Copyright: InvisiMail International Ltd


intro

Welcome to InvisiMail

Congratulations on choosing InvisiMail, the global high strength solution for secure e-mail communications on the Internet.

InvisiMail is an easy-to-use e-mail security enhancement for use with all standards-compliant Internet e-mail clients and servers.  Certified by the International Computer Security Association, InvisiMail automatically and transparently encrypts e-mail messages and attachments, authenticates the sender and verifies the contents have not changed in transit.


Installation screens help
InvisiMail Installation

Installing InvisiMail

•	InvisiMail easily guides you through the installation process.

•	On choosing to install, InvisiMail displays a welcome screen with a list of e-mail client's that are automatically supported by the Install process.

•	If you have an alternative POP3/SMTP compliant e-mail client it is possible to manually configure InvisiMail to support your system.

•	Depending on your install you will now be provided with the License screen in which to input the license information provided by your sale agent. The license screen is case sensitive so be careful when entering the provided license details.

•	You will now be provided with the license agreement form which must be accepted to proceed with the installation. Please read this document thoroughly. You will now be prompted to close any e-mail client that may be open. We strongly recommend that you close all other open programs at this point including any web browser that you may be using.

•	InvisiMail will now proceed to recommend locations for storing its operational files and Data - in general we recommend that you accept the default locations.

•	Following this, InvisiMail will search your machine for installed e-mail clients with which it can integrate; this may take some time. When InvisiMail has completed its search it will provide a list of all mail clients found on your machine.

•	Please note InvisiMail may find ghost installs from previously installed e-mail accounts that haven't been removed completely during the uninstall process. This is of no concern, simply click to remove the tick boxes against those mail clients you do not wish to protect. When you have made your selection click the Next button.

•	InvisiMail now asks that a security level be selected:-

•	607 bit encryption is more than adequate for most purposes and that choosing 1279 bit encryption may cause noticeable delays during the send and receive process. It is also important to note that the key size you select is the level of security at which others will encrypt messages to you not vice versa.

•	As such, consideration should be given for those with whom you wish to communicate as these are the people who will experience the encryption delays. Now simply click in the appropriate security level radio box you desire and choose next.

•	InvisiMail requires a good source of random data to generate your Public/Private key sets which is provided by scribbling with the mouse in the view pane presented. Once InvisiMail has collected sufficient random data you will be informed and advised to click Next.

•	InvisiMail will now ask that a default e-mail address be selected from the list identified during the earlier search for e-mail clients – it is possible to add an address at that stage if you wish.

•	The default address is the address which your public/private key set will be associated with on your and other machines. The other e-mail addresses will be aliases to the same key. i.e. if you have an address for your local network mail server such as steve@company.mail and an address with which you communicate with the rest of the world such as steve@somewhere.com. The somewhere.com address is likely to be a good candidate for the primary address.

•	InvisiMail will request that a password be provided.

•	This password will be used whenever you log on to your machine or attempt to send e-mail so DO NOT FORGET IT and be aware that the password is case sensitive. If you forget your password you will not be able to send or receive encrypted mail, it will also be impossible to read messages that you may have encrypted in your in-box.

•	You will now be presented with a ports screen that shows the default ports used for POP (incoming) and SMTP (outgoing) mail. Some applications such as Wingate or MimeSweeper use these ports for their own purposes and as such alternatives such as 3110 and 3025 should be used.  Now click Continue.

•	InvisiMail has finished gathering all the information required to install on your PC and provides an overview of the information it has collected for the proposed install. Please check that this is correct before clicking Continue.

•	The next screen details information regarding the new InvisiMail EasyMAP feature. The use of this is recommended wherever possible.

•	You will also be asked to log into InvisiMail while it encrypts your public/private key information and generates its secure data files.

•	Next you will be prompted to send InvisiMail to friends. This notifies correspondents that have InvisiMail of your public key so that they can send secure messages to you:

•	For correspondents who do not have InvisiMail the notification also sends a downloader program. The downloader program enables the recipient to download Invisimail so you can begin communicating securely. Please note the downloader providesthe free InvisiMail Lite version.

•	Your correspondents may choose to upgrade to the Deluxe version to gain the additional features of text, anti-virus scanning and desktop utilities. It is possible to personalise the "send to friends" message to suit your requirements. Please be careful not to include newsgroups in your distribution list.

•	InvisiMail will now asks if you would like free notification of updates and new releases. We strongly recommend you select Yes so you will be able to benefit from product enhancements as they become available.


Testing the installation

•	After running the InvisiMail installer it is a good idea to send a test message to yourself to see that InvisiMail has correctly configured your e-mail clients.

•	You should see the InvisiMail progress display as the message is being encrypted and sent.

•	On retrieval of the message you should again see the InvisiMail progress display and if you have a Deluxe or Enterprise Edition there will also be a File Signature.rp1 attachment. The File Signature attachment contain information as to the sender of the message/that it was received encrypted and that no change was made to the file during transit.

•	If you receive a message such as mail server unobtainable it is likely that InvisiMail has been unsuccessful in amending your e-mail settings which will now need to be set manually. Please see troubleshooting.


Troubleshooting installation

•	The most common error that will be received is likely to be server unobtainable or no InvisiMail progress display during send and receive. Typically this will occur if Invisi.exe has been unsuccessful at loading in the background. Be sure to check that the InvisiMail icon is loaded in the tray on the bottom right of the screen, if not choose to run Invisi.exe from the InvisiMail Business Directory.

•	If Invisi.exe is running but you still receive a Server unobtainable error it is likely that InvisiMail has been unsuccessful at amending your e-mail client setting to route via InvisiMail. A likely cause is that the e-mail client/browser was not closed during the installation process which would lock the addressing files so that the amendment couldn't be made.

•	To correct this setting:-

1.	CLOSE YOUR E-MAIL OR BROWSER then open the InvisiMail Manager and click on the Software Button.

2.	The left hand view pane details the clients that have been identified during the install. If no clients are shown, or if one is missing, choose Update E-mail.

3.	Otherwise select the e-mail client that you wish to amend by clicking in the action box. In the right hand pane the original settings should be displayed for the e-mail client along with the local address which InvisiMail is now routing communications through (e.g. 127.0.2.1).

4.	Choose to Stop InvisiMail protecting this client then close the Manager.

5.	Now Open your mail package and check that your SMTP/POP3 settings are correct for your internet service provider or network mail server and amend as necessary.

6.	Now close the e-mail client/browser and open the InvisiMail Manager and click on the Software Button.

7.	In the left hand view pane click on the "Update e-mail software" button. InvisiMail will then search your computer for your e-mail settings, when this has been completed click and select the e-mail client in the left hand pane you are amending.

8.	In the right hand pane the correct setting should now be shown – click on the Start InvisiMail protecting button and note the modified communication settings.

9.	Now close the InvisiMail Manager and open your e-mail client and attempt to send an e-mail message to yourself. InvisiMail should then display the encryption /decryption progress screen as the message is sent.

10.	If the progress display does not appear, be sure to check the SMTP/POP3 setting in the e-mail client which should be the amended settings (127.0.0.x) noted from the InvisiMail Manager.  If different, enter the setting shown in the InvisiMail Manager.


Planning install

Planning your Network Server installation

System requirements:-

For Windows 95

InvisiMail Business Edition Server for Windows 95

8MB Free Memory (Heavy loads will increase the memory requirement)

6MB Free Hard Disk Space

Windows Compatible PC

Network Configuration: Minimum Processor Pentium 166

For Windows NT

InvisiMail Business Edition Server for Windows NT

16MB Free Memory (Heavy loads will increase the memory requirement)

9MB Free Hard Disk Space

Windows NT Compatible PC

Network Configuration: Minimum Processor Pentium 166

InvisiMail Business Edition Server (IBES) can be configured to perform 4 separate functions:

1.	External SMTP Gateway

2.	External Network Server Link

3.	Internal Network Server

4.	Distributed Network

Each IBES solution provides the Network Administrator with different options over where information is in plain text and where it is encrypted. For the purposes of the IBES install information is categorised as follows:

•	In Public	in the Public Domain and generally refers to messages in the Internet

•	External	between your company e-mail system and the public domain.

•	On Server	stored on your e-mail server

•	Internal	between your e-mail server and an user

•	Client	on a user's machine.

These categories can be related to equipment with in your network e.g.

Internet Router	In Public

FireWall	External

Mail Server	On Server

Company Network	Internal

Your Workstation	Client

On an SMTP/POP3 based mail network the IBES can be installed at any location between the In Public and Client Categories. For other e-mail systems such as MS Exchange Server, Lotus Notes and Group Wise the IBES must be installed at the External Level.

IBES External Network Server Link

IBES is installed between any External Devices and the E-mail Server.

Note products that perform Virus or Content scanning must be located between IBES and e-mail server.

Network Device	Category	Encrypted/Plain Text

Internet Router	- 	In Public	Encrypted

FireWall	-	External	Encrypted

IBES Network Server Link

Virus Scanner	-	External	Plain Text

Mail Server	-	On Server	Plain Text

Company Network	-	Internal	Plain Text

Your Workstation	-	Client	Plain Text

The Network Server Link configuration is similar to the Gateway operation accept that SMTP connections are supported for sending of messages only and POP3 is used to retrieve incoming Messages. This configuration should be used when only protection of Public Domain messages is required and mail is collected from a network service provider or POP3 Mail Server.

IBES Internal Network Server

IBES is installed between the Mail Server and the Network Users. You internal network must be re-configured to use InvisiMail as the Network Mail Server. For example if your computers on your network currently reference Mail.MyCompany.Com as its mail server then Mail.MyCompany.Com should be changed to point at the InvisiMail Server or each workstation should be changed to use Invisi.MyCompany.Com (please note you will need to configure this address in your DNS). The IBES Network Server may be installed on the same machine as your mail server providing the mail server software supports either TCP/IP Port Mapping or can be bound to a specific IP Address.

Network Device	Category	Encrypted/Plain Text

Internet Router	- 	In Public	Encrypted

FireWall	-	External	Encrypted

Virus Scanner	-	External	Encrypted

Mail Server	-	On Server	Encrypted

IBES Network Server

Company Network	-	Internal	Plain Text

Your Workstation	-	Client	Plain Text

The Network Server configuration protects information while it is held on your e-mail server. Network Users connect to the Email Server via the IBES Network Server which encrypts/decrypts messages as appropriate. In addition to supporting SMTP/POP3 mail servers this configuration also supports e-mail proxy servers such as WinGate.

VIRUS WARNING:	ANY VIRUS SCANNING SOFTWARE NOT ON YOUR CLIENT WORKSTATIONS WILL NOT DETECT VIRUSES IN ENCRYPTED MESSAGES.

IBES Distributed Network

IBES Data Files are stored on a central file server, InvisiMail Workstation software is loaded on to each PC.

Network Device	Category	Encrypted/Plain Text

Internet Router	- 	In Public	Encrypted

FireWall	-	External	Encrypted

Virus Scanner	-	External	Encrypted

Mail Server	-	On Server	Encrypted

IBES Data Files on a File Server

Company Network	-	Internal	Encrypted

InvisiMail Workstation Software

Your Workstation	-	Client	Plain Text

This offers the highest level of security, protecting messages to and from the Workstation. This configuration also supports shared recipient lists, public and private keys.

VIRUS WARNING:	ANY VIRUS SCANNING SOFTWARE NOT ON YOUR CLIENT WORKSTATIONS WILL NOT DETECT VIRUSES IN ENCRYPTED MESSAGES.

IBES Other Configurations

The InvisiMail Business Edition Server provides a flexible network configuration. The above represents the main options but it is possible to create hybrid configuration to suit most requirements.

In seeking to integrate with the plethora of e-mail solutions currently available and supporting future releases of such software essentially rules out any solution that attempts to use an API approach. The simple fact is that all Internet e-mail packages support Internet Protocols making the communication protocol the ideal place from which to provide security. InvisiMail achieves this by utilising local proxy techniques that convince the existing Mail Client or Server that InvisiMail is the Mail server/Internet Connection while InvisiMail in turn points out to the real service. By capturing this traffic, all e-mail passes through the InvisiMail local proxy where upon it is automatically and intelligently encrypted/decrypted passed through or seeded/scanned with/for public key data. This process allows InvisiMail to integrate with a wide range of e-mail servers including Lotus Notes, Novell GroupWise, MS Exchange and a number of complimentary content security solutions.

The Connection display in the InvisiMail Manager displays the IP address on which InvisiMail will accept communications from the Local Network for routing mail. In so doing it provides the ability to support multiple Mail Servers in a distributed network or in a network installation with centralised encryption it will accept connections from listed clients. Within this section is the ability to set the IP profile from the "Allowed List" button and specifically deny external Internet Connections.

Management Tasks and Considerations

Tasks to Install External Network Server Link

1.     Note the IP Address and SMTP/POP3 Ports (Usually 25 and 110) of the External Mail Server to where external Email Messages are sent and from where Internal Messages may be retrieved.

2.	Note the IP Address and SMTP/POP3 Ports (Usually 25 and 110) of the InvisiMail Server.

3.	Prepare a list of the Users and email addresses (see below for File Format to enable import during Install)

4.	Ensure you have an InvisiMail Network license to cover the number of users/keys required.

5.	Install InvisiMail Network Server for Windows NT or Windows 95 as required.

6.	Alter the send and retrieve addresses of your email server to ensure that mail is routed via the InvisiMail Server.

7.	By Default InvisiMail accepts all connections. Use the Connections Screen in the InvisiMail manager to DENY access to the server as required.

Tasks to Install Internal Network Server

1.	Note the IP Address and SMTP/POP3 Ports (Usually 25 and 110) of your Network Mail Server.

2.	Note the IP Address and SMTP/POP3 Ports (Usually 25 and 110) of the InvisiMail Server.

3.	Prepare a list of the Users and email addresses (see below for File Format to enable import during Install)

4.	Ensure you have an InvisiMail Network license to cover the number of users/keys required.

5.	Install InvisiMail Network Server for Windows NT or Windows 95 as required.

6.	Alter the send and retrieve addresses of your email workstations or your internal DNS server to ensure that mail is routed via the InvisiMail Server.

7.	By Default InvisiMail accepts all connections. Use the Connections Screen in the InvisiMail manager to DENY access to the server as required.

Virus Scanning and Content Filtering: It is important to note that encrypted data cannot be checked for viruses or content. This must be considered when designing your Installation. Ensure that you take adequate steps to support these vital tasks. See the InvisiMail Web Site for more information on Encryption and Virus Scanning.

Data Backup: Remember to include the InvisiMail Data Directory in your Network Backup policy. Information such as Private Keys and Authentication Data cannot be recreated if lost.


Planning installation

Planning your Gateway Server installation

System requirements:-

For Windows 95

InvisiMail Business Edition Server for Windows 95

8MB Free Memory (Heavy loads will increase the memory requirement)

6MB Free Hard Disk Space

Windows Compatible PC

Gateway Configuration: Minimum Processor Pentium 100

For Windows NT

InvisiMail Business Edition Server for Windows NT

16MB Free Memory (Heavy loads will increase the memory requirement)

9MB Free Hard Disk Space

Windows NT Compatible PC

Gateway Configuration: Minimum Processor Pentium 100

InvisiMail Business Edition Server (IBES) can be configured to perform 4 separate functions:

1.	External SMTP Gateway

2.	External Network Server Link

3.	Internal Network Server

4.	Distributed Network

Each IBES solution provides the Network Administrator with different options over where information is in plain text and where it is encrypted. For the purposes of the IBES install information is categorised as follows:

•	In Public	in the Public Domain and generally refers to messages in the Internet

•	External	between your company e-mail system and the public domain.

•	On Server	stored on your e-mail server

•	Internal	between your e-mail server and an user

•	Client	on a user's machine.

These categories can be related to equipment with in your network e.g.

Internet Router	In Public

FireWall	External

Mail Server	On Server

Company Network	Internal

Your Workstation	Client

On an SMTP/POP3 based mail network the IBES can be installed at any location between the In Public and Client Categories. For other e-mail systems such as MS Exchange Server, Lotus Notes and Group Wise the IBES must be installed at the External Level.

IBES External SMTP Gateway Option

IBES is installed between any External Devices and the E-mail Server.

Note products that perform Virus or Content scanning must be located between IBES and e-mail server.

Network Device	Category	Encrypted/Plain Text

Internet Router	- 	In Public	Encrypted

FireWall	-	External	Encrypted

IEBS Gateway

Virus Scanner	-	External	Plain Text

Mail Server	-	On Server	Plain Text

Company Network	-	Internal	Plain Text

Your Workstation	-	Client	Plain Text

The IBES Gateway will accept INBOUND connections from the Firewall and OUTBOUND connections from the Virus Scanner. INBOUND connections MAY ONLY BE DECRYPTED, Out Bound connections MAY ONLY BE ENCRYPTED. The Gateway configuration supports SMTP connections only.

Installing an External SMTP Gateway

To install the InvisiMail Gateway it is necessary have a basic understanding of TCP/IP and Networking issues. As part of the install process the administrator is directed to read the Network Installer Guide which contains much of the information held in this document. To assist in the install  process InvisiMail provides a wizard based install that guides the Network Administrator through the installation process advising as to the appropriate settings for the mail server and Firewall.

1.	Note the IP Address and SMTP Port (Usually 25) of the Server from which Messages will be sent to InvisiMail prior to being forward to the Internet. This may be you E-mail Server or Virus Scanner. IT WILL ALWAYS BE A SERVER OR DEVICE ON YOUR NETWORK.

2.	Note the IP Address and SMTP Port (Usually 25) of the Server to which Messages will be sent. This will generally be your Internet Provider SMTP server and Relay Server. If you do not use an SMTP Server or Relay Server then visit the InvisiMail Web Site for a list of third party SMTP Relay products.

3.	Note the IP Address and SMTP Port (Usually 25) of the InvisiMail Server.

The IP addressing details will be used on an installation screen where InvisiMail will determine the appropriate addresses to be used as follows:

1.	On completion of your Gateway install it will be necessary to alter the forwarding address of your e-mail server/virus scanner to ensure that e-mail is forwarded to the InvisiMail Server. As this information is used the new addressing should be noted.

2.	It will also be necessary to alter the forwarding address of your external systems to ensure that Inbound e-mail is routed via InvisiMail.

In seeking to integrate with the plethora of e-mail solutions currently available and supporting future releases of such software essentially rules out any solution that attempts to use an API approach. The simple fact is that all Internet e-mail packages support Internet Protocols making the communication protocol the ideal place from which to provide security. InvisiMail achieves this by utilising local proxy techniques that convince the existing Mail Client or Server that InvisiMail is the Mail server/Internet Connection while InvisiMail in turn points out to the real service. By capturing this traffic, all e-mail passes through the InvisiMail local proxy where upon it is automatically and intelligently encrypted/decrypted passed through or seeded/scanned with/for public key data. This process allows InvisiMail to integrate with a wide range of e-mail servers including Lotus Notes, Novell GroupWise, MS Exchange and a number of complimentary content security solutions.

The Connection display in the InvisiMail Manager displays the IP address on which InvisiMail will accept communications from the Local Network for routing mail. In so doing it provides the ability to support multiple Mail Servers in a distributed network or in a network installation with centralised encryption it will accept connections from listed clients. Within this section is the ability to set the IP profile from the "Allowed List" button and specifically deny external Internet Connections.

Management Tasks and Considerations

Virus Scanning and Content Filtering: It is important to note that encrypted data cannot be checked for viruses or content. This must be considered when designing your Installation. Ensure that you take adequate steps to support these vital tasks. See the InvisiMail Web Site for more information on Encryption and Virus Scanning.

Data Backup: Remember to include the InvisiMail Data Directory in your Network Backup policy. Information such as Private Keys and Authentication Data cannot be recreated if lost.


Install on machines running WinGate

Using InvisiMail on the same PC as WinGate

InvisiMail can capture mail heading to the Internet via WinGate. InvisiMail sits between your e-mail clients and WinGate; the clients must be pointed to the IP and port address of InvisiMail which will in turn point to the same IP address, but must be given a separate port address to gain access to WinGate: e.g.

Client > 192.168.0.1:25 > InvisiMail > 192.168.0.1:3025 > WinGate	for SMTP

Client > 192.168.0.1:110 > InvisiMail > 192.168.0.1:3110 > WinGate	for POP3

Client > 192.168.0.1:143 > InvisiMail > 192.168.0.1:3143 > WinGate	for IMAP

Here the client and InvisiMail are pointing to the same IP address (the same PC), but are using different ports on which to communicate. This allows the e-mail client to operate exactly as it did previously, pointing to the same address/port, but all mail will pass through InvisiMail before it reaches the Internet and all received mail will be intercepted by InvisiMail before it arrives at the desktop.

The proxy settings can be entered on the Connections tab within the InvisiMail Manager; this may be done during installation if you are using the Enterprise edition or anytime after install through the Manager.

WinGate will require re-configuring to listen for e-mail traffic on the ports you have assigned in InvisiMail. This can be done within WinGate's GateKeeeper administration program. By selecting Services - POP3 and SMTP, you can change the port configuration on the General tab within the Properties page of each Service. After these alterations have been made, you should restart your InvisiMail / WinGate machine to ensure all changes are implemented correctly. A test email should then be sent to yourself to check the install.


Install on same machine as Email Server s/ware

Using InvisiMail on the same PC as your E-mail Server

How InvisiMail interacts with your e-mail server software will depend on the type of configuration you require. InvisiMail can capture mail from within the network heading to the mail server or it can perform its functions externally to the mail server (see Gateway Edition). In both cases the important issue here concerns IP and port addressing.

If InvisiMail sits between your e-mail clients and the e-mail server then the clients can remain pointed to the IP and port address of the mail server: e.g.

Client > 192.168.0.1:25 > InvisiMail > 192.168.0.1:3025 > E-mail Server	for SMTP

Client > 192.168.0.1:110 > InvisiMail > 192.168.0.1:3110 > E-mail Server	for POP3

Client > 192.168.0.1:143 > InvisiMail > 192.168.0.1:3143 > E-mail Server	for IMAP

Here the client and InvisiMail are pointing to the same IP address (the same PC), but are using different ports on which to communicate. This allows the e-mail client to operate exactly as it did previously, pointing to the same address/port, but all mail will pass through InvisiMail before it reaches the Internet and all received mail will be intercepted by InvisiMail before it arrives at the desktop. The E-mail Server will require re-configuring to listen for e-mail traffic on the ports you have assigned in InvisiMail. This is usually a simple task, but certain e-mail servers e.g. Microsoft Exchange Server will require Registry settings to be altered - if in doubt speak to your Systems Administrator or contact Technical Support.


InvisiMail Manager Overview

•          The InvisiMail Manager enables access to user settings and all the functions necessary to administer your e-mail security and content management control.

•       After you install InvisiMail, the Manager is available from the system tray by double-clicking on the lock and keys icon or via the Start menu in the Program files section (this assumes that the default folders created during install are being used).

•          The initial splash screen of InvisiMail Manager appears as follows:

•        It is both menu and icon driven - most of the functions you will require are easily accessed by using the relevant icon on the tool bar.

The user name, licensing and product details on the initial Manager screen will vary depending on your installation and who is logged on to your program.


System requirements

For Windows 95

8MB Free Memory (Heavy loads will increase the memory requirement)

6MB Free Hard Disk Space

Windows Compatible PC

Gateway Configuration: Minimum Processor Pentium 100

Network Configuration: Minimum Processor Pentium 166

For Windows NT

16MB Free Memory (Heavy loads will increase the memory requirement)

9MB Free Hard Disk Space

Windows NT Compatible PC

Gateway Configuration: Minimum Processor Pentium 100

Network Configuration: Minimum Processor Pentium 166


Configuration options

The InvisiMail Enterprise Edition can be configured in various ways to meet a wide variety of e-mail security requirements.  The main configuration options include:

1.	External SMTP e-mail Gateway

2.	Distributed Network Configuration

3.	Centralized Network Configuration

External SMTP e-mail Gateway

Protects entire location or company (with one key for the company or a separate key for each user).  In this configuration, InvisiMail is installed between the e-mail server and any external device. The InvisiMail SMTP Gateway will accept inbound connections from the firewall and outbound connections from the virus scanner.  Inbound connections may only be decrypted; outbound connections may only be encrypted.  The gateway configuration supports SMTP connections only.  Supports PC, Mac, Unix, AS400 workstations, etc, as long as they use a TCP/IP connection.

Distributed Network Configuration

Protects each individual's e-mail from their PC, whether mail is transmitted to an internal user or to a correspondent outside the organization. InvisiMail data files are stored on a central file server, InvisiMail Workstation software is loaded onto each PC.  This configuration option offers the highest level of security, protecting messages to and from the Workstation.  This configuration also supports shared recipient lists, and shared public and private keys.  Supports any TCP/IP Internet e-mail configuration, not just Windows.  Supports PC, Mac, Unix, AS400 workstations, etc, as long as they use a TCP/IP connection.

Centralized Network Configuration

Protects entire location or company, and allows secure authenticated mail between internal users as well as to the outside world.  Supports any TCP/IP Internet e-mail configuration, not just Windows.  In this configuration, InvisiMail is installed between the Mail Server and the Network Users.  InvisiMail may be installed on the same machine as your e-mail server providing the mail server software supports either TCP/IP Port Mapping or can be bound to a specific IP Address.

Configuring InvisiMail with an outsourced ISP e-mail server

InvisiMail can be easily configured to work even when the e-mail server is located at an ISP.  Either the Distributed or Centralized Network Configurations can be used in this case, and the company's e-mail will be protected before it leaves the organization.

Other Configurations

Any of these configuration options can be combined to create a system that meets the individual needs of the corporation.  For example, InvisiMail can be set up to protect certain key users from their PC, while protecting the rest of the organization from the server.  It is possible to create hybrid configuration to suit most requirements.


Viewing Key info
Pro Gateway installation

A Network Installer Guide and an installation wizard, provided with InvisiMail Pro Gateway, assists the Administrator in the installation process.

1.         Note the IP Address and SMTP Port (Usually 25) of the Server from which Messages will be sent to InvisiMail prior to being forward to the Internet. This may be your E-mail Server or Virus Scanner. IT WILL ALWAYS BE A SERVER OR DEVICE ON YOUR NETWORK.

2.         Note the IP Address and SMTP Port (Usually 25) of the Server to which Messages will be sent. This will generally be your Internet Service Provider SMTP server and Relay Server. If you do not use an SMTP Server or Relay Server then visit the InvisiMail Web Site for a list of third party SMTP Relay products.

3.         Note the IP Address and SMTP Port (Usually 25) of InvisiMail.

4.         On completion of your InvisiMail SMTP Gateway installation it will be necessary to manually amend the forwarding address of your e-mail server/virus scanner to ensure that mail is forwarded to the InvisiMail Server.  Make a note of these settings and manually enter them into your SMTP server software.

5.         It will also be necessary to amend the forwarding address of your external systems to ensure that Inbound e-mail is routed via InvisiMail.

6.         Prepare a list of the Users and e-mail addresses (see e-mail user import file format to enable import during Install).

7.         Ensure you have an InvisiMail Network license to cover the number of users/keys required.

By default, InvisiMail accepts all connections.  It will be necessary to use the Connections Screen in the InvisiMail manager if you wish to DENY access to the server. This section is discussed in more detail later in this document.


External SMTP Gateway installation

A Network Installer Guide and an installation wizard, provided with InvisiMail Enterprise Edition, assists the Network Administrator in the installation process.

1.         Note the IP Address and SMTP Port (Usually 25) of the Server from which Messages will be sent to InvisiMail prior to being forward to the Internet. This may be your E-mail Server or Virus Scanner. IT WILL ALWAYS BE A SERVER OR DEVICE ON YOUR NETWORK.

2.         Note the IP Address and SMTP Port (Usually 25) of the Server to which Messages will be sent. This will generally be your Internet Service Provider SMTP server and Relay Server. If you do not use an SMTP Server or Relay Server then visit the InvisiMail Web Site for a list of third party SMTP Relay products.

3.         Note the IP Address and SMTP Port (Usually 25) of InvisiMail.

4.         On completion of your InvisiMail SMTP Gateway installation it will be necessary to manually amend the forwarding address of your e-mail server/virus scanner to ensure that mail is forwarded to the InvisiMail Server.  Make a note of these settings and manually enter them into your SMTP server software.

5.         It will also be necessary to amend the forwarding address of your external systems to ensure that Inbound e-mail is routed via InvisiMail.

6.         Prepare a list of the Users and e-mail addresses (see e-mail user import file format to enable import during Install).

7.         Ensure you have an InvisiMail Network license to cover the number of users/keys required.

By default, InvisiMail accepts all connections.  It will be necessary to use the Connections Screen in the InvisiMail manager if you wish to DENY access to the server. This section is discussed in more detail later in this document.


Assigning email addresses to Keys

Assigning e-mail addresses to keys

•	By default, the first Key you create will have been assigned an e-mail address during the installation procedure.

•	If a user has more than one e-mail address, then more than one address can be assigned to a single key. This gives the ability to secure all your mail with one Key.

•	On the Private Keys page, clicking the button next to E-mail Aliases will bring up a dialog box in which you may type another e-mail address to add to the list of those using that particular Key. Multiple e-mail addresses may be assigned to any key, however, an e-mail address can only have one Key associated with it (either 607 bit or 1279 bit).

•	On creation of a new Key, you may associate an e-mail address that already has a Key assigned to it, but the last assignment always becomes the default for that address.

•	You may wish to use these options to enable Strong Encryption on one or more e-mail addresses while using Extreme Encryption on more sensitive addresses for the best possible security.

•	Note.  Security Policies can be assigned using Add Policy in the Message Control drop down menu, but a policy must be setup before you can assign a new one - all keys created are given a default policy.


Centralized Network

Centralized Network installation

For General details on Install InvisiMail Enterprise Edition read the section on Installing the InvisiMail Gateway Server.

Installing External Network Server Link

1        Note the IP Address and SMTP/POP3 Ports (Usually 25 and 110) of the External Mail Server to where external E-mail Messages are sent and from where Internal Messages may be retrieved.

2.       Note the IP Address and SMTP/POP3 Ports (Usually 25 and 110) of the InvisiMail Server.

3.       Prepare a list of the Users and e-mail addresses (see e-mail user import file Format to enable import during Install)

4.       Ensure you have an InvisiMail Network license to cover the number of users/keys required.

5.       Install InvisiMail Network Server for Windows NT or Windows 95 as required.

6.       Alter the send and retrieve addresses of your e-mail server to ensure that mail is routed via the InvisiMail Server.

Installing Internal Network Server

1.       Note the IP Address and SMTP/POP3 Ports (Usually 25 and 110) of your Network Mail Server.

2.       Note the IP Address and SMTP/POP3 Ports (Usually 25 and 110) of the InvisiMail Server.

3.       Prepare a list of the Users and e-mail addresses (see below for File Format to enable import during Install)

4.       Ensure you have an InvisiMail Network license to cover the number of users/keys required.

5.       Install InvisiMail Network Server for Windows NT or Windows 95 as required.

6.       Alter the send and retrieve addresses of your e-mail workstations or your internal DNS server to ensure that mail is routed via the InvisiMail Server.

By default InvisiMail accepts all connections. Use the Connections Screen in the InvisiMail manager to DENY access to the server as required.


E-mail User Import File

Sample E-mail User Import File

Having ensured that an appropriate license for the number of required e-mail accounts has been purchased it will be possible to import or manually enter the e-mail addresses from the following form.  If you wish to import e-mail addresses from a file, the data must be formatted as follows:

Separate columns of data by a tab.  Separate e-mail addresses by a comma.

John Smith            Jsmith@MyCompany.Com,John_Smith@MyCompany.co.uk

Bill Brown             BBrown@MyCompany.Com,Bill_Brown@MyCompany.co.uk

Helen Wallace       HWallace@MyCompany.ComHelen_Wallace@MyCompany.co.uk

MyCompany          *@MyCompany.Com

UKBranch             *@MyCompany.Co.uk


Software

E-mail packages

•	The Software page displays all the e-mail packages detected during install.

•	The list of compatible packages is given in the overview of InvisiMail.

•	All detected e-mail clients are displayed in the left-hand window: the check boxes (if ticked) show that InvisiMail is currently protecting that client.

•	There is a long button under the communication details on the right of the window that will allow you to unprotect/protect individual e-mail clients. This would be useful for instance if one client was used for internal network mail which did not require protection and another package was used for all Internet mail and needed high levels of security.

•	If you do load an e-mail program after installing InvisiMail and you wish to add the new program to the list of those already protected, use the Update E-mail Software button. Once this is complete you must select your newly detected program in the left-hand window and click on Start InvisiMail Protecting this Software on the right-hand side of the page. You should then close and re-open InvisiMail Manager to effect the changes and re-open your e-mail software.

•	The Force Reset button is for use when communication on one or more of the mail ports is not performing correctly. After pressing Force Reset, you must close and then re-open your e-mail clients in order for the changes to take effect; InvisiMail will alert you of this via a dialog box.

Communication Settings

•	The original communication settings refer to the name or the address of your mail server; the modified settings are the ones being used by InvisiMail to capture your messages and encrypt/decrypt them. These settings should not need to be altered if you are using the Deluxe/Enterprise desktop edition and you are not using any other mail server-type software on your PC.


Communication settings
Tools

Importing data from version 2.1x

•	If you are upgrading from a version of InvisiMail 2.1x (where x is a release number), then you may attempt to import your present data into your upgraded version of InvisiMail.

•	This process is performed on the Tools page, but should only be attempted if your previous version of InvisiMail does match the version range specified. If the import fails then you will have to setup your recipients list by using the Send to Friends program in your Start Menu.

•	You should be aware that this option is able to send mail to ALL members of your Address Book if you select everybody in the list. You should not send to news groups as InvisiMail does not use the same protocol for data transfer as news servers.

Communications logging

•	This is a built-in fault finding tool which can report all mail transactions in plain text format. It helps System Administrators/Technical Support personnel to trace problems with your mail transfers/access.

•	Logging is not turned on by default as in normal circumstances.  It is not required and large amounts of disk space are used to store the log.

Communications optimisation

•	On the Tools page there are five options available to optimise InvisiMail for use in various network or desktop setup scenarios:-

•	The options provided here are to allow InvisiMail to be configured for optimal Mail server access, dependent on the method of that access. In doing so, unnecessary network or telephone activity should be minimised.

•	If you use a stand-alone PC with its own modem for Internet dial-up connection then the top option (Dial Up Modem) will be the best to select. You will have this choice during install, but you may change this setting at any time if your connection method changes.

•	In most other cases, the LAN Based Mail Server option will be appropriate. If you are unsure of your method of mail collection/delivery then the Mixed Dial-up and LAN/Dedicated Internet option will provide a suitable compromise, but ideally you should contact your Systems Administrator or InvisiMail Technical Support if you are unsure.

MAPI / Outlook forms

•	Under the title InvisiMail Message Viewer MAPI support can be enabled either just for viewing forms or for use as the standard message protocol.

•	This provides much wider support for e-mail clients - AOL, Exchange Client, Compuserve and any MAPI or Outlook compliant e-mail system.

InvisiMail message banners

•	The InvisiMail product range enables differing levels of message banner and warning text control.  In Lite and Deluxe versions, a default banner is appended to each message that you send.  To remove this, select the 'Remove Banner' option from either the 'Lite' menu or the 'Deluxe' menu (whichever is relevant to your InvisiMail).


Synchronization
Database synchronization

•	From the Manager menu an option is available which enables mobile users and users who move between multiple sites to take advantage of the InvisiMail Multiple Key Database.

•	The screen shown above will allow you to export the data files from one PC and then import them into the database on a second PC thus combining both databases. The combined data can then be exported back to the original PC giving both a synchronized database of keys and or recipients.

•	How to process the syncronization:-

(i)	On your local machine, pick the data you wish to export; Personal Recipients, Personal Keys, Shared Recipients or Shared Keys - in this case we will choose Private keys.

(ii)	Choose where you wish to export to eg. to a file on a floppy disk.

(iii)   Choose a password to secure the file and press Synchronize - this will export the secured Private Key data to file on the floppy disk.

(iv)	Take the floppy disk to your remote machine. You may then synchronize the data from the first machine with the data from the second by specifying the second machine's Private keys in the Local Files to Synchronize box, choosing the path to the floppy disk file for the Remote Database File and entering your password.

(v)	Pressing Synchronize will now combine the two files on the hard disk of the second machine and on the floppy disk as well.

(vi)	If you wish, you may now return to the first machine, repeat the procedure using the newly synchronized file as the Remote Database File and press Synchronize; both PCs will now have identical Private Key references.

(vii)	You should always restart your PC after making changes to the InvisiMail setup to ensure all changes are recognised.

•	You can also synchronize with a database on somebody else's machine providing you have a user name and password for that machine.


System

•           The System button shows a page whose user functions are at the bottom - Service Status and Service Startup.

 •         By default, InvisiMail will load automatically when your PC boots up; you may turn this function off by using the radio button provided.

•          You must then close InvisiMail Manager and restart your PC to effect the change.

•          The Service Status radio buttons allow you to stop InvisiMail protection instantly and also to restart the service of protection from within the Manager, without the need to shutdown or restart your PC.

•          Use of this button obviously has significant implications for the e-mail packages you have installed - stopping and/or starting the service will affect ALL your e-mail programs not just a selected one. It is recommended that you close and then re-open your e-mail programs after the selected change has been made.


Communications

•	Connection proxy settings and Workstation IP port settings may be viewed and, if necessary, altered here.

•	The settings on this screen are input automatically when InvisiMail is installed.

•	They refer to your mail server settings and the means by which InvisiMail intercepts and secures your messages. In a stand-alone setup with a Dial-up connection and no other mail server-type software loaded these settings would not normally require any alteration.

•	For the installation of the Enterprise editions, the proxy settings will need to reflect the setup of your network mail arrangements; whether you have inbound mail from one address only or you wish to allow multiple connections etc.

•	Most of this setup can be performed during your install which is why we recommend you are fully cogniscent of your requirements and network layout prior to commencing - please read the install guide provided with the Enterprise Editions as it will save time later on.

•	It is inadvisable to alter any of these settings unless you are familiar with their concepts and usage or you have been advised on how to do so by your Systems Administrator or InvisiMail Technical Support.


Licensing agreement
License

•	InvisiMail automatically completes the licensing details section on upgrade from Lite to Deluxe, This section is only for use in the Pro, Pro Gateway and Enterprise editions of InvisiMail for adding additional licenses.


Users

Security level

•	If there is more than one user able to access the Manager then their ability to see and make changes to InvisiMail files and settings can be restricted. This is achieved by using the Security Level options screen on the Users page within InvisiMail Manager.

•	The check boxes shown can be ticked or un-ticked as required and the security settings applied to individual users. As with all other types of access restriction, rights should only be granted to a user if that user really needs them; security breaches are far more likely to occur if users are given unnecessary rights.

Security policy

Policies may be defined for use with groups or with individuals. They are assigned on the Private Keys page.

•	Most of the options available for Policies are for use with the Network and Gateway server editions only.

•	The drop-down menu is used to select the required policy (if you have not defined any then only the default policy will be available).

Default e-mail

•	The default address is set during installation, but may be changed at anytime using this button and text window.

•	The Update button must be used after a new address is entered, else the original address will be retained.


Default E-mail address

The default address is set during installation, but may be changed at anytime using this button and text window. The Update button must be used after a new address is entered, else the original address will be retained.


Certificates

To assist in the confirmation of a user's identity, InvisiMail provides Certificates from the InvisiMail Certificate server.  A certificate is automatically requested on generation of public/private key pairs during the installation. It is also possible to request a certificate a later date should new keys be generated by simply clicking on the "Request a Certificate" button in the Private Keys menu, where upon the user is prompted to confirm which key the certificate will be associated with. InvisiMail will also identify any aliases that are associated with this key and ask for confirmation as to which e-mail address the certificate should be sent as shown below

Requesting a Certificate

On receipt of your certificate this will be included with your public key information in the header of every message sent so that users can confirm by looking at your key reference in their recipients list which will confirm the certificate.


Acknowledgements

This product has been developed by Virtually Online Ltd.

Copyright property of InvisiMail International Ltd.

Cryptographic library (libeay32.dll) developed by Eric Young

Copyright 1997 Eric Young

All rights reserved

RPK Encryption technology developed by RPK New Zealand

Copyright property of RPK International Ltd

Copyright 1996

All rights reserved


User settings

•	You can choose options for compression (provided you have purchased a copy of InvisiMail), whether to decrypt your messages immediately or leave them safe until you are ready to read them.

•	You may turn off Progress screens to make InvisiMail completely unobtrusive.

•	Auto logon and timed auto logoff functions are available in this release.

•	If Auto logoff is set to 0 minutes then InvisiMail stays logged on. The Enable InvisiMail Application Password Sharing function allows you to log on once at startup and thereafter any time you access the Manager program it uses your startup logon to activate the Manager without you retyping the password.

•	You must click on the Update button to activate any setting changes made here.


Digital key signing

•	To assist in the confirmation of a user's identity, InvisiMail provides digital signatures from the InvisiMail Certificate server.

•	A signature is automatically requested on generation of public/private key pairs during the installation.

•	It is also possible to request a signature at a later date should new keys be generated by simply clicking on the "Digital Key Signing" button on the Private Keys screen, whereupon the user is prompted to confirm which key the signature will be associated with.

•	InvisiMail will also identify any aliases that are associated with this key and ask for confirmation as to which e-mail address the signature should be sent.

•	On receipt of your signature this will be included with your public key information in the header of every message sent so that users can confirm by looking at your key reference in their recipients list which will confirm the signature.


Updating from version 3.0

Updating from v2.1x, 3.0 to v

It is always good practice to back-up your software prior to any software changes and we recommend as a precaution you should copy your InvisiMail folder before running the InvisiMail  installer file.

If you are upgrading from v2.1x then the v installer will prompt you to uninstall your old version, install v and then import your previous data.

From v3.0 , Version  will pick up your settings and seamlessly transfer your keys and recipients from the previous install. You should then send yourself a test message to check functionality.

(see Testing the Installation)


Basic Concepts
Overview of InvisiMail

InvisiMail provides a comprehensive range of award winning Open Standard e-mail encryption and content security applications for the Home User through to Enterprise Corporate Gateway Servers. InvisiMail's unique proxy architecture allows closer integration with more e-mail clients and mail systems than any other security application available, including but not limited to Lotus Notes, MS Exchange and Groupwise through MS Outlook, Netscape Communicator, Eudora Mail and Pegasus Mail.  Furthermore, InvisiMail's intelligent automated key management makes the InvisiMail range unobtrusive and as simple to use as pressing 'send' in your email client. InvisiMail's key features are:

Transparent to the user

InvisiMail works in the background.  No special buttons, menu commands or other procedures are added or required.  You don't need to know anything about encryption.  InvisiMail handles everything for you.  All you need to do is choose and remember a password.  Then just send and receive e-mail as you normally do.

•	Automatic key management

Each time you send a message, your public key is embedded in the header of the message, therefore, the way you send your key to another InvisiMail user is simply by sending them a message.  Once a recipient's key has been received, all future messages to them will be encrypted.

•	Automatic encryption

InvisiMail automatically and intelligently encrypts the entire message including attachments where possible.  You never have to remember to issue commands to encrypt, thus eliminating the possibility of user error in highly secure environments.  With InvisiMail, all the benefits of e-mail security become automatic and transparent.  Older systems that required user interaction were designed that way because they were too slow and therefore took too much time to encrypt every message.  InvisiMail exceptional performance and message compression features minimise this overhead and can even make sending encrypted mail faster than sending a standard message.

InvisiMail is also intelligent in deciding who can receive encrypted message and who cannot.  InvisiMail can only encrypt a message to a recipient from whom it has already received the public key.  Therefore, it will only send encrypted messages to other users of InvisiMail that it knows can receive secure mail so as not to interfere with your day to day email operation.

•	Easiest-to-use

InvisiMail handles everything automatically.  It's the easiest-to-use e-mail encryption package available today.

•	Multi-platform support

InvisiMail supports more Internet E-mail Clients and Servers than any other product in its category.  If you are already using one of the major e-mail software products such as Netscape (Navigator or Communicator), Microsoft Outlook, (Internet Mail or Outlook Express), Microsoft Exchange, Eudora (Light or Pro), Calypso, Pegasus among others you simply install InvisiMail and everything is taken care of automatically.  Should you be using a an alternative SMTP/POP3/IMAP4 compliant system it is still possible to install InvisiMail by manually configuring the settings in your e-mail software.

Similarly, If you are using Mail servers such as Exchange, Groupwise or Lotus Notes it is simple to configure and install InvisiMail as an SMTP Gateway to secure corporate mail or centrally manage Policies and Keys for individual network users who require security through to their desktop.

•	Full Content Management and Security

InvisiMail provides a comprehensive set of Policy based Content Management and Security Features, including Recursive Scanning that allows InvisiMail to look within zip, arc, arj or other archives to check for banned content or viral threats. The core Anti-viral engine is the IRIS AV scanner, which is independently accredited by the ICSA as achieving 100% scan and detection rates.

Content Scanning can be set on message text, enabling administrators to control the contents of communication between their organisation and external bodies. InvisiMail also allows the Administrator to enter lists of file types to compare message attachments against, helping prevent sensitive or confidential information becoming accessible to unauthorised parties, while also preventing unsolicited files entering the organisation.  Content rules can be set against individuals or groups as well as corporate-wide, allowing for situations where certain files may be banned on a group-wide basis, while authorised personnel may have a different rule that allows such files.  InvisiMail also provides full Anti Spam, mail archival, and message / attachment quarantine features.

•	Desktop File & Folder Encryption and DSA Signing

InvisiMail Desktop utilities provide a complete set of file/folder encryption features that integrate with InvisiMail's centralised key Management Database. These Features allow InvisiMail to operate fully with non standard (POP3/IMAP4/SMTP) mail clients such as AOL, CompuServe or HotMail by allowing the user to select the information they wish to secure and send as encrypted attachments.  Secure File Shredding is provided along with DSA Digital signing for non-repudiation purposes.

•	Globally strong Encryption Protocol Independent Security

InvisiMail is the first e-mail security product with globally strong encryption that is directly available from the original developer.  By default InvisiMail uses the RPK Fast Public Key Encryptonite™ Engine, developed by RPK New Zealand Ltd which leverages the same underlying cryptography as used in Diffie Hellman or PGP.  The exceptional performance of the RPK Encryptonite™ allows the use of the asymmetric algorithm across the whole message, as opposed to a weaker symmetric + asymmetric hybrids, which is simply not practical using other encryption systems.

Despite the vigorous marketing efforts of encryption technologists, there is no single encryption standard. InvisiMail itself has over 100,000 users worldwide but recognise the business need for open standard security to mitigate the investment risk in security technology. As such, InvisiMail will be releasing plug–in modules for both S/Mime Open PKI and PGP to compliment our high end Enterprise product range.


Designing an installation

Universally Flexible "Proxy Architecture"

•	InvisiMail uses a proxy architecture based on standard Internet Protocols (POP3, STMP, IMAP4) for providing security.  InvisiMail can be optionally configured to sit between the user's e-mail client and the corporate e-mail server; between the e-mail server and the Internet (as an e-mail gateway firewall); or directly on the user's PC.  Regardless of the option chosen, all e-mail passes through the InvisiMail local proxy where it is automatically and intelligently encrypted/decrypted, seeded with public key data, or forwarded unchanged.

•	This proxy architecture allows InvisiMail to integrate with a wide range of e-mail servers including Lotus Notes, Novell GroupWise and MS Exchange.

•	The Communications screen in the InvisiMail Manager shown below, displays the IP address on which InvisiMail will accept communications from the Local Network for routing mail. In so doing it provides the ability to support multiple Mail Servers in a distributed network or in a network installation with centralized encryption it will accept connections from listed clients. Within this section is the ability to set the IP profile from the "Allowed List" button and specifically deny external Internet Connections.

InvisiMail Connections

If an additional Proxy needs to be included to map to an additional mail server it is possible to simply click on the "Add Proxy" and complete the connection from IP and the connect to server details; be sure to include the connection in the Allowed List.


Explanation Of Keys

Private keys

Brief explanation of private keys

•	The means by which information is secured is called encryption.

•	Decryption is the process of restoring information to its original format.

•	The information about the underlying technology used in InvisiMail is here for informational and educational purposes only.  The good news with InvisiMail is that you do not need to learn this material to be able to use the product.

•	The way in which InvisiMail deals with encryption and decryption is simple in principle.  Unlike doors with deadbolt locks where only one key is used to lock and unlock the door, InvisiMail there are two related keys:

(i)	used to encrypt (lock) the message, and

(ii)	the other to decrypt (unlock) the message.

•	The one used to encrypt is known as the Public Key since it is the one that is made known publicly and used by others to encrypt messages being sent to you.  This is also where the technology gets its common name "Public Key Encryption."

•	The second key, which is used to decrypt messages sent to you, is called the Private Key.  It is called "private" because it is known only by you.  InvisiMail keeps track of keys for you.  All you need to do is remember your InvisiMail password and keep it to yourself.

•	With InvisiMail, whenever you send a message to someone else who is using any version of InvisiMail (Lite, Deluxe, Pro or Enterprise), the message will automatically be encrypted prior to sending, using the public key of the recipient.  When that person receives the message, InvisiMail will automatically use their private key to decrypt the message.


Viewing Key Info
Viewing key information

•      Selecting Private Keys from the InvisiMail Manager Toolbar brings up the keys page.

•       On this page you can view, create and delete keys; you may also assign specific e-mail addresses to the same key or to different keys, thus enabling you to have different security settings for separate e-mail accounts.

•       On the left-hand side of this page there are two buttons (Personal Private Keys and Shared Private Keys).  These enable you to find a list of Key holders; at the left of each is a + sign, you may click on this to drop down a list of Key/s for each Key holder. A single click on the key or keys revealed will bring up that key's information on the right-hand side of the screen.

•       You can now see the name of the Key holder, the e-mail address associated with that Key, the Key ID and type and its expiration date.

•       The buttons to the left of the Name and E-mail aliases can be single-clicked to bring up dialog boxes. These dialog boxes will allow you to change the name associated with this Key and to associate e-mail aliases with this Key.


Creating Keys
Creating a new key

•	New Keys for an existing or a new user may be created from the keys page using the appropriate button (either New Personal Key or New Shared Key) at the bottom of the screen.

•	A dialog box is brought up, allowing the choice of Key type, Key Owner, Security Policy etc.

You may select one or more e-mail addresses from the drop down list provided to associate with the new Key, or you may type in the address.


Viewing Recipient Info

Recipients

Viewing Recipients' information

•	The Recipient section of the InvisiMail Manager provides the user with a complete list of the RPK Public and DSA Signing keys stored within the InvisiMail database. These are the keys that are available to the InvisiMail system to secure messages or digitally sign files or keys.

•	The Recipients section also allows for options to be set specific to each key governing aspect such as whether to encrypt on sending, whether to use a session key encryption process with multiple recipients. Whether the key has been verified and is trusted by the organisation.

The following information is provided:

•	All users of InvisiMail with whom you communicate will appear in the Recipients list once they have sent you their Key.

•	The Recipient list automatically adds New Public Keys on the receipt of e-mail message from a new InvisiMail user (Subject to Policy).

•	Information is provided as to the aliases or e-mail addresses associated with each key.

•	Expiry Dates may also be checked on each key should, the owner select to time limit their keys.

•	Signature Information and Signing authority is also provided to assist in assigning trust to a particular key.

•	Also whether the key signature itself is valid for the key. An Invalid key may simply mean that the user has added a new alias subsequent to receiving their certificate, from the InvisiMail server. Should a certificate be found to be invalid it the Key owner should be contacted to verify that the key can be trusted.

•	Individual Recipients and their keys can be selected in the same way as on the Private Keys page and their information will appear on the right of the page (see diagram on page 26).


Changing options for Recipients

The following are available for each Recipient by single clicking the Options box:

•	Whether to encrypt messages or not.

•	Enable IMAP support.  Thus allowing the subject of each message to be displayed so that IMAP users are able to determine the contents of Secure mail prior to downloading and decrypting.

•	Use digital signatures to prevent man-in-the-middle attacks.

•	Allowing use of Multiple Recipients.  This enables Session key encryption, providing significant speed advantage if the user is part of a mailing list. Session Key encryption will generate a unique asymmetric RPK Key to encrypt the message body. Thereafter, the private key of the session key is encrypted using the intended recipient public key so that it may be decrypted by the use on receipt. This process provides considerable performance advantages when sending to multiple recipients, as would be the case in a mailing list.

•	Enable/disable verification of the keys authenticity subject to Corporate Compliance Trust findings.

•	Once the required boxes have been checked/unchecked, the update button must be single-clicked to effect the changes.

•	Recipients may be removed from the list using the Delete button below this options panel. Alternatively you may simply select to not encrypt to that user from the option settings.


Message Control Overview
Message Control

•	The Message Control section allows for the management and control of inbound and outbound e-mail messages.

•	Messages are managed by creating and adding policies to individual keys which then enable a series of functions to be carried out each time that user sends/receives a message.

•	Control over messages is achieved by defining and adding 'rules' concerning the content of a message and/or details of the sender/recipient of a message thus allowing for the messages to be either blocked, redirected or copied to a specified address.


Policies

•	A new policy may be created under Add Policy under the Message Control menu and typing the new Security Policy Name in the box provided.

•	New Recipient Policy

This is the action taken when a New Recipient is found.  The Recipient key can be added either to the user's private file, shared file, or both.  Optionally, you may choose for the key to be ignored and this, when used with the 'Forward New Recipient Notification to' option, allows the organisation to establish compliance procedures.

•	Incoming Message Policy

This option is only available and relevant to those users with a Gateway server.  It is possible to set up a policy to accept all incoming messages, or to accept only those messages that are sent to known addresses (ie. that carry a private key) or to only accept messages that are encrypted.

A further option is available for those incoming encrypted messages that have failed authentication (ie. the Sender's signature is not correct or the contents of the message have changed).  You may choose to have the message delivered regardless of this failure, or have it returned to the Sender (with or without notification to the Recipient), or simply inform the Recipient of the error.  In addition the systems administrator may be notified of all of these incidences.

•	Outgoing Message Policy

This allows for encryption to be turned on/off depending on whether the policy is intended for sending messages securely or not.  There are also options to restrict which outgoing messages are actually sent by selecting one of the Send Rules options (see below):-

You may choose to send all messages, or only those that have been encrypted, have a filter on non-encrypted messages or restrict the policy by not allowing the user to send any outgoing messages.  The reject notification can be set up to notify the Sender if desired as well as the system administrator.

•	Key Handling

Key management provides the control over which key to send with a Policy (ie. the Sender's or a Defined Key such as the company key) and when to send such key.  You may choose to always send the key or never to send it.  The default setting is to always send.

•	Receipts

Receipts provide the user with confirmation that their outgoing messages have been successfully delivered to the person to whom they were intended.  There is also the option to enable receipts to be provided to Senders of incoming messages either on all messages or only those requested by the Sender.

•	Warning Text

Warning Text allows the Sender of a message to include a phrase on all plain (non-encryted) e-mail messages warning the Recipient that the content of the message has not been encrypted.  To activate this option tick the check box next to 'Include Warning in Plain Messages' and then enter the wording of the warning message you require.  This text will then always appear as a header to every plain message sent.


Content rules

•	The routing of an e-mail message according to the actual text contained therein is controlled with the aid of a Content Rule and Content Profiler.

•	Selecting Add Content Rule in the Message Control menu brings up the following screen:-

•	This screen enables you to set up a rule according to whether you wish to scan the message for viruses, specified words/text, specified attachments, filtering Spam messages.  In this example Ange Virus Rule has been set up with corresponding ID 26043320 in order to protect the user from sending and receiving messages that contain a virus.

•	The e-mail address of the sender of outbound and the recipient of inbound messages is entered by clicking the Edit Email Aliases List icon in the centre of the screen and typing in the address/es, clicking Add and then OK.  This list can be updated at any time by clicking the Add or Delete button as necessary followed by clicking OK.

•	The Content Rule is then used in conjunction with the Content Profiler to protect both incoming and outgoing messages according to the criteria available in the specified Profile.


Recipient rules

•	Messages may be routed based upon either the message Recipient or the message Sender.

•	It is possible for e-mail messages to or from chosen Recipients to be controlled by selecting Add Recipient in the drop down Message Control menu..

•	The Route Rule allows for the particular rule to be defined and entered with an individual Rule ID number being automatically allocated.

•	The e-mail address(es) of the Recipient(s) which will be governed by the Recipient Rule are entered by clicking the Edit E-mail Aliases List icon beneath the Rule ID.  This then brings up the E-mail Alias Editor where the address(es) may be added or deleted accordingly.

•	The destination of the message that has been defined under the specified Rule is controlled by the options provided.  Outbound or inbound messages may be:

•	blocked with or without notification to the sender that the message has been blocked, or

•	redirected to a specified e-mail address, and

•	copied to a specified e-mail address.

•	This Rule will then appear listed on the left of the screen under Routing Control together with any further Rules that are created.

For further help, see worked example of a Recipient Rule


Worked recipient rule

1.       click in the Route Rule box and type in the name of the Rule you are defining; in this case EXAMPLE BLOCK (as shown in the previous diagram);

2.       the Rule ID is automatically generated; for EXAMPLE BLOCK it is 51045729;

3.       click the icon beneath the prompt "When a Recipient of a message matches one of the following aliases" to select/enter the e-mail address you are wanting to control.  Enter e-mail address (me@example.net), click Add, then click OK to proceed;

4.       select the inbound or outbound tab to specify whether you wish the message to be blocked, redirected or copied.  In this example any message addressed to me@example.net will never reach that address because the message will be completely blocked by InvisiMail.  The sender will be notified and a copy of the message will automatically be sent to ange@virtuallyonline.com;

5.       if at any point of the above process you make an input error simply click the Undo button at the bottom of the screen which will take you back to step 1;

6.       once you have entered the details of the Recipient Rule click on the Save button at the bottom of the screen to process the Rule;

7.       therefore, whenever a message to the aforementioned e-mail address is attempted InvisiMail will block it and issue an error log as shown below and a copy of the message will be sent to the address specified;

8.       to recall your Recipient Rule at any time, click on the + sign left of the Routing Control (under Personal Controls File).  Your newly created Rule will be listed here, then click on the particular Rule you wish to recall and this will bring up the corresponding screen showing all the details previously input;

9.       in order to delete an established Rule repeat the above step 8 to recall the Rule onto your screen, then click the Delete button at the foot of the screen.  This command will bring up a confirmation box to ensure that you are sure you want to delete the Rule.  If so, click on 'Yes' and the Rule will then be deleted.


Sender rules

•	When a message is to be routed according to the message Sender, select Add Sender Rule in the Message Control menu.

•	The layout of this screen is shown below.  The same process is followed as setting up a Recipient Rule in that the Rule is defined and typed in at the Route Rule box where an automatic Rule ID number is allocated.

•	The prompt 'When a Sender of the message matches one of the following aliases' is completed by clicking the icon below it and inserting the e-mail address(es) of the Sender(s) you require to be part of the routing control.

•	The inbound and/or outbound message(s) from the Sender(s) may be:-

•	blocked with or without notification to the Sender that the message has been blocked, or

•	redirected to a specified e-mail address, and

•	copied to a specified e-mail address.

•	The Sender Rule will appear listed on the left of the screen under Routing Control.  These details can be recalled at any time by clicking the + sign adjacent to the Routing Control heading, then clicking on the + sign relating to the Rule you require and then clicking on the individual Rule with its ID number to bring up all the details on the screen.


Content profiler

•          To enable a Content Rule to be applied to an e-mail message it is necessary to set up the Profile that will enable the detection of the criteria you choose.  By clicking on the Browse button you can select and name the profile to be used.  In this example, the profile for inbound messages used is Angescanner.csp and the details of this profile can be edited by clicking the Edit button.  The Edit button brings up the following:-

•          Virus Scanning

The message may be scanned in order to detect whether any viruses exist, both for incoming and outgoing messages.

If the scan detects a virus the message may be either rejected, quarantined (with or without telling the sender) or the attachment removed enabling the body of the message to be sent/received.

In the above example of Angescanner, the 'Enable Virus Scanning' check box has been ticked to activate the process and the option to place the message in quarantine has been chosen.

•          Spam Filtering

Spam filtering is activated by entering your choice of words or phrases in the given table together with their associated weighting.  For example, to filter messages containing the words 'hardcore sex' together would be input as two separate words with a weighting of 50%  each.  The scanner will detect whether these words are contained in a message and if they are, and the combined weightings of the words/phrases detected exceed 100%, the message will be blocked.  Thus a message containing the word 'hardcore' alone would not be subject to this filtering.

There is an option to mark the message as Spam, quarantine it, or reject it if the message were to contain the words highlighted.

•           Filter Attachments

Messages may also be filtered according to the file attachments they contain.  Once you have entered the details of the file types you wish to filter all future messages containing these specified files as attachments will therefore be filtered and the attachment removed enabling the message only to be delivered.

•           Text Controls

A message may be scanned according to the words and/or phrases contained therein and a weighting attached to enable the message to be blocked once this weighting exceeds 100%.  This works on the principle as outlined in Spam filtering above.

If messages contain data that correspond with that detailed in the text control the message is either rejected or placed in Quarantine with the added option of notifying the Sender of this rejection.

•           Banned Attachments

The Banned Attachments option enables the entire message to fail if it contains a specified attachment.

•           Message Logging

Messages that have had their contents scanned and contain any of the specified variables may be logged according to sender, destination, subject, date, body text, attachment or a combination of these headings.


Quarantine Viewer

•	When setting up a Content Rule that controls e-mail messages containing any of the following search criteria:-

•	virus scanning

•	spam filtering

•	text control

•	banned attachments

the user is provided with options as to the destination of the message once it is blocked.  If the option to "Quarantine Message" or "Quarantine Message and Tell Sender" is selected the inbound or outbound message will be placed in quarantine.

•	Clicking on the icon allows the user to view the messages being held in quarantine at any given time.  From this screen it is possible to see who the message was sent to and from, its subject heading, date sent, and full reasoning as to why the message was blocked.

•	The entire contents of a message in quarantine may be viewed by single clicking on the View button at the foot of the screen, and then forwarded as required.  Alternatively, the message may be deleted or archived to a specified location.