause computer to implement same methodUS20020035685Sep 10, 2001Mar 21, 2002Masahiro OnoClient-server system with security function intermediaryUS20020035687Jun 7, 2001Mar 21, 2002Kristofer SkantzeMethod and device for secure wireless transmission of informationUS20020038420Apr 10, 2001Mar 28, 2002Collins Timothy S.Method for efficient public key based certification for mobile and desktop environmentsUS20020051544Jan 2, 2002May 2, 2002Fujitsu LimitedUser support system for cryptographic communication in network systemsUS20020053023 *Feb 28, 2001May 2, 2002Patterson Andrew JohnCertification validation systemUS20020059375May 23, 2001May 16, 2002Alvin PivowarSystem and method for sharing data among a plurality of personal digital assistantsUS20020059383Jun 14, 2001May 16, 2002Takeo KatsudaApparatus, portable terminal unit, and system for controlling E-mail, and its method, computer-readable recording medium and program product for processing E-mailUS20020080752 *Dec 22, 2000Jun 27, 2002Fredrik JohanssonRoute optimization technique for mobile IPUS20020099766 *Jan 24, 2001Jul 25, 2002Tuli Raja SinghPortable high speed internet access device with encryptionUS20020147905Apr 5, 2001Oct 10, 2002Sun Microsystems, Inc.System and method for shortening certificate chainsUS20020165967 *May 2, 2001Nov 7, 2002Morgan Paul A.Global personalization engineUS20020169954Jun 22, 2001Nov 14, 2002Bandini Jean-Christophe DenisMethod and system for e-mail message transmissionUS20020173295 *May 15, 2001Nov 21, 2002Petri NykanenContext sensitive web servicesUS20020176067 *May 23, 2002Nov 28, 2002Canesta, Inc.Method and system to enhance dynamic range conversion useable with CMOS three-dimensional imagingUS20030002671Jun 11, 2001Jan 2, 2003Eastman Kodak CompanyDelivery of electronic content over a network using a hybrid optical disk for authenticationUS20030074555Oct 17, 2001Apr 17, 2003Fahn Paul NeilURL-based certificate in a PKIUS20030126085Dec 27, 2001Jul 3, 2003Slamdunk Networks, Inc.Dynamic authentication of electronic messages using a reference to a certificateUS20030172122Mar 6, 2002Sep 11, 2003Little Herbert A.System and method for providing secure message signature status and trust status indicationUS20030198350Apr 18, 2002Oct 23, 2003International Business Machines CorporationMethod, system and program product for managing a size of a key management block during content distributionUS20030212888Mar 3, 2003Nov 13, 2003Wildish Michael AndrewSystem and method of looking up and validating a digital certificate in one passUS20040083364Dec 4, 2001Apr 29, 2004Jean-Pierre AndreauxMethod of secure transmission of digital data from a source to a receiverUS20040093493Jul 16, 2003May 13, 2004Bisbee Stephen F.System and method for electronic transmission, storage and retrieval of authenticated documentsUS20040133520Jun 17, 2003Jul 8, 2004Callas Jonathan D.System and method for secure and transparent electronic communicationUS20040133775Jun 17, 2003Jul 8, 2004Callas Jonathan D.System and method for secure electronic communication in a partially keyless environmentUS20040196978Jun 12, 2002Oct 7, 2004Godfrey James A.System and method for processing encoded messages for exchange with a mobile data communication deviceUS20040202327Aug 6, 2002Oct 14, 2004Little Herbert A.System and method for processing encoded messagesUS20040205248Jul 10, 2002Oct 14, 2004Herbert A LittleSystem and method for secure message key caching in a mobile communication deviceUS20050005097Sep 29, 2003Jan 6, 2005Minolta Co., Ltd.Communication system and method in public key infrastructureUS20050039100Aug 14, 2003Feb 17, 2005International Business Machines CorporationMethod and system for automatic error recovery in an electronic mail systemUS20050114671Mar 20, 2003May 26, 2005Research In Motion Ltd.System and method for transmitting and utilizing attachmentsUS20050148323Mar 20, 2003Jul 7, 2005Research In Motion LimitedSystem and method for supporting multiple certificate status providers on a mobile communication deviceUS20050149442Mar 20, 2003Jul 7, 2005Research In Motion LimitedCertificate information storage system and methodUS20050163320Mar 25, 2005Jul 28, 2005Brown Michael S.System and method for processing encoded messages for exchange with a mobile data communication deviceUS20050188219Dec 23, 2004Aug 25, 2005Orange FranceMethod and a system for communication between a terminal and at least one communication equipmentUS20050210289Mar 22, 2004Sep 22, 2005Brown Michael KSystem and method for viewing message attachmentsUS20050222991Feb 1, 2005Oct 6, 2005Kazuyuki IkenoyaInformation providing apparatus, information providing method, information providing program, and recording mediumUS20050246763Mar 24, 2005Nov 3, 2005National University Of IrelandSecure digital content reproduction using biometrically derived hybrid encryption techniquesUS20060015722Jul 18, 2005Jan 19, 2006GeotrustSecurity systems and services to provide identity and uniform resource identifier verificationUS20060036848Aug 9, 2004Feb 16, 2006Research In Motion LimitedSystem and method for enabling bulk retrieval of certificatesUS20060036849Aug 9, 2004Feb 16, 2006Research In Motion LimitedSystem and method for certificate searching and retrievalUS20060036865Aug 10, 2004Feb 16, 2006Research In Motion LimitedServer verification of secure electronic messagesUS20060059332Sep 2, 2004Mar 16, 2006Research In Motion LimitedSystem and method for searching and retrieving certificatesUS20070083749Oct 12, 2005Apr 12, 2007The Boeing CompanySystems and methods for automated exchange of electronic mail encryption certificatesUS20070118874Nov 18, 2005May 24, 2007Research In Motion LimitedSystem and method for handling electronic messagesUS20070123307Nov 30, 2005May 31, 2007Research In Motion LimitedDisplay of secure messages on a mobile communication deviceUS20070165844Dec 22, 2005Jul 19, 2007Research In Motion LimitedSystem and method for protecting master encryption keysUS20080016359Jul 11, 2007Jan 17, 2008Godfrey James ASystem and method for compressing secure e-mail for exchange with a mobile data communication deviceUS20090292916Jun 9, 2009Nov 26, 2009Little Herbert ACertificate Management and Transfer System and MethodWO1999017564A1 *Sep 17, 1998Apr 8, 1999Motorola IncMethod and apparatus for providing subscriber identification protection to a receiverWO2000031931A1 *Nov 8, 1999Jun 2, 2000Ericsson Telefon Ab L MMethod and system for securing data objects* Cited by examinerNon-Patent CitationsReference1Advisory Action from USPTO dated Aug. 19, 2009 for U.S. Appl. No. 10/483,282.2Australian Examiners Report issued on Oct. 12, 2006 for Australian patent application No. 2005204223.3 *Berson T et al: "Cryptography as a network service" 8th Annual Symposium on Network and Distributed System Security. (NDSS' 01) Internet Soc Reston, VA, USA, Feb. 7, 2001, Feb. 9, 2001 pp. 1-12, XP002551706 *the whole document*.4Blom et al. "Conversational IP Multimedia Security", 4th International Workshop on Mobile and Wireless Communications Network, Sep. 9-11, 2002, pp. 147-151.5Brown I., et al.: "A Proxy Approach to E-Mail Security", Software Practice & Experience, John Wiley & Sons Ltd. Chichester, GB, vol. 29, No. 12, Oct. 1999, pp. 1049-1060, XP000852351.6Brown M., et al.: "PGP in Constrained Wireless Devices", Proceedings of the 9th Usenix Security Symposium, Denver, CO, Aug. 14-17, 2000, XP002210575.7Butrico M et al: "Enterprise data access from mobile computers: an end-to-end story" Research Issues in Data Engineering, 2000. Ride 2000. Proceedings. Tenth International Workshop on San Diego, CA, USA Feb. 28-29, 2000, Los Alamitos, CA, USA, IEEE Comput. Soc, US, Feb. 28, 2000, pp. 9-16, XP010377083.8Certificate of Grant of Patent, Hong Kong Application No. 04103998.2, dated Apr. 24, 2009.9Chadwick, D.W., et al., "Modifying LDAP to Support X.509-based PKIs", In Seventeenth Annual IFIP WG 11.3 Working Conference on Database and Applications Security at Estes Park, Colorado, Aug. 2003.10Chinese First Office Action (English Translation), issued on Nov. 21, 2008 in connection with application No. 200510095984.7.11Chinese Office Action, issued Mar. 9, 2007, for Chinese Patent Application No. 02817741.X, along with an English translation thereof.12Cole R., et al: "An Architecture For A Mobile OSO Mail Access System", IEEE Journal on Selected Areas in Communications, IEEE Inc., New York, US, vol. 7, No. 2, Feb. 1989, pp. 249-256, XP000904914.13Communication Pursuant to Article 96(2) EPC, issued by the European Patent Office on Dec. 6, 2006 in connection with application No. 04104240.9.14Co-pending U.S. Appl. No. 10/483,282 entitled "System and method for secure message key caching in a mobile communication device", claims 1-49 stand rejected.15Co-pending U.S. Appl. No. 12/480,841 entitled "Certificate Management and Transfer System and Method", claims 1-30 have been allowed.16Co-pending U.S. Appl. No. 12/686,046 entitled "System and Method for Processing Encoded Messages for Exchange with a Mobile Data Communication Device".17Co-pending U.S. Appl. No. 12/691,204 entitled "System and Method for Compressing Secure E-Mail for Exchange With a Mobile Data Communication Device".18Co-pending U.S. Appl. No. 12/693,021 entitled "System and Method for Processing Encoded Messages for Exchange with a Mobile Data Communication Device".19Crocker S. et al.: "MIME Object Security Services; rfc1848.text". IETF Standard, Internet Engineering Task Force, IETF, CH, Oct. 1995, XP015007633.20Decision for Final Rejection issued by the Korean Patent Office (English Translation) in connection with application No. 10-2005-0081103, delivered on Apr. 12, 2007.21Deroest J.: "Ubiquitous Mobile Computing" Sunexpert Magazine, 'Online! Jul. 1998, pp. 54-56, SP002213003 Retrieved from the Internet: 'retrieved on Sep. 10, 2002.22Deroest J.: "Ubiquitous Mobile Computing" Sunexpert Magazine, ′Online! Jul. 1998, pp. 54-56, SP002213003 Retrieved from the Internet: <URL:http://swexpert.com/C8/SE.C8.JUL.98.pdf> 'retrieved on Sep. 10, 2002.23Dusse et al.: "S/MIME Version 2 Certificate Handling," Database IETF RFC Online IETF: RFC 2312, Mar. 1998, pp. 1-20 (Chapter 2.1, Chapter 4.1), XP002220385.24Dusse et al.: "S/MIME Version 2 Message Specification," Mar. 1998, pp. 1-37.25Encrypt Pre-shared Keys in Cisco IOS Router Configuration Example, Document 1D 46420 Cisco Systems, Internet Address: htto:/lwww.cisco.com/en/US/tech/tk5S3/tk3721technologies-configuration-example09186a00801f2336.shtml.26Encrypt Pre-shared Keys in Cisco IOS Router Configuration Example, Document 1D 46420 Cisco Systems, Internet Address: htto:/lwww.cisco.com/en/US/tech/tk5S3/tk3721technologies�configuration�example09186a00801f2336.shtml.27EPO Communication Pursuant to Article 71(3) EPC (Decision to Grant), in connection with Application No. 02754007.9-2413 dated May 15, 2008.28EPO Communication Pursuant to Article 94(3) EPC, in connection with Application No. 02752898.3-2413, dated May 6, 2010.29EPO Communication Pursuant to Article 96(2) EPC, in connection with Application No. 02752898.3-2413, dated Jun. 2, 2004.30EPO Communication Pursuant to Article 96(2) EPC, in connection with Application No. 02752898.3-2413, dated Mar. 2, 2006.31EPO Communication Pursuant to Article 96(2) EPC, in connection with Application No. 02754007.9-2413 dated Aug. 17, 2007.32EPO Communication Pursuant to Article 96(2) EPC, in connection with Application No. 02754007.9-2413 dated Jul. 26, 2006.33Eskicioglu et al. "A Key Transport Protocol Based on Secret Sharing Applications to Information Security", IEEE Transactions on Consumer Electronics, vol. 46, No. 4, Nov. 2002, pp. 816-824.34European Communication Under Rule 71(3) EPC, Application No. 08154580.38, dated Oct. 23, 2008.35European Examination Report dated Apr. 20, 2009, European Patent Application No. 05826460.7.36European Examination Report. Application No. 05826460.7, Apr. 4, 2008.37European Search Report of Application No. EP 05022525.9-2146 dated Jan. 24, 2006-4 pgs.38European Search Report of Application No. EP 05022525.9-2146 dated Jan. 24, 2006�4 pgs.39European Supplementary Search Report. Application No. 05826460.7, Feb. 14, 2008.40Examination Report issued on Sep. 19, 2006 by the Australian Patent Office for Singapore patent application No. 200505340-0.41First Office Action, Chinese Application No. 02819798.4, dated Jun. 9, 2006.42First Office Action, Chinese Application No. 200810009944.X, dated May 4, 2010.43Fumy et al. Principles of Key Management, IEEE Journal on Selected Areas in Communications, VDI, 11, No. 5, Jun. 1999, pp. 785-793.44Gong et al.: "Multicast Security and its Extension to a Mobile Environment," SRI International, Computer Science Laboratory, J.C. Baltzer AG, Science Publishers, Wireless Networks I (1995) pp. 281-295.45Hametvaara, Vesa, "Certificate Management in Mobile Devices", Master's Thesis, University of Tampere, dated May 14, 2002.46H�metvaara, Vesa. "Modifying LDAP to Support X.509-based PKIs", In Seventeenth Annual IFIP WG 11.3 Working Conference on Database and Applications Security at Estes Park, Colorado, Aug. 2003.47Harris A.: "Content Privacy and Content Security Working Together", Internet Article. Content Technologies White Paper, 'Online! Sep. 1999, XP002223158, pp. 8-9.48Harris A.: "Content Privacy and Content Security Working Together", Internet Article. Content Technologies White Paper, ′Online! Sep. 1999, XP002223158, pp. 8-9.49Hiroyuki Sawano, Create a Secure Electronic Mail Environment with S/MIME!, @IT Security & Trust, May 30, 2001, URL. http://www.atmarkit.co.jp/fsecurity/special/04smime/smime01.html.50Hoffman: "Enhanced Services For S/MIME," Database IETF RFC Online IETF; RFC 2634, Jun. 1999, pp. 1-58 (Chapter 3, pp. 24-32), XP002220386.51Housley, R et al. "Internet X.509 Public Key Infrastructure Certificate and CRL Profile (RFC 2459)", Jan. 1999.52Inquiry issued by the Japanese Patent Office on Mar. 13, 2009 for Japanese Patent Application No. 2003-504272.53International Preliminary Examination Report for PCT/CA02/01060 dated Oct. 23, 2003.54International Search Report for PCT/CA02/01060 dated Nov. 26, 2002.55International Search Report of Application No. PCT/CA02/00889, date of mailing Dec. 13, 2002, 10 pages.56International Search Report of Application No. PCT/CA02/00890, date of mailing Dec. 23, 2002-12 pgs.57International Search Report of Application No. PCT/CA02/00890, date of mailing Dec. 23, 2002�12 pgs.58Interview Summary dated Jun. 10, 2011 for U.S. Appl. No. 10/483,282.59ITU-T, "Information technology-Open systems interconnection-The Directory: Public-key and attribute certificate frameworks", Mar. 2000.60ITU-T, "Information technology�Open systems interconnection�The Directory: Public-key and attribute certificate frameworks", Mar. 2000.61Japanese Office Action dated Feb. 18, 2009, Japanese Application No. 2005-253511 (English translation).62Japanese Office Action dated Jun. 17, 2009, Japanese Application No. 2006-293228.63Jin Jing et al: "Client-server computing in mobile environments" ACM Computing Surveys, Jun. 1999, ACM, USA, vol. 31, No. 2, pp. 117-157, XP002212945.64Katsuro Inaya, et al., "Use Windows CE Now", ASCII, Oct. 1, 1999, vol. 23, No. 10, pp. 266-285.65Kiely, Don, Sal Server 2005 Secures Your Data Like Never Before, Sep. 29, 2005. Internet Address: http://www.devx.comlcodemaglArticle/29351?trk=DXESS-DB.66Kiely, Don, Sal Server 2005 Secures Your Data Like Never Before, Sep. 29, 2005. Internet Address: http://www.devx.comlcodemaglArticle/29351?trk=DXESS�DB.67Korean Examination Report (English translation). Application No. 10-2007-7011342. Dated: Jul. 15, 2008.68Kotzanikoloau et al. "Hybrid Key Establishment for Multiphase Self-Organized Sensor Networks", 6'' IEEE International Symposium on a World of Wireless Mobile and Multimedia Networks, Jun. 13-16, 2005, pp. 581-587.69Kotzanikoloau et al. "Hybrid Key Establishment for Multiphase Self-Organized Sensor Networks", 6″ IEEE International Symposium on a World of Wireless Mobile and Multimedia Networks, Jun. 13-16, 2005, pp. 581-587.70Lai, M.K.E., et al., A Mobile Subscriber Proxy Preserving Writer-to-Reader Message Security, Military Communications Conference, 1996, Milcom '96, Conference Proceedings, IEEE McLean, VA, USA, Oct. 21-24, 1996, New York, NY, USA, IEEE, Oct. 21, 1996, pp. 461-467, XP000904914.71Levien R: "Protecting Internet E-Mail From Prying Eyes", Data Communications, McGraw Hill. New York, US., vol. 25, No. 6 (May 1, 1996), pp. 117-118, 120, 122, XP000587586.72Mambo M., et al: "Proxy Signatures: Delegation of the Power to Sign Messages" IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences, IEICE Tokyo, JP, vol. E79-A, No. 9, Sep. 1, 1996, pp. 1338-1353, XP000679624.73Myers, M. et al. "Certificate Management Messages over CMS (RFC 2797)", Apr. 2000.74Myers, M. et al., X.509 Internet Public Key Infrastructure Online Certificate Status Protocol-OCSP, RFC2560 (Jun. 1999).75Myers, M. et al., X.509 Internet Public Key Infrastructure Online Certificate Status Protocol�OCSP, RFC2560 (Jun. 1999).76Nakajima T et al: "Adaptive continuous media applications in mobile computing environments" Multimedia Computing Systems '97. Proceedings., IEEE International Conference on Ottawa, Ont., Canada Jun. 3-6, 1997, Los Alamitos, CA, USA, IEEE Comput. Soc. US, Jun. 3, 1997, pp. 152-160, XP010239184.77Notice of Allowance (Notification for the Grant of Invention), Chinese Application No. 02819798.4, dated Nov. 30, 2007.78Notice of Allowance, Canadian Application No. 2,456,839, dated Sep. 4, 2009.79Notice of Appeal dated Oct. 30, 2009 for U.S. Appl. No. 10/483,282.80Notice of Reason for Rejection issued by the Japanese Patent Office on Jan. 5, 2010 for Japanese Patent Application No. 2005-253511.81Notice of Reason for Rejection issued by the Japanese Patent Office on May 12, 2006 for Japanese Patent Application No. 2003-504272.82Notice of Revocation of Rejection Decision, Chinese Application No. 02817741.X, dated Aug. 18, 2010.83Office Action from USPTO dated Apr. 30, 2009 for U.S. Appl. No. 10/483,282.84Office Action from USPTO dated Jul. 8, 2008 for U.S. Appl. No. 10/483,282.85Office Action from USPTO dated Mar. 4, 2010 for U.S. Appl. No. 10/483,282.86Office Action from USPTO dated Oct. 18, 2010 for U.S. Appl. No. 10/483,282.87Office Action from USPTO dated Oct. 5, 2007 for U.S. Appl. No. 10/483,282.88Office Action issued by the USPTO on Aug. 11, 2010 for U.S. Appl. No. 12/480,841.89Office Action, Canadian Application No. 2,454,218, dated Aug. 6, 2008.90Office Action, Canadian Application No. 2,454,218, dated Jul. 23, 2007.91Office Action, Canadian Application No. 2,454,218, dated Mar. 7, 2005.92Office Action, Canadian Application No. 2,454,218, dated May 12, 2010.93Office Action, Canadian Application No. 2,456,839, dated Apr. 15, 2008.94PCT International Search Report and Written Opinion of the International Searching Authority, Int'ernational App. No. PCT/CA2005/D01956, Jul. 29, 2006.95Policht, Martin, Sal Server 2005 Security-Part 3 Encryption, Database Journal Internet Address: http://www.databasejournal.com/features/mssql/article.php/34S3931.96Policht, Martin, Sal Server 2005 Security�Part 3 Encryption, Database Journal Internet Address: http://www.databasejournal.com/features/mssql/article.php/34S3931.97Pre-Brief Appeal Conference Decision dated Dec. 18, 2009 for U.S. Appl. No. 10/483,282.98Ramsdell, D. et al. "Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 3.1 Certificate Handling (RFC 3850)", Jul. 2004.99Rejection Decision, Chinese Application No. 02817741.X, dated Mar. 29, 2010.100Research in Motion Limited, Blackberry Security White Paper Release 4.0. 2005 Internet Address: http://blackberry.comlknowledgecenterpublicllivelink.exe?func=ll&objld=S2S044&objAction=browse&sort=name.101Research in Motion Limited, BlackBerry Security with the S/MIME Support Package, version 1.5, Dec. 17, 2003.102Response to Office Action from USPTO dated Aug. 3, 2010 for U.S. Appl. No. 10/483,282.103Response to Office Action from USPTO dated Feb. 15, 2011 for U.S. Appl. No. 10/483,282.104Response to Office Action from USPTO dated Jaunary 8, 2009 for U.S. Appl. No. 10/483,282.105Response to Office Action from USPTO dated Jun. 30, 2009 for U.S. Appl. No. 10/483,282.106Response to Office Action from USPTO dated Mar. 5, 2008 for U.S. Appl. No. 10/483,282.107Russell S: "Fast checking of individual certificate revocation on small systems" Computer Security Applications Conference, 1999. (ACSAC '99). Proceedings. 15th Annual Phoenix, AZ, USA Dec. 6-10, 1999, Los Alamitos, CA, USA, IEEE Comput. Soc. US, Dec. 6, 1999, pp. 249-255, XP010368617.108Russell S: "Fast checking of individual certificate revocation on small systems" Computer Security Applications Conference, 1999. (ACSAC '99). Proceedings. 15TH Annual Phoenix, AZ, USA Dec. 6-10, 1999, Los Alamitos, CA, USA, IEEE Comput. Soc. US. Dec. 6, 1999, pp. 249-255, XP010368617.109Second Office Action, Chinese Application No. 02817741.X, dated Jan. 25, 2008.110Second Office Action, Chinese Application No. 02819798.4, dated Jul. 20, 2007.111Second Office Action, Chinese Application No. 200810009944.X, dated May 25, 2011.112Stale Schumacher: "AutoPGP FAQ, Version 1", Internet Newsgroup, 'Online! (Apr. 19, 1994), XP002230742.113Stale Schumacher: "AutoPGP FAQ, Version 1", Internet Newsgroup, ′Online! (Apr. 19, 1994), XP002230742.114Stallings, W.: "S/MIME: E-Mail Gets Secure". Byte, McGraw-Hili Inc., St. Peterborough, US, vol. 23, No. 7, Jul. 1998, pp. 41-42, XP000774260.115Subramanyam V., et al.: "Security in mobile systems", Reliable Distributed Systems, 1998 Proceedings. 17th IEEE Symposium on W. Lafayette, IN, USA, Oct. 20-23, 1998, Los Alamitos, CA, USA, IEEE Comput. Soc., US, Oct. 20, 1998, pp. 407-412, XP010319125.116Syverson: "Limitations on Design Principles for Public Key Protocols," Security and Privacy, 1996, Proceedings, 1996 IEEE Symposium on Oakland, CA, USA, May 6-8, 1996, Los Alamitos, CA, USA, IEEE Comput. Soc., US, May 6, 1996, pp. 62-72, XP010164926.117Torvinen V.: "Wireless PKI: Fundamentals", Internet Article, Radicchio White Paper, 'Online! 2000, XP002223159, pp. 12-13.118Torvinen V.: "Wireless PKI: Fundamentals", Internet Article, Radicchio White Paper, ′Online! 2000, XP002223159, pp. 12-13.119Wasley D.L. et al: "Improving Digital Credential Management in Browsers" Internet Article. HEPKI-TAG Recommendation, 'Online! Jul. 21, 2000, XP002213004 Retrieved from the Internet: 'retrieved on Sep. 10, 2002.120Wasley D.L. et al: "Improving Digital Credential Management in Browsers" Internet Article. HEPKI-TAG Recommendation, ′Online! Jul. 21, 2000, XP002213004 Retrieved from the Internet: <URL:http://middleware.internet2.edu/hepk i -tag/HEPKI-TAG-Certs-Browser-03.pdf> 'retrieved on Sep. 10, 2002.121Written Opinion issued on Apr. 16, 2003 by European Patent Office for PCT/CA02/01060.122Written Opinion issued on Dec. 23, 2005 by the Australian Patent Office for Singapore patent application No. 200505624-7.123Written Opinion issued on Feb. 14, 2003 by European Patent Office for PCT/CA02/01060.124Written Opinion issued on Sep. 12, 2003 by European Patent Office for PCT/CA02/01225.125 *Zollner J: "Gateway to Overcome Incompatibilities of Security Mechanisms" Reliable Distributed Systems, 1999. Proceedings of the 19th IEEE Sympo Sium on Lausanne, Switzerland Oct. 19-22, 1999, Los Alamitos, Cal, USA, IEEE Comput. Soc, US Oct. 19, 1999, pp. 372-377, XP010357040 ISBN: 978-0-7695-0290-8 *the whole document*.* Cited by examinerReferenced byCiting PatentFiling datePublication dateApplicantTitleUS8661267Sep 9, 2011Feb 25, 2014Blackberry LimitedSystem and method for processing encoded messagesClassifications U.S. Classification380/270, 713/193International ClassificationH04K1/00, G06F11/30, H04L12/58, G06F12/14, H04L12/28, H04L9/32, H04L12/56, H04L29/06Cooperative ClassificationH04L69/22, H04L9/3247, H04L51/22, H04W12/02, H04W28/14, H04L9/3268, H04L63/0428, H04L63/12, H04L51/38, H04L63/045, H04L2209/80, H04L63/062, H04W12/10, H04W12/04, H04L2209/60European ClassificationH04W12/02, H04L9/32S, H04L12/58W, H04L63/04B4, H04L63/04BLegal EventsDateCodeEventDescriptionJun 11, 2014ASAssignmentEffective date: 20130709Free format text: CHANGE OF NAME;ASSIGNOR:RESEARCH IN MOTION LIMITED;REEL/FRAME:033134/0228Owner name: BLACKBERRY LIMITED, ONTARIOFeb 6, 2004ASAssignmentOwner name: RESEARCH IN MOTION LIMITED, CANADAFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:LITTLE, HERBERT A.;BROWN, MICHAEL S.;REEL/FRAME:015500/0443Effective date: 20020806RotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services©2012 Google