Method and apparatus for secure distributed collaboration and communication

• US 20050025172A1
• Filed: 07/30/2003
• Published: 02/03/2005
• Est. Priority Date: 07/30/2003
• Status: Abandoned Application

• Current Assignee: AOL LLC (Apollo Global Management, Inc.)
• Original Assignee: AOL LLC (Apollo Global Management, Inc.)
• Inventors: Frankel, Justin
• Application Number:
  US10/631,436
• Publication Number:
  US 20050025172A1
• Time in Patent Office: Days
• US Class Current: 370/437
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 65/4046 with distributed floor control
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys

Abstract

The invention comprises a system that permits secure distributed collaboration and communications for small trusted groups of people. The presently preferred embodiment of the invention allows users to communicate and transfer information easily and effortlessly. The invention requires very little administration, and no central server or central administration is required.

Claims

1. An apparatus for secure distributed collaboration and communications, comprising:

a plurality of host systems which are accessible by one or more users;

a distributed ad-hoc network which is used for all communications between said host systems;

wherein direct connections between said host systems are not brought up on demand;

a mechanism for maintaining said network as a private network by only connecting or allowing connections between known users; and

a link layer encryption mechanism for encrypting all communications links between said hosts.

2. The apparatus of claim 1, wherein said network comprises any of:

a mechanism for implementing redundancy; and

a load-balancing mechanism

3. The apparatus of claim 1, further comprising:

at least one of said hosts on said network being accessible from everywhere on said network;

wherein firewalls do not impair function because all data transfer is accomplished through said network and said at least one of said hosts on said network is accessible from everywhere on said network.

4. The apparatus of claim 1, said network comprising a plurality of nodes, wherein at least one of said nodes comprises a mechanism for throttling bandwidth usage to optimize network use.

5. A method for communicating over a distributed peer-to-peer network between a plurality of hosts, comprising the steps of:

maintaining said network as a private network by only connecting or allowing connections between known users;

encrypting all communications links between said hosts with a link layer encryption mechanism;

exchanging user messages between said hosts via broadcast request routed reply method which comprises the steps of;

a sending host sending out a broadcast message to said network; and

zero or more hosts sending routed replies that follow a path of said broadcast message back to said sending host.

6. The method of claim 5, further comprising the step of:

using a unique ID for each new broadcast message, wherein each network node can track which broadcast messages it has seen, and wherein each network node can send routed messages back to a point of origin for an original broadcast message.

7. The method of claim 6, wherein a path that took the least time to broadcast is used for a routed reply.

8. The method of claim 5, further comprising the step of:

at least one node on said network deciding whether or not to rebroadcast or route traffic based on a connection type.

9. The method of claim 8, further comprising the step of:

each node organizing a queue of messages for each connection, and prioritizing messages in said queue as appropriate for optimal network performance.

10. The method of claim 5, further comprising the step of:

providing a message format having fields for any of;

verifying integrity of said message;

preventing broadcast messages from saturating said network;

providing information on the kind of message a message is, as well whether or not it is any of a broadcast message, routed message, or local message;

indicating message length;

message identification; and

message data.

11. A method for communicating over a distributed peer-to-peer network between a plurality of hosts, comprising the steps of:

maintaining said network as a private network by only connecting or allowing connections between known users;

encrypting all communications links between said hosts with a link layer encryption mechanism;

providing one or more services for use on said network.

12. The method of claim 11, wherein said step of providing one or more services for use on said network comprises the step of:

providing an instant messaging service for allowing users to communicate with other users;

wherein instant messages are broadcasted on said network, along with information on a sender and a recipient; and

wherein routed replies inform said sender of said instant message when said recipient has received said message and, optionally, how long said instant message took to go round trip.

13. The method of claim 11, wherein said step of providing one or more services for use on said network comprises the step of:

providing a group chat service for allowing two or more users to chat on said network;

wherein messages are broadcasted on said network, along with information on a sender and a destination channel name;

wherein automated notification messages are sent on said network; and

wherein routed replies are sent when a user receives a channel message, allowing a sender to see who on said channel has gotten said message and, if not, for determining that a user is no longer available.

14. The method of claim 11, wherein said step of providing one or more services for use on said network comprises the step of:

providing a distributed presence service for allowing users to see which other users are currently on said network.

15. The method of claim 14, wherein each user periodically broadcasts its existence on said network to allow other users to see when a new user comes on, and to detect when said new user is no longer broadcasting their existence.

16. The method of claim 14, wherein a user sends a broadcast message to request replies with user names to allow a user to get a full list of who is on said network;

wherein a user detects when another user goes offline when no activity from said other user has been seen in a specified amount of time.

17. The method of claim 11, wherein said step of providing one or more services for use on said network comprises the step of:

providing a file browsing service for allowing a user to browse a virtual directory structure for each user on said network;

wherein each user can specify a list of directories to make available to other users on said network; and

wherein file browsing is accomplished by performing the steps of;

sending a broadcast message with a browse path to said network; and

each host sending routed replies as appropriate with any results that it may have.

18. The method of claim 11, wherein said step of providing one or more services for use on said network comprises the step of:

providing a file searching service for allowing a user to search other users'"'"' databases;

wherein each user can specify a list of directories to make available to other users on said network; and

wherein file searching is accomplished by performing the steps of;

sending a broadcast message with a search specification to said network; and

each host sending routed replies as appropriate with any results it may have.

19. The method of claim 11, wherein said step of providing one or more services for use on said network comprises the step of:

providing a file transfer service for allowing a user to transfer files to or from other users by performing the steps of;

when a node is to download a file, or portion of a file, from another node, a requesting node broadcasting a message with information on which file said node is requesting;

when a node that has said file receives said broadcast message requesting a file, said receiving node routing one or more replies, that include information on the file that it is sending, to said requesting node;

said requesting node and said receiving node optionally computing hashes of said file data, to ensure reliable transfer;

said requesting node sending a broadcast message to said receiving node requesting an upload, which said receiving node can optionally accept; and

once said receiving node accepts said upload request, said receiving load uploading said file.

20. The method of claim 11, wherein said step of providing one or more services for use on said network comprises the step of:

providing a key distribution service for allowing hosts on said network to exchange public keys so that they can directly connect to each other, wherein said key distribution service optionally distributes public keys for connection negotiation by periodically broadcasting them on said network.

21. The method of claim 11, said encrypting step further comprising the steps of:

using public-key encryption for session key negotiation and user authentication to prevent unknown users from joining said network; and

using link data security to prevent unknown users from sniffing network traffic.

22. The method of claim 11, said encrypting step further comprising the step of:

using an additional network name or ID to secure said network against users who do not have said network name or ID.

23. The method of claim 11, said encrypting step further comprising the step of:

using a cryptographically secure random number generator.

24. An apparatus for secure distributed collaboration and communications, comprising:

a plurality of host systems which are accessible by one or more users;

a distributed ad-hoc network which is used for all communications between said host systems;

wherein direct connections between said host systems are not brought up on demand;

a mechanism for maintaining said network as a private network by only connecting or allowing connections between known users; and

a link layer encryption mechanism for encrypting all communications links between said hosts, said link layer encryption mechanism comprising a link connection negotiation algorithm.

25. The apparatus of claim 24, said link layer encryption mechanism further comprising a random number generation algorithm,