A Holistic Approach Towards Secure and Privacy Enhanced Email System

Abstract

The right to privacy and freedom of expression is the basic right of every human being. In the digital communication the same rights should also be provided. This thesis elaborates the proposed design and protocol of a privacy enabled and secure email system. Many existing email solutions provide features like protection of email contents, security of address book and even encryption of IP address field, but privacy of users is still an issue. This is a serious concern for security engineers, perhaps they mostly argue that an interceptor can identify the communicating parties. After analyzing the current issues, we have proposed a new mechanism to secure the email address of sender and receiver in inter domain and intra domain communication. This mechanism is based upon layered approach. A secure proxy server and database server are used to achieve privacy of users. The system has features of signing and encryption of email messages, protection of email headers, privacy of original email addresses, authentication of original users, and management of symmetric and asymmetric keys in a closed environment. This system is based on a secure proxy server that handles the communication between email clients and standard email server. This system can be integrated with any email server. Public Key Cryptography is used for verification of users and server. After designing and implementing email system, its verification was done by using a verification tool, called Scyther. Results demonstrate that original email addresses are not leaked during communication. Besides using Scyther, various test cases were designed to analyze performance of email system. Results of test cases demonstrates, the security module slightly affects the performance of existing email system while keeping the privacy intact.