10 September 2002
Source: US Patent Office: http://www.uspto.gov

An anonymity system including a cryptographic device. The cryptographic device of the anonymity system is adapted to initially determine whether a response to an incoming electronic message is requested. If so, an address of the anonymity system is encrypted with a key. In one embodiment, the key may be a public key of a system targeted to receive an outgoing electronic message from the anonymity system inclusive of data contained in the incoming electronic message. The encrypted address is placed into an outgoing electronic message before re-routing to the target system to allow the target system to re-route the response back to the anonymity system.

Current U.S. Class:	713/162; 713/151; 713/153; 713/154
Intern'l Class:	H04L 009/00
Field of Search:	713/190,151,152,153,154,162,200

Other References

"Anonymous Remailer Information," anon.efga.org/Remailers[internet], 2001.* Bacard, "Anonymous Remailer FAQ," www.andrebacard.com/remail.htm[internet], Feb. 2001.* Dusse et al, "S/MIME Version 2 Message Specification," RFC 2311, Mar. 1998.

Primary Examiner: DeCady; Albert
Assistant Examiner: Kabakoff; Steve
Attorney, Agent or Firm: Blakely, Sokoloff, Taylor & Zafman LLP

FIG. 2 is a diagram of an illustrative embodiment of an anonymity system of the communication system of FIG. 1.

FIG. 3 is a diagram of an illustrative embodiment of a cryptographic device coupled to a system substrate of the anonymity system of FIG. 2.

FIG. 4 is a diagram of an alternative embodiment using a removable daughter card to interconnect the cryptographic device to the system of FIGS. 2 and 3.

FIG. 5 is a diagram of an illustrative embodiment of a cryptographic device implemented within the anonymity system of FIG. 2.

FIGS. 6-9 are diagrams of illustrative embodiments for a selected format of an incoming electronic message transmitted between electronic systems and/or multiple anonymity systems.

FIGS. 10-13 are diagrams of illustrative embodiments for a format of a response message returned to an electronic system from which the incoming electronic message of FIGS. 6-9 originated.

FIG. 14 is a flowchart of operations performed by an embodiment of the anonymity system of FIG. 2.

FIG. 15 is a flowchart of the authentication operations of an embodiment of the anonymity system of FIG. 2.

DETAILED DESCRIPTION OF AN EMBODIMENT

The present invention relates to a system and method for providing anonymous and traffic analysis resistant communications over a communication link in order to preserve the integrity and confidentiality of an electronic message transmitted between two electronic systems. In the following description, numerous details of selected embodiments of the invention are set forth in order to provide a thorough understanding of the present invention. It will be obvious, however, to one skilled in the art that other embodiments may be utilized while still practicing the present invention.

In the detailed description, certain terminology is used to generally describe features and characteristics of the present invention. For example, "information" includes data, address, control signals or any combination thereof. An "electronic message" is one or more packets of digital information which collectively comprise: (i) a header featuring an address of the immediate destination of the electronic message, and (ii) a body featuring data, addresses to identify the intended recipient of the electronic message and selected control information. A "key" is an encoding and/or decoding parameter such as, for example, public or private keys used by well-known or later established asymmetric key cryptographic functions or a secret key shared in confidence between the two electronic systems executing a well-known or later established symmetric key cryptographic function.

A "digital signature" is digital information encrypted with a private key of its signatory to ensure that the information has not been illicitly modified after being digitally signed. As a result, a digital signature authenticates the integrity of digital information provided in its entirety or as a digest produced by a one-way hash function. A "one-way hash function" includes a function, mathematical or otherwise, that takes information of a variable-length and converts it into a fixed-length result (referred to as a "digest"). The term "one-way" indicates that there does not readily exist an inverse function to recover any discernible portion of the original information from the digest. A "digital certificate" is defined herein as digital information used to authenticate a sender of information. For example, a digital certificate may include a public key, associated with an electronic system or entity (person, company, etc.) being certified, which is encrypted with the private key of a certification authority. Examples of a "certification authority" includes a manufacturer, a trade association, a governmental entity, a bank or any other entity held in trust by the consumer.

Referring to FIG. 1, a diagram of an illustrative embodiment of a communication system featuring the present invention is shown. The communication system 100 comprises a communication link 110 connecting a plurality of electronic systems 120.sub.1 -120.sub.n ("n" being a positive whole number; n=2) and at least one anonymity system 130. Optionally, as represented by dashed lines, other anonymity system(s) 140.sub.1 -140.sub.m ("m" being a positive whole number) may be coupled to communication link 110 so that an electronic message may be passed through multiple anonymity systems as described in FIGS. 6-9.

As shown in FIG. 1, communication link 110 provides bi-directional communications between (i) two electronic systems 120.sub.1 and 120.sub.2, (ii) an electronic system and an anonymity system, and/or (iii) two anonymity systems. The bi-directional communications may be accomplished through one or more communication channels. Various embodiments of communication link 110 may include, but are not limited or restricted to a public network including a Wide Area Network (WAN) such as the Internet, a private network such as a Local Area Network (LAN), wireless, Plain Old Telephone System (POTS), cable and Integrated Services Digital Network (ISDN) as defined by the International Telegraph and Telephone Consultative Committee and the like.

Each of the electronic systems 120.sub.1 and 120.sub.2 include a computer (e.g., portable, desktop, server, mainframe, network computer, etc.) or any other equipment accessible to communication link 110. Examples of the "other equipment" include, for example, a network television, a network printer, a telephone, a personal digital assistant and the like. In this embodiment, each electronic system 120.sub.1 or 120.sub.2 is uniquely addressed on communication link 110.

Referring now to FIG. 2, a diagram of an illustrative embodiment of anonymity system 130 implemented as a server is shown. Coupled to electronic systems 120.sub.1 and 120.sub.2 as described above, anonymity system 130 includes a system substrate 200, outlined by dashed lines, which controls the overall functionality of anonymity system 130. System substrate 200, normally a circuit board (e.g., a motherboard) formed with any type of material or combination of materials upon which logic devices can be attached.

As shown in FIG. 3, system substrate 200 comprises at least one processor 300 and a cryptographic device 320. To enable communications with processor 300, cryptographic device 320 may be coupled to any bus architecture to which processor 300 communicates (e.g., a dedicated bus, an input/output "I/O" bus such as a Peripheral Component Interconnect "PCI" bus, etc.). Alternatively, cryptographic device 320 may be integrated within the same package as processor 300, either on a separate die or on the same die as processor 300. Although not shown, discrete components (e.g., capacitors, resistors, inductors, etc.) are attached to system substrate 200 in a selected manner to, among other things, maximize routing characteristics and decrease latency between integrated circuitry.

Referring now to FIG. 4, an alternative embodiment of an implementation associated with cryptographic device 320 is shown. Cryptographic device 320 is coupled to a removable daughter card 400 electrically and mechanically coupled to system substrate 200 of FIGS. 2 and 3. In this embodiment, daughter card 400 includes a circuit board formed from any type of material upon which integrated circuitry (not shown) can be attached through well-known techniques such as soldering. A casing 410 substantially covers daughter card 400 in order to protect its integrated circuitry from damage or harmful contaminants. The daughter card 400 includes a connector 420 to establish the mechanical and an electrical connection with a connector of system substrate 200. In this embodiment, connector 420 includes a standard male edge connector. It is contemplated, however, that other embodiments of daughter card 400 include a removable card having a credit card format (e.g., a SmartCard), a PCMCIA card, a network interface card and the like.

Referring to FIG. 5, a diagram of one embodiment of cryptographic device 320 is shown. Cryptographic device 320 comprises an internal bus 500 coupling together a processor 510, non-volatile memory unit 520, an optional volatile memory unit 530 (as denoted by dashed lines), an optional random number generator 540 (as denoted by dashed lines) and a bus control unit 550. The bus control unit 550 controls information transmissions between cryptographic device 320 and communication link 10 of FIG. 1, thereby maintaining communications with any one of the "n" electronic systems remotely located from anonymity system 130.

In this embodiment, non-volatile memory unit 520 contains a public/private key pair 521 and 522 uniquely associated with cryptographic device 320. It is contemplated that non-volatile memory unit 520 further contains software 523, namely communication software and/or software to counter (resist) traffic analysis. When in operation, communication software allows electronic systems to transfer data while counter traffic analysis software performs operations making traffic analysis more difficult. For example, the counter traffic analysis software, when executed, may introduce padding into the electronic message to increase its size. Likewise, the counter traffic analysis software may (i) introduce an arbitrary delay before redirecting that electronic message, (ii) partition the electronic message into multiple messages which are transmitted in succession, and/or (iii) produce decoy (invalid) messages along with the redirected electronic message or any combination thereof. Of course, other techniques may be used. Of course, it is contemplated that software 523 may be stored outside cryptographic device 320, provided this software is cryptographically protected to avoid modification before being loaded into non-volatile memory unit 520 or volatile memory unit 530 of cryptographic device 320.

Volatile memory unit 530 may be utilized as temporary storage by processor 510, especially during the execution of software 523. The random number generator 540 may be used in the initial generation of values used to produce public key 521 and private key 522 contained in non-volatile memory unit 520. It is desirable to implement random number generator 540 into cryptographic device 320 to guarantee that a private key of a unique public/private key pair will not been exposed in readable form outside cryptographic device 320. Also, the cryptographic engine hardware represented by a symmetric (e.g., DES-based) and an asymmetric (e.g., RSA-based) encryption/decryption units may be optionally implemented, as indicated by dashed lines, to assist in performing cryptographic operations.

It is contemplated, however, that cryptographic device 320 of FIG. 4 may be implemented in a number of alternative embodiments. For example, the cryptographic device may be implemented with discrete logic on a printed circuit board, or implemented within a chipset operating in cooperation with a host processor, or implemented within the processor, or implemented as a separate device coupled to a bus accessible by the processor. There exist many embodiments which, although slightly different in design, do not deviate from the spirit and scope of the invention.

Referring to FIGS. 6-9, a general format of the data structures of an electronic message transmitted between two electronic systems and through one or more anonymity systems is shown. Each electronic message 600 includes a header 610 and a message body 620. The header 610 includes an immediate destination address of electronic message 600. Initially, this destination address is a unique address associated with a first anonymity system (identified as "AS(1)") as shown in FIG. 7. For subsequent routing, the destination address may be a unique address associated with another anonymity system (e.g., AS(x), where "x"=2) or the intended recipient (IR) such as a second electronic system 120.sub.2 of FIG. 1.

The message body 620 includes data 700 such as a viewable image, text, an audible sound, an executable program and the like. Optionally, data 700 is encrypted with a public key of the intended recipient (PUKIR). Besides data 700, body 620 may further include (i) a message propagation field 710, (ii) a target address field 720, (iii) a routing field 730, (iv) a control field 740 and perhaps (v) padding information which is interspersed in body 620 or appended to data 700 or predetermined field 710, 720, 730 or 740. The optional padding is not shown.

In this embodiment, control field 740 includes a communication path enable bit which, when set, indicates to communication software, executed by the cryptographic device of an anonymity system, that message propagation field 710 can be loaded with information as described below. This allows a response to be routed back to the original sender of electronic message 600. Otherwise, electronic message 600 cannot be responded to by the intended recipient.

When the enable bit is set, message propagation field 710 is loaded with data to identify provider(s) of electronic message 600; namely, in this embodiment, the address(es) 711 of those anonymity system(s) through which electronic message 600 has been routed. Successive loading of message propagation field 710 is described below and is illustrated in FIGS. 7-10. In addition, message propagation field 710 is loaded with data acting as a tag identification value for the electronic message (referred to as a "message tag" 712). Herein, message tag (MT) 712 is encrypted with the public key of the original sender (PUKSDR) as represented by "MT.sub.PUKSDR ".

The contents of message propagation field 710, which are used in identifying where a response is directed to and what the response pertains to, are initially encrypted with the public key of a targeted anonymity system or electronic system. For example, message propagation field 710 includes an address of the original sender (SDR) and MT.sub.PUKSDR, both encrypted with a public key of AS(1) (e.g., PUKAS1) when routed to a first anonymity system (FIG. 7). Subsequently, message propagation field 710 successively includes (i) an address of AS(1) encrypted with a public key of AS(2) (e.g., PUKAS2) when routed to a second anonymity system (FIG. 8), (ii) an address of AS(2) encrypted with a public key of AS(3) (e.g., PUKAS3) when routed to a third anonymity system, and (iii) an address of AS(M) encrypted with PUKIR when routed to the intended recipient (IR) such as another electronic system. "M" represents the m.sup.th anonymity system being the last system prior to routing the intended recipient.

As further shown in FIGS. 6-9, target address field 720 contains an address of the intended recipient (IR) of electronic message 600 (such as the address of second electronic system 120.sub.2 of FIG. 1 in this embodiment). The routing field 730 includes one or more bytes of information to indicate when to route electronic message 600 to the intended recipient. For example, in one embodiment, routing field 730 includes a maximum (max) number and minimum (min) number of intermediary anonymity systems for re-routing electronic message 600 (where min.ltoreq.M.ltoreq.max). The "minimum number" 731 is decremented upon receipt by each of the anonymity system(s) and, upon reaching zero, enables the anonymity system to route electronic message 600 to the intended recipient. The "maximum number" 732 is decremented upon receipt by each of the anonymity system(s) and, if reaches zero, forces that anonymity system to route electronic message 600 to the intended recipient. The routing field 730 may further include explicit routing information 733 that allows specified routing to occur. Otherwise, routing will be dependent on the configuration of each anonymity system. The information contained in target address field 720 and routing field 730 is deleted by the mth anonymity system addressed by AS(M) before transmission to the intended recipient as shown in FIG. 10.

Referring now to FIG. 11, upon responding to electronic message 600, a second electronic system decrypts a portion of message propagation field 710 (see FIG. 10) to recover an address of the immediately preceding anonymity system, such as AS(M), which had routed the electronic message thereto. The data may need decryption as well. In general, a response 800 having the same general format as the electronic message may be generated by the second electronic system. The response 800 comprises a header 810 to contain the address of the immediate destination of response 800, for example AS(M), from the message propagation field of the electronic message 600 of FIG. 10. The response 800 further comprises a body 820 featuring a return message propagation field 900, data 910 as an optional digital signature 920. Return message propagation field 900 includes the contents of message propagation field 710 of FIG. 10 which were provided to the second electronic system. Certain contents would be encrypted with the public key of the mth anonymity system (e.g., PUKASM), such as the address AS(M-1) of the next intermediary system to receive response 800. The optional digital signature 920 provides assurances to the original sender that the intended recipient is, in fact, responding to the electronic message.

After being received by each of the anonymity systems, the contents of message propagation field 900 are decrypted and the most significant address, namely AS(M-1) is placed into header 810 as shown in FIG. 12. Now, the most significant address of message propagation field 900 is encrypted with the public key associated with the M-1.sup.th anonymity system (e.g., PUKASM-1). This process continues until response 800 is received by the first anonymity system addressed by AS(1).

Upon reaching the first anonymity system, prior to transmission to the original sender, header 810 features an address of the original sender (e.g., SDR) to which the response was intended. Message 800 also includes message propagation field 900 having the encrypted message tag "E(MT).sub.PUKSDR " provided in the original message 600 and data 910. E(MT).sub.PUKSDR, when decrypted, identifies what the response pertains to (see FIG. 13). Data 910 may be encrypted with PUKSDR. As an option, digital signature 920 may be provided to the original sender to verify that response 800 originated from the intended recipient of electronic message 600.

Referring now to FIG. 14, one embodiment of an address assignment scheme would involve the anonymity system routing an electronic message to the cryptographic device (block 1000). Internally within the cryptographic device, a determination is made as to whether the communication path enable bit has been enabled (block 1010). If this bit has been disabled, the address assignment scheme is discontinued. Instead, a new address (e.g., address of intended recipient) is placed in the header, perhaps counter traffic analysis procedures are performed, and the electronic message is redirected (blocks 1060, 1070, 1080 and 1090).

If this bit is enabled, a message tag (MT) is generated and determined whether the message tag has already been assigned (block 1020). If previously assigned, the message tag is again generated (block 1030) and checked. Otherwise, the message tag is stored in a table to correspond with the public key of the sender (PUKSDR) which is supplied by the electronic message (block 1040). Both the message tag and the address of a target anonymity system to receive this message are encrypted with a public key of the targeted anonymity system (block 10500. The encrypted message tag and address are placed in the electronic message (block 1060) prior to reconfiguration of the header for redirection from the anonymity system (block 1090).

If counter traffic analysis measures are desirable (block 1070), these measures may be employed internally within the cryptographic device (block 1080). For example, the cryptographic device may provide padding to the electronic message in order to vary its size. Alternatively or in combination therewith, a random delay before redirecting the electronic message may be induced. As a result, the decrypted data is not exposed to the operator. Instead, random counter traffic analysis measures are performed to make it difficult for somebody to look at incoming messages and to accurately deduce certain output messages are associated with corresponding incoming messages.

Referring now to FIG. 15, authentication of an anonymity system of FIG. 1 is shown. First, in block 1110, a sender tentatively selects a particular anonymity system. Upon selecting an anonymity system, the sender determines whether the characteristics of the anonymity system such as its operational protocol (block 1120). This may be accomplished through a number of authentication procedures.

As shown, one authentication procedure involves at least one of the parties requesting the public key of either the anonymity system (PUKAS) or the cryptographic device "PUKCD" and perhaps a digital certificate (block 1130). The digital certificate would verify that the anonymity system was manufactured by a certain company or perhaps approved by a certification authority such as a reputable manufacturer, trade association, governmental entity and the like. The digital certificate and perhaps the public key are encrypted with a private key of the certificate authority (PRKCA) whose public key (PUKCA) is widely disseminated. Thus, the parties can obtain PUKAS (or PUKCD) and send a challenge message to the anonymity system requesting a response to the message, this requested response being the message encrypted with the private key of the anonymity system (PRKAS) or private key of cryptographic device (PRKCD), respectively (block 1140). In block 1150, if the party can read the response by decrypting it with PUKAS (or PUKCD), the anonymity system has been authenticated to be the device that the parties have sought (blocks 1160 and 1170).

If the cryptographic device is configured to maintain counter traffic analysis software and/or firmware, an additional authentication operation may be performed to ensure that an acceptable version of such software/firmware is installed (block 1180). This authentication operation consists of querying the previously authenticated cryptographic device for details of its configuration.

The present invention described herein may be designed in accordance with many different methods and using many other embodiments that may come to mind to a person skilled in the art, without that person departing from the spirit and scope of the present invention. The invention should, therefore, be measured in terms of the claims which follows.