Secure instant messaging system

• US 10,313,135 B2
• Filed: 05/24/2018
• Issued: 06/04/2019
• Est. Priority Date: 02/20/2003
• Status: Expired due to Term

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google LLC (Alphabet Inc.)
• Inventors: Lord, Robert B., Hayes, Terry N., Uberti, Justin
• Primary Examiner(s): Revak, Christopher A
• Application Number:
  US15/989,117
• Publication Number:
  US 20180270072A1
• Time in Patent Office: 376 Days
• Field of Search: None
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A secure instant messaging (IM) system integrates secure instant messaging into existing instant messaging systems. A certificate authority (CA) issues security certificates to users binding the user'"'"'s IM screen name to a public key, used by sending users to encrypt messages and files for the user. The CA uses a subscriber database to keep track of valid users and associated information, e.g. user screen names, user subscription expiration dates, and enrollment agent information. A user sends his certificate to an instant messaging server which publishes the user'"'"'s certificate to other users. Users encrypt instant messages and files using an encryption algorithm and the recipient'"'"'s certificate. A sending user can sign instant messages using his private signing key. The security status of received messages is displayed to recipients.

Claims

1. A method to secure communication of data across a computer network via a messaging system, the method comprising:

receiving a public key and an identification of a first user associated with the public key, wherein the public key is issued to the first user;

determining, based on the identification of the first user, a list of users associated with the identification of the first user; and

sending the public key to a messaging client device that is associated with a second user included on the list of users, wherein the public key is usable to encrypt messages sent to the first user from the messaging client device.

2. The method of claim 1 wherein the messaging client device is a second messaging client device, and further comprising:

receiving an encrypted message from the second messaging client device, wherein the encrypted message is encrypted using the public key issued to the first user; and

sending the encrypted message to a first messaging client device associated with the first user.

3. The method of claim 2 wherein the public key issued to the first user is associated with a corresponding private key accessible to the first messaging client device, and wherein the private key is usable by the first messaging client device to decrypt the encrypted message.

4. The method of claim 2 further comprising receiving a request for the public key issued to the first user, wherein the request is received from the messaging client device.

5. The method of claim 1 wherein the public key is received from a first messaging client device associated with the first user.

6. The method of claim 5 wherein the public key and the identification of the first user are included in a certificate received from the first messaging client device, and wherein sending the public key to the messaging client device includes sending the certificate and a status of the certificate to the messaging client device.

7. The method of claim 1 further comprising:

receiving a second user public key and an identification of the second user associated with the second user public key, wherein the second user public key is issued to the second user;

determining, based on the identification of the second user, a list of users associated with the identification of the second user; and

sending the second user public key to one or more messaging client devices that are associated with users included on the list of users associated with the identification of the second user, wherein the second user public key is usable to encrypt messages sent to the second user from the one or more messaging client devices.

8. The method of claim 1 wherein the public key and the identification of the first user are included in a certificate, wherein the certificate is associated with a current location of the messaging client device.

9. The method of claim 2, wherein the encrypted message is designated to be sent to multiple identifications of users as recipients for the encrypted message, wherein the multiple identifications of users are associated with respective multiple users included in a chat session with the second user,

wherein sending the encrypted message to the first messaging client device includes sending a respective encrypted message to messaging client devices associated with the multiple identifications of users.

10. A system to secure communication of data across a computer network, the system comprising:

a database storing identifications of messaging users; and

a processor configured to perform operations comprising;

receiving a public key and an identification of a first user associated with the public key, wherein the public key is issued to the first user;

determining, based on the identification of the first user, a list of users associated with the identification of the first user;

sending the public key to a second messaging client device that is associated with a second user included on the list of users;

receiving an encrypted message from the second messaging client device, wherein the encrypted message is encrypted using the public key issued to the first user; and

sending the encrypted message to a first messaging client device associated with the first user.

11. The system of claim 10 wherein the public key issued to the first user is associated with a corresponding private key accessible to the first messaging client device, and wherein the private key is usable by the first messaging client device to decrypt the encrypted message.

12. The system of claim 10 wherein the operations further include:

receiving a second user public key and an identification of the second user associated with the second user public key, wherein the second user public key is issued to the second user;

determining, based on the identification of the second user, a list of users associated with the identification of the second user; and

sending the second user public key to one or more messaging client devices that are associated with users included on the list of users associated with the identification of the second user, wherein the second user public key is usable to encrypt messages sent to the second user from the one or more messaging client devices.

13. The system of claim 10 wherein the public key and the identification of the first user are included in a certificate, wherein the certificate is associated with a current location of the messaging client device.

14. A method to secure communication of data across a computer network via a messaging system, comprising:

obtaining, at a first messaging client device of a first user via a messaging server, a second user public key associated with an identification of a second user, the second user using a second messaging client device, wherein the first user is associated to the identification of the second user by being listed on a list of users, the list of users being associated with the second user;

encrypting an electronic message for the second user using the second user public key; and

sending the encrypted message to the messaging server, wherein the encrypted message is configured to be decrypted using a second user private key associated with the second user.

15. The method of claim 14 wherein the second user public key is included in a certificate received by the first messaging client device, wherein the certificate associates the identification of the second user to the second user public key.

16. The method of claim 15 further comprising obtaining, at the first messaging client device, a status of the certificate.

17. The method of claim 14 wherein a first user public key is associated with an identification of the first user.

18. The method of claim 17 further comprising providing a list of users associated with the first user and accessible by the messaging server, wherein the list of users associated with the first user indicates identifications of users to receive the first user public key.

19. The method of claim 17 further comprising:

receiving a second electronic encrypted message from the second messaging client device via the messaging server, the second electronic encrypted message encrypted using the first user public key; and

decrypting the second electronic encrypted message using a first user private key.

20. The method of claim 14 wherein the second user public key is associated with a particular location of the first messaging client device.