Secure messaging

This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "Secure messaging" – news · newspapers · books · scholar · JSTOR (March 2014) (Learn how and when to remove this message)

Secure messaging refers to the practice of protecting sensitive data during communication through platforms that ensure confidentiality, integrity, and availability of communication using encryption and security protocols. It is commonly used for personal, professional, and governmental communication to protect sensitive information from unauthorized access, interception, or tampering. Secure messages provide non-repudiation as the recipients (similar to online banking) are personally identified and transactions are logged by the secure email platform.^[1]

Secure messaging works as an online messaging service. Firstly, users enroll in a secure messaging platform. Then, the user logs into their account by typing in their username and password (or strong authentication) similar to a web-based email account. Out of a message center, the messages can be sent over a secure SSL-connection or via other equally protecting methods to any recipient. If the recipient is contacted for the first time, a message unlock code (see below MUC) is needed to authenticate the recipient. Alternatively, secure messaging can be used out of any standard email program without installing software.^[2]

Secure messaging possesses different types of delivery: secured web interface, S/MIME or PGP encrypted communication or TLS secured connections to email domains, or individual email clients. One single secure message can be sent to different recipients with different types of secure delivery that the sender does not have to worry about.

Secure messaging relies on a web of trust. This method synthesizes the authentication approach of web of trust, known from PGP, with the advantages of hierarchical structures, known from centralized PKI systems. Those combined with certificates provide a high quality of electronic identities. This approach focuses on the user and allows for immediate and personal bootstrapping of trust, respectively revocation.

In a traditional client-server email, message data is downloaded to a local hard drive, and it is vulnerable if the computer is lost, stolen, or physically accessed by an unauthorized person. Secure messages are stored on a network or internet server which are typically more physically secure, and they are encrypted when data is inbound or outbound. However, an abundance of data still makes the server an attractive target for remote attacks. Methods that can be taken to protect physical security include ensuring environmental safety and hardware safety.^[3] Of course, the intentions of the server operator may also come into question.^{[citation needed]}

Secure messaging is used in many business areas with company-wide and sensitive data exchanges. Financial institutions, insurance companies, public services, health organizations, and service providers rely on the protection from secure messaging.^{[citation needed]} Secure messaging can be easily integrated into corporate email infrastructures.^{[citation needed][4]} According to Wolcott et al., secure messaging offers potential improvements in patient-provider relationships and outcomes.^[5]

In the government context, secure messaging can offer electronic registered mail functions. For this to be binding, some countries, such as Switzerland,^[6] require it to be accredited as a secure platform.

There is no software required for using Secure messaging. Users only need a valid email address and a working internet connection with an up-to-date web browser.

With its use in business areas and one-on-one interaction secure messaging for recipients also includes their desire to share information with another party and negotiating the different rules across state borders. Even with the private misuse of some information data, some recipients continue to use the service. This may be referred to as a privacy paradox, where convenience of usage in apps such as secure messaging may be more important than the privacy concern in information systems.^[7]

• PGP
• S/MIME
• Identity-Based Encryption

• 1965: Mainframe computer users are able to exchange messages.
• 1982: Standard for (D)ARPA internet text messages (RFC822) is adopted: different email systems can communicate with each other.
• 1983: Development of the Internet Protocol
• 1991: Phil Zimmermann creates PGP in 1991, a first-generation for secure mail communication.
• 1999: Launch of browser-based internet banking at UBS AG (Union Bank of Switzerland) with the advent of strong cryptography in industry standard browsers.
• 2001: Google search engine indexes more than 1 billion internet pages: cooperating web sites can be found easily
• 2002: Introduction of strong authentication in internet banking (UBS Switzerland) to prevent identity fraud.
• 2005: More than 1 billion internet users: most people in industrial countries can be reached via the internet

• Information security
• Email authentication
• Email encryption
• Email privacy
• Secure communication
• Secure instant messaging
• Transport Layer Security
• Cryptography
• Electronic signature
• Certified email