Patent ID: 7624269

Claim:
A method for a sender at an organization to send a message to a recipient who is a customer of the organization over a communications network, wherein the recipient has a recipient identity (ID), comprising: at the organization, deriving a symmetric key for encrypting the message from a master key using a one-way function whose inputs include the master key and the recipient ID; at the organization, encrypting the message using the derived symmetric key and sending the message to the recipient over the communications network; at the recipient, receiving the encrypted message; at the recipient, submitting a derived symmetric key request to the organization over the communications network, wherein the derived symmetric key request includes the recipient ID; authenticating the recipient to the organization and establishing a secure communications channel between the organization and the recipient over the communications network; and in response to the derived symmetric key request of the recipient, generating the derived symmetric key for the recipient to use in decrypting the message and providing the derived symmetric key to the recipient over the secure communications channel, wherein the organization has a gateway and a key generator and wherein encrypting the message comprises: using the gateway at the organization to provide the key generator at the organization with a derived key request that contains the recipient ID; and in response to the derived key request from the gateway, using the key generator to compute the derived key using the one-way function.