Secure messaging is a server-based approach to protect sensitive data when sent beyond the corporate borders and provides compliance with industry regulations such as HIPAA, GLBA and SOX. Advantages over classical secure e-mail are that confidential and authenticated exchanges can be started immediately by any internet user worldwide since there is no requirement to install any software nor to obtain or to distribute cryptographic keys beforehand. Secure messages provide non-repudiation as the recipients are personally identified and transactions are logged by the secure email platform.
Functionality
Secure messaging works as an online messaging service. Firstly, users enroll to a secure messaging platform. Then the user logs into their account by typing in the username and password similar to a web-based email account. Out of a message center messages can be sent over a secure SSL-connection or via other equally protecting methods to any recipient. If the recipient is contacted for the first time a message unlock code is needed to authenticate the recipient. Alternatively, Secure messaging can be used out of any standard email program without installing software.
Secure delivery
Secure Messaging possesses different types of delivery: secured web interface, S/MIME or PGPencrypted communication or TLS secured connections to email domains or individual email clients. One single secure message can be sent to different recipients with different types of secure delivery the sender does not have to worry about.
Trust management
Secure Messaging relies on the method of the dynamic personal web of trust. This method synthesizes the authentication approach of web of trust, known from PGP, with the advantages of hierarchical structures, known from centralized PKI systems. Those combined with certificates provide high quality of electronic identities. This approach focuses on the user and allows for immediate and personal bootstrapping of trust, respectively revocation.
Physical security
In traditional client-server email, message data is downloaded to a local hard drive, and is vulnerable if the computer is lost, stolen, or physically accessed by an unauthorized person. Secure Messages are stored on a network or internet server which are typically more physically secure, and are encrypted when data is inbound or outbound. However, an abundance of data still makes the server an attractive target for remote attacks. Of course, the intentions of the server operator may also come into question.
Application
Secure Messaging is used in many business areas with company-wide and sensitive data exchanges. Financial institutions, insurance companies, public services, health organizations and service providers rely on the protection from Secure Messaging. Secure Messaging can be easily integrated into the corporate email infrastructures. In the government context, secure messaging can offer electronic registered mail functions. For this to be binding, some countries, such as Switzerland, require it to be accredited as a secure platform.
With its use in business areas and one-on-one interaction secure messaging for recipients also includes their desire to share information with another party and negotiating the different rules across state borders. Even with the private misuse of some information data, some recipients continue to use the service. This may be referred to as a privacy paradox, where use convenience in apps such as for secure messaging may be more important than the privacy concern in information systems.
