Policy, Design and Implementation of Key Recovery Protocol for a Web-based Internet Business E-Mail System

Abstract

In this paper, the application of a key recovery protocol to Web-based Internet business environment with public key infrastructure is proposed. Several kinds of key recovery protocols are reviewed as the key recovery standards. Among them, the encapsulation method is chosen for selective recovery of encrypted data of an e-mail message without submitting end users private keys to law enforcement organizations. The word 'selective' means that key recovery is applied when a certain end user violates an AUP(Acceptable User Policy) of an organization. Therefore, this method provides end users with management of their private keys securely. The policy, design and implementation of a key recovery protocol for a Web-based Internet enterprise e-mail system are proposed. It is assumed that a certain organization is doing a process of exchange e-mail messages for Internet-based electronic commerce tasks with other organizations. The proposed key recovery protocol is applied only when the outgoing and incoming e-mail messages violate the AUP of the organization. The main point of the proposed protocol is focused on the balance of end users' privacy and organizational security. End users are satisfied for not submitting their private keys to a legal authority or authority in their organization. And the manager is satisfied for managing the encrypted email message with help of the proposed key recovery protocol.